[Sat Jul 18 23:13:34.117716 2026] [lsapi:notice] [pid 943696:tid 943696] mod_lsapi:  version 1.1-92
[Sat Jul 18 23:13:34.123371 2026] [:notice] [pid 830682:tid 830682] [host root@box5936.bluehost.com] mod_lsapi:  Selfstarter 830682 started
[Sat Jul 18 23:13:34.143066 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: entraalnuevomundo.sarahmacmillan.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.164866 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: website-ea73e5c1.vnl.uel.mybluehost.me:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.167147 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: thepauze.sarahmacmillan.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.167850 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: soundbathmiami.sarahmacmillan.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.168519 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: sardimacmillan.sarahmacmillan.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.169223 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: sarahmusica.sarahmacmillan.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.170090 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: membresiabeyou.sarahmacmillan.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.170777 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: representgrace.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.178882 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: alfardanphygital.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.184848 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: beforeracism.org:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.190196 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: website-3568b81f.zbj.ahr.mybluehost.me:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.202979 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: dnsplumbing.gpu.twj.mybluehost.me:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.203854 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: lakebreezegolf.gpu.twj.mybluehost.me:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.204766 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: omrobuildingcenter.gpu.twj.mybluehost.me:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.205553 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: lakebreezegolfclub.gpu.twj.mybluehost.me:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.256925 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: website-555c397c.thestudioatfruitland.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.285770 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: boutrosinc.tempo-domain.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.286253 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: boutiquereinc.tempo-domain.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.290347 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: arunavabanerjee.stiqstudio.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.293650 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: sitelca-com-co.sitac.com.co:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.302309 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: panova.safe-systems.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.307143 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: nextbit-mx.safe-systems.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.308478 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: queridavida.safe-systems.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.309168 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: digi-access.safe-systems.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.311092 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: brisaslapunta.safe-systems.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.315310 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: eco-toner-com-mx.safe-systems.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.317438 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: elespecialista-mx.safe-systems.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.327596 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: fkconstructionfunding-info.fkconstructionfunding.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.329334 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: website-a61ebc8c.primefocusfm.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.331127 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: outlookturf.lightspeedturf.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.332038 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: website-991472ff.lightspeedturf.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.332936 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: hilltopnurseryinc.lightspeedturf.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.338404 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: qualitycoatingsinspection.northernstatemedia.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.341595 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: mail.oldraceltd.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.342251 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: link.oldraceltd.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.346361 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: silkbyblair.oldraceltd.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.347215 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: oldracelimited.oldraceltd.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.347904 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: learnthissecret.oldraceltd.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.385868 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: kingsafety.ca.ksands.co.uk:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.394033 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: misralrakamia.itdynamix.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.394848 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: dev.sixpackminer.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.396114 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: panel.sixpackminer.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.398096 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: 6packminer.alfardanphygital.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.398829 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: sixpackminer.alfardanphygital.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.399516 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: 6packminer-org.alfardanphygital.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.400172 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: 6packminer-net.alfardanphygital.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.400828 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: sixpackminer-io.alfardanphygital.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.401497 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: website-1f18706a.alfardanphygital.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.402247 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: sixpackminer-org.alfardanphygital.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.402922 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: sixpackminer-net.alfardanphygital.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.403814 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: abilite-uk.finding-funding.co.uk:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.413388 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: webhubpro.doctornovikov.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.415902 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: mnvk-co-uk.doctornovikov.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.417549 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: ukstudyagent.doctornovikov.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.418438 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: nvkart-co-uk.doctornovikov.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.419141 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: bacg-finance.doctornovikov.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.421627 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: website-fe5f3c9f.doctornovikov.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.422493 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: website-f881ee98.doctornovikov.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.423280 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: website-f6f4e776.doctornovikov.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.424208 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: website-f3475bc5.doctornovikov.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.425001 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: website-da985395.doctornovikov.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.425813 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: website-b20dbffc.doctornovikov.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.426789 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: website-8515b3f7.doctornovikov.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.427622 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: website-701c1737.doctornovikov.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.428504 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: website-0f976ec9.doctornovikov.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.429410 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: uktouragency-com.doctornovikov.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.430203 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: bacginvest-co-uk.doctornovikov.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.431846 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: estateagentuk.com.doctornovikov.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.432516 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: registerbusinessuk.doctornovikov.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.434210 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: exportsolution-co-uk.doctornovikov.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.435097 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: accountingco.finance.doctornovikov.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.435771 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: technicalseohouse.com.doctornovikov.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.436640 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: gua-yhh-mybluehost-me.doctornovikov.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.437457 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: companyregistrationuk.doctornovikov.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.473459 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: mtredistricting-gov.mtlegnews.gov:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.476518 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: website-201b05a6.drtoddreiter.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.477494 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: longevityperformanceclinic.drtoddreiter.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.478340 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: c-control.dexmanager.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.478980 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: sauronsoftware.dexmanager.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.490815 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: website-a3818cc7.curlsnpearlsss.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.493471 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: wildlifeart-net.creekcombatveterans.org:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.494112 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: tellthetruthtravel.creekcombatveterans.org:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.494847 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: lowemissionsasia-org.creekcombatveterans.org:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.495512 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: hamelrealestate.collectingrealestate.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.509364 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: nevelow.bespokesaintlouis.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.517673 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: faidr.auddia.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.538334 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: yungmedusa.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.549455 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: willockhall.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.551781 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: karmaminds.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.575230 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: totheyoungerme.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.580531 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: threethirds.co:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.582571 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: thexo.blog:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.584646 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: thepostalshoppe1.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.605135 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: sunsetwaters.com.au:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.605955 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: sulfure.ch:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.610889 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: s-o-solutions.org:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.613424 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: sodacitypeaceofmind.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.616379 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: sitac.com.co:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.618896 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: sheliastransportation.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.625398 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: scottdudekphotography.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.633759 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: saintrhum.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.636698 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: sacredpathway.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.642606 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: rose-treks.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.644832 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: rhs.tev.mybluehost.me:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.655004 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: qoe.tdd.mybluehost.me:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.657427 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: qcms.org:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.663068 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: primefocusfm.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.664037 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: lightspeedturf.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.666860 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: peycosoluciones.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.668979 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: passportsnpinot.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.676767 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: northernstatemedia.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.680901 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: oldraceltd.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.682562 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: ohq.ryb.mybluehost.me:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.689298 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: nowetsheets.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.693640 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: ninilchik.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.696325 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: nextlevellifts.co.uk:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.702610 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: mvg.rfs.mybluehost.me:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.703958 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: mswsupply.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.728636 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: lindakingart.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.733760 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: launchrolesville.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.736931 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: ksd.oas.mybluehost.me:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.738551 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: krissywiedenhoff.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.740339 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: saphansiam.org:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.744435 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: jxk.wid.mybluehost.me:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.749048 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: jmfinnfilms.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.754234 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: livingwithhiddenpain.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.763392 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: holistica.com.br:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.764932 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: hoggdavis.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.765689 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: heidimortenson.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.766545 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: hcresthomes.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.769742 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: doctornovikov.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.787263 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: freestoreministry.org:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.788464 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: fpn.adr.mybluehost.me:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.790057 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: fol.ehn.mybluehost.me:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.795002 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: ffl.tdd.mybluehost.me:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.799092 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: eym.rfn.mybluehost.me:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.811032 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: heatherbowman.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.811846 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: drtoddreiter.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.819571 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: curlsnpearlsss.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.827746 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: cleansparkly.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.840841 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: bridgetforcongress.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.855306 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: auddia.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.856843 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: matthewkilthaumd.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.871175 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: airportsec.com.ec:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.878504 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: bog.vvo.mybluehost.me:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.902410 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: oneoilaway.teresarharding.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.903133 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: loveteresa.teresarharding.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.903774 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: teresaharding.teresarharding.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.904392 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: dadviceonline.teresarharding.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.905006 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: mlmgamechangers.teresarharding.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.905641 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: myoilsuccesssystem.teresarharding.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.906279 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: joinmlmgamechangers.teresarharding.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.906877 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: frankincenseoils-net.teresarharding.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.907635 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: mlmgamechangersecrets.teresarharding.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.908361 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: operationcoursecreation.teresarharding.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.908995 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: teresahardingmasterclass.teresarharding.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.909665 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: marketinggamechangersonline.teresarharding.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.910510 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: marketinggamechangersecrets.teresarharding.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.911876 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: besoundful.sarahmacmillan.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.912487 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: alimentamor.sarahmacmillan.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.913151 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: rodrigosardi.sarahmacmillan.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.913816 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: fansarogroup.sarahmacmillan.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.915373 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: theupgradables.sarahmacmillan.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.916193 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: thegpsapproach.sarahmacmillan.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.917487 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: meditacionmiami.sarahmacmillan.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.918159 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: bgenerationlove.sarahmacmillan.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.918884 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: website-dad43c4c.sarahmacmillan.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.919738 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: website-4fba7881.sarahmacmillan.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.920570 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: miamimeditations.sarahmacmillan.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.921835 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: iamsarahmacmillan.sarahmacmillan.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.922520 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: familiaconsciente.sarahmacmillan.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.923197 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: aprendeameditar-co.sarahmacmillan.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.923880 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: sarahmacmillan-life.sarahmacmillan.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.924512 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: familiasconscientes.sarahmacmillan.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.925211 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: soundmeditationmiami.sarahmacmillan.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.926003 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: generationloveproject.sarahmacmillan.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.926755 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: espiritualidadmoderna.sarahmacmillan.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.927425 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: soundhealingsouthflorida.sarahmacmillan.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.928196 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: soundmeditationsouthflorida.sarahmacmillan.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.929128 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: sergnotes.raya31.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.930057 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: jennylouraya.raya31.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.930889 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: locketsandcharms.raya31.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.933288 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: oohlovely.laughingliondesignhost.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.934337 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: jenfarley.laughingliondesignhost.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.935165 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: cathybuffini.laughingliondesignhost.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.936006 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: drawingthedog.laughingliondesignhost.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.936927 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: hedgerow-crafts.laughingliondesignhost.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.937770 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: website-a6fcc47f.laughingliondesignhost.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.939997 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: thescarystory.lakelopezonline.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.940869 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: thewritinglair.lakelopezonline.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.954783 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: teresarharding.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.956125 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: sarahmacmillan.net:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.961898 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: lvcinc.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.963277 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: laughingliondesignhost.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.977332 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: website-7a50eaec.querenciapartners.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.978251 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: rootsofwisdom.ca.querenciapartners.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:34.979044 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: thailandtire.greatroadtire.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:35.032283 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: elementfix.elementconstruction.co.uk:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:35.051385 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: boracayhaven.com.ph:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:35.066942 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: globalglow.ca:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:35.075271 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: callourplace.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:35.102535 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: pesco-ae.hemayah.ae:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:35.103344 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: lpggas-ae.hemayah.ae:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:35.104145 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: tanfeedh-ae.hemayah.ae:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:35.104825 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: binhilal-ae.hemayah.ae:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:35.105548 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: msalghurair-ae.hemayah.ae:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:35.106291 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: hmconsultants-ae.hemayah.ae:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:35.120171 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: demnetworks.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:35.122737 2026] [ssl:warn] [pid 943696:tid 943696] AH01909: localhost:8443:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 18 23:13:35.134993 2026] [qos:notice] [pid 943696:tid 943696] mod_qos(007): calculated MaxClients/MaxRequestWorkers (max connections): 6144, applied limit: 2048 (QS_MaxClients)
[Sat Jul 18 23:13:35.335737 2026] [http2:info] [pid 943696:tid 943696] AH03090: mod_http2 (v2.0.42, feats=CHPRIO+SHA256+INVHD+DWINS, nghttp2 1.69.0), initializing...
[Sat Jul 18 23:13:35.340209 2026] [mpm_event:notice] [pid 943696:tid 943696] AH00489: Apache/2.4.68 (cPanel) OpenSSL/3.5.5 Apache mod_qos/11.76 mod_bwlimited/1.4 mod_fcgid/2.3.9 mod_rbld2.0 configured -- resuming normal operations
[Sat Jul 18 23:13:35.340222 2026] [core:notice] [pid 943696:tid 943696] AH00094: Command line: '/usr/sbin/httpd'
[Sat Jul 18 23:13:36.386968 2026] [http2:info] [pid 830701:tid 830701] h2_workers: created with min=128 max=192 idle_ms=600000
[Sat Jul 18 23:13:36.408946 2026] [security2:error] [pid 830701:tid 830834] [client 34.77.24.24:52668] ModSecurity: Access denied with code 406 (phase 1). Pattern match "python-requests|python-urllib" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "1460"] [id "909111"] [msg "Python UA brute"] [hostname "108.179.215.73"] [uri "/"] [unique_id "alxdAMu1nEoSSDHiOXatXAAAAQ0"]
[Sat Jul 18 23:13:36.433699 2026] [security2:error] [pid 830701:tid 830831] [client 113.160.97.242:62530] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxdAMu1nEoSSDHiOXatWwAAAQo"]
[Sat Jul 18 23:13:36.473186 2026] [security2:error] [pid 830701:tid 830913] [client 74.208.214.194:37412] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxdAMu1nEoSSDHiOXatlwAAAVw"]
[Sat Jul 18 23:13:36.559432 2026] [security2:error] [pid 830701:tid 830857] [client 15.236.141.54:41812] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.141.236.15.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "website-e4de5cd0.epu.kzx.mybluehost.me"] [uri "/phpinfo.php.bak"] [unique_id "alxdAMu1nEoSSDHiOXatzgAAASQ"]
[Sat Jul 18 23:13:36.568405 2026] [security2:error] [pid 830701:tid 830902] [client 193.176.31.229:6560] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "50.116.65.227"] [uri "/onvif/device_service"] [unique_id "alxdAMu1nEoSSDHiOXat1AAAAVE"]
[Sat Jul 18 23:13:36.583897 2026] [ssl:error] [pid 830701:tid 830929] [client 104.48.69.105:43202] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname www.icemarc.org provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:13:36.655986 2026] [security2:error] [pid 830701:tid 830764] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdAMu1nEoSSDHiOXat6QABXj4"]
[Sat Jul 18 23:13:36.656257 2026] [security2:error] [pid 830701:tid 830915] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdAMu1nEoSSDHiOXat6QABXj4"]
[Sat Jul 18 23:13:36.722957 2026] [security2:error] [pid 830701:tid 830767] [remote 31.42.184.154:49908] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxdAMu1nEoSSDHiOXat-gABUkE"]
[Sat Jul 18 23:13:36.744340 2026] [security2:error] [pid 830701:tid 830839] [client 74.7.227.179:48134] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxdAMu1nEoSSDHiOXatlAABEiI"], referer: https://tejasenvironmental.com/p=367411
[Sat Jul 18 23:13:36.784201 2026] [security2:error] [pid 830701:tid 830893] [client 138.0.247.157:44793] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 157.247.0.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "claysharecon.com"] [uri "/xmlrpc.php"] [unique_id "alxdAMu1nEoSSDHiOXauFgAAAUg"]
[Sat Jul 18 23:13:36.784339 2026] [security2:error] [pid 830701:tid 830893] [client 138.0.247.157:44793] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "claysharecon.com"] [uri "/xmlrpc.php"] [unique_id "alxdAMu1nEoSSDHiOXauFgAAAUg"]
[Sat Jul 18 23:13:36.831611 2026] [security2:error] [pid 830701:tid 830773] [remote 20.153.140.50:52402] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxdAMu1nEoSSDHiOXauKQABMkc"]
[Sat Jul 18 23:13:36.851200 2026] [security2:error] [pid 830701:tid 830890] [client 93.86.49.238:45517] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 238.49.86.93.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdAMu1nEoSSDHiOXauNAAAAUU"]
[Sat Jul 18 23:13:36.851381 2026] [security2:error] [pid 830701:tid 830890] [client 93.86.49.238:45517] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdAMu1nEoSSDHiOXauNAAAAUU"]
[Sat Jul 18 23:13:36.888815 2026] [security2:error] [pid 830701:tid 830779] [remote 31.42.184.154:44372] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "oohlovely.com"] [uri "/wp-login.php"] [unique_id "alxdAMu1nEoSSDHiOXauPAABLU0"]
[Sat Jul 18 23:13:36.912460 2026] [security2:error] [pid 830701:tid 830928] [client 171.4.232.110:51110] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdAMu1nEoSSDHiOXauQQAAAWs"]
[Sat Jul 18 23:13:36.912621 2026] [security2:error] [pid 830701:tid 830928] [client 171.4.232.110:51110] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdAMu1nEoSSDHiOXauQQAAAWs"]
[Sat Jul 18 23:13:36.917948 2026] [security2:error] [pid 830701:tid 830880] [client 124.29.246.106:63141] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdAMu1nEoSSDHiOXauPwAAATs"]
[Sat Jul 18 23:13:36.918149 2026] [security2:error] [pid 830701:tid 830880] [client 124.29.246.106:63141] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdAMu1nEoSSDHiOXauPwAAATs"]
[Sat Jul 18 23:13:36.922802 2026] [security2:error] [pid 830701:tid 830780] [remote 209.133.204.250:60422] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 250.204.133.209.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "crimargroup.com"] [uri "/wp-login.php"] [unique_id "alxdAMu1nEoSSDHiOXauQAABXU4"]
[Sat Jul 18 23:13:36.997281 2026] [security2:error] [pid 830701:tid 830926] [client 15.236.141.54:46808] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.141.236.15.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "website-e4de5cd0.epu.kzx.mybluehost.me"] [uri "/phpinfo.php.old"] [unique_id "alxdAMu1nEoSSDHiOXauTgAAAWk"]
[Sat Jul 18 23:13:37.017082 2026] [security2:error] [pid 830701:tid 830934] [client 223.185.61.63:20623] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdAcu1nEoSSDHiOXauUQAAAXE"]
[Sat Jul 18 23:13:37.017215 2026] [security2:error] [pid 830701:tid 830934] [client 223.185.61.63:20623] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdAcu1nEoSSDHiOXauUQAAAXE"]
[Sat Jul 18 23:13:37.115814 2026] [security2:error] [pid 830701:tid 830790] [remote 31.42.184.154:44372] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "oohlovely.com"] [uri "/wp-login.php"] [unique_id "alxdAcu1nEoSSDHiOXauXQABO1g"], referer: https://oohlovely.com/wp-login.php
[Sat Jul 18 23:13:37.169936 2026] [security2:error] [pid 830701:tid 830792] [remote 209.133.204.250:60422] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 250.204.133.209.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "crimargroup.com"] [uri "/wp-login.php"] [unique_id "alxdAcu1nEoSSDHiOXauYQABeVo"], referer: https://crimargroup.com/wp-login.php
[Sat Jul 18 23:13:37.232940 2026] [security2:error] [pid 830701:tid 830794] [remote 20.153.140.50:52402] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxdAcu1nEoSSDHiOXauZAABMlw"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:13:37.399708 2026] [http2:info] [pid 831031:tid 831031] h2_workers: created with min=128 max=192 idle_ms=600000
[Sat Jul 18 23:13:37.429006 2026] [security2:error] [pid 830701:tid 830877] [client 15.236.141.54:46816] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.141.236.15.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "website-e4de5cd0.epu.kzx.mybluehost.me"] [uri "/phpinfo.php~"] [unique_id "alxdAcu1nEoSSDHiOXaubQAAATg"]
[Sat Jul 18 23:13:37.868247 2026] [security2:error] [pid 830701:tid 830901] [client 15.236.141.54:46820] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.141.236.15.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "website-e4de5cd0.epu.kzx.mybluehost.me"] [uri "/info.php.bak"] [unique_id "alxdAcu1nEoSSDHiOXauhgAAAVA"]
[Sat Jul 18 23:13:38.225180 2026] [security2:error] [pid 830701:tid 830828] [remote 31.42.184.154:49910] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxdAsu1nEoSSDHiOXauowABJn4"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:13:38.246426 2026] [security2:error] [pid 831031:tid 831171] [client 27.34.68.67:58781] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdApnU1ySsD4Tkeg4EtwAAAZg"]
[Sat Jul 18 23:13:38.246672 2026] [security2:error] [pid 831031:tid 831171] [client 27.34.68.67:58781] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdApnU1ySsD4Tkeg4EtwAAAZg"]
[Sat Jul 18 23:13:38.315431 2026] [security2:error] [pid 830701:tid 830866] [client 15.236.141.54:46832] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.141.236.15.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "website-e4de5cd0.epu.kzx.mybluehost.me"] [uri "/phpinfo.php.save"] [unique_id "alxdAsu1nEoSSDHiOXauqAAAAS0"]
[Sat Jul 18 23:13:38.756863 2026] [security2:error] [pid 831031:tid 831224] [client 15.236.141.54:46834] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.141.236.15.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "website-e4de5cd0.epu.kzx.mybluehost.me"] [uri "/staging/phpinfo.php"] [unique_id "alxdApnU1ySsD4Tkeg4EywAAAc0"]
[Sat Jul 18 23:13:38.875051 2026] [security2:error] [pid 830701:tid 830713] [remote 117.0.21.154:46334] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxdAsu1nEoSSDHiOXauwAABTgs"]
[Sat Jul 18 23:13:39.139051 2026] [security2:error] [pid 830701:tid 830853] [client 57.141.18.30:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxdAMu1nEoSSDHiOXat2AAAASA"]
[Sat Jul 18 23:13:39.210707 2026] [security2:error] [pid 830701:tid 830871] [client 15.236.141.54:46840] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.141.236.15.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "website-e4de5cd0.epu.kzx.mybluehost.me"] [uri "/beta/phpinfo.php"] [unique_id "alxdA8u1nEoSSDHiOXauzwAAATI"]
[Sat Jul 18 23:13:39.279071 2026] [security2:error] [pid 830701:tid 830898] [client 45.45.237.7:54950] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "slydogdevelopment.com"] [uri "/.git/HEAD"] [unique_id "alxdA8u1nEoSSDHiOXau1QAAAU0"]
[Sat Jul 18 23:13:39.279184 2026] [security2:error] [pid 830701:tid 830898] [client 45.45.237.7:54950] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "slydogdevelopment.com"] [uri "/.git/HEAD"] [unique_id "alxdA8u1nEoSSDHiOXau1QAAAU0"]
[Sat Jul 18 23:13:39.435055 2026] [security2:error] [pid 831031:tid 831240] [client 223.178.210.203:5987] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdA5nU1ySsD4Tkeg4E3AAAAd0"]
[Sat Jul 18 23:13:39.435196 2026] [security2:error] [pid 831031:tid 831240] [client 223.178.210.203:5987] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdA5nU1ySsD4Tkeg4E3AAAAd0"]
[Sat Jul 18 23:13:39.606182 2026] [security2:error] [pid 831031:tid 831250] [client 119.154.81.234:59537] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdA5nU1ySsD4Tkeg4E3gAAAec"]
[Sat Jul 18 23:13:39.606301 2026] [security2:error] [pid 831031:tid 831250] [client 119.154.81.234:59537] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdA5nU1ySsD4Tkeg4E3gAAAec"]
[Sat Jul 18 23:13:39.651088 2026] [security2:error] [pid 830701:tid 830853] [client 15.236.141.54:46852] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.141.236.15.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "website-e4de5cd0.epu.kzx.mybluehost.me"] [uri "/uat/phpinfo.php"] [unique_id "alxdA8u1nEoSSDHiOXau5AAAASA"]
[Sat Jul 18 23:13:39.729850 2026] [security2:error] [pid 830701:tid 830740] [remote 117.0.21.154:46334] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxdA8u1nEoSSDHiOXau6QABeiY"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:13:39.852579 2026] [security2:error] [pid 830701:tid 830839] [client 74.208.214.194:60294] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxdA8u1nEoSSDHiOXau8gAAARI"]
[Sat Jul 18 23:13:40.079882 2026] [security2:error] [pid 830701:tid 830950] [client 15.236.141.54:46868] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.141.236.15.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "website-e4de5cd0.epu.kzx.mybluehost.me"] [uri "/qa/phpinfo.php"] [unique_id "alxdBMu1nEoSSDHiOXavAAAAAYE"]
[Sat Jul 18 23:13:40.135253 2026] [security2:error] [pid 831031:tid 831284] [client 36.68.125.232:59354] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 232.125.68.36.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.texasolartrade.com"] [uri "/phpinfo.php"] [unique_id "alxdBJnU1ySsD4Tkeg4E5QAAAgk"]
[Sat Jul 18 23:13:40.146464 2026] [security2:error] [pid 830701:tid 830885] [client 65.111.28.212:61053] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 212.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxdBMu1nEoSSDHiOXavBQAAAUA"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:13:40.321597 2026] [security2:error] [pid 831031:tid 831282] [client 190.245.146.99:54923] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdBJnU1ySsD4Tkeg4E7wAAAgc"]
[Sat Jul 18 23:13:40.327693 2026] [security2:error] [pid 831031:tid 831282] [client 190.245.146.99:54923] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdBJnU1ySsD4Tkeg4E7wAAAgc"]
[Sat Jul 18 23:13:40.517604 2026] [security2:error] [pid 830701:tid 830899] [client 15.236.141.54:46882] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.141.236.15.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "website-e4de5cd0.epu.kzx.mybluehost.me"] [uri "/preview/phpinfo.php"] [unique_id "alxdBMu1nEoSSDHiOXavHgAAAU4"]
[Sat Jul 18 23:13:40.561857 2026] [security2:error] [pid 831031:tid 831171] [client 36.68.125.232:60067] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 232.125.68.36.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.texasolartrade.com"] [uri "/test.php"] [unique_id "alxdBJnU1ySsD4Tkeg4E9QAAAZg"]
[Sat Jul 18 23:13:40.759180 2026] [security2:error] [pid 831031:tid 831185] [client 192.204.128.50:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "tiokubito.cl"] [uri "/index.php"] [unique_id "alxdBJnU1ySsD4Tkeg4E8wABpg8"], referer: https://tiokubito.cl/producto/%E3%80%90preventa%E3%80%91galaxy-studio-escala-1-6-mai-sakurajima/
[Sat Jul 18 23:13:40.951509 2026] [security2:error] [pid 831031:tid 831200] [client 15.236.141.54:46890] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.141.236.15.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "website-e4de5cd0.epu.kzx.mybluehost.me"] [uri "/www/phpinfo.php"] [unique_id "alxdBJnU1ySsD4Tkeg4FAAAAAbU"]
[Sat Jul 18 23:13:41.388495 2026] [security2:error] [pid 831031:tid 831235] [client 15.236.141.54:46898] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.141.236.15.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "website-e4de5cd0.epu.kzx.mybluehost.me"] [uri "/htdocs/phpinfo.php"] [unique_id "alxdBZnU1ySsD4Tkeg4FCgAAAdg"]
[Sat Jul 18 23:13:41.456826 2026] [security2:error] [pid 830701:tid 830851] [client 36.68.125.232:61022] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\.bak|\\\\.bak\\\\.php)$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1260"] [id "390582"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that nclude .bak)"] [severity "CRITICAL"] [hostname "webmail.texasolartrade.com"] [uri "/___proxy_subdomain_webmail/.env/.env.bak"] [unique_id "alxdBcu1nEoSSDHiOXavSgAAAR4"]
[Sat Jul 18 23:13:41.465613 2026] [security2:error] [pid 830701:tid 830898] [client 114.119.139.220:61167] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "jvcmotorsports.com"] [uri "/"] [unique_id "alxdBcu1nEoSSDHiOXavTQAAAU0"], referer: https://jvcmotorsports.com/shop/
[Sat Jul 18 23:13:41.821414 2026] [security2:error] [pid 830701:tid 830952] [client 15.236.141.54:46904] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.141.236.15.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "website-e4de5cd0.epu.kzx.mybluehost.me"] [uri "/public_html/phpinfo.php"] [unique_id "alxdBcu1nEoSSDHiOXavXQAAAYM"]
[Sat Jul 18 23:13:42.085624 2026] [security2:error] [pid 831031:tid 831230] [client 45.3.45.217:21065] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 217.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxdBpnU1ySsD4Tkeg4FGQAAAdM"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:13:42.260100 2026] [security2:error] [pid 831031:tid 831275] [client 15.236.141.54:46920] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.141.236.15.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "website-e4de5cd0.epu.kzx.mybluehost.me"] [uri "/site/phpinfo.php"] [unique_id "alxdBpnU1ySsD4Tkeg4FGwAAAgA"]
[Sat Jul 18 23:13:42.341426 2026] [security2:error] [pid 830701:tid 830897] [client 36.68.125.232:62040] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 232.125.68.36.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.texasolartrade.com"] [uri "/index.php"] [unique_id "alxdBsu1nEoSSDHiOXavcQAAAUw"]
[Sat Jul 18 23:13:42.695717 2026] [security2:error] [pid 830701:tid 830888] [client 15.236.141.54:46934] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.141.236.15.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "website-e4de5cd0.epu.kzx.mybluehost.me"] [uri "/docs/phpinfo.php"] [unique_id "alxdBsu1nEoSSDHiOXavfwAAAUM"]
[Sat Jul 18 23:13:42.756860 2026] [security2:error] [pid 830701:tid 830893] [client 114.119.129.50:53885] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "50.116.64.39"] [uri "/robots.txt"] [unique_id "alxdBsu1nEoSSDHiOXavgwAAAUg"], referer: http://50.116.64.39/robots.txt
[Sat Jul 18 23:13:42.791413 2026] [security2:error] [pid 831031:tid 831280] [client 93.86.49.238:28267] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 238.49.86.93.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdBpnU1ySsD4Tkeg4FJQAAAgU"]
[Sat Jul 18 23:13:42.795282 2026] [security2:error] [pid 831031:tid 831280] [client 93.86.49.238:28267] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdBpnU1ySsD4Tkeg4FJQAAAgU"]
[Sat Jul 18 23:13:43.136412 2026] [security2:error] [pid 831031:tid 831198] [client 15.236.141.54:46936] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.141.236.15.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "website-e4de5cd0.epu.kzx.mybluehost.me"] [uri "/wp-admin/phpinfo.php"] [unique_id "alxdB5nU1ySsD4Tkeg4FLQAAAbM"]
[Sat Jul 18 23:13:43.288696 2026] [security2:error] [pid 831031:tid 831060] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdB5nU1ySsD4Tkeg4FLwABvRs"]
[Sat Jul 18 23:13:43.288996 2026] [security2:error] [pid 831031:tid 831208] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdB5nU1ySsD4Tkeg4FLwABvRs"]
[Sat Jul 18 23:13:43.566990 2026] [security2:error] [pid 831031:tid 831234] [client 15.236.141.54:46944] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.141.236.15.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "website-e4de5cd0.epu.kzx.mybluehost.me"] [uri "/administrator/phpinfo.php"] [unique_id "alxdB5nU1ySsD4Tkeg4FPgAAAdc"]
[Sat Jul 18 23:13:43.788816 2026] [security2:error] [pid 830701:tid 830877] [client 4.194.24.143:41807] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/nine2code.php"] [unique_id "alxdB8u1nEoSSDHiOXavrgAAATg"]
[Sat Jul 18 23:13:43.999957 2026] [security2:error] [pid 830701:tid 830919] [client 15.236.141.54:46956] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.141.236.15.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "website-e4de5cd0.epu.kzx.mybluehost.me"] [uri "/core/phpinfo.php"] [unique_id "alxdB8u1nEoSSDHiOXavtQAAAWI"]
[Sat Jul 18 23:13:44.053050 2026] [security2:error] [pid 831031:tid 831166] [client 109.70.100.7:57886] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 7.100.70.109.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdCJnU1ySsD4Tkeg4FTwAAAZM"]
[Sat Jul 18 23:13:44.053185 2026] [security2:error] [pid 831031:tid 831166] [client 109.70.100.7:57886] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdCJnU1ySsD4Tkeg4FTwAAAZM"]
[Sat Jul 18 23:13:44.430203 2026] [security2:error] [pid 830701:tid 830837] [client 15.236.141.54:36420] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.141.236.15.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "website-e4de5cd0.epu.kzx.mybluehost.me"] [uri "/includes/phpinfo.php"] [unique_id "alxdCMu1nEoSSDHiOXavwgAAARA"]
[Sat Jul 18 23:13:44.533822 2026] [security2:error] [pid 831031:tid 831188] [client 4.194.24.143:54616] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/num.php"] [unique_id "alxdCJnU1ySsD4Tkeg4FXQAAAak"]
[Sat Jul 18 23:13:44.921522 2026] [security2:error] [pid 831031:tid 831187] [client 190.227.22.249:41697] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.keywayconstructionclt.com"] [uri "/index.php"] [unique_id "alxdB5nU1ySsD4Tkeg4FPQAAAag"]
[Sat Jul 18 23:13:45.219708 2026] [security2:error] [pid 831031:tid 831174] [client 109.70.100.7:48748] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 7.100.70.109.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdCZnU1ySsD4Tkeg4FeQAAAZs"]
[Sat Jul 18 23:13:45.219840 2026] [security2:error] [pid 831031:tid 831174] [client 109.70.100.7:48748] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdCZnU1ySsD4Tkeg4FeQAAAZs"]
[Sat Jul 18 23:13:45.223859 2026] [security2:error] [pid 830701:tid 830934] [client 4.194.24.143:4877] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/odf7udtspqtpxzyxmw2rccdefault.php"] [unique_id "alxdCcu1nEoSSDHiOXav3AAAAXE"]
[Sat Jul 18 23:13:45.375815 2026] [security2:error] [pid 831031:tid 831230] [client 171.4.232.110:51604] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdCZnU1ySsD4Tkeg4FewAAAdM"]
[Sat Jul 18 23:13:45.375929 2026] [security2:error] [pid 831031:tid 831230] [client 171.4.232.110:51604] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdCZnU1ySsD4Tkeg4FewAAAdM"]
[Sat Jul 18 23:13:45.598952 2026] [security2:error] [pid 831031:tid 831164] [client 181.237.206.175:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "mezzacraft.com"] [uri "/index.php"] [unique_id "alxdCZnU1ySsD4Tkeg4FegAAAZE"]
[Sat Jul 18 23:13:45.755406 2026] [security2:error] [pid 831031:tid 831207] [client 57.141.18.23:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxdCZnU1ySsD4Tkeg4FgwAAAbw"]
[Sat Jul 18 23:13:45.838606 2026] [security2:error] [pid 830701:tid 830854] [client 4.194.24.143:34440] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/option.php"] [unique_id "alxdCcu1nEoSSDHiOXav8wAAASE"]
[Sat Jul 18 23:13:46.095649 2026] [security2:error] [pid 831031:tid 831215] [client 124.29.207.185:39750] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdCpnU1ySsD4Tkeg4FlgAAAcQ"]
[Sat Jul 18 23:13:46.095806 2026] [security2:error] [pid 831031:tid 831215] [client 124.29.207.185:39750] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdCpnU1ySsD4Tkeg4FlgAAAcQ"]
[Sat Jul 18 23:13:46.108235 2026] [security2:error] [pid 830701:tid 830866] [client 223.185.61.63:3971] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdCsu1nEoSSDHiOXawAQAAAS0"]
[Sat Jul 18 23:13:46.108324 2026] [security2:error] [pid 830701:tid 830866] [client 223.185.61.63:3971] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdCsu1nEoSSDHiOXawAQAAAS0"]
[Sat Jul 18 23:13:47.015849 2026] [security2:error] [pid 830701:tid 830838] [client 109.70.100.7:36310] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 7.100.70.109.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdCsu1nEoSSDHiOXawKAAAARE"]
[Sat Jul 18 23:13:47.016031 2026] [security2:error] [pid 830701:tid 830838] [client 109.70.100.7:36310] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdCsu1nEoSSDHiOXawKAAAARE"]
[Sat Jul 18 23:13:47.291261 2026] [security2:error] [pid 831031:tid 831168] [client 85.208.98.206:0] ModSecurity: Warning. Matched phrase "Semrush" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "origine.nz"] [uri "/index.php"] [unique_id "alxdCpnU1ySsD4Tkeg4FngABlSw"]
[Sat Jul 18 23:13:47.405782 2026] [security2:error] [pid 831031:tid 831198] [client 4.194.24.143:54593] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/p.php"] [unique_id "alxdC5nU1ySsD4Tkeg4FsgAAAbM"]
[Sat Jul 18 23:13:47.585799 2026] [security2:error] [pid 830701:tid 830954] [client 45.45.237.7:53742] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-config\\\\.php(?:\\\\W[a-z]*|bak)" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "300"] [id "900256"] [msg "Wp-Config Backup/edit file request"] [hostname "slydogdevelopment.com"] [uri "/wp-config.php.bak"] [unique_id "alxdC8u1nEoSSDHiOXawQgAAAYU"]
[Sat Jul 18 23:13:47.587200 2026] [security2:error] [pid 831031:tid 831180] [client 45.45.237.7:53966] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "slydogdevelopment.com"] [uri "/.github/workflows/deploy.yml"] [unique_id "alxdC5nU1ySsD4Tkeg4FxAAAAaE"]
[Sat Jul 18 23:13:47.587311 2026] [security2:error] [pid 831031:tid 831180] [client 45.45.237.7:53966] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "slydogdevelopment.com"] [uri "/.github/workflows/deploy.yml"] [unique_id "alxdC5nU1ySsD4Tkeg4FxAAAAaE"]
[Sat Jul 18 23:13:47.587773 2026] [security2:error] [pid 830701:tid 830875] [client 45.45.237.7:53532] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "slydogdevelopment.com"] [uri "/secrets.json"] [unique_id "alxdC8u1nEoSSDHiOXawSwAAATY"]
[Sat Jul 18 23:13:47.587877 2026] [security2:error] [pid 830701:tid 830875] [client 45.45.237.7:53532] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "slydogdevelopment.com"] [uri "/secrets.json"] [unique_id "alxdC8u1nEoSSDHiOXawSwAAATY"]
[Sat Jul 18 23:13:47.590925 2026] [security2:error] [pid 830701:tid 830880] [client 45.45.237.7:53756] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "web.config"] [severity "CRITICAL"] [hostname "slydogdevelopment.com"] [uri "/web.config"] [unique_id "alxdC8u1nEoSSDHiOXawVQAAATs"]
[Sat Jul 18 23:13:47.593636 2026] [security2:error] [pid 830701:tid 830846] [client 45.45.237.7:53448] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "slydogdevelopment.com"] [uri "/wp/.env"] [unique_id "alxdC8u1nEoSSDHiOXawWwAAARk"]
[Sat Jul 18 23:13:47.601703 2026] [security2:error] [pid 830701:tid 830858] [client 45.45.237.7:53732] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 7.237.45.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "slydogdevelopment.com"] [uri "/wp-config.php"] [unique_id "alxdC8u1nEoSSDHiOXawVAAAASU"]
[Sat Jul 18 23:13:47.916373 2026] [security2:error] [pid 830701:tid 830847] [client 45.45.237.7:53920] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "slydogdevelopment.com"] [uri "/.env.bak"] [unique_id "alxdC8u1nEoSSDHiOXawfgAAARo"]
[Sat Jul 18 23:13:47.916472 2026] [security2:error] [pid 830701:tid 830847] [client 45.45.237.7:53920] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "slydogdevelopment.com"] [uri "/.env.bak"] [unique_id "alxdC8u1nEoSSDHiOXawfgAAARo"]
[Sat Jul 18 23:13:47.917458 2026] [security2:error] [pid 831031:tid 831193] [client 45.45.237.7:53956] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.backup$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1279"] [id "390588"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .backup)"] [severity "CRITICAL"] [hostname "slydogdevelopment.com"] [uri "/.env.backup"] [unique_id "alxdC5nU1ySsD4Tkeg4F8gAAAa4"]
[Sat Jul 18 23:13:47.917759 2026] [security2:error] [pid 831031:tid 831205] [client 45.45.237.7:53762] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.old$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1263"] [id "390583"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .old)"] [severity "CRITICAL"] [hostname "slydogdevelopment.com"] [uri "/.env.old"] [unique_id "alxdC5nU1ySsD4Tkeg4F8wAAAbo"]
[Sat Jul 18 23:13:47.919396 2026] [security2:error] [pid 831031:tid 831197] [client 45.45.237.7:53972] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "slydogdevelopment.com"] [uri "/.env.test"] [unique_id "alxdC5nU1ySsD4Tkeg4F9gAAAbI"]
[Sat Jul 18 23:13:47.919469 2026] [security2:error] [pid 831031:tid 831197] [client 45.45.237.7:53972] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "slydogdevelopment.com"] [uri "/.env.test"] [unique_id "alxdC5nU1ySsD4Tkeg4F9gAAAbI"]
[Sat Jul 18 23:13:48.322259 2026] [security2:error] [pid 831031:tid 831274] [client 4.194.24.143:34472] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/past.php"] [unique_id "alxdDJnU1ySsD4Tkeg4GBAAAAf8"]
[Sat Jul 18 23:13:48.635332 2026] [security2:error] [pid 831031:tid 831202] [client 196.251.121.187:56934] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\w ?(?:user|and)(\\\\w+)char ?\\\\([0-9]| \\\\b(?:execute|convert) ?\\\\(|; ?\\\\bdelete\\\\b.{1,100}?; ?(?:insert|declare @|varchar) ?|\\\\bdrop\\\\b .{1,100} table |(?:declare|convert) .{1,100} varchar\\\\(|null ?, ?null ?, ?(?:accesslevel|user_?name) ?,|\\\\bconcat ..." at ARGS:requests.requests.body.requests.requests.path. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "395"] [id "340157"] [rev "38"] [msg "Atomicorp.com WAF Rules: Generic SQL inline command protection"] [data "union select ,ARGS:requests.requests.body.requests.requests.path"] [severity "CRITICAL"] [tag "SQLi"] [hostname "solkeetw.com"] [uri "/"] [unique_id "alxdDJnU1ySsD4Tkeg4GAgAAAbc"]
[Sat Jul 18 23:13:48.673062 2026] [security2:error] [pid 830701:tid 830857] [client 45.45.237.7:53452] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "slydogdevelopment.com"] [uri "/public/.env"] [unique_id "alxdDMu1nEoSSDHiOXawnwAAASQ"]
[Sat Jul 18 23:13:48.678561 2026] [security2:error] [pid 831031:tid 831239] [client 45.45.237.7:53462] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "slydogdevelopment.com"] [uri "/laravel/.env"] [unique_id "alxdDJnU1ySsD4Tkeg4GDAAAAdw"]
[Sat Jul 18 23:13:48.817514 2026] [security2:error] [pid 831031:tid 831261] [client 27.34.68.67:25509] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdDJnU1ySsD4Tkeg4GEwAAAfI"]
[Sat Jul 18 23:13:48.817620 2026] [security2:error] [pid 831031:tid 831261] [client 27.34.68.67:25509] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdDJnU1ySsD4Tkeg4GEwAAAfI"]
[Sat Jul 18 23:13:48.920590 2026] [security2:error] [pid 831031:tid 831246] [client 4.194.24.143:34494] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/php.php"] [unique_id "alxdDJnU1ySsD4Tkeg4GFAAAAeM"]
[Sat Jul 18 23:13:49.091005 2026] [security2:error] [pid 831031:tid 831207] [client 45.45.237.7:54936] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "slydogdevelopment.com"] [uri "/app/.env"] [unique_id "alxdDZnU1ySsD4Tkeg4GFgAAAbw"]
[Sat Jul 18 23:13:49.096347 2026] [security2:error] [pid 830701:tid 830921] [client 45.45.237.7:54024] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "slydogdevelopment.com"] [uri "/backend/.env"] [unique_id "alxdDcu1nEoSSDHiOXawrgAAAWQ"]
[Sat Jul 18 23:13:49.096414 2026] [security2:error] [pid 830701:tid 830942] [client 45.45.237.7:54060] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "slydogdevelopment.com"] [uri "/api/.env"] [unique_id "alxdDcu1nEoSSDHiOXawrwAAAXk"]
[Sat Jul 18 23:13:49.096903 2026] [security2:error] [pid 831031:tid 831245] [client 45.45.237.7:54038] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "slydogdevelopment.com"] [uri "/.env"] [unique_id "alxdDZnU1ySsD4Tkeg4GGQAAAeI"]
[Sat Jul 18 23:13:49.464675 2026] [security2:error] [pid 831031:tid 831194] [client 4.194.24.143:56754] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/php8.php"] [unique_id "alxdDZnU1ySsD4Tkeg4GIgAAAa8"]
[Sat Jul 18 23:13:49.699741 2026] [autoindex:error] [pid 831031:tid 831093] [remote 164.68.113.190:0] AH01276: Cannot serve directory /home3/dbnvkfmy/public_html/nzfoodstory/wp-includes/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:13:50.014642 2026] [security2:error] [pid 830701:tid 830900] [client 4.194.24.143:45014] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/phpinfo.php"] [unique_id "alxdDsu1nEoSSDHiOXaw6gAAAU8"]
[Sat Jul 18 23:13:50.027516 2026] [security2:error] [pid 831031:tid 831248] [client 223.178.210.203:11313] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdDpnU1ySsD4Tkeg4GTQAAAeU"]
[Sat Jul 18 23:13:50.027688 2026] [security2:error] [pid 831031:tid 831248] [client 223.178.210.203:11313] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdDpnU1ySsD4Tkeg4GTQAAAeU"]
[Sat Jul 18 23:13:50.122252 2026] [security2:error] [pid 830701:tid 830925] [client 119.154.81.234:59932] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdDsu1nEoSSDHiOXaw7wAAAWg"]
[Sat Jul 18 23:13:50.122372 2026] [security2:error] [pid 830701:tid 830925] [client 119.154.81.234:59932] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdDsu1nEoSSDHiOXaw7wAAAWg"]
[Sat Jul 18 23:13:50.828469 2026] [security2:error] [pid 830701:tid 830839] [client 190.245.146.99:55421] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdDsu1nEoSSDHiOXaxFgAAARI"]
[Sat Jul 18 23:13:50.828562 2026] [security2:error] [pid 830701:tid 830839] [client 190.245.146.99:55421] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdDsu1nEoSSDHiOXaxFgAAARI"]
[Sat Jul 18 23:13:51.903975 2026] [security2:error] [pid 831031:tid 831186] [client 45.66.35.22:37230] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 22.35.66.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdD5nU1ySsD4Tkeg4GfgAAAac"]
[Sat Jul 18 23:13:51.904076 2026] [security2:error] [pid 831031:tid 831186] [client 45.66.35.22:37230] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdD5nU1ySsD4Tkeg4GfgAAAac"]
[Sat Jul 18 23:13:52.645503 2026] [security2:error] [pid 831031:tid 831269] [client 34.192.224.176:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxdEJnU1ySsD4Tkeg4GjwAB-k0"]
[Sat Jul 18 23:13:52.969333 2026] [security2:error] [pid 831031:tid 831262] [client 65.111.28.5:36535] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxdEJnU1ySsD4Tkeg4GnAAAAfM"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:13:53.098364 2026] [security2:error] [pid 831031:tid 831230] [client 138.0.247.157:44607] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 157.247.0.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "claysharecon.com"] [uri "/xmlrpc.php"] [unique_id "alxdEZnU1ySsD4Tkeg4GnwAAAdM"]
[Sat Jul 18 23:13:53.099102 2026] [security2:error] [pid 831031:tid 831230] [client 138.0.247.157:44607] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "claysharecon.com"] [uri "/xmlrpc.php"] [unique_id "alxdEZnU1ySsD4Tkeg4GnwAAAdM"]
[Sat Jul 18 23:13:53.238124 2026] [security2:error] [pid 831031:tid 831113] [remote 152.228.213.32:33110] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxdEZnU1ySsD4Tkeg4GpAABslA"]
[Sat Jul 18 23:13:53.250968 2026] [security2:error] [pid 830701:tid 830936] [client 4.194.24.143:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "waterproofgoods.com"] [uri "/index.php"] [unique_id "alxdDsu1nEoSSDHiOXaxEAAAAXM"]
[Sat Jul 18 23:13:53.498012 2026] [security2:error] [pid 831031:tid 831169] [client 45.66.35.22:37238] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 22.35.66.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdEZnU1ySsD4Tkeg4GrgAAAZY"]
[Sat Jul 18 23:13:53.498112 2026] [security2:error] [pid 831031:tid 831169] [client 45.66.35.22:37238] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdEZnU1ySsD4Tkeg4GrgAAAZY"]
[Sat Jul 18 23:13:53.592793 2026] [security2:error] [pid 831031:tid 831115] [remote 152.228.213.32:33110] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxdEZnU1ySsD4Tkeg4GrwAB2FI"], referer: https://mezzacraft.com/wp-login.php
[Sat Jul 18 23:13:53.599317 2026] [security2:error] [pid 831031:tid 831163] [client 4.194.24.143:45008] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/post.php"] [unique_id "alxdEZnU1ySsD4Tkeg4GsAAAAZA"]
[Sat Jul 18 23:13:53.883522 2026] [security2:error] [pid 830701:tid 830797] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdEcu1nEoSSDHiOXaxdgABa18"]
[Sat Jul 18 23:13:53.883652 2026] [security2:error] [pid 830701:tid 830928] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdEcu1nEoSSDHiOXaxdgABa18"]
[Sat Jul 18 23:13:53.896545 2026] [security2:error] [pid 831031:tid 831117] [remote 154.61.75.100:51706] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxdEZnU1ySsD4Tkeg4GtAAB7FQ"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:13:53.900453 2026] [security2:error] [pid 830701:tid 830865] [client 93.86.49.238:9568] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 238.49.86.93.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdEcu1nEoSSDHiOXaxeAAAASw"]
[Sat Jul 18 23:13:53.900576 2026] [security2:error] [pid 830701:tid 830865] [client 93.86.49.238:9568] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdEcu1nEoSSDHiOXaxeAAAASw"]
[Sat Jul 18 23:13:54.185079 2026] [security2:error] [pid 830701:tid 830897] [client 113.160.97.242:62543] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "wpad"] [uri "/wpad.dat"] [unique_id "alxdEsu1nEoSSDHiOXaxigAAAUw"]
[Sat Jul 18 23:13:54.399106 2026] [security2:error] [pid 830701:tid 830871] [client 4.194.24.143:41721] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/public/assets/design_1/css/parts/course_cards/grid_card_1.min.php"] [unique_id "alxdEsu1nEoSSDHiOXaxkAAAATI"]
[Sat Jul 18 23:13:54.768740 2026] [security2:error] [pid 830701:tid 830789] [remote 91.142.222.105:36282] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxdEsu1nEoSSDHiOXaxpgABflc"]
[Sat Jul 18 23:13:55.042331 2026] [security2:error] [pid 830701:tid 830861] [client 45.66.35.22:37254] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 22.35.66.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdE8u1nEoSSDHiOXaxrgAAASg"]
[Sat Jul 18 23:13:55.042429 2026] [security2:error] [pid 830701:tid 830861] [client 45.66.35.22:37254] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdE8u1nEoSSDHiOXaxrgAAASg"]
[Sat Jul 18 23:13:55.092865 2026] [security2:error] [pid 831031:tid 831271] [client 4.194.24.143:4214] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/public/css.php"] [unique_id "alxdE5nU1ySsD4Tkeg4G7QAAAfw"]
[Sat Jul 18 23:13:55.927257 2026] [security2:error] [pid 831031:tid 831222] [client 4.194.24.143:55816] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/r.php"] [unique_id "alxdE5nU1ySsD4Tkeg4HDwAAAcs"]
[Sat Jul 18 23:13:56.089301 2026] [security2:error] [pid 831031:tid 831191] [client 171.4.232.110:22481] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdFJnU1ySsD4Tkeg4HEgAAAaw"]
[Sat Jul 18 23:13:56.089394 2026] [security2:error] [pid 831031:tid 831191] [client 171.4.232.110:22481] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdFJnU1ySsD4Tkeg4HEgAAAaw"]
[Sat Jul 18 23:13:56.296761 2026] [security2:error] [pid 830701:tid 830933] [client 57.141.18.79:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxdFMu1nEoSSDHiOXax2gAAAXA"]
[Sat Jul 18 23:13:56.401458 2026] [autoindex:error] [pid 830701:tid 830895] [client 34.62.162.2:0] AH01276: Cannot serve directory /home2/youposit/public_html/upositive/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:13:56.585792 2026] [security2:error] [pid 830701:tid 830912] [client 45.66.35.22:37260] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 22.35.66.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdFMu1nEoSSDHiOXax8AAAAVs"]
[Sat Jul 18 23:13:56.585888 2026] [security2:error] [pid 830701:tid 830912] [client 45.66.35.22:37260] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdFMu1nEoSSDHiOXax8AAAAVs"]
[Sat Jul 18 23:13:56.733328 2026] [security2:error] [pid 831031:tid 831227] [client 223.185.61.63:10028] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdFJnU1ySsD4Tkeg4HJAAAAdA"]
[Sat Jul 18 23:13:56.733462 2026] [security2:error] [pid 831031:tid 831227] [client 223.185.61.63:10028] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdFJnU1ySsD4Tkeg4HJAAAAdA"]
[Sat Jul 18 23:13:57.069730 2026] [security2:error] [pid 831031:tid 831287] [client 4.194.24.143:41706] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/radio.php"] [unique_id "alxdFZnU1ySsD4Tkeg4HKQAAAgw"]
[Sat Jul 18 23:13:57.461216 2026] [core:error] [pid 831031:tid 831058] [remote 45.148.10.62:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:13:57.461243 2026] [core:error] [pid 831031:tid 831058] [remote 45.148.10.62:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:13:57.668740 2026] [security2:error] [pid 831031:tid 831174] [client 114.119.130.12:31063] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "jvcmotorsports.com"] [uri "/product/lab-c04-chassis-evo-2-new-version-2021"] [unique_id "alxdFZnU1ySsD4Tkeg4HSwAAAZs"], referer: https://jvcmotorsports.com/product/lab-c04-chassis-evo-2-new-version-2021
[Sat Jul 18 23:13:57.890934 2026] [security2:error] [pid 830701:tid 830841] [client 4.194.24.143:4202] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/randkeyword.php7"] [unique_id "alxdFcu1nEoSSDHiOXayIgAAARQ"]
[Sat Jul 18 23:13:57.963097 2026] [security2:error] [pid 831031:tid 831057] [remote 45.148.10.62:0] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.ardhalwafaa.com"] [uri "/___proxy_subdomain_webmail/.env"] [unique_id "alxdFZnU1ySsD4Tkeg4HUgAB8hg"]
[Sat Jul 18 23:13:57.999650 2026] [core:error] [pid 831031:tid 831063] [remote 45.148.10.62:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:13:57.999685 2026] [core:error] [pid 831031:tid 831063] [remote 45.148.10.62:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:13:58.083056 2026] [security2:error] [pid 831031:tid 831064] [remote 31.42.184.154:54766] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "giftofgiving-usa.org"] [uri "/wp-login.php"] [unique_id "alxdFpnU1ySsD4Tkeg4HWAABmh8"]
[Sat Jul 18 23:13:58.134633 2026] [security2:error] [pid 831031:tid 831045] [remote 45.148.10.62:0] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.ardhalwafaa.com"] [uri "/___proxy_subdomain_webmail/.env"] [unique_id "alxdFpnU1ySsD4Tkeg4HXAABqAw"]
[Sat Jul 18 23:13:58.153224 2026] [security2:error] [pid 831031:tid 831266] [client 45.66.35.22:37272] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 22.35.66.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdFpnU1ySsD4Tkeg4HXwAAAfc"]
[Sat Jul 18 23:13:58.153315 2026] [security2:error] [pid 831031:tid 831266] [client 45.66.35.22:37272] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdFpnU1ySsD4Tkeg4HXwAAAfc"]
[Sat Jul 18 23:13:58.480573 2026] [core:error] [pid 831031:tid 831053] [remote 45.148.10.62:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:13:58.480600 2026] [core:error] [pid 831031:tid 831053] [remote 45.148.10.62:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:13:58.576329 2026] [security2:error] [pid 831031:tid 831071] [remote 31.42.184.154:54766] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "giftofgiving-usa.org"] [uri "/wp-login.php"] [unique_id "alxdFpnU1ySsD4Tkeg4HbAACASY"], referer: https://giftofgiving-usa.org/wp-login.php
[Sat Jul 18 23:13:58.661826 2026] [core:error] [pid 831031:tid 831073] [remote 45.148.10.62:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:13:58.661859 2026] [core:error] [pid 831031:tid 831073] [remote 45.148.10.62:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:13:58.712046 2026] [security2:error] [pid 831031:tid 831199] [client 4.194.24.143:44881] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/readme.php"] [unique_id "alxdFpnU1ySsD4Tkeg4HdwAAAbQ"]
[Sat Jul 18 23:13:58.833712 2026] [security2:error] [pid 831031:tid 831078] [remote 45.148.10.62:0] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.ardhalwafaa.com"] [uri "/___proxy_subdomain_webmail/api/.env"] [unique_id "alxdFpnU1ySsD4Tkeg4HfwAB8C0"]
[Sat Jul 18 23:13:59.032471 2026] [security2:error] [pid 831031:tid 831082] [remote 45.148.10.62:0] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\.bak|\\\\.bak\\\\.php)$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1260"] [id "390582"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that nclude .bak)"] [severity "CRITICAL"] [hostname "webmail.ardhalwafaa.com"] [uri "/___proxy_subdomain_webmail/.env.bak"] [unique_id "alxdF5nU1ySsD4Tkeg4HigABszE"]
[Sat Jul 18 23:13:59.070606 2026] [security2:error] [pid 831031:tid 831231] [client 122.161.68.230:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "packerjanitorial.com"] [uri "/index.php"] [unique_id "alxdFpnU1ySsD4Tkeg4HawAB1Cc"], referer: https://packerjanitorial.com
[Sat Jul 18 23:13:59.386613 2026] [core:error] [pid 831031:tid 831094] [remote 45.148.10.62:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:13:59.386638 2026] [core:error] [pid 831031:tid 831094] [remote 45.148.10.62:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:13:59.542767 2026] [security2:error] [pid 831031:tid 831232] [client 27.34.68.67:20182] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdF5nU1ySsD4Tkeg4HoQAAAdU"]
[Sat Jul 18 23:13:59.542862 2026] [security2:error] [pid 831031:tid 831232] [client 27.34.68.67:20182] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdF5nU1ySsD4Tkeg4HoQAAAdU"]
[Sat Jul 18 23:13:59.565053 2026] [security2:error] [pid 831031:tid 831096] [remote 45.148.10.62:0] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.ardhalwafaa.com"] [uri "/___proxy_subdomain_webmail/stripe/.env"] [unique_id "alxdF5nU1ySsD4Tkeg4HogABxj8"]
[Sat Jul 18 23:13:59.632114 2026] [security2:error] [pid 831031:tid 831247] [client 4.194.24.143:4328] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/reze.php"] [unique_id "alxdF5nU1ySsD4Tkeg4HpQAAAeQ"]
[Sat Jul 18 23:13:59.729151 2026] [security2:error] [pid 831031:tid 831171] [client 45.66.35.22:40816] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 22.35.66.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdF5nU1ySsD4Tkeg4HrgAAAZg"]
[Sat Jul 18 23:13:59.729248 2026] [security2:error] [pid 831031:tid 831171] [client 45.66.35.22:40816] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdF5nU1ySsD4Tkeg4HrgAAAZg"]
[Sat Jul 18 23:13:59.736227 2026] [core:error] [pid 831031:tid 831099] [remote 45.148.10.62:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:13:59.736246 2026] [core:error] [pid 831031:tid 831099] [remote 45.148.10.62:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:13:59.908355 2026] [core:error] [pid 831031:tid 831104] [remote 45.148.10.62:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:13:59.908386 2026] [core:error] [pid 831031:tid 831104] [remote 45.148.10.62:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:14:00.082035 2026] [core:error] [pid 831031:tid 831111] [remote 45.148.10.62:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:14:00.082059 2026] [core:error] [pid 831031:tid 831111] [remote 45.148.10.62:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:14:00.253083 2026] [security2:error] [pid 831031:tid 831108] [remote 45.148.10.62:0] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.ardhalwafaa.com"] [uri "/___proxy_subdomain_webmail/backend/.env"] [unique_id "alxdGJnU1ySsD4Tkeg4HwwAB9Es"]
[Sat Jul 18 23:14:00.422076 2026] [security2:error] [pid 831031:tid 831098] [remote 45.148.10.62:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.10.148.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.ardhalwafaa.com"] [uri "/test.php"] [unique_id "alxdGJnU1ySsD4Tkeg4H1QABtkE"]
[Sat Jul 18 23:14:00.588880 2026] [security2:error] [pid 831031:tid 831184] [client 223.178.210.203:28650] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdGJnU1ySsD4Tkeg4H3wAAAaU"]
[Sat Jul 18 23:14:00.588996 2026] [security2:error] [pid 831031:tid 831184] [client 223.178.210.203:28650] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdGJnU1ySsD4Tkeg4H3wAAAaU"]
[Sat Jul 18 23:14:00.596142 2026] [security2:error] [pid 831031:tid 831126] [remote 45.148.10.62:0] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.backup$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1279"] [id "390588"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .backup)"] [severity "CRITICAL"] [hostname "webmail.ardhalwafaa.com"] [uri "/___proxy_subdomain_webmail/.env.backup"] [unique_id "alxdGJnU1ySsD4Tkeg4H4AABpl0"]
[Sat Jul 18 23:14:00.689297 2026] [security2:error] [pid 831031:tid 831207] [client 119.154.81.234:60330] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdGJnU1ySsD4Tkeg4H5QAAAbw"]
[Sat Jul 18 23:14:00.689427 2026] [security2:error] [pid 831031:tid 831207] [client 119.154.81.234:60330] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdGJnU1ySsD4Tkeg4H5QAAAbw"]
[Sat Jul 18 23:14:00.774628 2026] [security2:error] [pid 831031:tid 831128] [remote 45.148.10.62:0] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.old$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1263"] [id "390583"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .old)"] [severity "CRITICAL"] [hostname "webmail.ardhalwafaa.com"] [uri "/___proxy_subdomain_webmail/.env.old"] [unique_id "alxdGJnU1ySsD4Tkeg4H5wAB-l8"]
[Sat Jul 18 23:14:00.819406 2026] [security2:error] [pid 831031:tid 831285] [client 4.194.24.143:41707] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/rh.php"] [unique_id "alxdGJnU1ySsD4Tkeg4H6wAAAgo"]
[Sat Jul 18 23:14:00.960078 2026] [core:error] [pid 831031:tid 831132] [remote 45.148.10.62:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:14:00.960104 2026] [core:error] [pid 831031:tid 831132] [remote 45.148.10.62:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:14:01.000760 2026] [security2:error] [pid 831031:tid 831239] [client 57.141.18.34:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jenfarley.com"] [uri "/index.php"] [unique_id "alxdGJnU1ySsD4Tkeg4H1gAAAdw"]
[Sat Jul 18 23:14:01.143910 2026] [security2:error] [pid 831031:tid 831136] [remote 45.148.10.62:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.10.148.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.ardhalwafaa.com"] [uri "/.env.php.bak"] [unique_id "alxdGZnU1ySsD4Tkeg4H-gABsmc"]
[Sat Jul 18 23:14:01.301658 2026] [security2:error] [pid 831031:tid 831256] [client 190.245.146.99:55923] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdGZnU1ySsD4Tkeg4H_wAAAe0"]
[Sat Jul 18 23:14:01.307667 2026] [security2:error] [pid 831031:tid 831256] [client 190.245.146.99:55923] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdGZnU1ySsD4Tkeg4H_wAAAe0"]
[Sat Jul 18 23:14:01.316054 2026] [security2:error] [pid 831031:tid 831145] [remote 45.148.10.62:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.10.148.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.ardhalwafaa.com"] [uri "/.env.php"] [unique_id "alxdGZnU1ySsD4Tkeg4IAgABxXA"]
[Sat Jul 18 23:14:01.329046 2026] [security2:error] [pid 831031:tid 831245] [client 45.66.35.22:40828] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 22.35.66.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdGZnU1ySsD4Tkeg4IBQAAAeI"]
[Sat Jul 18 23:14:01.329153 2026] [security2:error] [pid 831031:tid 831245] [client 45.66.35.22:40828] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdGZnU1ySsD4Tkeg4IBQAAAeI"]
[Sat Jul 18 23:14:01.440324 2026] [security2:error] [pid 831031:tid 831215] [client 65.111.28.55:42785] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 55.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxdGZnU1ySsD4Tkeg4ICAAAAcQ"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:14:01.605419 2026] [security2:error] [pid 830701:tid 830855] [client 4.194.24.143:4347] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/rip.php"] [unique_id "alxdGcu1nEoSSDHiOXaybAAAASI"]
[Sat Jul 18 23:14:01.608296 2026] [security2:error] [pid 831031:tid 831236] [client 46.248.189.127:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "timespans.org"] [uri "/index.php"] [unique_id "alxdGZnU1ySsD4Tkeg4IDAAAAdk"]
[Sat Jul 18 23:14:01.666742 2026] [core:error] [pid 831031:tid 831151] [remote 45.148.10.62:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:14:01.666784 2026] [core:error] [pid 831031:tid 831151] [remote 45.148.10.62:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:14:01.676321 2026] [security2:error] [pid 830701:tid 830703] [remote 154.61.75.100:51704] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxdGcu1nEoSSDHiOXaybgABKQE"]
[Sat Jul 18 23:14:01.676452 2026] [security2:error] [pid 830701:tid 830862] [client 154.61.75.100:51704] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxdGcu1nEoSSDHiOXaybgABKQE"]
[Sat Jul 18 23:14:01.846278 2026] [core:error] [pid 831031:tid 831158] [remote 45.148.10.62:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:14:01.846303 2026] [core:error] [pid 831031:tid 831158] [remote 45.148.10.62:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:14:02.023250 2026] [core:error] [pid 831031:tid 831160] [remote 45.148.10.62:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:14:02.023270 2026] [core:error] [pid 831031:tid 831160] [remote 45.148.10.62:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:14:02.409796 2026] [security2:error] [pid 831031:tid 831052] [remote 45.148.10.62:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.10.148.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.ardhalwafaa.com"] [uri "/config.php"] [unique_id "alxdGpnU1ySsD4Tkeg4IOgABohM"]
[Sat Jul 18 23:14:02.588222 2026] [security2:error] [pid 831031:tid 831043] [remote 45.148.10.62:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.10.148.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.ardhalwafaa.com"] [uri "/config.php.bak"] [unique_id "alxdGpnU1ySsD4Tkeg4IRgACDAo"]
[Sat Jul 18 23:14:02.720956 2026] [security2:error] [pid 830701:tid 830905] [client 4.194.24.143:4641] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/root.php"] [unique_id "alxdGsu1nEoSSDHiOXayhwAAAVQ"]
[Sat Jul 18 23:14:03.416651 2026] [security2:error] [pid 831031:tid 831219] [client 104.244.73.43:38996] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 43.73.244.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdG5nU1ySsD4Tkeg4IYwAAAcg"]
[Sat Jul 18 23:14:03.416757 2026] [security2:error] [pid 831031:tid 831219] [client 104.244.73.43:38996] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdG5nU1ySsD4Tkeg4IYwAAAcg"]
[Sat Jul 18 23:14:03.681169 2026] [security2:error] [pid 831031:tid 831061] [remote 103.82.22.235:41974] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.22.82.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxdG5nU1ySsD4Tkeg4IdQABoRw"]
[Sat Jul 18 23:14:03.891684 2026] [security2:error] [pid 831031:tid 831164] [client 45.3.45.215:12215] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 215.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxdG5nU1ySsD4Tkeg4IgAAAAZE"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:14:04.211700 2026] [security2:error] [pid 831031:tid 831072] [remote 103.82.22.235:41974] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.22.82.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxdHJnU1ySsD4Tkeg4IjwABvSc"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:14:04.238921 2026] [security2:error] [pid 831031:tid 831056] [remote 45.148.10.62:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.10.148.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.ardhalwafaa.com"] [uri "/phpinfo.php"] [unique_id "alxdHJnU1ySsD4Tkeg4IkgAB6hc"]
[Sat Jul 18 23:14:04.258520 2026] [security2:error] [pid 831031:tid 831276] [client 4.194.24.143:44892] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/s.php"] [unique_id "alxdHJnU1ySsD4Tkeg4IlAAAAgE"]
[Sat Jul 18 23:14:04.491813 2026] [security2:error] [pid 831031:tid 831088] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdHJnU1ySsD4Tkeg4ImwAB4zc"]
[Sat Jul 18 23:14:04.491922 2026] [security2:error] [pid 831031:tid 831246] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdHJnU1ySsD4Tkeg4ImwAB4zc"]
[Sat Jul 18 23:14:04.574670 2026] [security2:error] [pid 831031:tid 831089] [remote 152.53.111.131:45590] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.111.53.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.talknutritionwithlesley.com"] [uri "/wp-login.php"] [unique_id "alxdHJnU1ySsD4Tkeg4InwAB3jg"]
[Sat Jul 18 23:14:04.954024 2026] [security2:error] [pid 831031:tid 831289] [client 93.86.49.238:17304] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 238.49.86.93.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdHJnU1ySsD4Tkeg4IrQAAAg4"]
[Sat Jul 18 23:14:04.954232 2026] [security2:error] [pid 831031:tid 831289] [client 93.86.49.238:17304] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdHJnU1ySsD4Tkeg4IrQAAAg4"]
[Sat Jul 18 23:14:05.319788 2026] [security2:error] [pid 831031:tid 831221] [client 65.111.28.97:50741] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 97.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxdHZnU1ySsD4Tkeg4IwQAAAco"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:14:05.377823 2026] [security2:error] [pid 831031:tid 831106] [remote 152.53.111.131:45590] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.111.53.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.talknutritionwithlesley.com"] [uri "/wp-login.php"] [unique_id "alxdHZnU1ySsD4Tkeg4IxgACA0k"], referer: https://mail.talknutritionwithlesley.com/wp-login.php
[Sat Jul 18 23:14:05.391762 2026] [security2:error] [pid 831031:tid 831199] [client 104.244.73.43:58070] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 43.73.244.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdHZnU1ySsD4Tkeg4IygAAAbQ"]
[Sat Jul 18 23:14:05.391857 2026] [security2:error] [pid 831031:tid 831199] [client 104.244.73.43:58070] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdHZnU1ySsD4Tkeg4IygAAAbQ"]
[Sat Jul 18 23:14:05.516813 2026] [security2:error] [pid 831031:tid 831281] [client 4.194.24.143:56816] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/sang.php"] [unique_id "alxdHZnU1ySsD4Tkeg4I0gAAAgY"]
[Sat Jul 18 23:14:05.824993 2026] [security2:error] [pid 831031:tid 831271] [client 57.141.18.60:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxdHZnU1ySsD4Tkeg4I1QAAAfw"]
[Sat Jul 18 23:14:05.926209 2026] [security2:error] [pid 831031:tid 831118] [remote 31.42.184.154:58276] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxdHZnU1ySsD4Tkeg4I3wABplU"]
[Sat Jul 18 23:14:06.403914 2026] [security2:error] [pid 831031:tid 831190] [client 4.194.24.143:56772] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/scxy.php"] [unique_id "alxdHpnU1ySsD4Tkeg4I9wAAAas"]
[Sat Jul 18 23:14:06.472971 2026] [security2:error] [pid 831031:tid 831132] [remote 49.13.1.223:57454] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.1.13.49.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxdHpnU1ySsD4Tkeg4I-gAB3mM"]
[Sat Jul 18 23:14:06.550494 2026] [security2:error] [pid 831031:tid 831116] [remote 31.42.184.154:58276] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxdHpnU1ySsD4Tkeg4JAQABs1M"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:14:06.635812 2026] [security2:error] [pid 831031:tid 831197] [client 171.4.232.110:52606] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdHpnU1ySsD4Tkeg4JBQAAAbI"]
[Sat Jul 18 23:14:06.635899 2026] [security2:error] [pid 831031:tid 831197] [client 171.4.232.110:52606] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdHpnU1ySsD4Tkeg4JBQAAAbI"]
[Sat Jul 18 23:14:06.739891 2026] [security2:error] [pid 831031:tid 831195] [client 45.3.45.176:46293] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 176.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxdHpnU1ySsD4Tkeg4JDQAAAbA"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:14:07.140062 2026] [security2:error] [pid 831031:tid 831122] [remote 49.13.1.223:57454] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.1.13.49.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxdH5nU1ySsD4Tkeg4JIQAB8Fk"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:14:07.161453 2026] [security2:error] [pid 831031:tid 831214] [client 4.194.24.143:22856] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/sd.php"] [unique_id "alxdH5nU1ySsD4Tkeg4JIgAAAcM"]
[Sat Jul 18 23:14:07.253023 2026] [security2:error] [pid 831031:tid 831253] [client 223.185.61.63:16517] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdH5nU1ySsD4Tkeg4JJgAAAeo"]
[Sat Jul 18 23:14:07.253124 2026] [security2:error] [pid 831031:tid 831253] [client 223.185.61.63:16517] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdH5nU1ySsD4Tkeg4JJgAAAeo"]
[Sat Jul 18 23:14:07.482734 2026] [security2:error] [pid 831031:tid 831247] [client 104.244.73.43:58074] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 43.73.244.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdH5nU1ySsD4Tkeg4JLAAAAeQ"]
[Sat Jul 18 23:14:07.482837 2026] [security2:error] [pid 831031:tid 831247] [client 104.244.73.43:58074] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdH5nU1ySsD4Tkeg4JLAAAAeQ"]
[Sat Jul 18 23:14:07.624665 2026] [security2:error] [pid 831031:tid 831134] [remote 20.153.140.50:37340] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "dlu.cjf.mybluehost.me"] [uri "/blog/wp-login.php"] [unique_id "alxdH5nU1ySsD4Tkeg4JNQAB-GU"]
[Sat Jul 18 23:14:07.858537 2026] [security2:error] [pid 831031:tid 831270] [client 4.194.24.143:27820] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/sf.php"] [unique_id "alxdH5nU1ySsD4Tkeg4JSAAAAfs"]
[Sat Jul 18 23:14:08.087327 2026] [security2:error] [pid 831031:tid 831221] [client 124.29.207.185:64701] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdIJnU1ySsD4Tkeg4JUAAAAco"]
[Sat Jul 18 23:14:08.087427 2026] [security2:error] [pid 831031:tid 831221] [client 124.29.207.185:64701] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdIJnU1ySsD4Tkeg4JUAAAAco"]
[Sat Jul 18 23:14:08.263146 2026] [security2:error] [pid 831031:tid 831036] [remote 20.153.140.50:37340] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "dlu.cjf.mybluehost.me"] [uri "/blog/wp-login.php"] [unique_id "alxdIJnU1ySsD4Tkeg4JXAABkQM"], referer: https://dlu.cjf.mybluehost.me/blog/wp-login.php
[Sat Jul 18 23:14:08.562044 2026] [security2:error] [pid 830701:tid 830878] [client 4.194.24.143:4649] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/shell.php"] [unique_id "alxdIMu1nEoSSDHiOXay-wAAATk"]
[Sat Jul 18 23:14:09.390449 2026] [security2:error] [pid 831031:tid 831239] [client 104.244.73.43:58088] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 43.73.244.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdIZnU1ySsD4Tkeg4JmgAAAdw"]
[Sat Jul 18 23:14:09.390577 2026] [security2:error] [pid 831031:tid 831239] [client 104.244.73.43:58088] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdIZnU1ySsD4Tkeg4JmgAAAdw"]
[Sat Jul 18 23:14:10.098566 2026] [security2:error] [pid 831031:tid 831203] [client 27.34.68.67:56575] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdIpnU1ySsD4Tkeg4JuQAAAbg"]
[Sat Jul 18 23:14:10.098663 2026] [security2:error] [pid 831031:tid 831203] [client 27.34.68.67:56575] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdIpnU1ySsD4Tkeg4JuQAAAbg"]
[Sat Jul 18 23:14:10.352863 2026] [security2:error] [pid 831031:tid 831164] [client 4.194.24.143:22889] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/sid3.php"] [unique_id "alxdIpnU1ySsD4Tkeg4JywAAAZE"]
[Sat Jul 18 23:14:11.070622 2026] [security2:error] [pid 831031:tid 831284] [client 4.194.24.143:52955] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/simple.php"] [unique_id "alxdI5nU1ySsD4Tkeg4J6QAAAgk"]
[Sat Jul 18 23:14:11.207158 2026] [security2:error] [pid 830701:tid 830936] [client 223.178.210.203:16973] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdI8u1nEoSSDHiOXazMgAAAXM"]
[Sat Jul 18 23:14:11.207260 2026] [security2:error] [pid 830701:tid 830936] [client 223.178.210.203:16973] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdI8u1nEoSSDHiOXazMgAAAXM"]
[Sat Jul 18 23:14:11.257208 2026] [security2:error] [pid 830701:tid 830885] [client 119.154.81.234:60737] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdI8u1nEoSSDHiOXazNAAAAUA"]
[Sat Jul 18 23:14:11.257309 2026] [security2:error] [pid 830701:tid 830885] [client 119.154.81.234:60737] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdI8u1nEoSSDHiOXazNAAAAUA"]
[Sat Jul 18 23:14:11.345859 2026] [security2:error] [pid 831031:tid 831183] [client 182.48.68.87:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "worbals.com"] [uri "/index.php"] [unique_id "alxdIZnU1ySsD4Tkeg4JiQAAAaQ"]
[Sat Jul 18 23:14:11.385076 2026] [security2:error] [pid 831031:tid 831202] [client 104.244.73.43:58094] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 43.73.244.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdI5nU1ySsD4Tkeg4J_gAAAbc"]
[Sat Jul 18 23:14:11.385172 2026] [security2:error] [pid 831031:tid 831202] [client 104.244.73.43:58094] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdI5nU1ySsD4Tkeg4J_gAAAbc"]
[Sat Jul 18 23:14:11.856965 2026] [security2:error] [pid 830701:tid 830866] [client 190.245.146.99:56430] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdI8u1nEoSSDHiOXazSQAAAS0"]
[Sat Jul 18 23:14:11.862798 2026] [security2:error] [pid 830701:tid 830866] [client 190.245.146.99:56430] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdI8u1nEoSSDHiOXazSQAAAS0"]
[Sat Jul 18 23:14:11.907393 2026] [security2:error] [pid 830701:tid 830917] [client 4.194.24.143:22887] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/sitemap.php"] [unique_id "alxdI8u1nEoSSDHiOXazSgAAAWA"]
[Sat Jul 18 23:14:11.942464 2026] [security2:error] [pid 831031:tid 831239] [client 57.141.18.4:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxdI5nU1ySsD4Tkeg4KDgAAAdw"]
[Sat Jul 18 23:14:12.414118 2026] [security2:error] [pid 831031:tid 831128] [remote 31.42.184.154:50966] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxdJJnU1ySsD4Tkeg4KLgACAV8"]
[Sat Jul 18 23:14:12.646632 2026] [security2:error] [pid 831031:tid 831256] [client 4.194.24.143:22893] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/size.php"] [unique_id "alxdJJnU1ySsD4Tkeg4KNAAAAe0"]
[Sat Jul 18 23:14:12.853679 2026] [security2:error] [pid 830701:tid 830935] [client 62.150.67.110:42090] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "ali-alghanim.net"] [uri "/index.php"] [unique_id "alxdJMu1nEoSSDHiOXazWAAAAXI"]
[Sat Jul 18 23:14:12.919823 2026] [security2:error] [pid 831031:tid 831116] [remote 31.42.184.154:50966] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxdJJnU1ySsD4Tkeg4KPwABlFM"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:14:13.361482 2026] [security2:error] [pid 831031:tid 831228] [client 104.244.73.43:58098] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 43.73.244.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdJZnU1ySsD4Tkeg4KTwAAAdE"]
[Sat Jul 18 23:14:13.361573 2026] [security2:error] [pid 831031:tid 831228] [client 104.244.73.43:58098] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdJZnU1ySsD4Tkeg4KTwAAAdE"]
[Sat Jul 18 23:14:13.621117 2026] [security2:error] [pid 830701:tid 830842] [client 4.194.24.143:22850] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/sm.php"] [unique_id "alxdJcu1nEoSSDHiOXazfwAAARU"]
[Sat Jul 18 23:14:13.695458 2026] [security2:error] [pid 831031:tid 831146] [remote 97.74.93.24:42440] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/wp-login.php"] [unique_id "alxdJZnU1ySsD4Tkeg4KWwAB6HE"]
[Sat Jul 18 23:14:14.192144 2026] [security2:error] [pid 831031:tid 831135] [remote 97.74.93.24:42440] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/wp-login.php"] [unique_id "alxdJpnU1ySsD4Tkeg4KcwABvGY"], referer: https://factsandminds.com/wp-login.php
[Sat Jul 18 23:14:14.201516 2026] [security2:error] [pid 831031:tid 831262] [client 185.242.3.25:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.3.242.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lakelopezonline.com"] [uri "/wp-plain.php"] [unique_id "alxdJpnU1ySsD4Tkeg4KcgAAAfM"], referer: www.google.com
[Sat Jul 18 23:14:14.252456 2026] [security2:error] [pid 831031:tid 831195] [client 4.194.24.143:52985] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/sql.php"] [unique_id "alxdJpnU1ySsD4Tkeg4KdQAAAbA"]
[Sat Jul 18 23:14:14.457326 2026] [security2:error] [pid 831031:tid 831156] [remote 91.142.222.105:47496] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxdJpnU1ySsD4Tkeg4KgAAByns"]
[Sat Jul 18 23:14:14.646436 2026] [security2:error] [pid 831031:tid 831235] [client 138.0.247.157:44083] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 157.247.0.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "claysharecon.com"] [uri "/xmlrpc.php"] [unique_id "alxdJpnU1ySsD4Tkeg4KjAAAAdg"]
[Sat Jul 18 23:14:14.646578 2026] [security2:error] [pid 831031:tid 831235] [client 138.0.247.157:44083] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "claysharecon.com"] [uri "/xmlrpc.php"] [unique_id "alxdJpnU1ySsD4Tkeg4KjAAAAdg"]
[Sat Jul 18 23:14:14.831899 2026] [security2:error] [pid 831031:tid 831033] [remote 103.28.36.205:33976] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 205.36.28.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.yok.mqz.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxdJpnU1ySsD4Tkeg4KkgABogA"]
[Sat Jul 18 23:14:14.915821 2026] [security2:error] [pid 831031:tid 831196] [client 185.242.3.25:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.3.242.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lakelopezonline.com"] [uri "/wp-plain.php"] [unique_id "alxdJpnU1ySsD4Tkeg4KmwAAAbE"], referer: www.google.com
[Sat Jul 18 23:14:14.971768 2026] [security2:error] [pid 831031:tid 831046] [remote 91.142.222.105:47496] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxdJpnU1ySsD4Tkeg4KnwAB1Q0"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:14:15.061344 2026] [security2:error] [pid 831031:tid 831208] [client 45.84.107.174:38601] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.107.84.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdJ5nU1ySsD4Tkeg4KowAAAb0"]
[Sat Jul 18 23:14:15.061511 2026] [security2:error] [pid 831031:tid 831208] [client 45.84.107.174:38601] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdJ5nU1ySsD4Tkeg4KowAAAb0"]
[Sat Jul 18 23:14:15.088271 2026] [security2:error] [pid 831031:tid 831182] [client 4.194.24.143:31434] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/ss.php"] [unique_id "alxdJ5nU1ySsD4Tkeg4KpAAAAaM"]
[Sat Jul 18 23:14:15.091288 2026] [security2:error] [pid 831031:tid 831050] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdJ5nU1ySsD4Tkeg4KpQACBxE"]
[Sat Jul 18 23:14:15.091459 2026] [security2:error] [pid 831031:tid 831282] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdJ5nU1ySsD4Tkeg4KpQACBxE"]
[Sat Jul 18 23:14:15.341553 2026] [security2:error] [pid 831031:tid 831281] [client 62.150.67.110:42146] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "ali-alghanim.net"] [uri "/index.php"] [unique_id "alxdJ5nU1ySsD4Tkeg4KrQAAAgY"]
[Sat Jul 18 23:14:15.667649 2026] [security2:error] [pid 831031:tid 831058] [remote 103.28.36.205:33976] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 205.36.28.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.yok.mqz.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxdJ5nU1ySsD4Tkeg4KvwACBRk"], referer: https://mail.yok.mqz.mybluehost.me/wp-login.php
[Sat Jul 18 23:14:15.706588 2026] [security2:error] [pid 831031:tid 831267] [client 4.194.24.143:33850] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/stats.php"] [unique_id "alxdJ5nU1ySsD4Tkeg4KwAAAAfg"]
[Sat Jul 18 23:14:15.858942 2026] [authz_core:error] [pid 831031:tid 831265] [client 161.118.233.30:0] AH01630: client denied by server configuration: /home2/laughio2/public_html/jenfarley/wp-includes/error_log
[Sat Jul 18 23:14:15.903820 2026] [security2:error] [pid 831031:tid 831234] [client 74.208.214.194:47942] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxdJ5nU1ySsD4Tkeg4KxQAAAdc"]
[Sat Jul 18 23:14:16.270698 2026] [security2:error] [pid 830701:tid 830847] [client 4.194.24.143:33795] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/sump1.php"] [unique_id "alxdKMu1nEoSSDHiOXazswAAARo"]
[Sat Jul 18 23:14:16.318680 2026] [security2:error] [pid 831031:tid 831271] [client 93.86.49.238:51844] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 238.49.86.93.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdKJnU1ySsD4Tkeg4K4AAAAfw"]
[Sat Jul 18 23:14:16.322654 2026] [security2:error] [pid 831031:tid 831271] [client 93.86.49.238:51844] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdKJnU1ySsD4Tkeg4K4AAAAfw"]
[Sat Jul 18 23:14:16.450056 2026] [authz_core:error] [pid 831031:tid 831275] [client 161.118.233.30:0] AH01630: client denied by server configuration: /home2/laughio2/public_html/jenfarley/wp-includes/error_log
[Sat Jul 18 23:14:16.658186 2026] [security2:error] [pid 830701:tid 830884] [client 41.90.66.152:1091] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.keywayconstructionclt.com"] [uri "/index.php"] [unique_id "alxdKMu1nEoSSDHiOXazvAAAAT8"]
[Sat Jul 18 23:14:16.831459 2026] [security2:error] [pid 831031:tid 831233] [client 4.194.24.143:48497] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/system.php"] [unique_id "alxdKJnU1ySsD4Tkeg4K9wAAAdY"]
[Sat Jul 18 23:14:16.911686 2026] [security2:error] [pid 831031:tid 831274] [client 45.84.107.174:29315] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.107.84.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdKJnU1ySsD4Tkeg4K-QAAAf8"]
[Sat Jul 18 23:14:16.911826 2026] [security2:error] [pid 831031:tid 831274] [client 45.84.107.174:29315] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdKJnU1ySsD4Tkeg4K-QAAAf8"]
[Sat Jul 18 23:14:17.152026 2026] [security2:error] [pid 830701:tid 830850] [client 171.4.232.110:32981] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdKcu1nEoSSDHiOXazxgAAAR0"]
[Sat Jul 18 23:14:17.152110 2026] [security2:error] [pid 830701:tid 830850] [client 171.4.232.110:32981] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdKcu1nEoSSDHiOXazxgAAAR0"]
[Sat Jul 18 23:14:17.191056 2026] [security2:error] [pid 831031:tid 831176] [client 124.29.207.185:65156] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdKZnU1ySsD4Tkeg4LBQAAAZ0"]
[Sat Jul 18 23:14:17.191151 2026] [security2:error] [pid 831031:tid 831176] [client 124.29.207.185:65156] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdKZnU1ySsD4Tkeg4LBQAAAZ0"]
[Sat Jul 18 23:14:17.194203 2026] [security2:error] [pid 831031:tid 831080] [remote 91.142.222.105:46150] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxdKZnU1ySsD4Tkeg4LBgABvy8"]
[Sat Jul 18 23:14:17.393058 2026] [security2:error] [pid 831031:tid 831283] [client 4.194.24.143:48473] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/system/03n1hob7p03r2npdefault.php"] [unique_id "alxdKZnU1ySsD4Tkeg4LEgAAAgg"]
[Sat Jul 18 23:14:17.642102 2026] [security2:error] [pid 830701:tid 830874] [client 45.3.45.121:21751] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 121.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxdKcu1nEoSSDHiOXazzQAAATU"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:14:17.856203 2026] [security2:error] [pid 831031:tid 831248] [client 223.185.61.63:15770] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdKZnU1ySsD4Tkeg4LKAAAAeU"]
[Sat Jul 18 23:14:17.856292 2026] [security2:error] [pid 831031:tid 831248] [client 223.185.61.63:15770] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdKZnU1ySsD4Tkeg4LKAAAAeU"]
[Sat Jul 18 23:14:18.010064 2026] [security2:error] [pid 831031:tid 831229] [client 4.194.24.143:4994] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/system/cj5ha2rah8lyiqqdefault.php"] [unique_id "alxdKpnU1ySsD4Tkeg4LMgAAAdI"]
[Sat Jul 18 23:14:18.161071 2026] [security2:error] [pid 831031:tid 831215] [client 51.211.216.144:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.primefocushrc.com"] [uri "/index.php"] [unique_id "alxdJ5nU1ySsD4Tkeg4KvAABxBM"]
[Sat Jul 18 23:14:18.468414 2026] [security2:error] [pid 830701:tid 830915] [client 45.84.107.174:29321] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.107.84.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdKsu1nEoSSDHiOXaz3wAAAV4"]
[Sat Jul 18 23:14:18.468505 2026] [security2:error] [pid 830701:tid 830915] [client 45.84.107.174:29321] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdKsu1nEoSSDHiOXaz3wAAAV4"]
[Sat Jul 18 23:14:18.593134 2026] [security2:error] [pid 831031:tid 831180] [client 4.194.24.143:4474] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/system_log.php"] [unique_id "alxdKpnU1ySsD4Tkeg4LWwAAAaE"]
[Sat Jul 18 23:14:19.026455 2026] [lsapi:warn] [pid 831031:tid 831127] [remote 57.141.18.18:43088] [host www.oswegooperatheater.com] Backend log: PHP Warning:  Invalid "max_input_time" setting. Invalid quantity "60000000000000000000000": value is out of range, using overflow result for backwards compatibility in Unknown on line 0\n
[Sat Jul 18 23:14:19.026491 2026] [lsapi:warn] [pid 831031:tid 831127] [remote 57.141.18.18:43088] [host www.oswegooperatheater.com] Backend log: PHP Warning:  Invalid "max_input_vars" setting. Invalid quantity "100000000000000000000": value is out of range, using overflow result for backwards compatibility in Unknown on line 0\n
[Sat Jul 18 23:14:19.285280 2026] [security2:error] [pid 831031:tid 831187] [client 4.194.24.143:33823] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/t.php"] [unique_id "alxdK5nU1ySsD4Tkeg4LeAAAAag"]
[Sat Jul 18 23:14:19.569164 2026] [lsapi:warn] [pid 831031:tid 831252] [client 50.116.65.227:56004] [host www.oswegooperatheater.com] Backend log: PHP Warning:  Invalid "max_input_time" setting. Invalid quantity "60000000000000000000000": value is out of range, using overflow result for backwards compatibility in Unknown on line 0\n
[Sat Jul 18 23:14:19.569181 2026] [lsapi:warn] [pid 831031:tid 831252] [client 50.116.65.227:56004] [host www.oswegooperatheater.com] Backend log: PHP Warning:  Invalid "max_input_vars" setting. Invalid quantity "100000000000000000000": value is out of range, using overflow result for backwards compatibility in Unknown on line 0\n
[Sat Jul 18 23:14:19.697768 2026] [security2:error] [pid 831031:tid 831162] [client 4.194.24.143:30913] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/nine2code.php"] [unique_id "alxdK5nU1ySsD4Tkeg4LhwAAAY8"]
[Sat Jul 18 23:14:19.953344 2026] [security2:error] [pid 830701:tid 830851] [client 4.194.24.143:5055] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/term.php"] [unique_id "alxdK8u1nEoSSDHiOXa0AgAAAR4"]
[Sat Jul 18 23:14:19.973944 2026] [security2:error] [pid 830701:tid 830938] [client 171.99.159.67:59288] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.159.99.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "viennarotaryfoundation.com"] [uri "/xmlrpc.php"] [unique_id "alxdK8u1nEoSSDHiOXa0AQAAAXU"]
[Sat Jul 18 23:14:19.974080 2026] [security2:error] [pid 830701:tid 830938] [client 171.99.159.67:59288] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "viennarotaryfoundation.com"] [uri "/xmlrpc.php"] [unique_id "alxdK8u1nEoSSDHiOXa0AQAAAXU"]
[Sat Jul 18 23:14:20.018453 2026] [autoindex:error] [pid 831031:tid 831140] [remote 164.68.113.190:0] AH01276: Cannot serve directory /home3/dbnvkfmy/public_html/nzfoodstory/wp-includes/Text/Diff/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:14:20.064841 2026] [security2:error] [pid 830701:tid 830936] [client 45.84.107.174:29329] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.107.84.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdLMu1nEoSSDHiOXa0BAAAAXM"]
[Sat Jul 18 23:14:20.064977 2026] [security2:error] [pid 830701:tid 830936] [client 45.84.107.174:29329] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdLMu1nEoSSDHiOXa0BAAAAXM"]
[Sat Jul 18 23:14:20.250128 2026] [security2:error] [pid 830701:tid 830933] [client 4.194.24.143:30920] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/num.php"] [unique_id "alxdLMu1nEoSSDHiOXa0CQAAAXA"]
[Sat Jul 18 23:14:20.624343 2026] [security2:error] [pid 831031:tid 831289] [client 27.34.68.67:11887] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdLJnU1ySsD4Tkeg4LrwAAAg4"]
[Sat Jul 18 23:14:20.624459 2026] [security2:error] [pid 831031:tid 831289] [client 27.34.68.67:11887] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdLJnU1ySsD4Tkeg4LrwAAAg4"]
[Sat Jul 18 23:14:20.630848 2026] [security2:error] [pid 831031:tid 831259] [client 4.194.24.143:31459] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/test.php"] [unique_id "alxdLJnU1ySsD4Tkeg4LsQAAAfA"]
[Sat Jul 18 23:14:20.688153 2026] [security2:error] [pid 831031:tid 831157] [remote 207.46.13.9:32231] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.13.46.207.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.maxenengineering.com"] [uri "/guide/receipt/museum.php"] [unique_id "alxdLJnU1ySsD4Tkeg4LswABr3w"]
[Sat Jul 18 23:14:20.801721 2026] [security2:error] [pid 831031:tid 831254] [client 4.194.24.143:16709] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/odf7udtspqtpxzyxmw2rccdefault.php"] [unique_id "alxdLJnU1ySsD4Tkeg4LuwAAAes"]
[Sat Jul 18 23:14:21.117604 2026] [security2:error] [pid 831031:tid 831215] [client 171.99.159.67:59312] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.159.99.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "viennarotaryfoundation.org"] [uri "/xmlrpc.php"] [unique_id "alxdLZnU1ySsD4Tkeg4L0gAAAcQ"]
[Sat Jul 18 23:14:21.117698 2026] [security2:error] [pid 831031:tid 831215] [client 171.99.159.67:59312] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "viennarotaryfoundation.org"] [uri "/xmlrpc.php"] [unique_id "alxdLZnU1ySsD4Tkeg4L0gAAAcQ"]
[Sat Jul 18 23:14:21.341785 2026] [security2:error] [pid 830701:tid 830863] [client 4.194.24.143:16750] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/option.php"] [unique_id "alxdLcu1nEoSSDHiOXa0MgAAASo"]
[Sat Jul 18 23:14:21.363501 2026] [security2:error] [pid 830701:tid 830852] [client 4.194.24.143:48510] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/test1.php"] [unique_id "alxdLcu1nEoSSDHiOXa0MwAAAR8"]
[Sat Jul 18 23:14:21.508184 2026] [security2:error] [pid 830701:tid 830890] [client 45.3.45.250:23875] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 250.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxdLcu1nEoSSDHiOXa0NgAAAUU"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:14:21.816535 2026] [security2:error] [pid 830701:tid 830911] [client 119.154.81.234:61136] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdLcu1nEoSSDHiOXa0OwAAAVo"]
[Sat Jul 18 23:14:21.816680 2026] [security2:error] [pid 830701:tid 830911] [client 119.154.81.234:61136] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdLcu1nEoSSDHiOXa0OwAAAVo"]
[Sat Jul 18 23:14:21.837616 2026] [security2:error] [pid 831031:tid 831222] [client 223.178.210.203:24389] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdLZnU1ySsD4Tkeg4L8gAAAcs"]
[Sat Jul 18 23:14:21.837704 2026] [security2:error] [pid 831031:tid 831222] [client 223.178.210.203:24389] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdLZnU1ySsD4Tkeg4L8gAAAcs"]
[Sat Jul 18 23:14:21.892066 2026] [security2:error] [pid 831031:tid 831194] [client 4.194.24.143:17044] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/p.php"] [unique_id "alxdLZnU1ySsD4Tkeg4L9QAAAa8"]
[Sat Jul 18 23:14:21.993818 2026] [security2:error] [pid 831031:tid 831244] [client 45.84.107.174:29337] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.107.84.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdLZnU1ySsD4Tkeg4L-gAAAeE"]
[Sat Jul 18 23:14:21.993940 2026] [security2:error] [pid 831031:tid 831244] [client 45.84.107.174:29337] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdLZnU1ySsD4Tkeg4L-gAAAeE"]
[Sat Jul 18 23:14:22.031899 2026] [security2:error] [pid 831031:tid 831175] [client 4.194.24.143:48456] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/tfm.php"] [unique_id "alxdLpnU1ySsD4Tkeg4L_gAAAZw"]
[Sat Jul 18 23:14:22.430976 2026] [security2:error] [pid 831031:tid 831243] [client 190.245.146.99:56942] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdLpnU1ySsD4Tkeg4MFAAAAeA"]
[Sat Jul 18 23:14:22.431073 2026] [security2:error] [pid 831031:tid 831243] [client 190.245.146.99:56942] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdLpnU1ySsD4Tkeg4MFAAAAeA"]
[Sat Jul 18 23:14:22.432574 2026] [security2:error] [pid 831031:tid 831279] [client 4.194.24.143:21467] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/past.php"] [unique_id "alxdLpnU1ySsD4Tkeg4MFQAAAgQ"]
[Sat Jul 18 23:14:22.550605 2026] [security2:error] [pid 830701:tid 830944] [client 40.77.167.28:48809] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.fkconstructionfunding.com"] [uri "/index.php"] [unique_id "alxdLMu1nEoSSDHiOXa0JgABew8"]
[Sat Jul 18 23:14:22.870818 2026] [security2:error] [pid 831031:tid 831187] [client 4.194.24.143:31449] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/thebe.php"] [unique_id "alxdLpnU1ySsD4Tkeg4MNgAAAag"]
[Sat Jul 18 23:14:22.897925 2026] [security2:error] [pid 831031:tid 831259] [client 54.242.155.65:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxdLpnU1ySsD4Tkeg4MIQAB8Bw"]
[Sat Jul 18 23:14:22.929299 2026] [security2:error] [pid 831031:tid 831255] [client 50.116.65.227:56034] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.fkconstructionfunding.com"] [uri "/index.php"] [unique_id "alxdLpnU1ySsD4Tkeg4MKgAAAew"]
[Sat Jul 18 23:14:22.950508 2026] [security2:error] [pid 831031:tid 831232] [client 45.3.45.165:9677] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxdLpnU1ySsD4Tkeg4MNwAAAdU"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:14:22.992192 2026] [security2:error] [pid 831031:tid 831219] [client 4.194.24.143:17082] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/php.php"] [unique_id "alxdLpnU1ySsD4Tkeg4MPwAAAcg"]
[Sat Jul 18 23:14:23.118465 2026] [security2:error] [pid 831031:tid 831203] [client 50.116.65.227:56050] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.fkconstructionfunding.com"] [uri "/index.php"] [unique_id "alxdLpnU1ySsD4Tkeg4MPQAAAbg"]
[Sat Jul 18 23:14:23.247979 2026] [security2:error] [pid 831031:tid 831165] [client 98.90.166.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxdL5nU1ySsD4Tkeg4MRgABkjo"]
[Sat Jul 18 23:14:23.550993 2026] [security2:error] [pid 831031:tid 831236] [client 4.194.24.143:30917] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/php8.php"] [unique_id "alxdL5nU1ySsD4Tkeg4MWAAAAdk"]
[Sat Jul 18 23:14:23.603357 2026] [security2:error] [pid 831031:tid 831281] [client 45.84.107.174:29345] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.107.84.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdL5nU1ySsD4Tkeg4MXAAAAgY"]
[Sat Jul 18 23:14:23.603465 2026] [security2:error] [pid 831031:tid 831281] [client 45.84.107.174:29345] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdL5nU1ySsD4Tkeg4MXAAAAgY"]
[Sat Jul 18 23:14:23.813453 2026] [security2:error] [pid 830701:tid 830866] [client 4.194.24.143:31470] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/themes.php"] [unique_id "alxdL8u1nEoSSDHiOXa0XgAAAS0"]
[Sat Jul 18 23:14:24.093672 2026] [security2:error] [pid 830701:tid 830862] [client 4.194.24.143:21464] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/phpinfo.php"] [unique_id "alxdMMu1nEoSSDHiOXa0aAAAASk"]
[Sat Jul 18 23:14:24.755287 2026] [security2:error] [pid 830701:tid 830785] [remote 31.42.184.154:33794] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxdMMu1nEoSSDHiOXa0fQABg1M"]
[Sat Jul 18 23:14:24.771875 2026] [security2:error] [pid 830701:tid 830779] [remote 199.189.225.167:27129] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.225.189.199.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "timespans.org"] [uri "/wp-login.php"] [unique_id "alxdMMu1nEoSSDHiOXa0fAABIk0"]
[Sat Jul 18 23:14:24.790443 2026] [security2:error] [pid 831031:tid 831280] [client 4.194.24.143:48458] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/tiny.php"] [unique_id "alxdMJnU1ySsD4Tkeg4MmwAAAgU"]
[Sat Jul 18 23:14:25.088832 2026] [security2:error] [pid 830701:tid 830782] [remote 31.42.184.154:33794] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxdMcu1nEoSSDHiOXa0gwABXlA"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:14:25.371967 2026] [security2:error] [pid 830701:tid 830787] [remote 199.189.225.167:27129] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.225.189.199.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "timespans.org"] [uri "/wp-login.php"] [unique_id "alxdMcu1nEoSSDHiOXa0iQABe1U"], referer: https://timespans.org/wp-login.php
[Sat Jul 18 23:14:25.411702 2026] [security2:error] [pid 831031:tid 831200] [client 138.0.247.157:44295] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 157.247.0.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "claysharecon.com"] [uri "/xmlrpc.php"] [unique_id "alxdMZnU1ySsD4Tkeg4MwwAAAbU"]
[Sat Jul 18 23:14:25.411812 2026] [security2:error] [pid 831031:tid 831200] [client 138.0.247.157:44295] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "claysharecon.com"] [uri "/xmlrpc.php"] [unique_id "alxdMZnU1ySsD4Tkeg4MwwAAAbU"]
[Sat Jul 18 23:14:25.499630 2026] [security2:error] [pid 831031:tid 831157] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdMZnU1ySsD4Tkeg4MxwACCnw"]
[Sat Jul 18 23:14:25.499763 2026] [security2:error] [pid 831031:tid 831285] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdMZnU1ySsD4Tkeg4MxwACCnw"]
[Sat Jul 18 23:14:25.611976 2026] [security2:error] [pid 830701:tid 830836] [client 4.194.24.143:4462] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/tmp/byp.php"] [unique_id "alxdMcu1nEoSSDHiOXa0lwAAAQ8"]
[Sat Jul 18 23:14:26.944416 2026] [security2:error] [pid 830701:tid 830791] [remote 160.187.68.132:51238] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.68.187.160.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "viennarotaryfoundation.com"] [uri "/wp-login.php"] [unique_id "alxdMsu1nEoSSDHiOXa0uAABXFk"]
[Sat Jul 18 23:14:27.043476 2026] [security2:error] [pid 831031:tid 831073] [remote 91.142.222.105:57438] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxdM5nU1ySsD4Tkeg4NGQACByg"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:14:27.274579 2026] [security2:error] [pid 830701:tid 830890] [client 4.194.24.143:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "itdynamix.com"] [uri "/index.php"] [unique_id "alxdMMu1nEoSSDHiOXa0eAAAAUU"]
[Sat Jul 18 23:14:27.466260 2026] [security2:error] [pid 831031:tid 831235] [client 4.194.24.143:30946] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/post.php"] [unique_id "alxdM5nU1ySsD4Tkeg4NOAAAAdg"]
[Sat Jul 18 23:14:27.623061 2026] [security2:error] [pid 831031:tid 831209] [client 124.29.207.185:47757] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdM5nU1ySsD4Tkeg4NRAAAAb4"]
[Sat Jul 18 23:14:27.623169 2026] [security2:error] [pid 831031:tid 831209] [client 124.29.207.185:47757] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdM5nU1ySsD4Tkeg4NRAAAAb4"]
[Sat Jul 18 23:14:27.694374 2026] [security2:error] [pid 830701:tid 830797] [remote 160.187.68.132:51238] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.68.187.160.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "viennarotaryfoundation.com"] [uri "/wp-login.php"] [unique_id "alxdM8u1nEoSSDHiOXa0zAABUl8"], referer: https://viennarotaryfoundation.com/wp-login.php
[Sat Jul 18 23:14:27.695584 2026] [security2:error] [pid 831031:tid 831233] [client 171.4.232.110:33305] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdM5nU1ySsD4Tkeg4NSwAAAdY"]
[Sat Jul 18 23:14:27.696004 2026] [security2:error] [pid 831031:tid 831233] [client 171.4.232.110:33305] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdM5nU1ySsD4Tkeg4NSwAAAdY"]
[Sat Jul 18 23:14:27.924386 2026] [security2:error] [pid 831031:tid 831232] [client 93.86.49.238:51160] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 238.49.86.93.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdM5nU1ySsD4Tkeg4NUgAAAdU"]
[Sat Jul 18 23:14:27.924795 2026] [security2:error] [pid 831031:tid 831232] [client 93.86.49.238:51160] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdM5nU1ySsD4Tkeg4NUgAAAdU"]
[Sat Jul 18 23:14:28.009590 2026] [security2:error] [pid 831031:tid 831196] [client 4.194.24.143:21440] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/public/assets/design_1/css/parts/course_cards/grid_card_1.min.php"] [unique_id "alxdNJnU1ySsD4Tkeg4NWQAAAbE"]
[Sat Jul 18 23:14:28.077954 2026] [security2:error] [pid 830701:tid 830809] [remote 31.42.184.154:33806] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxdNMu1nEoSSDHiOXa01AABP2s"]
[Sat Jul 18 23:14:28.238780 2026] [security2:error] [pid 831031:tid 831162] [client 57.141.18.71:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxdNJnU1ySsD4Tkeg4NXQAAAY8"]
[Sat Jul 18 23:14:28.349328 2026] [security2:error] [pid 830701:tid 830817] [remote 31.42.184.154:33806] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxdNMu1nEoSSDHiOXa01gABU3M"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:14:28.554280 2026] [security2:error] [pid 831031:tid 831225] [client 223.185.61.63:19520] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdNJnU1ySsD4Tkeg4NagAAAc4"]
[Sat Jul 18 23:14:28.554394 2026] [security2:error] [pid 831031:tid 831225] [client 223.185.61.63:19520] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdNJnU1ySsD4Tkeg4NagAAAc4"]
[Sat Jul 18 23:14:28.563663 2026] [security2:error] [pid 831031:tid 831182] [client 4.194.24.143:36342] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/public/css.php"] [unique_id "alxdNJnU1ySsD4Tkeg4NawAAAaM"]
[Sat Jul 18 23:14:29.128244 2026] [security2:error] [pid 830701:tid 830937] [client 4.194.24.143:16723] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/r.php"] [unique_id "alxdNcu1nEoSSDHiOXa07AAAAXQ"]
[Sat Jul 18 23:14:29.706466 2026] [security2:error] [pid 830701:tid 830922] [client 4.194.24.143:28334] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/radio.php"] [unique_id "alxdNcu1nEoSSDHiOXa0-AAAAWU"]
[Sat Jul 18 23:14:29.731771 2026] [fcgid:warn] [pid 830701:tid 830847] (70007)The timeout specified has expired: [client 103.19.253.71:49952] mod_fcgid: can't get data from http client
[Sat Jul 18 23:14:30.248794 2026] [security2:error] [pid 830701:tid 830852] [client 4.194.24.143:21463] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/randkeyword.php7"] [unique_id "alxdNsu1nEoSSDHiOXa1BgAAAR8"]
[Sat Jul 18 23:14:30.547797 2026] [security2:error] [pid 831031:tid 831125] [remote 97.74.93.24:35020] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tee.qtw.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxdNpnU1ySsD4Tkeg4NvAABu1w"]
[Sat Jul 18 23:14:30.548045 2026] [security2:error] [pid 831031:tid 831206] [client 97.74.93.24:35020] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "tee.qtw.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxdNpnU1ySsD4Tkeg4NvAABu1w"]
[Sat Jul 18 23:14:30.800428 2026] [security2:error] [pid 831031:tid 831221] [client 4.194.24.143:28304] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/readme.php"] [unique_id "alxdNpnU1ySsD4Tkeg4NzAAAAco"]
[Sat Jul 18 23:14:31.267918 2026] [security2:error] [pid 830701:tid 830888] [client 27.34.68.67:33567] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdN8u1nEoSSDHiOXa1LgAAAUM"]
[Sat Jul 18 23:14:31.268010 2026] [security2:error] [pid 830701:tid 830888] [client 27.34.68.67:33567] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdN8u1nEoSSDHiOXa1LgAAAUM"]
[Sat Jul 18 23:14:31.361547 2026] [security2:error] [pid 831031:tid 831240] [client 4.194.24.143:21461] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/reze.php"] [unique_id "alxdN5nU1ySsD4Tkeg4N3QAAAd0"]
[Sat Jul 18 23:14:31.451441 2026] [security2:error] [pid 830701:tid 830777] [remote 41.76.213.235:44422] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxdN8u1nEoSSDHiOXa1MAABP0s"]
[Sat Jul 18 23:14:31.653799 2026] [security2:error] [pid 830701:tid 830727] [remote 202.51.202.242:46958] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 242.202.51.202.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "petpawo.com"] [uri "/wp-login.php"] [unique_id "alxdN8u1nEoSSDHiOXa1NQABdBk"]
[Sat Jul 18 23:14:31.702464 2026] [security2:error] [pid 831031:tid 831157] [remote 74.235.96.117:52248] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.235.74.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxdN5nU1ySsD4Tkeg4N5wABv3w"]
[Sat Jul 18 23:14:31.934771 2026] [security2:error] [pid 830701:tid 830865] [client 4.194.24.143:28318] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/rh.php"] [unique_id "alxdN8u1nEoSSDHiOXa1QwAAASw"]
[Sat Jul 18 23:14:32.028202 2026] [security2:error] [pid 831031:tid 831247] [client 196.178.162.249:39074] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "toddnielsen.com"] [uri "/index.php"] [unique_id "alxdN5nU1ySsD4Tkeg4N0gAB5Gw"], referer: https://toddnielsen.com
[Sat Jul 18 23:14:32.160387 2026] [security2:error] [pid 831031:tid 831155] [remote 74.235.96.117:52248] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.235.74.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxdOJnU1ySsD4Tkeg4N-AACBXo"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:14:32.323506 2026] [security2:error] [pid 830701:tid 830867] [client 119.154.81.234:61531] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdOMu1nEoSSDHiOXa1XAAAAS4"]
[Sat Jul 18 23:14:32.323630 2026] [security2:error] [pid 830701:tid 830867] [client 119.154.81.234:61531] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdOMu1nEoSSDHiOXa1XAAAAS4"]
[Sat Jul 18 23:14:32.377306 2026] [security2:error] [pid 830701:tid 830728] [remote 202.51.202.242:46958] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 242.202.51.202.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "petpawo.com"] [uri "/wp-login.php"] [unique_id "alxdOMu1nEoSSDHiOXa1XQABNRo"], referer: https://petpawo.com/wp-login.php
[Sat Jul 18 23:14:32.379277 2026] [security2:error] [pid 831031:tid 831169] [client 74.7.227.179:46524] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxdOJnU1ySsD4Tkeg4N-QABlgA"], referer: https://tejasenvironmental.com/p=1612428
[Sat Jul 18 23:14:32.394916 2026] [security2:error] [pid 830701:tid 830776] [remote 41.76.213.235:44422] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxdOMu1nEoSSDHiOXa1XgABDko"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:14:32.401228 2026] [security2:error] [pid 830701:tid 830870] [client 180.153.197.248:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxdOMu1nEoSSDHiOXa1WQABMTA"]
[Sat Jul 18 23:14:32.487379 2026] [security2:error] [pid 831031:tid 831184] [client 4.194.24.143:28294] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/rip.php"] [unique_id "alxdOJnU1ySsD4Tkeg4OBQAAAaU"]
[Sat Jul 18 23:14:32.504231 2026] [security2:error] [pid 831031:tid 831286] [client 188.217.52.248:3368] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.52.217.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "whispersofevidence.com"] [uri "/wp-login.php"] [unique_id "alxdOJnU1ySsD4Tkeg4OBAAAAgs"], referer: https://www.google.com
[Sat Jul 18 23:14:32.565693 2026] [security2:error] [pid 831031:tid 831174] [client 223.178.210.203:5812] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdOJnU1ySsD4Tkeg4OCwAAAZs"]
[Sat Jul 18 23:14:32.565806 2026] [security2:error] [pid 831031:tid 831174] [client 223.178.210.203:5812] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdOJnU1ySsD4Tkeg4OCwAAAZs"]
[Sat Jul 18 23:14:32.679799 2026] [security2:error] [pid 830701:tid 830939] [client 120.240.178.144:11072] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "keywayconstructionclt.com"] [uri "/index.php"] [unique_id "alxdOMu1nEoSSDHiOXa1YgAAAXY"]
[Sat Jul 18 23:14:32.724996 2026] [security2:error] [pid 830701:tid 830932] [client 65.111.28.12:11099] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxdOMu1nEoSSDHiOXa1ZwAAAW8"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:14:33.009781 2026] [security2:error] [pid 831031:tid 831229] [client 190.245.146.99:57448] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdOZnU1ySsD4Tkeg4OIQAAAdI"]
[Sat Jul 18 23:14:33.009934 2026] [security2:error] [pid 831031:tid 831229] [client 190.245.146.99:57448] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdOZnU1ySsD4Tkeg4OIQAAAdI"]
[Sat Jul 18 23:14:33.028477 2026] [security2:error] [pid 831031:tid 831198] [client 98.89.176.131:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxdOJnU1ySsD4Tkeg4OHwABsxA"]
[Sat Jul 18 23:14:33.028596 2026] [security2:error] [pid 831031:tid 831190] [client 4.194.24.143:28314] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/root.php"] [unique_id "alxdOZnU1ySsD4Tkeg4OIgAAAas"]
[Sat Jul 18 23:14:33.431784 2026] [security2:error] [pid 831031:tid 831206] [client 98.88.186.79:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxdOZnU1ySsD4Tkeg4OLAABuwQ"]
[Sat Jul 18 23:14:33.570880 2026] [security2:error] [pid 830701:tid 830944] [client 4.194.24.143:17060] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/s.php"] [unique_id "alxdOcu1nEoSSDHiOXa1fQAAAXs"]
[Sat Jul 18 23:14:33.790449 2026] [security2:error] [pid 831031:tid 831177] [client 45.3.45.161:21387] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxdOZnU1ySsD4Tkeg4ORwAAAZ4"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:14:33.795460 2026] [security2:error] [pid 831031:tid 831258] [client 35.92.83.184:10672] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 184.83.92.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxdOZnU1ySsD4Tkeg4OSQAAAe8"]
[Sat Jul 18 23:14:33.883458 2026] [security2:error] [pid 831031:tid 831200] [client 74.208.214.194:60044] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxdOZnU1ySsD4Tkeg4OTgAAAbU"]
[Sat Jul 18 23:14:34.111781 2026] [security2:error] [pid 831031:tid 831220] [client 4.194.24.143:17071] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/sang.php"] [unique_id "alxdOpnU1ySsD4Tkeg4OWQAAAck"]
[Sat Jul 18 23:14:34.720913 2026] [security2:error] [pid 830701:tid 830908] [client 4.194.24.143:16710] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/scxy.php"] [unique_id "alxdOsu1nEoSSDHiOXa1kwAAAVc"]
[Sat Jul 18 23:14:34.806741 2026] [security2:error] [pid 831031:tid 831206] [client 45.3.45.215:53261] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 215.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxdOpnU1ySsD4Tkeg4OdAAAAbs"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:14:35.294534 2026] [security2:error] [pid 831031:tid 831280] [client 4.194.24.143:30950] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/sd.php"] [unique_id "alxdO5nU1ySsD4Tkeg4OrAAAAgU"]
[Sat Jul 18 23:14:35.841256 2026] [security2:error] [pid 831031:tid 831268] [client 4.194.24.143:36331] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/sf.php"] [unique_id "alxdO5nU1ySsD4Tkeg4OyAAAAfk"]
[Sat Jul 18 23:14:35.927182 2026] [security2:error] [pid 831031:tid 831149] [remote 102.134.101.35:35324] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 35.101.134.102.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mtredistricting.gov"] [uri "/wp-login.php"] [unique_id "alxdO5nU1ySsD4Tkeg4OzAACC3Q"]
[Sat Jul 18 23:14:36.099869 2026] [security2:error] [pid 831031:tid 831146] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdPJnU1ySsD4Tkeg4O1gAB_HE"]
[Sat Jul 18 23:14:36.100064 2026] [security2:error] [pid 831031:tid 831271] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdPJnU1ySsD4Tkeg4O1gAB_HE"]
[Sat Jul 18 23:14:36.382270 2026] [security2:error] [pid 830701:tid 830890] [client 4.194.24.143:28339] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/shell.php"] [unique_id "alxdPMu1nEoSSDHiOXa1wAAAAUU"]
[Sat Jul 18 23:14:36.413041 2026] [security2:error] [pid 830701:tid 830733] [remote 180.153.197.248:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.197.153.180.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.aleishapenny.ca"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxdPMu1nEoSSDHiOXa1xQABdR8"], referer: https://www.aleishapenny.ca/listing/?view=grid&posts_per_page=24
[Sat Jul 18 23:14:36.436155 2026] [security2:error] [pid 830701:tid 830805] [remote 180.153.197.248:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.197.153.180.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.aleishapenny.ca"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxdPMu1nEoSSDHiOXa1xAABdWc"], referer: https://www.aleishapenny.ca/listing/?view=grid&posts_per_page=24
[Sat Jul 18 23:14:36.668877 2026] [security2:error] [pid 831031:tid 831150] [remote 102.134.101.35:35324] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 35.101.134.102.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mtredistricting.gov"] [uri "/wp-login.php"] [unique_id "alxdPJnU1ySsD4Tkeg4O7AABr3U"], referer: https://mtredistricting.gov/wp-login.php
[Sat Jul 18 23:14:37.093974 2026] [security2:error] [pid 831031:tid 831241] [client 138.0.247.157:44576] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 157.247.0.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "claysharecon.com"] [uri "/xmlrpc.php"] [unique_id "alxdPZnU1ySsD4Tkeg4PBAAAAd4"]
[Sat Jul 18 23:14:37.094097 2026] [security2:error] [pid 831031:tid 831241] [client 138.0.247.157:44576] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "claysharecon.com"] [uri "/xmlrpc.php"] [unique_id "alxdPZnU1ySsD4Tkeg4PBAAAAd4"]
[Sat Jul 18 23:14:37.517303 2026] [proxy:error] [pid 831031:tid 831209] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:14:37.517342 2026] [proxy_http:error] [pid 831031:tid 831209] [client 185.247.137.66:37631] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:14:37.517978 2026] [proxy:error] [pid 831031:tid 831209] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:14:37.518017 2026] [proxy_http:error] [pid 831031:tid 831209] [client 185.247.137.66:37631] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:14:37.617949 2026] [security2:error] [pid 831031:tid 831212] [client 4.194.24.143:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "itdynamix.com"] [uri "/index.php"] [unique_id "alxdPJnU1ySsD4Tkeg4O-wAAAcE"]
[Sat Jul 18 23:14:37.703658 2026] [security2:error] [pid 830701:tid 830823] [remote 20.153.140.50:36748] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxdPcu1nEoSSDHiOXa16QABQnk"]
[Sat Jul 18 23:14:37.821343 2026] [security2:error] [pid 830701:tid 830855] [client 4.194.24.143:36305] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/sid3.php"] [unique_id "alxdPcu1nEoSSDHiOXa16gAAASI"]
[Sat Jul 18 23:14:38.197013 2026] [security2:error] [pid 831031:tid 831159] [remote 57.141.18.37:50938] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 37.18.141.57.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/product/5076100"] [unique_id "alxdPpnU1ySsD4Tkeg4PKgABj34"]
[Sat Jul 18 23:14:38.229117 2026] [security2:error] [pid 831031:tid 831279] [client 124.29.246.106:55754] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdPpnU1ySsD4Tkeg4PMAAAAgQ"]
[Sat Jul 18 23:14:38.229218 2026] [security2:error] [pid 831031:tid 831279] [client 124.29.246.106:55754] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdPpnU1ySsD4Tkeg4PMAAAAgQ"]
[Sat Jul 18 23:14:38.305817 2026] [security2:error] [pid 831031:tid 831252] [client 171.4.232.110:33621] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdPpnU1ySsD4Tkeg4PNgAAAek"]
[Sat Jul 18 23:14:38.305954 2026] [security2:error] [pid 831031:tid 831252] [client 171.4.232.110:33621] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdPpnU1ySsD4Tkeg4PNgAAAek"]
[Sat Jul 18 23:14:38.313653 2026] [security2:error] [pid 830701:tid 830829] [remote 20.153.140.50:36748] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxdPsu1nEoSSDHiOXa18gABIH8"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:14:38.383887 2026] [security2:error] [pid 831031:tid 831225] [client 4.194.24.143:30963] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/simple.php"] [unique_id "alxdPpnU1ySsD4Tkeg4PPAAAAc4"]
[Sat Jul 18 23:14:38.797566 2026] [security2:error] [pid 831031:tid 831037] [remote 102.134.101.35:35336] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 35.101.134.102.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.nvy.ppp.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxdPpnU1ySsD4Tkeg4PTgABogQ"]
[Sat Jul 18 23:14:38.797734 2026] [security2:error] [pid 831031:tid 831181] [client 102.134.101.35:35336] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "mail.nvy.ppp.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxdPpnU1ySsD4Tkeg4PTgABogQ"]
[Sat Jul 18 23:14:38.958675 2026] [security2:error] [pid 831031:tid 831212] [client 4.194.24.143:21491] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/sitemap.php"] [unique_id "alxdPpnU1ySsD4Tkeg4PVAAAAcE"]
[Sat Jul 18 23:14:39.065304 2026] [security2:error] [pid 830701:tid 830872] [client 223.185.61.63:23457] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdP8u1nEoSSDHiOXa2BQAAATM"]
[Sat Jul 18 23:14:39.065443 2026] [security2:error] [pid 830701:tid 830872] [client 223.185.61.63:23457] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdP8u1nEoSSDHiOXa2BQAAATM"]
[Sat Jul 18 23:14:39.432007 2026] [security2:error] [pid 830701:tid 830851] [client 93.86.49.238:11590] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 238.49.86.93.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdP8u1nEoSSDHiOXa2CAAAAR4"]
[Sat Jul 18 23:14:39.432123 2026] [security2:error] [pid 830701:tid 830851] [client 93.86.49.238:11590] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdP8u1nEoSSDHiOXa2CAAAAR4"]
[Sat Jul 18 23:14:41.508085 2026] [security2:error] [pid 830701:tid 830727] [remote 31.42.184.154:37236] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxdQcu1nEoSSDHiOXa2PAABXxk"]
[Sat Jul 18 23:14:41.588977 2026] [security2:error] [pid 831031:tid 831101] [remote 157.66.47.83:43272] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "alchemygroup.ca"] [uri "/wp-login.php"] [unique_id "alxdQZnU1ySsD4Tkeg4PxQAB0EQ"]
[Sat Jul 18 23:14:41.709122 2026] [security2:error] [pid 830701:tid 830898] [client 27.34.68.67:62149] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdQcu1nEoSSDHiOXa2QgAAAU0"]
[Sat Jul 18 23:14:41.709272 2026] [security2:error] [pid 830701:tid 830898] [client 27.34.68.67:62149] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdQcu1nEoSSDHiOXa2QgAAAU0"]
[Sat Jul 18 23:14:42.010607 2026] [security2:error] [pid 831031:tid 831110] [remote 157.66.47.83:43272] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "alchemygroup.ca"] [uri "/wp-login.php"] [unique_id "alxdQpnU1ySsD4Tkeg4P2gAB5U0"], referer: https://alchemygroup.ca/wp-login.php
[Sat Jul 18 23:14:42.164654 2026] [security2:error] [pid 830701:tid 830736] [remote 31.42.184.154:37236] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxdQsu1nEoSSDHiOXa2RwABKiI"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:14:42.821087 2026] [autoindex:error] [pid 831031:tid 831138] [remote 164.68.113.190:0] AH01276: Cannot serve directory /home3/dbnvkfmy/public_html/nzfoodstory/wp-includes/css/dist/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:14:42.841887 2026] [security2:error] [pid 831031:tid 831228] [client 119.154.81.234:61939] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdQpnU1ySsD4Tkeg4QAwAAAdE"]
[Sat Jul 18 23:14:42.842040 2026] [security2:error] [pid 831031:tid 831228] [client 119.154.81.234:61939] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdQpnU1ySsD4Tkeg4QAwAAAdE"]
[Sat Jul 18 23:14:43.111021 2026] [security2:error] [pid 831031:tid 831226] [client 223.178.210.203:26690] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdQ5nU1ySsD4Tkeg4QFgAAAc8"]
[Sat Jul 18 23:14:43.111117 2026] [security2:error] [pid 831031:tid 831226] [client 223.178.210.203:26690] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdQ5nU1ySsD4Tkeg4QFgAAAc8"]
[Sat Jul 18 23:14:43.426746 2026] [autoindex:error] [pid 831031:tid 831136] [remote 164.68.113.190:0] AH01276: Cannot serve directory /home3/dbnvkfmy/public_html/nzfoodstory/wp-includes/fonts/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:14:43.510192 2026] [security2:error] [pid 831031:tid 831181] [client 190.245.146.99:57955] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdQ5nU1ySsD4Tkeg4QJQAAAaI"]
[Sat Jul 18 23:14:43.516299 2026] [security2:error] [pid 831031:tid 831181] [client 190.245.146.99:57955] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdQ5nU1ySsD4Tkeg4QJQAAAaI"]
[Sat Jul 18 23:14:44.867258 2026] [security2:error] [pid 831031:tid 831236] [client 45.84.107.174:24171] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.107.84.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdRJnU1ySsD4Tkeg4QcwAAAdk"]
[Sat Jul 18 23:14:44.867354 2026] [security2:error] [pid 831031:tid 831236] [client 45.84.107.174:24171] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdRJnU1ySsD4Tkeg4QcwAAAdk"]
[Sat Jul 18 23:14:45.155808 2026] [security2:error] [pid 831031:tid 831202] [client 209.209.9.152:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mtlegnews.gov"] [uri "/index.php"] [unique_id "alxdRJnU1ySsD4Tkeg4QcgAAAbc"]
[Sat Jul 18 23:14:45.667625 2026] [security2:error] [pid 830701:tid 830867] [client 45.3.45.165:40199] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxdRcu1nEoSSDHiOXa2hgAAAS4"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:14:45.799553 2026] [security2:error] [pid 831031:tid 831255] [client 45.84.107.174:12609] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.107.84.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdRZnU1ySsD4Tkeg4QwAAAAew"]
[Sat Jul 18 23:14:45.799630 2026] [security2:error] [pid 831031:tid 831255] [client 45.84.107.174:12609] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdRZnU1ySsD4Tkeg4QwAAAAew"]
[Sat Jul 18 23:14:45.827526 2026] [fcgid:warn] [pid 831031:tid 831233] (70014)End of file found: [client 91.238.181.10:64402] mod_fcgid: can't get data from http client
[Sat Jul 18 23:14:45.897060 2026] [autoindex:error] [pid 831031:tid 831093] [remote 164.68.113.190:0] AH01276: Cannot serve directory /home3/dbnvkfmy/public_html/nzfoodstory/wp-includes/ID3/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:14:46.532083 2026] [security2:error] [pid 830701:tid 830741] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdRsu1nEoSSDHiOXa2mAABIic"]
[Sat Jul 18 23:14:46.532307 2026] [security2:error] [pid 830701:tid 830855] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdRsu1nEoSSDHiOXa2mAABIic"]
[Sat Jul 18 23:14:46.594239 2026] [autoindex:error] [pid 831031:tid 831138] [remote 164.68.113.190:0] AH01276: Cannot serve directory /home3/dbnvkfmy/public_html/nzfoodstory/wp-includes/sitemaps/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:14:46.675914 2026] [security2:error] [pid 831031:tid 831276] [client 138.0.247.157:44924] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 157.247.0.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "claysharecon.com"] [uri "/xmlrpc.php"] [unique_id "alxdRpnU1ySsD4Tkeg4RBQAAAgE"]
[Sat Jul 18 23:14:46.676011 2026] [security2:error] [pid 831031:tid 831276] [client 138.0.247.157:44924] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "claysharecon.com"] [uri "/xmlrpc.php"] [unique_id "alxdRpnU1ySsD4Tkeg4RBQAAAgE"]
[Sat Jul 18 23:14:47.198634 2026] [security2:error] [pid 830701:tid 830873] [client 188.70.50.19:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "ali-alghanim.net"] [uri "/index.php"] [unique_id "alxdRsu1nEoSSDHiOXa2qgABNBs"]
[Sat Jul 18 23:14:47.344781 2026] [security2:error] [pid 831031:tid 831168] [client 45.84.107.174:20147] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.107.84.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdR5nU1ySsD4Tkeg4RLwAAAZU"]
[Sat Jul 18 23:14:47.344875 2026] [security2:error] [pid 831031:tid 831168] [client 45.84.107.174:20147] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdR5nU1ySsD4Tkeg4RLwAAAZU"]
[Sat Jul 18 23:14:47.550138 2026] [autoindex:error] [pid 831031:tid 831160] [remote 164.68.113.190:0] AH01276: Cannot serve directory /home3/dbnvkfmy/public_html/nzfoodstory/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:14:47.708294 2026] [security2:error] [pid 831031:tid 831033] [remote 72.167.132.114:38660] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "wgs.doq.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxdR5nU1ySsD4Tkeg4RSQABuAA"]
[Sat Jul 18 23:14:47.914506 2026] [security2:error] [pid 831031:tid 831042] [remote 72.167.132.114:38660] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "wgs.doq.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxdR5nU1ySsD4Tkeg4RVAABqQk"], referer: https://wgs.doq.mybluehost.me/wp-login.php
[Sat Jul 18 23:14:48.006935 2026] [security2:error] [pid 831031:tid 831047] [remote 212.64.199.131:59866] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.199.64.212.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.narv.co"] [uri "/xmlrpc.php"] [unique_id "alxdR5nU1ySsD4Tkeg4RVgABlw4"]
[Sat Jul 18 23:14:48.007120 2026] [security2:error] [pid 831031:tid 831170] [client 212.64.199.131:59866] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.narv.co"] [uri "/xmlrpc.php"] [unique_id "alxdR5nU1ySsD4Tkeg4RVgABlw4"]
[Sat Jul 18 23:14:48.643208 2026] [security2:error] [pid 831031:tid 831265] [client 124.29.246.106:35590] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdSJnU1ySsD4Tkeg4RcwAAAfY"]
[Sat Jul 18 23:14:48.643327 2026] [security2:error] [pid 831031:tid 831265] [client 124.29.246.106:35590] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdSJnU1ySsD4Tkeg4RcwAAAfY"]
[Sat Jul 18 23:14:48.712662 2026] [security2:error] [pid 831031:tid 831254] [client 65.111.28.40:13413] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 40.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxdSJnU1ySsD4Tkeg4RdAAAAes"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:14:48.913738 2026] [proxy:error] [pid 831031:tid 831225] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:14:48.913792 2026] [proxy_http:error] [pid 831031:tid 831225] [client 193.47.62.168:33572] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:14:48.914338 2026] [proxy:error] [pid 831031:tid 831225] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:14:48.914363 2026] [proxy_http:error] [pid 831031:tid 831225] [client 193.47.62.168:33572] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:14:48.924430 2026] [security2:error] [pid 831031:tid 831173] [client 171.4.232.110:33933] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdSJnU1ySsD4Tkeg4RfgAAAZo"]
[Sat Jul 18 23:14:48.924508 2026] [security2:error] [pid 831031:tid 831173] [client 171.4.232.110:33933] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdSJnU1ySsD4Tkeg4RfgAAAZo"]
[Sat Jul 18 23:14:48.981470 2026] [security2:error] [pid 831031:tid 831243] [client 45.84.107.174:20163] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.107.84.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdSJnU1ySsD4Tkeg4RggAAAeA"]
[Sat Jul 18 23:14:48.981613 2026] [security2:error] [pid 831031:tid 831243] [client 45.84.107.174:20163] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "securingmemories.com"] [uri "/xmlrpc.php"] [unique_id "alxdSJnU1ySsD4Tkeg4RggAAAeA"]
[Sat Jul 18 23:14:49.738227 2026] [security2:error] [pid 831031:tid 831221] [client 223.185.61.63:7675] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdSZnU1ySsD4Tkeg4RpQAAAco"]
[Sat Jul 18 23:14:49.738344 2026] [security2:error] [pid 831031:tid 831221] [client 223.185.61.63:7675] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdSZnU1ySsD4Tkeg4RpQAAAco"]
[Sat Jul 18 23:14:50.158947 2026] [security2:error] [pid 831031:tid 831090] [remote 45.157.54.14:55104] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "jenfarley.com"] [uri "/xmlrpc.php"] [unique_id "alxdSpnU1ySsD4Tkeg4RwwABvjk"]
[Sat Jul 18 23:14:50.159115 2026] [security2:error] [pid 831031:tid 831209] [client 45.157.54.14:55104] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "jenfarley.com"] [uri "/xmlrpc.php"] [unique_id "alxdSpnU1ySsD4Tkeg4RwwABvjk"]
[Sat Jul 18 23:14:50.193116 2026] [security2:error] [pid 831031:tid 831224] [client 65.111.28.115:25285] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxdSpnU1ySsD4Tkeg4RxAAAAc0"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:14:50.288674 2026] [security2:error] [pid 831031:tid 831052] [remote 31.42.184.154:56258] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "myspineworld.com"] [uri "/wp-login.php"] [unique_id "alxdSpnU1ySsD4Tkeg4RyAABpBM"]
[Sat Jul 18 23:14:50.491422 2026] [security2:error] [pid 831031:tid 831185] [client 93.86.49.238:12760] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 238.49.86.93.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdSpnU1ySsD4Tkeg4R1gAAAaY"]
[Sat Jul 18 23:14:50.494920 2026] [security2:error] [pid 831031:tid 831185] [client 93.86.49.238:12760] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdSpnU1ySsD4Tkeg4R1gAAAaY"]
[Sat Jul 18 23:14:50.523910 2026] [security2:error] [pid 831031:tid 831128] [remote 31.42.184.154:56258] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "myspineworld.com"] [uri "/wp-login.php"] [unique_id "alxdSpnU1ySsD4Tkeg4R2QABlV8"], referer: https://myspineworld.com/wp-login.php
[Sat Jul 18 23:14:51.038926 2026] [security2:error] [pid 831031:tid 831217] [client 74.7.230.34:58670] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "cloudspacesgroup.com"] [uri "/index.php"] [unique_id "alxdSpnU1ySsD4Tkeg4RvgABxjo"]
[Sat Jul 18 23:14:51.912231 2026] [security2:error] [pid 831031:tid 831174] [client 50.116.65.227:41456] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Jin-Wee-Feature-Image.jpg"] [unique_id "alxdS5nU1ySsD4Tkeg4SDwAAAZs"]
[Sat Jul 18 23:14:51.924083 2026] [security2:error] [pid 831031:tid 831199] [client 50.116.65.227:43140] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Jin-Wee-Feature-Image.jpg"] [unique_id "alxdS5nU1ySsD4Tkeg4SEQAAAbI"]
[Sat Jul 18 23:14:52.175504 2026] [core:error] [pid 831031:tid 831187] [client 207.241.173.67:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:14:52.175686 2026] [core:error] [pid 831031:tid 831187] [client 207.241.173.67:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:14:52.267609 2026] [security2:error] [pid 830701:tid 830920] [client 27.34.68.67:55951] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdTMu1nEoSSDHiOXa3JgAAAWM"]
[Sat Jul 18 23:14:52.267708 2026] [security2:error] [pid 830701:tid 830920] [client 27.34.68.67:55951] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdTMu1nEoSSDHiOXa3JgAAAWM"]
[Sat Jul 18 23:14:52.303771 2026] [security2:error] [pid 831031:tid 831288] [client 54.184.226.94:4368] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "TRACE" at REQUEST_METHOD. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "52"] [id "340002"] [rev "3"] [msg "Atomicorp.com WAF Rules: TRACE/TRACK method denied"] [severity "CRITICAL"] [hostname "www.thecreole.com"] [uri "/"] [unique_id "alxdTJnU1ySsD4Tkeg4SJAAAAg0"]
[Sat Jul 18 23:14:52.341912 2026] [security2:error] [pid 831031:tid 831165] [client 54.184.226.94:9863] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "thecreole.com"] [uri "/"] [unique_id "alxdTJnU1ySsD4Tkeg4SKgAAAZI"]
[Sat Jul 18 23:14:52.416350 2026] [security2:error] [pid 831031:tid 831136] [remote 45.157.54.14:57615] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "jenfarley.com"] [uri "/xmlrpc.php"] [unique_id "alxdTJnU1ySsD4Tkeg4SLwACDGc"]
[Sat Jul 18 23:14:52.416478 2026] [security2:error] [pid 831031:tid 831287] [client 45.157.54.14:57615] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "jenfarley.com"] [uri "/xmlrpc.php"] [unique_id "alxdTJnU1ySsD4Tkeg4SLwACDGc"]
[Sat Jul 18 23:14:52.491509 2026] [autoindex:error] [pid 831031:tid 831109] [remote 164.68.113.190:0] AH01276: Cannot serve directory /home3/dbnvkfmy/public_html/nzfoodstory/wp-includes/IXR/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:14:52.644780 2026] [core:error] [pid 831031:tid 831188] [client 207.241.173.67:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:14:52.644802 2026] [core:error] [pid 831031:tid 831188] [client 207.241.173.67:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:14:52.645421 2026] [core:error] [pid 831031:tid 831180] [client 207.241.173.67:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:14:52.645440 2026] [core:error] [pid 831031:tid 831180] [client 207.241.173.67:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:14:53.436036 2026] [security2:error] [pid 831031:tid 831239] [client 119.154.81.234:62353] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdTZnU1ySsD4Tkeg4SZwAAAdw"]
[Sat Jul 18 23:14:53.436150 2026] [security2:error] [pid 831031:tid 831239] [client 119.154.81.234:62353] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdTZnU1ySsD4Tkeg4SZwAAAdw"]
[Sat Jul 18 23:14:53.627250 2026] [security2:error] [pid 831031:tid 831163] [client 54.184.226.94:9308] ModSecurity: Access denied with code 429 (phase 2). Pattern match "Googlebot[\\\\/-]" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/google.conf"] [line "3"] [id "901003"] [msg "Googlebot Crawler 429 ADDED BY MONITORING DO NOT WHITELIST"] [hostname "www.thecreole.com"] [uri "/"] [unique_id "alxdTZnU1ySsD4Tkeg4ScQAAAZA"], referer: https://www.google.com/images/url
[Sat Jul 18 23:14:53.729397 2026] [security2:error] [pid 831031:tid 831165] [client 223.178.210.203:33254] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdTZnU1ySsD4Tkeg4SdAAAAZI"]
[Sat Jul 18 23:14:53.729523 2026] [security2:error] [pid 831031:tid 831165] [client 223.178.210.203:33254] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdTZnU1ySsD4Tkeg4SdAAAAZI"]
[Sat Jul 18 23:14:53.804479 2026] [security2:error] [pid 831031:tid 831214] [client 113.160.97.242:59961] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxdTZnU1ySsD4Tkeg4SdwAAAcM"]
[Sat Jul 18 23:14:54.020320 2026] [security2:error] [pid 831031:tid 831273] [client 91.211.133.27:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "itekphonerepair.com"] [uri "/index.php"] [unique_id "alxdS5nU1ySsD4Tkeg4SEAAAAf4"]
[Sat Jul 18 23:14:54.020929 2026] [security2:error] [pid 831031:tid 831191] [client 190.245.146.99:58461] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdTpnU1ySsD4Tkeg4SggAAAaw"]
[Sat Jul 18 23:14:54.027447 2026] [security2:error] [pid 831031:tid 831191] [client 190.245.146.99:58461] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdTpnU1ySsD4Tkeg4SggAAAaw"]
[Sat Jul 18 23:14:54.692322 2026] [security2:error] [pid 831031:tid 831058] [remote 41.186.86.12:46457] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "slutilities.com"] [uri "/wp-login.php"] [unique_id "alxdTpnU1ySsD4Tkeg4SmwABnxk"]
[Sat Jul 18 23:14:55.294968 2026] [security2:error] [pid 831031:tid 831040] [remote 154.120.133.86:12005] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 86.133.120.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "idigress.studio"] [uri "/wp-login.php"] [unique_id "alxdT5nU1ySsD4Tkeg4SsgABjwc"]
[Sat Jul 18 23:14:55.349775 2026] [security2:error] [pid 831031:tid 831066] [remote 41.186.86.12:46457] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "slutilities.com"] [uri "/wp-login.php"] [unique_id "alxdT5nU1ySsD4Tkeg4StgAB2CE"], referer: https://slutilities.com/wp-login.php
[Sat Jul 18 23:14:56.148631 2026] [security2:error] [pid 831031:tid 831086] [remote 154.120.133.86:12005] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 86.133.120.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "idigress.studio"] [uri "/wp-login.php"] [unique_id "alxdUJnU1ySsD4Tkeg4S4AABnTU"], referer: https://idigress.studio/wp-login.php
[Sat Jul 18 23:14:56.583508 2026] [autoindex:error] [pid 831031:tid 831044] [remote 164.68.113.190:0] AH01276: Cannot serve directory /home3/dbnvkfmy/public_html/nzfoodstory/wp-includes/images/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:14:56.836893 2026] [security2:error] [pid 831031:tid 831085] [remote 134.209.147.209:54952] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.147.209.134.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxdUJnU1ySsD4Tkeg4S-gABuTQ"]
[Sat Jul 18 23:14:56.837085 2026] [security2:error] [pid 831031:tid 831204] [client 134.209.147.209:54952] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxdUJnU1ySsD4Tkeg4S-gABuTQ"]
[Sat Jul 18 23:14:57.147645 2026] [security2:error] [pid 830701:tid 830739] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdUcu1nEoSSDHiOXa3hwABPSU"]
[Sat Jul 18 23:14:57.147829 2026] [security2:error] [pid 830701:tid 830882] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdUcu1nEoSSDHiOXa3hwABPSU"]
[Sat Jul 18 23:14:57.798299 2026] [security2:error] [pid 830701:tid 830712] [remote 31.42.184.154:57114] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxdUcu1nEoSSDHiOXa3jgABXgo"]
[Sat Jul 18 23:14:57.857046 2026] [autoindex:error] [pid 831031:tid 831087] [remote 164.68.113.190:0] AH01276: Cannot serve directory /home3/dbnvkfmy/public_html/nzfoodstory/wp-includes/PHPMailer/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:14:58.124652 2026] [security2:error] [pid 830701:tid 830748] [remote 31.42.184.154:57114] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxdUsu1nEoSSDHiOXa3kAABcC4"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:14:59.427869 2026] [security2:error] [pid 830701:tid 830778] [remote 152.53.111.131:51984] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.111.53.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "elevator-data.com"] [uri "/wp-login.php"] [unique_id "alxdU8u1nEoSSDHiOXa3qgABRUw"]
[Sat Jul 18 23:14:59.460355 2026] [security2:error] [pid 830701:tid 830832] [client 171.4.232.110:55123] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdU8u1nEoSSDHiOXa3qwAAAQs"]
[Sat Jul 18 23:14:59.460449 2026] [security2:error] [pid 830701:tid 830832] [client 171.4.232.110:55123] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdU8u1nEoSSDHiOXa3qwAAAQs"]
[Sat Jul 18 23:15:00.156287 2026] [security2:error] [pid 830701:tid 830788] [remote 152.53.111.131:51984] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.111.53.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "elevator-data.com"] [uri "/wp-login.php"] [unique_id "alxdVMu1nEoSSDHiOXa3tQABNlY"], referer: https://elevator-data.com/wp-login.php
[Sat Jul 18 23:15:00.390224 2026] [security2:error] [pid 830701:tid 830869] [client 223.185.61.63:21730] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdVMu1nEoSSDHiOXa3uQAAATA"]
[Sat Jul 18 23:15:00.390347 2026] [security2:error] [pid 830701:tid 830869] [client 223.185.61.63:21730] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdVMu1nEoSSDHiOXa3uQAAATA"]
[Sat Jul 18 23:15:00.454746 2026] [security2:error] [pid 831031:tid 831287] [client 2a06:98c0:3600::103:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "thierry-henry.fr"] [uri "/index.php"] [unique_id "alxdVJnU1ySsD4Tkeg4TqAACDAE"]
[Sat Jul 18 23:15:00.907770 2026] [security2:error] [pid 831031:tid 831210] [client 114.119.141.100:50403] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.thecreole.com"] [uri "/"] [unique_id "alxdVJnU1ySsD4Tkeg4TzwAAAb8"], referer: https://newstral.com/en/organisations/18141394
[Sat Jul 18 23:15:01.078673 2026] [security2:error] [pid 830701:tid 830950] [client 45.3.45.33:20231] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 33.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxdVcu1nEoSSDHiOXa3xQAAAYE"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:15:01.237114 2026] [security2:error] [pid 831031:tid 831047] [remote 167.235.147.177:53026] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^0$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "96"] [id "392301"] [rev "7"] [msg "Atomicorp.com WAF Rules: Request Containing Content, but Missing Content-Type header"] [severity "NOTICE"] [tag "no_ar"] [hostname "sprine-hareware-prows.psiphon3.com"] [uri "/inproxy-broker"] [unique_id "alxdVZnU1ySsD4Tkeg4T2AACBg4"]
[Sat Jul 18 23:15:01.682582 2026] [security2:error] [pid 831031:tid 831236] [client 93.86.49.238:11011] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 238.49.86.93.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdVZnU1ySsD4Tkeg4T6wAAAdk"]
[Sat Jul 18 23:15:01.685009 2026] [security2:error] [pid 831031:tid 831236] [client 93.86.49.238:11011] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdVZnU1ySsD4Tkeg4T6wAAAdk"]
[Sat Jul 18 23:15:01.960245 2026] [security2:error] [pid 831031:tid 831066] [remote 157.66.47.83:54240] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxdVZnU1ySsD4Tkeg4T_QABsSE"]
[Sat Jul 18 23:15:01.960438 2026] [security2:error] [pid 831031:tid 831196] [client 157.66.47.83:54240] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxdVZnU1ySsD4Tkeg4T_QABsSE"]
[Sat Jul 18 23:15:02.623562 2026] [security2:error] [pid 831031:tid 831276] [client 54.89.16.186:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxdVpnU1ySsD4Tkeg4UEgACARw"]
[Sat Jul 18 23:15:02.879380 2026] [security2:error] [pid 830701:tid 830935] [client 27.34.68.67:48210] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdVsu1nEoSSDHiOXa35AAAAXI"]
[Sat Jul 18 23:15:02.879557 2026] [security2:error] [pid 830701:tid 830935] [client 27.34.68.67:48210] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdVsu1nEoSSDHiOXa35AAAAXI"]
[Sat Jul 18 23:15:03.690586 2026] [security2:error] [pid 831031:tid 831090] [remote 31.42.184.154:38166] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sk-financial.com"] [uri "/wp-login.php"] [unique_id "alxdV5nU1ySsD4Tkeg4USwABpzk"]
[Sat Jul 18 23:15:03.928298 2026] [security2:error] [pid 831031:tid 831103] [remote 31.42.184.154:38166] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sk-financial.com"] [uri "/wp-login.php"] [unique_id "alxdV5nU1ySsD4Tkeg4UVgABl0Y"], referer: https://sk-financial.com/wp-login.php
[Sat Jul 18 23:15:03.941474 2026] [security2:error] [pid 831031:tid 831284] [client 119.154.81.234:62766] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdV5nU1ySsD4Tkeg4UVwAAAgk"]
[Sat Jul 18 23:15:03.941559 2026] [security2:error] [pid 831031:tid 831284] [client 119.154.81.234:62766] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdV5nU1ySsD4Tkeg4UVwAAAgk"]
[Sat Jul 18 23:15:04.211496 2026] [security2:error] [pid 831031:tid 831111] [remote 167.235.147.177:53026] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^0$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "96"] [id "392301"] [rev "7"] [msg "Atomicorp.com WAF Rules: Request Containing Content, but Missing Content-Type header"] [severity "NOTICE"] [tag "no_ar"] [hostname "sprine-hareware-prows.psiphon3.com"] [uri "/inproxy-broker"] [unique_id "alxdWJnU1ySsD4Tkeg4UaQABr04"]
[Sat Jul 18 23:15:04.488799 2026] [security2:error] [pid 831031:tid 831197] [client 223.178.210.203:30529] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdWJnU1ySsD4Tkeg4UbQAAAbI"]
[Sat Jul 18 23:15:04.488912 2026] [security2:error] [pid 831031:tid 831197] [client 223.178.210.203:30529] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdWJnU1ySsD4Tkeg4UbQAAAbI"]
[Sat Jul 18 23:15:04.536437 2026] [security2:error] [pid 831031:tid 831192] [client 190.245.146.99:58969] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdWJnU1ySsD4Tkeg4UcQAAAa0"]
[Sat Jul 18 23:15:04.539709 2026] [security2:error] [pid 831031:tid 831192] [client 190.245.146.99:58969] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdWJnU1ySsD4Tkeg4UcQAAAa0"]
[Sat Jul 18 23:15:04.725222 2026] [autoindex:error] [pid 831031:tid 831128] [remote 164.68.113.190:0] AH01276: Cannot serve directory /home3/dbnvkfmy/public_html/nzfoodstory/wp-includes/pomo/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:15:06.175901 2026] [security2:error] [pid 830701:tid 830947] [client 45.3.45.142:49305] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "155"] [id "900406"] [msg "wp-login POST logging"] [data "200"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxdWMu1nEoSSDHiOXa3_wAAAX4"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:15:06.362401 2026] [security2:error] [pid 831031:tid 831074] [remote 167.235.147.177:53026] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^0$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "96"] [id "392301"] [rev "7"] [msg "Atomicorp.com WAF Rules: Request Containing Content, but Missing Content-Type header"] [severity "NOTICE"] [tag "no_ar"] [hostname "sprine-hareware-prows.psiphon3.com"] [uri "/inproxy-broker"] [unique_id "alxdWpnU1ySsD4Tkeg4UvAABtSk"]
[Sat Jul 18 23:15:06.526215 2026] [security2:error] [pid 831031:tid 831283] [client 65.0.26.70:20416] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.26.0.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxdWpnU1ySsD4Tkeg4UxAAAAgg"]
[Sat Jul 18 23:15:06.526299 2026] [security2:error] [pid 831031:tid 831283] [client 65.0.26.70:20416] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxdWpnU1ySsD4Tkeg4UxAAAAgg"]
[Sat Jul 18 23:15:06.800959 2026] [security2:error] [pid 831031:tid 831156] [remote 97.74.93.24:47056] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "worbals.com"] [uri "/wp-login.php"] [unique_id "alxdWpnU1ySsD4Tkeg4U0QAB0Xs"]
[Sat Jul 18 23:15:07.182545 2026] [security2:error] [pid 831031:tid 831134] [remote 97.74.93.24:47056] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "worbals.com"] [uri "/wp-login.php"] [unique_id "alxdW5nU1ySsD4Tkeg4U6AABv2U"], referer: https://worbals.com/wp-login.php
[Sat Jul 18 23:15:07.582335 2026] [security2:error] [pid 830701:tid 830757] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdW8u1nEoSSDHiOXa4NQABQDc"]
[Sat Jul 18 23:15:07.582490 2026] [security2:error] [pid 830701:tid 830885] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdW8u1nEoSSDHiOXa4NQABQDc"]
[Sat Jul 18 23:15:07.764017 2026] [security2:error] [pid 830701:tid 830835] [client 5.193.175.36:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "maxcom.net"] [uri "/index.php"] [unique_id "alxdW8u1nEoSSDHiOXa4NgAAAQ4"]
[Sat Jul 18 23:15:07.771370 2026] [security2:error] [pid 830701:tid 830759] [remote 4.205.168.44:58810] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory-com.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxdW8u1nEoSSDHiOXa4PQABNjk"]
[Sat Jul 18 23:15:08.288486 2026] [security2:error] [pid 830701:tid 830789] [remote 4.205.168.44:58810] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory-com.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxdXMu1nEoSSDHiOXa4RAABXlc"], referer: https://nzfoodstory-com.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:15:09.073882 2026] [security2:error] [pid 831031:tid 831182] [client 138.0.247.157:44500] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 157.247.0.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "claysharecon.com"] [uri "/xmlrpc.php"] [unique_id "alxdXZnU1ySsD4Tkeg4VPQAAAaM"]
[Sat Jul 18 23:15:09.074049 2026] [security2:error] [pid 831031:tid 831182] [client 138.0.247.157:44500] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "claysharecon.com"] [uri "/xmlrpc.php"] [unique_id "alxdXZnU1ySsD4Tkeg4VPQAAAaM"]
[Sat Jul 18 23:15:09.086639 2026] [security2:error] [pid 831031:tid 831070] [remote 104.131.116.82:56812] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.116.131.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxdXZnU1ySsD4Tkeg4VPgAB8CU"]
[Sat Jul 18 23:15:09.673531 2026] [security2:error] [pid 831031:tid 831061] [remote 104.131.116.82:56812] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.116.131.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxdXZnU1ySsD4Tkeg4VUgABmBw"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:15:10.089911 2026] [security2:error] [pid 831031:tid 831233] [client 124.29.207.185:51050] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdXpnU1ySsD4Tkeg4VbgAAAdY"]
[Sat Jul 18 23:15:10.090058 2026] [security2:error] [pid 831031:tid 831233] [client 124.29.207.185:51050] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdXpnU1ySsD4Tkeg4VbgAAAdY"]
[Sat Jul 18 23:15:10.144351 2026] [security2:error] [pid 830701:tid 830942] [client 171.4.232.110:55624] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdXsu1nEoSSDHiOXa4YAAAAXk"]
[Sat Jul 18 23:15:10.144473 2026] [security2:error] [pid 830701:tid 830942] [client 171.4.232.110:55624] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdXsu1nEoSSDHiOXa4YAAAAXk"]
[Sat Jul 18 23:15:10.885514 2026] [security2:error] [pid 831031:tid 831174] [client 223.185.61.63:30345] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdXpnU1ySsD4Tkeg4VjQAAAZs"]
[Sat Jul 18 23:15:10.885674 2026] [security2:error] [pid 831031:tid 831174] [client 223.185.61.63:30345] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdXpnU1ySsD4Tkeg4VjQAAAZs"]
[Sat Jul 18 23:15:11.290272 2026] [security2:error] [pid 831031:tid 831196] [client 65.0.26.70:63698] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.26.0.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxdX5nU1ySsD4Tkeg4VmwAAAbE"]
[Sat Jul 18 23:15:11.290370 2026] [security2:error] [pid 831031:tid 831196] [client 65.0.26.70:63698] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxdX5nU1ySsD4Tkeg4VmwAAAbE"]
[Sat Jul 18 23:15:11.365685 2026] [security2:error] [pid 831031:tid 831228] [client 47.128.34.234:48414] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "hammadownenterprises.com"] [uri "/robots.txt"] [unique_id "alxdX5nU1ySsD4Tkeg4VpgAAAdE"]
[Sat Jul 18 23:15:11.968719 2026] [security2:error] [pid 831031:tid 831256] [client 65.111.28.38:36399] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 38.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxdX5nU1ySsD4Tkeg4VyAAAAe0"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:15:12.782232 2026] [security2:error] [pid 830701:tid 830887] [client 4.194.24.143:22555] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/nine2code.php"] [unique_id "alxdYMu1nEoSSDHiOXa4jQAAAUI"]
[Sat Jul 18 23:15:12.850406 2026] [security2:error] [pid 831031:tid 831203] [client 34.228.124.71:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxdYJnU1ySsD4Tkeg4V6AABuHI"]
[Sat Jul 18 23:15:13.075802 2026] [security2:error] [pid 830701:tid 830859] [client 57.141.18.63:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxdYMu1nEoSSDHiOXa4jwAAASY"]
[Sat Jul 18 23:15:13.160180 2026] [security2:error] [pid 830701:tid 830955] [client 93.86.49.238:24945] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 238.49.86.93.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdYcu1nEoSSDHiOXa4mAAAAYY"]
[Sat Jul 18 23:15:13.160260 2026] [security2:error] [pid 830701:tid 830955] [client 93.86.49.238:24945] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdYcu1nEoSSDHiOXa4mAAAAYY"]
[Sat Jul 18 23:15:13.328539 2026] [security2:error] [pid 831031:tid 831210] [client 4.194.24.143:52379] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/num.php"] [unique_id "alxdYZnU1ySsD4Tkeg4WBgAAAb8"]
[Sat Jul 18 23:15:13.441941 2026] [security2:error] [pid 830701:tid 830839] [client 65.111.28.128:24019] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxdYcu1nEoSSDHiOXa4mQAAARI"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:15:13.479261 2026] [security2:error] [pid 830701:tid 830957] [client 27.34.68.67:30127] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdYcu1nEoSSDHiOXa4nAAAAYg"]
[Sat Jul 18 23:15:13.479408 2026] [security2:error] [pid 830701:tid 830957] [client 27.34.68.67:30127] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdYcu1nEoSSDHiOXa4nAAAAYg"]
[Sat Jul 18 23:15:13.509894 2026] [security2:error] [pid 831031:tid 831289] [client 3.108.60.216:50808] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxdYZnU1ySsD4Tkeg4WDQAAAg4"]
[Sat Jul 18 23:15:13.510013 2026] [security2:error] [pid 831031:tid 831289] [client 3.108.60.216:50808] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxdYZnU1ySsD4Tkeg4WDQAAAg4"]
[Sat Jul 18 23:15:13.575541 2026] [security2:error] [pid 831031:tid 831153] [remote 188.138.102.156:56570] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory-com.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxdYZnU1ySsD4Tkeg4WEAAByXg"]
[Sat Jul 18 23:15:13.881348 2026] [security2:error] [pid 831031:tid 831231] [client 4.194.24.143:37468] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/odf7udtspqtpxzyxmw2rccdefault.php"] [unique_id "alxdYZnU1ySsD4Tkeg4WIwAAAdQ"]
[Sat Jul 18 23:15:14.446436 2026] [security2:error] [pid 831031:tid 831263] [client 4.194.24.143:59994] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/option.php"] [unique_id "alxdYpnU1ySsD4Tkeg4WPwAAAfQ"]
[Sat Jul 18 23:15:14.461280 2026] [security2:error] [pid 831031:tid 831152] [remote 188.138.102.156:56570] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory-com.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxdYpnU1ySsD4Tkeg4WQQABnHc"], referer: https://nzfoodstory-com.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:15:14.495083 2026] [security2:error] [pid 831031:tid 831229] [client 119.154.81.234:63206] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdYpnU1ySsD4Tkeg4WRwAAAdI"]
[Sat Jul 18 23:15:14.495217 2026] [security2:error] [pid 831031:tid 831229] [client 119.154.81.234:63206] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdYpnU1ySsD4Tkeg4WRwAAAdI"]
[Sat Jul 18 23:15:14.791904 2026] [security2:error] [pid 831031:tid 831177] [client 57.141.18.93:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxdYpnU1ySsD4Tkeg4WTQAAAZ4"]
[Sat Jul 18 23:15:14.989882 2026] [security2:error] [pid 830701:tid 830891] [client 223.178.210.203:18731] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdYsu1nEoSSDHiOXa4tQAAAUY"]
[Sat Jul 18 23:15:14.990021 2026] [security2:error] [pid 830701:tid 830891] [client 223.178.210.203:18731] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdYsu1nEoSSDHiOXa4tQAAAUY"]
[Sat Jul 18 23:15:14.991133 2026] [security2:error] [pid 831031:tid 831276] [client 4.194.24.143:37470] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/p.php"] [unique_id "alxdYpnU1ySsD4Tkeg4WYQAAAgE"]
[Sat Jul 18 23:15:15.006266 2026] [security2:error] [pid 831031:tid 831215] [client 190.245.146.99:59479] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdY5nU1ySsD4Tkeg4WYgAAAcQ"]
[Sat Jul 18 23:15:15.006371 2026] [security2:error] [pid 831031:tid 831215] [client 190.245.146.99:59479] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdY5nU1ySsD4Tkeg4WYgAAAcQ"]
[Sat Jul 18 23:15:15.536141 2026] [security2:error] [pid 831031:tid 831244] [client 4.194.24.143:59982] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/past.php"] [unique_id "alxdY5nU1ySsD4Tkeg4WdQAAAeE"]
[Sat Jul 18 23:15:15.831913 2026] [security2:error] [pid 830701:tid 830866] [client 114.119.145.192:30821] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "elite-pk.com"] [uri "/robots.txt"] [unique_id "alxdY8u1nEoSSDHiOXa4yQAAAS0"], referer: http://elite-pk.com/robots.txt
[Sat Jul 18 23:15:16.134939 2026] [security2:error] [pid 830701:tid 830893] [client 4.194.24.143:52410] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/php.php"] [unique_id "alxdZMu1nEoSSDHiOXa41QAAAUg"]
[Sat Jul 18 23:15:16.731315 2026] [security2:error] [pid 830701:tid 830934] [client 4.194.24.143:22586] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/php8.php"] [unique_id "alxdZMu1nEoSSDHiOXa46AAAAXE"]
[Sat Jul 18 23:15:17.048930 2026] [autoindex:error] [pid 831031:tid 831101] [remote 164.68.113.190:0] AH01276: Cannot serve directory /home3/dbnvkfmy/public_html/nzfoodstory/wp-includes/js/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:15:17.288699 2026] [security2:error] [pid 830701:tid 830891] [client 4.194.24.143:20583] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/phpinfo.php"] [unique_id "alxdZcu1nEoSSDHiOXa47wAAAUY"]
[Sat Jul 18 23:15:17.636435 2026] [security2:error] [pid 831031:tid 831180] [client 45.3.45.245:45057] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 245.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxdZZnU1ySsD4Tkeg4W0gAAAaE"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:15:17.924986 2026] [security2:error] [pid 831031:tid 831274] [client 65.111.28.152:40033] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 152.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxdZZnU1ySsD4Tkeg4W5AAAAf8"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:15:18.082363 2026] [security2:error] [pid 831031:tid 831253] [client 4.194.24.143:28706] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/post.php"] [unique_id "alxdZpnU1ySsD4Tkeg4W9AAAAeo"]
[Sat Jul 18 23:15:18.164973 2026] [security2:error] [pid 831031:tid 831105] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdZpnU1ySsD4Tkeg4W-QAB0Eg"]
[Sat Jul 18 23:15:18.165127 2026] [security2:error] [pid 831031:tid 831227] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdZpnU1ySsD4Tkeg4W-QAB0Eg"]
[Sat Jul 18 23:15:18.649401 2026] [security2:error] [pid 831031:tid 831236] [client 4.194.24.143:21762] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/public/assets/design_1/css/parts/course_cards/grid_card_1.min.php"] [unique_id "alxdZpnU1ySsD4Tkeg4XDwAAAdk"]
[Sat Jul 18 23:15:18.722122 2026] [security2:error] [pid 831031:tid 831213] [client 138.0.247.157:44570] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 157.247.0.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "claysharecon.com"] [uri "/xmlrpc.php"] [unique_id "alxdZpnU1ySsD4Tkeg4XFAAAAcI"]
[Sat Jul 18 23:15:18.722216 2026] [security2:error] [pid 831031:tid 831213] [client 138.0.247.157:44570] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "claysharecon.com"] [uri "/xmlrpc.php"] [unique_id "alxdZpnU1ySsD4Tkeg4XFAAAAcI"]
[Sat Jul 18 23:15:19.219579 2026] [security2:error] [pid 830701:tid 830855] [client 4.194.24.143:27453] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/public/css.php"] [unique_id "alxdZ8u1nEoSSDHiOXa5EgAAASI"]
[Sat Jul 18 23:15:19.434328 2026] [security2:error] [pid 830701:tid 830947] [client 18.139.208.24:38142] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.208.139.18.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxdZ8u1nEoSSDHiOXa5HgAAAX4"]
[Sat Jul 18 23:15:19.434499 2026] [security2:error] [pid 830701:tid 830947] [client 18.139.208.24:38142] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxdZ8u1nEoSSDHiOXa5HgAAAX4"]
[Sat Jul 18 23:15:19.792536 2026] [security2:error] [pid 831031:tid 831268] [client 4.194.24.143:28713] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/r.php"] [unique_id "alxdZ5nU1ySsD4Tkeg4XPAAAAfk"]
[Sat Jul 18 23:15:20.125400 2026] [security2:error] [pid 831031:tid 831271] [client 124.29.207.185:51506] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdaJnU1ySsD4Tkeg4XWgAAAfw"]
[Sat Jul 18 23:15:20.125917 2026] [security2:error] [pid 831031:tid 831271] [client 124.29.207.185:51506] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdaJnU1ySsD4Tkeg4XWgAAAfw"]
[Sat Jul 18 23:15:20.340305 2026] [security2:error] [pid 831031:tid 831199] [client 4.194.24.143:20560] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/radio.php"] [unique_id "alxdaJnU1ySsD4Tkeg4XXwAAAbQ"]
[Sat Jul 18 23:15:20.364565 2026] [ssl:error] [pid 830701:tid 830877] [client 98.88.137.2:46043] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname autodiscover.jrconsultores.org provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:15:20.420919 2026] [security2:error] [pid 830701:tid 830803] [remote 31.42.184.154:38564] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.grndl.com"] [uri "/xmlrpc.php"] [unique_id "alxdaMu1nEoSSDHiOXa5OgABT2U"]
[Sat Jul 18 23:15:20.421093 2026] [security2:error] [pid 830701:tid 830900] [client 31.42.184.154:38564] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "mail.grndl.com"] [uri "/xmlrpc.php"] [unique_id "alxdaMu1nEoSSDHiOXa5OgABT2U"]
[Sat Jul 18 23:15:20.488647 2026] [security2:error] [pid 831031:tid 831219] [client 31.171.130.18:40483] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/ms-themes.php"] [unique_id "alxdaJnU1ySsD4Tkeg4XZgAAAcg"]
[Sat Jul 18 23:15:20.523047 2026] [security2:error] [pid 831031:tid 831200] [client 31.171.130.26:21357] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/ms-themes.php"] [unique_id "alxdaJnU1ySsD4Tkeg4XaAAAAbU"]
[Sat Jul 18 23:15:20.534377 2026] [security2:error] [pid 830701:tid 830865] [client 31.171.130.28:32641] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/ms-themes.php"] [unique_id "alxdaMu1nEoSSDHiOXa5PQAAASw"]
[Sat Jul 18 23:15:20.539963 2026] [security2:error] [pid 831031:tid 831287] [client 31.171.130.40:34069] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/ms-themes.php"] [unique_id "alxdaJnU1ySsD4Tkeg4XagAAAgw"]
[Sat Jul 18 23:15:20.540161 2026] [security2:error] [pid 830701:tid 830912] [client 31.171.130.7:34667] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/ms-themes.php"] [unique_id "alxdaMu1nEoSSDHiOXa5PgAAAVs"]
[Sat Jul 18 23:15:20.550123 2026] [security2:error] [pid 831031:tid 831228] [client 31.171.130.5:36641] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/ms-themes.php"] [unique_id "alxdaJnU1ySsD4Tkeg4XawAAAdE"]
[Sat Jul 18 23:15:20.551690 2026] [security2:error] [pid 831031:tid 831259] [client 31.171.130.38:48473] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/ms-themes.php"] [unique_id "alxdaJnU1ySsD4Tkeg4XbAAAAfA"]
[Sat Jul 18 23:15:20.587901 2026] [security2:error] [pid 831031:tid 831188] [client 31.171.130.16:46813] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/ms-themes.php"] [unique_id "alxdaJnU1ySsD4Tkeg4XbQAAAak"]
[Sat Jul 18 23:15:20.610945 2026] [security2:error] [pid 830701:tid 830904] [client 31.171.130.46:35835] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/ms-themes.php"] [unique_id "alxdaMu1nEoSSDHiOXa5PwAAAVM"]
[Sat Jul 18 23:15:20.733247 2026] [security2:error] [pid 830701:tid 830813] [remote 164.52.120.6:4880] ModSecurity: Access denied with code 406 (phase 2). Match of "beginsWith %{request_headers.host}" against "TX:1" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "504"] [id "340162"] [rev "302"] [msg "Atomicorp.com WAF Rules: Remote File Injection Attack detected (Unauthorized URL detected as argument)"] [data ",TX:1"] [severity "CRITICAL"] [hostname "mollycahill.com"] [uri "/"] [unique_id "alxdaMu1nEoSSDHiOXa5QQABTG8"]
[Sat Jul 18 23:15:20.950585 2026] [security2:error] [pid 830701:tid 830848] [client 4.194.24.143:21792] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/randkeyword.php7"] [unique_id "alxdaMu1nEoSSDHiOXa5SwAAARs"]
[Sat Jul 18 23:15:20.991433 2026] [security2:error] [pid 830701:tid 830954] [client 31.171.130.12:39199] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/chosen.php"] [unique_id "alxdaMu1nEoSSDHiOXa5TAAAAYU"]
[Sat Jul 18 23:15:21.012650 2026] [security2:error] [pid 831031:tid 831198] [client 31.171.130.28:59085] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/chosen.php"] [unique_id "alxdaZnU1ySsD4Tkeg4XgwAAAbM"]
[Sat Jul 18 23:15:21.026755 2026] [security2:error] [pid 831031:tid 831209] [client 171.4.232.110:34875] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdaZnU1ySsD4Tkeg4XjwAAAb4"]
[Sat Jul 18 23:15:21.026837 2026] [security2:error] [pid 831031:tid 831209] [client 171.4.232.110:34875] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdaZnU1ySsD4Tkeg4XjwAAAb4"]
[Sat Jul 18 23:15:21.039384 2026] [security2:error] [pid 831031:tid 831237] [client 31.171.130.20:30211] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/chosen.php"] [unique_id "alxdaZnU1ySsD4Tkeg4XkQAAAdo"]
[Sat Jul 18 23:15:21.056230 2026] [security2:error] [pid 830701:tid 830861] [client 31.171.130.49:63303] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/chosen.php"] [unique_id "alxdacu1nEoSSDHiOXa5TQAAASg"]
[Sat Jul 18 23:15:21.067506 2026] [security2:error] [pid 830701:tid 830883] [client 31.171.130.48:37049] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/chosen.php"] [unique_id "alxdacu1nEoSSDHiOXa5TgAAAT4"]
[Sat Jul 18 23:15:21.067774 2026] [security2:error] [pid 831031:tid 831266] [client 31.171.130.38:30181] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/chosen.php"] [unique_id "alxdaZnU1ySsD4Tkeg4XkgAAAfc"]
[Sat Jul 18 23:15:21.072643 2026] [security2:error] [pid 830701:tid 830878] [client 31.171.130.34:42429] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/chosen.php"] [unique_id "alxdacu1nEoSSDHiOXa5TwAAATk"]
[Sat Jul 18 23:15:21.096881 2026] [security2:error] [pid 831031:tid 831182] [client 31.171.130.1:61399] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/chosen.php"] [unique_id "alxdaZnU1ySsD4Tkeg4XpAAAAaM"]
[Sat Jul 18 23:15:21.114861 2026] [security2:error] [pid 831031:tid 831236] [client 31.171.130.29:37953] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/chosen.php"] [unique_id "alxdaZnU1ySsD4Tkeg4XpgAAAdk"]
[Sat Jul 18 23:15:21.501970 2026] [security2:error] [pid 831031:tid 831193] [client 4.194.24.143:28714] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/readme.php"] [unique_id "alxdaZnU1ySsD4Tkeg4XtwAAAa4"]
[Sat Jul 18 23:15:21.504904 2026] [security2:error] [pid 830701:tid 830871] [client 223.185.61.63:8207] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdacu1nEoSSDHiOXa5XgAAATI"]
[Sat Jul 18 23:15:21.505008 2026] [security2:error] [pid 830701:tid 830871] [client 223.185.61.63:8207] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdacu1nEoSSDHiOXa5XgAAATI"]
[Sat Jul 18 23:15:21.537537 2026] [security2:error] [pid 830701:tid 830827] [remote 188.138.102.156:49964] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "justinagrayman.com"] [uri "/wp-login.php"] [unique_id "alxdacu1nEoSSDHiOXa5YAABIX0"]
[Sat Jul 18 23:15:21.575521 2026] [security2:error] [pid 831031:tid 831188] [client 31.171.130.26:52727] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/file.php"] [unique_id "alxdaZnU1ySsD4Tkeg4XvwAAAak"]
[Sat Jul 18 23:15:21.589247 2026] [security2:error] [pid 831031:tid 831284] [client 31.171.130.6:34407] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/file.php"] [unique_id "alxdaZnU1ySsD4Tkeg4XwQAAAgk"]
[Sat Jul 18 23:15:21.608237 2026] [security2:error] [pid 830701:tid 830940] [client 31.171.130.30:37503] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/file.php"] [unique_id "alxdacu1nEoSSDHiOXa5YQAAAXc"]
[Sat Jul 18 23:15:21.624907 2026] [security2:error] [pid 831031:tid 831253] [client 31.171.130.28:38675] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/file.php"] [unique_id "alxdaZnU1ySsD4Tkeg4XwgAAAeo"]
[Sat Jul 18 23:15:21.640942 2026] [security2:error] [pid 831031:tid 831251] [client 31.171.130.49:51615] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/file.php"] [unique_id "alxdaZnU1ySsD4Tkeg4XxAAAAeg"]
[Sat Jul 18 23:15:21.646116 2026] [security2:error] [pid 830701:tid 830849] [client 31.171.130.48:63067] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/file.php"] [unique_id "alxdacu1nEoSSDHiOXa5YgAAARw"]
[Sat Jul 18 23:15:21.660083 2026] [security2:error] [pid 830701:tid 830953] [client 31.171.130.3:31593] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/file.php"] [unique_id "alxdacu1nEoSSDHiOXa5YwAAAYQ"]
[Sat Jul 18 23:15:21.660083 2026] [security2:error] [pid 831031:tid 831260] [client 31.171.130.18:23675] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/file.php"] [unique_id "alxdaZnU1ySsD4Tkeg4XxQAAAfE"]
[Sat Jul 18 23:15:21.696208 2026] [security2:error] [pid 830701:tid 830879] [client 31.171.130.39:49071] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/file.php"] [unique_id "alxdacu1nEoSSDHiOXa5ZAAAATo"]
[Sat Jul 18 23:15:22.061801 2026] [security2:error] [pid 831031:tid 831276] [client 4.194.24.143:20551] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/reze.php"] [unique_id "alxdapnU1ySsD4Tkeg4X1gAAAgE"]
[Sat Jul 18 23:15:22.160060 2026] [security2:error] [pid 831031:tid 831182] [client 31.171.130.40:32789] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/flower.php"] [unique_id "alxdapnU1ySsD4Tkeg4X4gAAAaM"]
[Sat Jul 18 23:15:22.165884 2026] [security2:error] [pid 830701:tid 830877] [client 31.171.130.37:53315] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/flower.php"] [unique_id "alxdasu1nEoSSDHiOXa5bAAAATg"]
[Sat Jul 18 23:15:22.193327 2026] [security2:error] [pid 830701:tid 830723] [remote 188.138.102.156:49964] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "justinagrayman.com"] [uri "/wp-login.php"] [unique_id "alxdasu1nEoSSDHiOXa5bgABUBU"], referer: https://justinagrayman.com/wp-login.php
[Sat Jul 18 23:15:22.194017 2026] [security2:error] [pid 830701:tid 830921] [client 31.171.130.24:21771] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/flower.php"] [unique_id "alxdasu1nEoSSDHiOXa5bwAAAWQ"]
[Sat Jul 18 23:15:22.223991 2026] [security2:error] [pid 831031:tid 831205] [client 31.171.130.24:32199] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/flower.php"] [unique_id "alxdapnU1ySsD4Tkeg4X5QAAAbo"]
[Sat Jul 18 23:15:22.225635 2026] [security2:error] [pid 831031:tid 831218] [client 31.171.130.9:36867] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/flower.php"] [unique_id "alxdapnU1ySsD4Tkeg4X5gAAAcc"]
[Sat Jul 18 23:15:22.234948 2026] [security2:error] [pid 831031:tid 831171] [client 31.171.130.11:42333] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/flower.php"] [unique_id "alxdapnU1ySsD4Tkeg4X6AAAAZg"]
[Sat Jul 18 23:15:22.235852 2026] [security2:error] [pid 830701:tid 830865] [client 31.171.130.31:58365] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/flower.php"] [unique_id "alxdasu1nEoSSDHiOXa5cwAAASw"]
[Sat Jul 18 23:15:22.246088 2026] [security2:error] [pid 830701:tid 830852] [client 31.171.130.16:25887] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/flower.php"] [unique_id "alxdasu1nEoSSDHiOXa5dAAAAR8"]
[Sat Jul 18 23:15:22.258214 2026] [security2:error] [pid 831031:tid 831208] [client 31.171.130.2:63567] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/flower.php"] [unique_id "alxdapnU1ySsD4Tkeg4X6wAAAb0"]
[Sat Jul 18 23:15:22.659290 2026] [security2:error] [pid 830701:tid 830926] [client 4.194.24.143:20591] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/rh.php"] [unique_id "alxdasu1nEoSSDHiOXa5ewAAAWk"]
[Sat Jul 18 23:15:22.712792 2026] [security2:error] [pid 831031:tid 831183] [client 31.171.130.25:55997] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/gifclass.php"] [unique_id "alxdapnU1ySsD4Tkeg4YFAAAAaQ"]
[Sat Jul 18 23:15:22.717034 2026] [security2:error] [pid 831031:tid 831165] [client 31.171.130.16:65247] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/gifclass.php"] [unique_id "alxdapnU1ySsD4Tkeg4YFQAAAZI"]
[Sat Jul 18 23:15:22.721267 2026] [security2:error] [pid 831031:tid 831286] [client 31.171.130.14:34885] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/gifclass.php"] [unique_id "alxdapnU1ySsD4Tkeg4YFgAAAgs"]
[Sat Jul 18 23:15:22.756642 2026] [security2:error] [pid 830701:tid 830838] [client 31.171.130.40:25869] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/gifclass.php"] [unique_id "alxdasu1nEoSSDHiOXa5fQAAARE"]
[Sat Jul 18 23:15:22.762861 2026] [security2:error] [pid 831031:tid 831280] [client 31.171.130.10:61299] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/gifclass.php"] [unique_id "alxdapnU1ySsD4Tkeg4YGQAAAgU"]
[Sat Jul 18 23:15:22.770746 2026] [security2:error] [pid 831031:tid 831222] [client 31.171.130.21:28703] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/gifclass.php"] [unique_id "alxdapnU1ySsD4Tkeg4YGgAAAcs"]
[Sat Jul 18 23:15:22.804673 2026] [security2:error] [pid 830701:tid 830914] [client 31.171.130.52:54985] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/gifclass.php"] [unique_id "alxdasu1nEoSSDHiOXa5fwAAAV0"]
[Sat Jul 18 23:15:22.804876 2026] [security2:error] [pid 830701:tid 830907] [client 31.171.130.47:56397] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/gifclass.php"] [unique_id "alxdasu1nEoSSDHiOXa5fgAAAVY"]
[Sat Jul 18 23:15:22.812430 2026] [security2:error] [pid 831031:tid 831262] [client 31.171.130.14:32149] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/gifclass.php"] [unique_id "alxdapnU1ySsD4Tkeg4YHAAAAfM"]
[Sat Jul 18 23:15:22.931040 2026] [ssl:error] [pid 831031:tid 831180] [client 98.84.1.175:47350] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname whm.website-41aebdfc.msd.mqz.mybluehost.me provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:15:23.213987 2026] [security2:error] [pid 831031:tid 831163] [client 4.194.24.143:28715] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/rip.php"] [unique_id "alxda5nU1ySsD4Tkeg4YOAAAAZA"]
[Sat Jul 18 23:15:23.257480 2026] [security2:error] [pid 831031:tid 831244] [client 18.205.180.59:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxda5nU1ySsD4Tkeg4YNgAB4Wc"]
[Sat Jul 18 23:15:23.264933 2026] [security2:error] [pid 831031:tid 831272] [client 31.171.130.21:22213] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/bless.php"] [unique_id "alxda5nU1ySsD4Tkeg4YOQAAAf0"]
[Sat Jul 18 23:15:23.285651 2026] [security2:error] [pid 831031:tid 831224] [client 31.171.130.16:59699] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/bless.php"] [unique_id "alxda5nU1ySsD4Tkeg4YOwAAAc0"]
[Sat Jul 18 23:15:23.286448 2026] [security2:error] [pid 831031:tid 831213] [client 31.171.130.51:40171] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/bless.php"] [unique_id "alxda5nU1ySsD4Tkeg4YPAAAAcI"]
[Sat Jul 18 23:15:23.295794 2026] [security2:error] [pid 831031:tid 831229] [client 31.171.130.43:40581] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/bless.php"] [unique_id "alxda5nU1ySsD4Tkeg4YPQAAAdI"]
[Sat Jul 18 23:15:23.368078 2026] [security2:error] [pid 831031:tid 831162] [client 31.171.130.47:33089] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/bless.php"] [unique_id "alxda5nU1ySsD4Tkeg4YRAAAAY8"]
[Sat Jul 18 23:15:23.368673 2026] [security2:error] [pid 830701:tid 830945] [client 31.171.130.5:27503] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/bless.php"] [unique_id "alxda8u1nEoSSDHiOXa5iAAAAXw"]
[Sat Jul 18 23:15:23.368834 2026] [security2:error] [pid 830701:tid 830878] [client 31.171.130.21:45963] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/bless.php"] [unique_id "alxda8u1nEoSSDHiOXa5hwAAATk"]
[Sat Jul 18 23:15:23.776026 2026] [security2:error] [pid 831031:tid 831264] [client 31.171.130.33:36197] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/class-t.api.php"] [unique_id "alxda5nU1ySsD4Tkeg4YVgAAAfU"]
[Sat Jul 18 23:15:23.789126 2026] [security2:error] [pid 831031:tid 831237] [client 4.194.24.143:27433] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/root.php"] [unique_id "alxda5nU1ySsD4Tkeg4YVwAAAdo"]
[Sat Jul 18 23:15:23.836295 2026] [security2:error] [pid 831031:tid 831200] [client 31.171.130.52:47897] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/class-t.api.php"] [unique_id "alxda5nU1ySsD4Tkeg4YWQAAAbU"]
[Sat Jul 18 23:15:23.899464 2026] [security2:error] [pid 831031:tid 831166] [client 31.171.130.36:63765] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/class-t.api.php"] [unique_id "alxda5nU1ySsD4Tkeg4YXAAAAZM"]
[Sat Jul 18 23:15:23.931806 2026] [security2:error] [pid 831031:tid 831254] [client 31.171.130.48:42011] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/class-t.api.php"] [unique_id "alxda5nU1ySsD4Tkeg4YYwAAAes"]
[Sat Jul 18 23:15:23.980239 2026] [security2:error] [pid 831031:tid 831257] [client 31.171.130.51:46281] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/class-t.api.php"] [unique_id "alxda5nU1ySsD4Tkeg4YZwAAAe4"]
[Sat Jul 18 23:15:23.981309 2026] [security2:error] [pid 830701:tid 830719] [remote 31.42.184.154:51930] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-login.php"] [unique_id "alxda8u1nEoSSDHiOXa5kwABWRE"]
[Sat Jul 18 23:15:23.995739 2026] [security2:error] [pid 831031:tid 831286] [client 27.34.68.67:21384] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxda5nU1ySsD4Tkeg4YawAAAgs"]
[Sat Jul 18 23:15:23.995857 2026] [security2:error] [pid 831031:tid 831286] [client 27.34.68.67:21384] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxda5nU1ySsD4Tkeg4YawAAAgs"]
[Sat Jul 18 23:15:24.065112 2026] [security2:error] [pid 831031:tid 831210] [client 31.171.130.1:27057] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/class-t.api.php"] [unique_id "alxdbJnU1ySsD4Tkeg4YcgAAAb8"]
[Sat Jul 18 23:15:24.073653 2026] [security2:error] [pid 831031:tid 831287] [client 31.171.130.37:64937] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/class-t.api.php"] [unique_id "alxdbJnU1ySsD4Tkeg4YdQAAAgw"]
[Sat Jul 18 23:15:24.347315 2026] [security2:error] [pid 831031:tid 831233] [client 4.194.24.143:28687] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/s.php"] [unique_id "alxdbJnU1ySsD4Tkeg4YhAAAAdY"]
[Sat Jul 18 23:15:24.394704 2026] [security2:error] [pid 831031:tid 831245] [client 31.171.130.40:52059] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/bless.php"] [unique_id "alxdbJnU1ySsD4Tkeg4YiQAAAeI"]
[Sat Jul 18 23:15:24.415297 2026] [security2:error] [pid 831031:tid 831186] [client 31.171.130.44:30701] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/blurbs.php"] [unique_id "alxdbJnU1ySsD4Tkeg4YiwAAAac"]
[Sat Jul 18 23:15:24.435740 2026] [security2:error] [pid 831031:tid 831278] [client 31.171.130.41:48773] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/bless.php"] [unique_id "alxdbJnU1ySsD4Tkeg4YjAAAAgM"]
[Sat Jul 18 23:15:24.449390 2026] [security2:error] [pid 831031:tid 831197] [client 31.171.130.42:36073] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/blurbs.php"] [unique_id "alxdbJnU1ySsD4Tkeg4YjQAAAbI"]
[Sat Jul 18 23:15:24.474406 2026] [security2:error] [pid 831031:tid 831209] [client 31.171.130.45:36451] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/blurbs.php"] [unique_id "alxdbJnU1ySsD4Tkeg4YjwAAAb4"]
[Sat Jul 18 23:15:24.498577 2026] [security2:error] [pid 831031:tid 831190] [client 31.171.130.40:21235] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/blurbs.php"] [unique_id "alxdbJnU1ySsD4Tkeg4YlAAAAas"]
[Sat Jul 18 23:15:24.512512 2026] [security2:error] [pid 831031:tid 831202] [client 31.171.130.38:54963] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/blurbs.php"] [unique_id "alxdbJnU1ySsD4Tkeg4YlgAAAbc"]
[Sat Jul 18 23:15:24.535874 2026] [security2:error] [pid 831031:tid 831187] [client 31.171.130.8:38103] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/blurbs.php"] [unique_id "alxdbJnU1ySsD4Tkeg4YmAAAAag"]
[Sat Jul 18 23:15:24.684546 2026] [security2:error] [pid 831031:tid 831153] [remote 31.42.184.154:51940] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "solkeetw.com"] [uri "/xmlrpc.php"] [unique_id "alxdbJnU1ySsD4Tkeg4YoQAB5Xg"]
[Sat Jul 18 23:15:24.684661 2026] [security2:error] [pid 831031:tid 831248] [client 31.42.184.154:51940] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "solkeetw.com"] [uri "/xmlrpc.php"] [unique_id "alxdbJnU1ySsD4Tkeg4YoQAB5Xg"]
[Sat Jul 18 23:15:24.933722 2026] [security2:error] [pid 831031:tid 831181] [client 31.171.130.21:30259] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/class-t.api.php"] [unique_id "alxdbJnU1ySsD4Tkeg4YpwAAAaI"]
[Sat Jul 18 23:15:24.940823 2026] [security2:error] [pid 831031:tid 831262] [client 119.154.81.234:63631] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdbJnU1ySsD4Tkeg4YqQAAAfM"]
[Sat Jul 18 23:15:24.940908 2026] [security2:error] [pid 831031:tid 831262] [client 119.154.81.234:63631] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdbJnU1ySsD4Tkeg4YqQAAAfM"]
[Sat Jul 18 23:15:24.954331 2026] [security2:error] [pid 831031:tid 831241] [client 4.194.24.143:22028] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/sang.php"] [unique_id "alxdbJnU1ySsD4Tkeg4YqgAAAd4"]
[Sat Jul 18 23:15:24.959700 2026] [security2:error] [pid 831031:tid 831185] [client 31.171.130.24:58967] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/akcc.php"] [unique_id "alxdbJnU1ySsD4Tkeg4YqwAAAaY"]
[Sat Jul 18 23:15:24.960901 2026] [security2:error] [pid 831031:tid 831195] [client 31.171.130.8:50897] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/akcc.php"] [unique_id "alxdbJnU1ySsD4Tkeg4YrAAAAbA"]
[Sat Jul 18 23:15:24.998249 2026] [security2:error] [pid 831031:tid 831203] [client 31.171.130.27:25793] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/akcc.php"] [unique_id "alxdbJnU1ySsD4Tkeg4YsAAAAbg"]
[Sat Jul 18 23:15:25.000757 2026] [security2:error] [pid 831031:tid 831235] [client 31.171.130.35:28957] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/class-t.api.php"] [unique_id "alxdbZnU1ySsD4Tkeg4YsQAAAdg"]
[Sat Jul 18 23:15:25.015384 2026] [security2:error] [pid 831031:tid 831211] [client 31.171.130.34:27703] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/akcc.php"] [unique_id "alxdbZnU1ySsD4Tkeg4YswAAAcA"]
[Sat Jul 18 23:15:25.028027 2026] [security2:error] [pid 831031:tid 831165] [client 31.171.130.31:38511] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/akcc.php"] [unique_id "alxdbZnU1ySsD4Tkeg4YtQAAAZI"]
[Sat Jul 18 23:15:25.107681 2026] [security2:error] [pid 831031:tid 831270] [client 31.171.130.6:27071] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/akcc.php"] [unique_id "alxdbZnU1ySsD4Tkeg4YtwAAAfs"]
[Sat Jul 18 23:15:25.230987 2026] [security2:error] [pid 831031:tid 831277] [client 93.86.49.238:31616] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 238.49.86.93.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdbZnU1ySsD4Tkeg4YugAAAgI"]
[Sat Jul 18 23:15:25.231095 2026] [security2:error] [pid 831031:tid 831277] [client 93.86.49.238:31616] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdbZnU1ySsD4Tkeg4YugAAAgI"]
[Sat Jul 18 23:15:25.242234 2026] [security2:error] [pid 830701:tid 830835] [client 78.142.18.40:52102] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 40.18.142.78.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "theshakespeareconspiracy.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxdbcu1nEoSSDHiOXa5owAAAQ4"]
[Sat Jul 18 23:15:25.344013 2026] [security2:error] [pid 830701:tid 830768] [remote 31.42.184.154:51930] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-login.php"] [unique_id "alxdbcu1nEoSSDHiOXa5pAABP0I"], referer: https://maxenengineering.com/wp-login.php
[Sat Jul 18 23:15:25.444835 2026] [security2:error] [pid 831031:tid 831190] [client 31.171.130.34:61119] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/blurbs.php"] [unique_id "alxdbZnU1ySsD4Tkeg4YwQAAAas"]
[Sat Jul 18 23:15:25.531659 2026] [security2:error] [pid 831031:tid 831182] [client 57.141.18.69:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxdbZnU1ySsD4Tkeg4YvwAAAaM"]
[Sat Jul 18 23:15:25.544853 2026] [security2:error] [pid 831031:tid 831200] [client 31.171.130.34:33403] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/abcd.php"] [unique_id "alxdbZnU1ySsD4Tkeg4YxgAAAbU"]
[Sat Jul 18 23:15:25.556083 2026] [security2:error] [pid 830701:tid 830875] [client 4.194.24.143:27438] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/scxy.php"] [unique_id "alxdbcu1nEoSSDHiOXa5pwAAATY"]
[Sat Jul 18 23:15:25.578120 2026] [security2:error] [pid 831031:tid 831164] [client 190.245.146.99:59988] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdbZnU1ySsD4Tkeg4YygAAAZE"]
[Sat Jul 18 23:15:25.583998 2026] [security2:error] [pid 831031:tid 831164] [client 190.245.146.99:59988] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdbZnU1ySsD4Tkeg4YygAAAZE"]
[Sat Jul 18 23:15:25.655414 2026] [security2:error] [pid 831031:tid 831218] [client 78.142.18.40:55676] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 40.18.142.78.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "theshakespeareconspiracy.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxdbZnU1ySsD4Tkeg4Y0AAAAcc"]
[Sat Jul 18 23:15:25.667828 2026] [security2:error] [pid 831031:tid 831201] [client 31.171.130.51:62137] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/abcd.php"] [unique_id "alxdbZnU1ySsD4Tkeg4Y0gAAAbY"]
[Sat Jul 18 23:15:25.682239 2026] [security2:error] [pid 830701:tid 830870] [client 31.171.130.3:59017] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/abcd.php"] [unique_id "alxdbcu1nEoSSDHiOXa5rwAAATE"]
[Sat Jul 18 23:15:25.684326 2026] [security2:error] [pid 830701:tid 830923] [client 31.171.130.26:50401] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/blurbs.php"] [unique_id "alxdbcu1nEoSSDHiOXa5sAAAAWY"]
[Sat Jul 18 23:15:25.685706 2026] [security2:error] [pid 830701:tid 830894] [client 31.171.130.47:32063] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/abcd.php"] [unique_id "alxdbcu1nEoSSDHiOXa5sQAAAUk"]
[Sat Jul 18 23:15:25.697406 2026] [security2:error] [pid 830701:tid 830882] [client 31.171.130.19:44145] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/abcd.php"] [unique_id "alxdbcu1nEoSSDHiOXa5sgAAAT0"]
[Sat Jul 18 23:15:25.725792 2026] [security2:error] [pid 831031:tid 831237] [client 31.171.130.7:51031] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/blurbs.php"] [unique_id "alxdbZnU1ySsD4Tkeg4Y1QAAAdo"]
[Sat Jul 18 23:15:25.746969 2026] [security2:error] [pid 830701:tid 830931] [client 31.171.130.23:54903] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/abcd.php"] [unique_id "alxdbcu1nEoSSDHiOXa5tQAAAW4"]
[Sat Jul 18 23:15:25.804377 2026] [security2:error] [pid 831031:tid 831250] [client 223.178.210.203:7254] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdbZnU1ySsD4Tkeg4Y2QAAAec"]
[Sat Jul 18 23:15:25.804465 2026] [security2:error] [pid 831031:tid 831250] [client 223.178.210.203:7254] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdbZnU1ySsD4Tkeg4Y2QAAAec"]
[Sat Jul 18 23:15:25.930356 2026] [security2:error] [pid 831031:tid 831207] [client 31.171.130.16:26805] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/akcc.php"] [unique_id "alxdbZnU1ySsD4Tkeg4Y3gAAAbw"]
[Sat Jul 18 23:15:26.017894 2026] [security2:error] [pid 830701:tid 830838] [client 31.171.130.26:22251] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/shelp.php"] [unique_id "alxdbsu1nEoSSDHiOXa5uwAAARE"]
[Sat Jul 18 23:15:26.067688 2026] [security2:error] [pid 830701:tid 830916] [client 78.142.18.40:61251] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 40.18.142.78.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "theshakespeareconspiracy.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxdbsu1nEoSSDHiOXa5vwAAAV8"]
[Sat Jul 18 23:15:26.107410 2026] [security2:error] [pid 830701:tid 830918] [client 4.194.24.143:22055] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/sd.php"] [unique_id "alxdbsu1nEoSSDHiOXa5wAAAAWE"]
[Sat Jul 18 23:15:26.149977 2026] [security2:error] [pid 831031:tid 831274] [client 31.171.130.48:63411] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/shelp.php"] [unique_id "alxdbpnU1ySsD4Tkeg4Y6QAAAf8"]
[Sat Jul 18 23:15:26.165382 2026] [security2:error] [pid 831031:tid 831252] [client 31.171.130.5:48357] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/akcc.php"] [unique_id "alxdbpnU1ySsD4Tkeg4Y6gAAAek"]
[Sat Jul 18 23:15:26.167474 2026] [security2:error] [pid 830701:tid 830848] [client 31.171.130.19:49619] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/shelp.php"] [unique_id "alxdbsu1nEoSSDHiOXa5wwAAARs"]
[Sat Jul 18 23:15:26.185974 2026] [security2:error] [pid 830701:tid 830925] [client 31.171.130.13:51885] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/shelp.php"] [unique_id "alxdbsu1nEoSSDHiOXa5xAAAAWg"]
[Sat Jul 18 23:15:26.220437 2026] [security2:error] [pid 831031:tid 831186] [client 31.171.130.8:48843] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/akcc.php"] [unique_id "alxdbpnU1ySsD4Tkeg4Y7QAAAac"]
[Sat Jul 18 23:15:26.253244 2026] [security2:error] [pid 831031:tid 831255] [client 31.171.130.32:40217] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/shelp.php"] [unique_id "alxdbpnU1ySsD4Tkeg4Y8QAAAew"]
[Sat Jul 18 23:15:26.416146 2026] [security2:error] [pid 831031:tid 831270] [client 95.108.213.159:62202] ModSecurity: Access denied with code 429 (phase 2). Pattern match "Mozilla\\\\/5\\\\.0 \\\\(compatible; YandexBot\\\\/3\\\\.0; \\\\+http:\\\\/\\\\/yandex\\\\.com\\\\/bots\\\\)" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/othercrawler.conf"] [line "3"] [id "901008"] [msg "Yandex Crawler 429 ADDED BY MONITORING DO NOT WHITELIST"] [hostname "heroesoftomorrow.us"] [uri "/robots.txt"] [unique_id "alxdbpnU1ySsD4Tkeg4Y-QAAAfs"]
[Sat Jul 18 23:15:26.419540 2026] [security2:error] [pid 831031:tid 831264] [client 31.171.130.6:23177] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/abcd.php"] [unique_id "alxdbpnU1ySsD4Tkeg4Y-wAAAfU"]
[Sat Jul 18 23:15:26.478674 2026] [security2:error] [pid 831031:tid 831209] [client 78.142.18.40:60115] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 40.18.142.78.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "theshakespeareconspiracy.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxdbpnU1ySsD4Tkeg4Y_wAAAb4"]
[Sat Jul 18 23:15:26.508755 2026] [security2:error] [pid 831031:tid 831249] [client 31.171.130.5:58629] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/cord.php"] [unique_id "alxdbpnU1ySsD4Tkeg4ZAQAAAeY"]
[Sat Jul 18 23:15:26.582087 2026] [security2:error] [pid 831031:tid 831214] [client 45.86.203.64:32915] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/ms-themes.php"] [unique_id "alxdbpnU1ySsD4Tkeg4ZAwAAAcM"]
[Sat Jul 18 23:15:26.655704 2026] [security2:error] [pid 830701:tid 830945] [client 4.194.24.143:22039] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/sf.php"] [unique_id "alxdbsu1nEoSSDHiOXa5ywAAAXw"]
[Sat Jul 18 23:15:26.691680 2026] [security2:error] [pid 831031:tid 831244] [client 31.171.130.20:29703] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/cord.php"] [unique_id "alxdbpnU1ySsD4Tkeg4ZCwAAAeE"]
[Sat Jul 18 23:15:26.709622 2026] [security2:error] [pid 830701:tid 830892] [client 31.171.130.23:53987] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/cord.php"] [unique_id "alxdbsu1nEoSSDHiOXa5zAAAAUc"]
[Sat Jul 18 23:15:26.709793 2026] [security2:error] [pid 831031:tid 831224] [client 31.171.130.7:34759] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/abcd.php"] [unique_id "alxdbpnU1ySsD4Tkeg4ZDQAAAc0"]
[Sat Jul 18 23:15:26.863882 2026] [security2:error] [pid 831031:tid 831207] [client 31.171.130.40:49229] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/abcd.php"] [unique_id "alxdbpnU1ySsD4Tkeg4ZEgAAAbw"]
[Sat Jul 18 23:15:26.908017 2026] [security2:error] [pid 831031:tid 831162] [client 31.171.130.12:25829] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/cord.php"] [unique_id "alxdbpnU1ySsD4Tkeg4ZFAAAAY8"]
[Sat Jul 18 23:15:26.921130 2026] [security2:error] [pid 830701:tid 830949] [client 31.171.130.24:48239] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/shelp.php"] [unique_id "alxdbsu1nEoSSDHiOXa50QAAAYA"]
[Sat Jul 18 23:15:26.973315 2026] [security2:error] [pid 831031:tid 831203] [client 31.171.130.42:50195] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/cord.php"] [unique_id "alxdbpnU1ySsD4Tkeg4ZFgAAAbg"]
[Sat Jul 18 23:15:27.011997 2026] [security2:error] [pid 831031:tid 831283] [client 31.171.130.22:61863] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/dex.php"] [unique_id "alxdb5nU1ySsD4Tkeg4ZFwAAAgg"]
[Sat Jul 18 23:15:27.015344 2026] [security2:error] [pid 831031:tid 831088] [remote 31.42.184.154:44956] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxdb5nU1ySsD4Tkeg4ZGAAB9zc"]
[Sat Jul 18 23:15:27.199099 2026] [security2:error] [pid 831031:tid 831265] [client 31.171.130.10:20389] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/shelp.php"] [unique_id "alxdb5nU1ySsD4Tkeg4ZJAAAAfY"]
[Sat Jul 18 23:15:27.208071 2026] [security2:error] [pid 830701:tid 830846] [client 4.194.24.143:27403] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/shell.php"] [unique_id "alxdb8u1nEoSSDHiOXa52AAAARk"]
[Sat Jul 18 23:15:27.237725 2026] [security2:error] [pid 831031:tid 831277] [client 31.171.130.34:46217] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/shelp.php"] [unique_id "alxdb5nU1ySsD4Tkeg4ZJgAAAgI"]
[Sat Jul 18 23:15:27.237804 2026] [security2:error] [pid 831031:tid 831245] [client 31.171.130.30:20429] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/dex.php"] [unique_id "alxdb5nU1ySsD4Tkeg4ZJwAAAeI"]
[Sat Jul 18 23:15:27.238803 2026] [security2:error] [pid 831031:tid 831222] [client 31.171.130.20:49689] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/dex.php"] [unique_id "alxdb5nU1ySsD4Tkeg4ZKAAAAcs"]
[Sat Jul 18 23:15:27.373599 2026] [security2:error] [pid 830701:tid 830898] [client 31.171.130.22:39255] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/shelp.php"] [unique_id "alxdb8u1nEoSSDHiOXa53AAAAU0"]
[Sat Jul 18 23:15:27.411402 2026] [security2:error] [pid 831031:tid 831246] [client 31.171.130.18:48075] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/dex.php"] [unique_id "alxdb5nU1ySsD4Tkeg4ZLwAAAeM"]
[Sat Jul 18 23:15:27.438283 2026] [security2:error] [pid 831031:tid 831279] [client 31.171.130.1:61441] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/cord.php"] [unique_id "alxdb5nU1ySsD4Tkeg4ZMAAAAgQ"]
[Sat Jul 18 23:15:27.502308 2026] [security2:error] [pid 831031:tid 831192] [client 31.171.130.47:63801] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/dex.php"] [unique_id "alxdb5nU1ySsD4Tkeg4ZNgAAAa0"]
[Sat Jul 18 23:15:27.510144 2026] [security2:error] [pid 831031:tid 831215] [client 31.171.130.37:43585] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxdb5nU1ySsD4Tkeg4ZNwAAAcQ"]
[Sat Jul 18 23:15:27.543971 2026] [security2:error] [pid 831031:tid 831090] [remote 31.42.184.154:44956] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxdb5nU1ySsD4Tkeg4ZOgABwzk"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:15:27.676320 2026] [security2:error] [pid 830701:tid 830847] [client 31.171.130.49:49639] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/cord.php"] [unique_id "alxdb8u1nEoSSDHiOXa55AAAARo"]
[Sat Jul 18 23:15:27.711632 2026] [security2:error] [pid 831031:tid 831244] [client 31.171.130.12:49947] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/cord.php"] [unique_id "alxdb5nU1ySsD4Tkeg4ZQQAAAeE"]
[Sat Jul 18 23:15:27.717993 2026] [security2:error] [pid 830701:tid 830938] [client 31.171.130.11:49143] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxdb8u1nEoSSDHiOXa55wAAAXU"]
[Sat Jul 18 23:15:27.718259 2026] [security2:error] [pid 830701:tid 830875] [client 31.171.130.17:65295] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxdb8u1nEoSSDHiOXa56AAAATY"]
[Sat Jul 18 23:15:27.838016 2026] [security2:error] [pid 830701:tid 830929] [client 45.86.203.70:57401] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/chosen.php"] [unique_id "alxdb8u1nEoSSDHiOXa56wAAAWw"]
[Sat Jul 18 23:15:27.871824 2026] [security2:error] [pid 830701:tid 830923] [client 31.171.130.42:43249] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/cord.php"] [unique_id "alxdb8u1nEoSSDHiOXa57QAAAWY"]
[Sat Jul 18 23:15:27.897323 2026] [security2:error] [pid 830701:tid 830894] [client 31.171.130.35:63117] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxdb8u1nEoSSDHiOXa57gAAAUk"]
[Sat Jul 18 23:15:27.919049 2026] [security2:error] [pid 831031:tid 831272] [client 31.171.130.20:48413] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/dex.php"] [unique_id "alxdb5nU1ySsD4Tkeg4ZRgAAAf0"]
[Sat Jul 18 23:15:27.944842 2026] [security2:error] [pid 831031:tid 831210] [client 4.194.24.143:21773] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/sid3.php"] [unique_id "alxdb5nU1ySsD4Tkeg4ZSAAAAb8"]
[Sat Jul 18 23:15:27.984308 2026] [security2:error] [pid 831031:tid 831262] [client 31.171.130.12:33853] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxdb5nU1ySsD4Tkeg4ZTAAAAfM"]
[Sat Jul 18 23:15:27.997151 2026] [security2:error] [pid 831031:tid 831259] [client 31.171.130.34:52677] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/zwso.php"] [unique_id "alxdb5nU1ySsD4Tkeg4ZTQAAAfA"]
[Sat Jul 18 23:15:28.062624 2026] [proxy:error] [pid 831031:tid 831195] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:15:28.062707 2026] [proxy_http:error] [pid 831031:tid 831195] [client 193.47.62.168:52162] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:15:28.063380 2026] [proxy:error] [pid 831031:tid 831195] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:15:28.063422 2026] [proxy_http:error] [pid 831031:tid 831195] [client 193.47.62.168:52162] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:15:28.189018 2026] [security2:error] [pid 831031:tid 831252] [client 31.171.130.35:41345] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/dex.php"] [unique_id "alxdcJnU1ySsD4Tkeg4ZWAAAAek"]
[Sat Jul 18 23:15:28.219169 2026] [security2:error] [pid 831031:tid 831186] [client 31.171.130.15:31253] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/zwso.php"] [unique_id "alxdcJnU1ySsD4Tkeg4ZWwAAAac"]
[Sat Jul 18 23:15:28.219312 2026] [security2:error] [pid 831031:tid 831265] [client 31.171.130.52:23581] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/dex.php"] [unique_id "alxdcJnU1ySsD4Tkeg4ZXAAAAfY"]
[Sat Jul 18 23:15:28.227451 2026] [security2:error] [pid 831031:tid 831177] [client 31.171.130.3:20019] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/zwso.php"] [unique_id "alxdcJnU1ySsD4Tkeg4ZXQAAAZ4"]
[Sat Jul 18 23:15:28.273487 2026] [security2:error] [pid 831031:tid 831289] [client 74.7.175.151:34360] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/robots.txt"] [unique_id "alxdcJnU1ySsD4Tkeg4ZXwAAAg4"]
[Sat Jul 18 23:15:28.283221 2026] [autoindex:error] [pid 831031:tid 831258] [client 43.130.9.111:58722] AH01276: Cannot serve directory /home1/ypkrfsmy/finalcialsgroup.com/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:15:28.293140 2026] [core:error] [pid 831031:tid 831183] [client 140.248.75.197:56342] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:15:28.293144 2026] [core:error] [pid 831031:tid 831273] [client 140.248.75.197:56350] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:15:28.293162 2026] [core:error] [pid 831031:tid 831183] [client 140.248.75.197:56342] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:15:28.293167 2026] [core:error] [pid 831031:tid 831273] [client 140.248.75.197:56350] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:15:28.363587 2026] [security2:error] [pid 831031:tid 831206] [client 31.171.130.33:50687] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/dex.php"] [unique_id "alxdcJnU1ySsD4Tkeg4ZZgAAAbs"]
[Sat Jul 18 23:15:28.399001 2026] [security2:error] [pid 830701:tid 830873] [client 31.171.130.49:63931] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxdcMu1nEoSSDHiOXa59AAAATQ"]
[Sat Jul 18 23:15:28.442492 2026] [security2:error] [pid 831031:tid 831180] [client 74.7.175.151:0] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "omenana.com"] [uri "/robots.txt"] [unique_id "alxdcJnU1ySsD4Tkeg4ZawAAAaE"], referer: http://omenana.com/robots.txt
[Sat Jul 18 23:15:28.445066 2026] [security2:error] [pid 830701:tid 830933] [client 74.7.175.151:55950] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "omenana.com"] [uri "/robots.txt"] [unique_id "alxdcMu1nEoSSDHiOXa59QABcAM"], referer: http://omenana.com/robots.txt
[Sat Jul 18 23:15:28.481882 2026] [security2:error] [pid 830701:tid 830932] [client 31.171.130.15:49311] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/zwso.php"] [unique_id "alxdcMu1nEoSSDHiOXa5-AAAAW8"]
[Sat Jul 18 23:15:28.488603 2026] [security2:error] [pid 830701:tid 830944] [client 31.171.130.32:35305] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxdcMu1nEoSSDHiOXa5-QAAAXs"]
[Sat Jul 18 23:15:28.518453 2026] [security2:error] [pid 831031:tid 831202] [client 4.194.24.143:21790] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/simple.php"] [unique_id "alxdcJnU1ySsD4Tkeg4ZbQAAAbc"]
[Sat Jul 18 23:15:28.556810 2026] [security2:error] [pid 831031:tid 831072] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdcJnU1ySsD4Tkeg4ZbgAB4yc"]
[Sat Jul 18 23:15:28.556950 2026] [security2:error] [pid 831031:tid 831246] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdcJnU1ySsD4Tkeg4ZbgAB4yc"]
[Sat Jul 18 23:15:28.636073 2026] [security2:error] [pid 831031:tid 831057] [remote 31.42.184.154:51944] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "careysheatingandcooling.com"] [uri "/wp-login.php"] [unique_id "alxdcJnU1ySsD4Tkeg4ZdQACDRg"]
[Sat Jul 18 23:15:28.682909 2026] [security2:error] [pid 830701:tid 830907] [client 31.171.130.51:35143] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxdcMu1nEoSSDHiOXa5_wAAAVY"]
[Sat Jul 18 23:15:28.699451 2026] [security2:error] [pid 830701:tid 830952] [client 31.171.130.27:55565] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxdcMu1nEoSSDHiOXa6AAAAAYM"]
[Sat Jul 18 23:15:28.699703 2026] [security2:error] [pid 831031:tid 831213] [client 31.171.130.49:21173] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxdcJnU1ySsD4Tkeg4ZeAAAAcI"]
[Sat Jul 18 23:15:28.710707 2026] [security2:error] [pid 830701:tid 830918] [client 31.171.130.28:60051] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxdcMu1nEoSSDHiOXa6AQAAAWE"]
[Sat Jul 18 23:15:28.914827 2026] [security2:error] [pid 830701:tid 830863] [client 31.171.130.41:38919] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxdcMu1nEoSSDHiOXa6CwAAASo"]
[Sat Jul 18 23:15:29.070219 2026] [security2:error] [pid 831031:tid 831193] [client 4.194.24.143:22057] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/sitemap.php"] [unique_id "alxdcZnU1ySsD4Tkeg4ZigAAAa4"]
[Sat Jul 18 23:15:29.160173 2026] [security2:error] [pid 831031:tid 831186] [client 31.171.130.8:33635] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/zwso.php"] [unique_id "alxdcZnU1ySsD4Tkeg4ZjwAAAac"]
[Sat Jul 18 23:15:29.247689 2026] [security2:error] [pid 830701:tid 830747] [remote 31.42.184.154:44962] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxdccu1nEoSSDHiOXa6EgABFC0"]
[Sat Jul 18 23:15:29.268974 2026] [security2:error] [pid 831031:tid 831119] [remote 31.42.184.154:51944] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "careysheatingandcooling.com"] [uri "/wp-login.php"] [unique_id "alxdcZnU1ySsD4Tkeg4ZlwABu1Y"], referer: https://careysheatingandcooling.com/wp-login.php
[Sat Jul 18 23:15:29.462959 2026] [security2:error] [pid 830701:tid 830949] [client 31.171.130.3:22309] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxdccu1nEoSSDHiOXa6FwAAAYA"]
[Sat Jul 18 23:15:29.468776 2026] [security2:error] [pid 830701:tid 830928] [client 31.171.130.42:37915] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/bolt.php"] [unique_id "alxdccu1nEoSSDHiOXa6GAAAAWs"]
[Sat Jul 18 23:15:29.506956 2026] [security2:error] [pid 831031:tid 831257] [client 31.171.130.52:29479] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/zwso.php"] [unique_id "alxdcZnU1ySsD4Tkeg4ZowAAAe4"]
[Sat Jul 18 23:15:29.525941 2026] [security2:error] [pid 830701:tid 830895] [client 45.86.203.57:45737] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/file.php"] [unique_id "alxdccu1nEoSSDHiOXa6GQAAAUo"]
[Sat Jul 18 23:15:29.591209 2026] [security2:error] [pid 830701:tid 830910] [client 31.171.130.2:50085] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/zwso.php"] [unique_id "alxdccu1nEoSSDHiOXa6GgAAAVk"]
[Sat Jul 18 23:15:29.631645 2026] [security2:error] [pid 831031:tid 831197] [client 4.194.24.143:21822] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/size.php"] [unique_id "alxdcZnU1ySsD4Tkeg4ZqQAAAbI"]
[Sat Jul 18 23:15:29.650869 2026] [security2:error] [pid 830701:tid 830868] [client 31.171.130.13:42521] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxdccu1nEoSSDHiOXa6HAAAAS8"]
[Sat Jul 18 23:15:29.689631 2026] [security2:error] [pid 830701:tid 830920] [client 31.171.130.2:47671] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/zwso.php"] [unique_id "alxdccu1nEoSSDHiOXa6IAAAAWM"]
[Sat Jul 18 23:15:29.701897 2026] [security2:error] [pid 831031:tid 831263] [client 31.171.130.24:36731] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/bolt.php"] [unique_id "alxdcZnU1ySsD4Tkeg4ZrAAAAfQ"]
[Sat Jul 18 23:15:29.702644 2026] [security2:error] [pid 831031:tid 831237] [client 31.171.130.27:35653] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/zwso.php"] [unique_id "alxdcZnU1ySsD4Tkeg4ZrQAAAdo"]
[Sat Jul 18 23:15:29.703386 2026] [security2:error] [pid 831031:tid 831224] [client 31.171.130.22:41749] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/bolt.php"] [unique_id "alxdcZnU1ySsD4Tkeg4ZrgAAAc0"]
[Sat Jul 18 23:15:30.024719 2026] [security2:error] [pid 830701:tid 830957] [client 31.171.130.18:43281] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/cjfuns.php"] [unique_id "alxdcsu1nEoSSDHiOXa6JAAAAYg"]
[Sat Jul 18 23:15:30.031604 2026] [security2:error] [pid 831031:tid 831165] [client 31.171.130.48:34739] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxdcpnU1ySsD4Tkeg4ZvwAAAZI"]
[Sat Jul 18 23:15:30.031897 2026] [security2:error] [pid 831031:tid 831274] [client 31.171.130.23:57221] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/bolt.php"] [unique_id "alxdcpnU1ySsD4Tkeg4ZwAAAAf8"]
[Sat Jul 18 23:15:30.137434 2026] [security2:error] [pid 830701:tid 830788] [remote 31.42.184.154:44962] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxdcsu1nEoSSDHiOXa6JwABDlY"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:15:30.187860 2026] [security2:error] [pid 830701:tid 830879] [client 4.194.24.143:28681] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/sm.php"] [unique_id "alxdcsu1nEoSSDHiOXa6KQAAATo"]
[Sat Jul 18 23:15:30.246967 2026] [security2:error] [pid 831031:tid 831245] [client 31.171.130.13:62263] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/bolt.php"] [unique_id "alxdcpnU1ySsD4Tkeg4ZyQAAAeI"]
[Sat Jul 18 23:15:30.280080 2026] [security2:error] [pid 831031:tid 831183] [client 31.171.130.28:46347] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxdcpnU1ySsD4Tkeg4ZzAAAAaQ"]
[Sat Jul 18 23:15:30.294272 2026] [security2:error] [pid 831031:tid 831273] [client 31.171.130.16:50949] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/cjfuns.php"] [unique_id "alxdcpnU1ySsD4Tkeg4ZzgAAAf4"]
[Sat Jul 18 23:15:30.309435 2026] [security2:error] [pid 830701:tid 830877] [client 31.171.130.47:46243] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxdcsu1nEoSSDHiOXa6NAAAATg"]
[Sat Jul 18 23:15:30.311676 2026] [security2:error] [pid 831031:tid 831190] [client 31.171.130.45:63301] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/cjfuns.php"] [unique_id "alxdcpnU1ySsD4Tkeg4Z0AAAAas"]
[Sat Jul 18 23:15:30.319683 2026] [security2:error] [pid 830701:tid 830931] [client 31.171.130.3:36293] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxdcsu1nEoSSDHiOXa6NgAAAW4"]
[Sat Jul 18 23:15:30.710650 2026] [security2:error] [pid 830701:tid 830925] [client 31.171.130.12:31113] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/bolt.php"] [unique_id "alxdcsu1nEoSSDHiOXa6QgAAAWg"]
[Sat Jul 18 23:15:30.711238 2026] [security2:error] [pid 830701:tid 830890] [client 31.171.130.49:52105] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxdcsu1nEoSSDHiOXa6QwAAAUU"]
[Sat Jul 18 23:15:30.731061 2026] [security2:error] [pid 830701:tid 830932] [client 4.194.24.143:27435] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/sql.php"] [unique_id "alxdcsu1nEoSSDHiOXa6RAAAAW8"]
[Sat Jul 18 23:15:30.734454 2026] [security2:error] [pid 830701:tid 830874] [client 31.171.130.42:40109] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/cjfuns.php"] [unique_id "alxdcsu1nEoSSDHiOXa6RQAAATU"]
[Sat Jul 18 23:15:30.822966 2026] [security2:error] [pid 830701:tid 830864] [client 31.171.130.11:53573] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/cjfuns.php"] [unique_id "alxdcsu1nEoSSDHiOXa6SgAAASs"]
[Sat Jul 18 23:15:30.938259 2026] [security2:error] [pid 831031:tid 831272] [client 45.86.203.57:48211] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/flower.php"] [unique_id "alxdcpnU1ySsD4Tkeg4Z6AAAAf0"]
[Sat Jul 18 23:15:30.983867 2026] [security2:error] [pid 831031:tid 831196] [client 31.171.130.12:33447] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/bolt.php"] [unique_id "alxdcpnU1ySsD4Tkeg4Z6wAAAbE"]
[Sat Jul 18 23:15:31.001922 2026] [security2:error] [pid 831031:tid 831250] [client 31.171.130.33:41975] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxdc5nU1ySsD4Tkeg4Z7AAAAec"]
[Sat Jul 18 23:15:31.001937 2026] [security2:error] [pid 830701:tid 830913] [client 31.171.130.31:64483] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/bolt.php"] [unique_id "alxdc8u1nEoSSDHiOXa6UwAAAVw"]
[Sat Jul 18 23:15:31.010267 2026] [security2:error] [pid 831031:tid 831199] [client 31.171.130.29:38911] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxdc5nU1ySsD4Tkeg4Z7QAAAbQ"]
[Sat Jul 18 23:15:31.011344 2026] [security2:error] [pid 831031:tid 831229] [client 31.171.130.42:25129] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/bolt.php"] [unique_id "alxdc5nU1ySsD4Tkeg4Z7wAAAdI"]
[Sat Jul 18 23:15:31.030226 2026] [security2:error] [pid 831031:tid 831142] [remote 199.189.225.167:63221] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.225.189.199.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "villa-m-medjugorje.com"] [uri "/xmlrpc.php"] [unique_id "alxdc5nU1ySsD4Tkeg4Z8QABoW0"]
[Sat Jul 18 23:15:31.030373 2026] [security2:error] [pid 831031:tid 831180] [client 199.189.225.167:63221] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "villa-m-medjugorje.com"] [uri "/xmlrpc.php"] [unique_id "alxdc5nU1ySsD4Tkeg4Z8QABoW0"]
[Sat Jul 18 23:15:31.177968 2026] [security2:error] [pid 830701:tid 830859] [client 124.29.207.185:56155] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdc8u1nEoSSDHiOXa6WAAAASY"]
[Sat Jul 18 23:15:31.178111 2026] [security2:error] [pid 830701:tid 830859] [client 124.29.207.185:56155] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdc8u1nEoSSDHiOXa6WAAAASY"]
[Sat Jul 18 23:15:31.214508 2026] [security2:error] [pid 831031:tid 831274] [client 31.171.130.30:61557] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxdc5nU1ySsD4Tkeg4Z-wAAAf8"]
[Sat Jul 18 23:15:31.242074 2026] [security2:error] [pid 831031:tid 831162] [client 31.171.130.18:58693] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/cjfuns.php"] [unique_id "alxdc5nU1ySsD4Tkeg4Z_QAAAY8"]
[Sat Jul 18 23:15:31.245212 2026] [security2:error] [pid 831031:tid 831177] [client 31.171.130.17:46623] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxdc5nU1ySsD4Tkeg4Z_gAAAZ4"]
[Sat Jul 18 23:15:31.274341 2026] [security2:error] [pid 831031:tid 831235] [client 4.194.24.143:20549] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/ss.php"] [unique_id "alxdc5nU1ySsD4Tkeg4aAAAAAdg"]
[Sat Jul 18 23:15:31.312223 2026] [security2:error] [pid 831031:tid 831164] [client 31.171.130.9:38319] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxdc5nU1ySsD4Tkeg4aAQAAAZE"]
[Sat Jul 18 23:15:31.528382 2026] [security2:error] [pid 831031:tid 831182] [client 66.228.34.49:0] ModSecurity: Warning. Matched phrase "Sucuri" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "404"] [hostname "youpositive.co"] [uri "/cgi-sys/404.html"] [unique_id "alxdc5nU1ySsD4Tkeg4aEwAAAaM"]
[Sat Jul 18 23:15:31.586299 2026] [security2:error] [pid 831031:tid 831208] [client 31.171.130.23:47941] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/cjfuns.php"] [unique_id "alxdc5nU1ySsD4Tkeg4aFAAAAb0"]
[Sat Jul 18 23:15:31.630822 2026] [security2:error] [pid 831031:tid 831253] [client 31.171.130.10:42843] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/cjfuns.php"] [unique_id "alxdc5nU1ySsD4Tkeg4aFgAAAeo"]
[Sat Jul 18 23:15:31.634452 2026] [security2:error] [pid 831031:tid 831178] [client 31.171.130.40:46617] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxdc5nU1ySsD4Tkeg4aFwAAAZ8"]
[Sat Jul 18 23:15:31.697567 2026] [security2:error] [pid 831031:tid 831227] [client 171.4.232.110:35185] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdc5nU1ySsD4Tkeg4aGAAAAdA"]
[Sat Jul 18 23:15:31.697708 2026] [security2:error] [pid 831031:tid 831227] [client 171.4.232.110:35185] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdc5nU1ySsD4Tkeg4aGAAAAdA"]
[Sat Jul 18 23:15:31.773416 2026] [security2:error] [pid 830701:tid 830938] [client 31.171.130.14:29147] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxdc8u1nEoSSDHiOXa6ZwAAAXU"]
[Sat Jul 18 23:15:31.792925 2026] [security2:error] [pid 830701:tid 830931] [client 31.171.130.15:43271] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/cjfuns.php"] [unique_id "alxdc8u1nEoSSDHiOXa6agAAAW4"]
[Sat Jul 18 23:15:31.800633 2026] [security2:error] [pid 831031:tid 831232] [client 31.171.130.51:21779] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxdc5nU1ySsD4Tkeg4aIAAAAdU"]
[Sat Jul 18 23:15:31.802337 2026] [security2:error] [pid 831031:tid 831201] [client 31.171.130.48:33629] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxdc5nU1ySsD4Tkeg4aIQAAAbY"]
[Sat Jul 18 23:15:31.847810 2026] [security2:error] [pid 831031:tid 831192] [client 4.194.24.143:22030] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/stats.php"] [unique_id "alxdc5nU1ySsD4Tkeg4aIgAAAa0"]
[Sat Jul 18 23:15:32.080571 2026] [security2:error] [pid 831031:tid 831273] [client 31.171.130.29:51515] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxddJnU1ySsD4Tkeg4aNwAAAf4"]
[Sat Jul 18 23:15:32.146932 2026] [security2:error] [pid 830701:tid 830875] [client 223.185.61.63:27143] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxddMu1nEoSSDHiOXa6dQAAATY"]
[Sat Jul 18 23:15:32.147052 2026] [security2:error] [pid 830701:tid 830875] [client 223.185.61.63:27143] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxddMu1nEoSSDHiOXa6dQAAATY"]
[Sat Jul 18 23:15:32.228001 2026] [security2:error] [pid 831031:tid 831278] [client 45.86.203.66:50537] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/gifclass.php"] [unique_id "alxddJnU1ySsD4Tkeg4aOQAAAgM"]
[Sat Jul 18 23:15:32.409003 2026] [security2:error] [pid 831031:tid 831241] [client 4.194.24.143:20556] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/sump1.php"] [unique_id "alxddJnU1ySsD4Tkeg4aRQAAAd4"]
[Sat Jul 18 23:15:32.500153 2026] [security2:error] [pid 831031:tid 831194] [client 74.7.227.179:58648] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxddJnU1ySsD4Tkeg4aQwABr3g"], referer: https://tejasenvironmental.com/p=551497
[Sat Jul 18 23:15:32.571853 2026] [security2:error] [pid 831031:tid 831236] [client 31.171.130.31:42225] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/wp-content/index.php"] [unique_id "alxddJnU1ySsD4Tkeg4aSgAAAdk"]
[Sat Jul 18 23:15:32.653106 2026] [security2:error] [pid 830701:tid 830855] [client 52.20.85.108:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxddMu1nEoSSDHiOXa6fAABImM"]
[Sat Jul 18 23:15:32.758389 2026] [security2:error] [pid 831031:tid 831242] [client 217.181.91.199:24197] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.91.181.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/xmlrpc.php"] [unique_id "alxddJnU1ySsD4Tkeg4aUQAAAd8"], referer: https://www.google.com/
[Sat Jul 18 23:15:32.764357 2026] [security2:error] [pid 830701:tid 830893] [client 31.171.130.28:55661] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/wp-content/index.php"] [unique_id "alxddMu1nEoSSDHiOXa6ggAAAUg"]
[Sat Jul 18 23:15:32.899201 2026] [security2:error] [pid 831031:tid 831179] [client 31.171.130.52:33581] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxddJnU1ySsD4Tkeg4aWQAAAaA"]
[Sat Jul 18 23:15:32.907091 2026] [security2:error] [pid 831031:tid 831237] [client 31.171.130.16:49885] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/wp-content/index.php"] [unique_id "alxddJnU1ySsD4Tkeg4aWwAAAdo"]
[Sat Jul 18 23:15:32.948975 2026] [security2:error] [pid 830701:tid 830874] [client 31.171.130.29:64221] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/wp-content/index.php"] [unique_id "alxddMu1nEoSSDHiOXa6iQAAATU"]
[Sat Jul 18 23:15:32.952792 2026] [security2:error] [pid 830701:tid 830863] [client 31.171.130.46:45683] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/wp-content/index.php"] [unique_id "alxddMu1nEoSSDHiOXa6iwAAASo"]
[Sat Jul 18 23:15:32.967080 2026] [security2:error] [pid 830701:tid 830955] [client 4.194.24.143:22021] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/system.php"] [unique_id "alxddMu1nEoSSDHiOXa6jAAAAYY"]
[Sat Jul 18 23:15:32.992758 2026] [security2:error] [pid 830701:tid 830900] [client 31.171.130.38:33971] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxddMu1nEoSSDHiOXa6jQAAAU8"]
[Sat Jul 18 23:15:33.002406 2026] [security2:error] [pid 830701:tid 830943] [client 31.171.130.19:34529] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxddcu1nEoSSDHiOXa6jgAAAXo"]
[Sat Jul 18 23:15:33.012102 2026] [security2:error] [pid 830701:tid 830890] [client 52.20.85.108:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxddMu1nEoSSDHiOXa6hwABRWo"]
[Sat Jul 18 23:15:33.055414 2026] [security2:error] [pid 831031:tid 831195] [client 31.171.130.10:24299] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/ioxi-o.php"] [unique_id "alxddZnU1ySsD4Tkeg4aYAAAAbA"]
[Sat Jul 18 23:15:33.062316 2026] [security2:error] [pid 831031:tid 831235] [client 45.86.203.49:25339] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/bless.php"] [unique_id "alxddZnU1ySsD4Tkeg4aYQAAAdg"]
[Sat Jul 18 23:15:33.175580 2026] [proxy:error] [pid 831031:tid 831286] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:15:33.175630 2026] [proxy_http:error] [pid 831031:tid 831286] [client 94.154.43.179:17554] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:15:33.176079 2026] [proxy:error] [pid 831031:tid 831286] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:15:33.176107 2026] [proxy_http:error] [pid 831031:tid 831286] [client 94.154.43.179:17554] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:15:33.186780 2026] [proxy:error] [pid 831031:tid 831244] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:15:33.186838 2026] [proxy_http:error] [pid 831031:tid 831244] [client 94.154.43.188:23544] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:15:33.187445 2026] [proxy:error] [pid 831031:tid 831244] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:15:33.187477 2026] [proxy_http:error] [pid 831031:tid 831244] [client 94.154.43.188:23544] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:15:33.349597 2026] [security2:error] [pid 831031:tid 831225] [client 31.171.130.19:41907] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/ioxi-o.php"] [unique_id "alxddZnU1ySsD4Tkeg4aeAAAAc4"]
[Sat Jul 18 23:15:33.459364 2026] [security2:error] [pid 830701:tid 830934] [client 31.171.130.28:31533] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxddcu1nEoSSDHiOXa6lAAAAXE"]
[Sat Jul 18 23:15:33.480413 2026] [security2:error] [pid 831031:tid 831227] [client 31.171.130.41:38989] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/ioxi-o.php"] [unique_id "alxddZnU1ySsD4Tkeg4agAAAAdA"]
[Sat Jul 18 23:15:33.518147 2026] [security2:error] [pid 831031:tid 831260] [client 4.194.24.143:27408] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/system/03n1hob7p03r2npdefault.php"] [unique_id "alxddZnU1ySsD4Tkeg4agQAAAfE"]
[Sat Jul 18 23:15:33.523593 2026] [security2:error] [pid 831031:tid 831197] [client 31.171.130.46:32277] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/wp-content/index.php"] [unique_id "alxddZnU1ySsD4Tkeg4agwAAAbI"]
[Sat Jul 18 23:15:33.523594 2026] [security2:error] [pid 831031:tid 831185] [client 31.171.130.26:35701] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/ioxi-o.php"] [unique_id "alxddZnU1ySsD4Tkeg4aggAAAaY"]
[Sat Jul 18 23:15:33.524345 2026] [security2:error] [pid 831031:tid 831236] [client 31.171.130.48:43277] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxddZnU1ySsD4Tkeg4ahAAAAdk"]
[Sat Jul 18 23:15:33.549616 2026] [security2:error] [pid 831031:tid 831258] [client 31.171.130.2:44471] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/ioxi-o.php"] [unique_id "alxddZnU1ySsD4Tkeg4aiAAAAe8"]
[Sat Jul 18 23:15:33.586030 2026] [security2:error] [pid 831031:tid 831267] [client 31.171.130.36:39371] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/insc.php"] [unique_id "alxddZnU1ySsD4Tkeg4ajQAAAfg"]
[Sat Jul 18 23:15:33.662471 2026] [security2:error] [pid 830701:tid 830851] [client 31.171.130.32:35933] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/wp-admin/css/index.php"] [unique_id "alxddcu1nEoSSDHiOXa6mQAAAR4"]
[Sat Jul 18 23:15:33.753798 2026] [security2:error] [pid 831031:tid 831209] [client 65.111.28.158:36783] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 158.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxddZnU1ySsD4Tkeg4amAAAAb4"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:15:33.841440 2026] [security2:error] [pid 830701:tid 830867] [client 31.171.130.18:37173] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/insc.php"] [unique_id "alxddcu1nEoSSDHiOXa6mgAAAS4"]
[Sat Jul 18 23:15:33.954434 2026] [security2:error] [pid 830701:tid 830940] [client 31.171.130.16:51653] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/wp-content/index.php"] [unique_id "alxddcu1nEoSSDHiOXa6ngAAAXc"]
[Sat Jul 18 23:15:33.965708 2026] [security2:error] [pid 831031:tid 831200] [client 31.171.130.30:47881] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/insc.php"] [unique_id "alxddZnU1ySsD4Tkeg4apwAAAbU"]
[Sat Jul 18 23:15:34.055126 2026] [security2:error] [pid 830701:tid 830957] [client 31.171.130.10:34755] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/ioxi-o.php"] [unique_id "alxddsu1nEoSSDHiOXa6owAAAYg"]
[Sat Jul 18 23:15:34.083219 2026] [security2:error] [pid 830701:tid 830847] [client 31.171.130.30:48633] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/wp-content/index.php"] [unique_id "alxddsu1nEoSSDHiOXa6pAAAARo"]
[Sat Jul 18 23:15:34.083366 2026] [security2:error] [pid 831031:tid 831182] [client 31.171.130.10:22213] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/insc.php"] [unique_id "alxddpnU1ySsD4Tkeg4atQAAAaM"]
[Sat Jul 18 23:15:34.092435 2026] [security2:error] [pid 830701:tid 830885] [client 31.171.130.47:22829] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/insc.php"] [unique_id "alxddsu1nEoSSDHiOXa6pgAAAUA"]
[Sat Jul 18 23:15:34.111707 2026] [security2:error] [pid 831031:tid 831234] [client 4.194.24.143:22056] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/system/cj5ha2rah8lyiqqdefault.php"] [unique_id "alxddpnU1ySsD4Tkeg4atgAAAdc"]
[Sat Jul 18 23:15:34.195576 2026] [security2:error] [pid 830701:tid 830840] [client 31.171.130.7:20675] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/classwithtostring.php"] [unique_id "alxddsu1nEoSSDHiOXa6qgAAARM"]
[Sat Jul 18 23:15:34.214955 2026] [security2:error] [pid 831031:tid 831197] [client 31.171.130.6:46699] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/wp-content/plugins/index.php"] [unique_id "alxddpnU1ySsD4Tkeg4augAAAbI"]
[Sat Jul 18 23:15:34.364658 2026] [security2:error] [pid 831031:tid 831201] [client 178.171.72.74:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "mollycahill.com"] [uri "/index.php"] [unique_id "alxddZnU1ySsD4Tkeg4apQAAAbY"]
[Sat Jul 18 23:15:34.424992 2026] [security2:error] [pid 831031:tid 831199] [client 45.86.203.49:36945] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/class-t.api.php"] [unique_id "alxddpnU1ySsD4Tkeg4awQAAAbQ"]
[Sat Jul 18 23:15:34.441516 2026] [security2:error] [pid 831031:tid 831194] [client 65.111.31.242:15029] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 242.31.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxddpnU1ySsD4Tkeg4awAAAAa8"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:15:34.586057 2026] [security2:error] [pid 831031:tid 831253] [client 27.34.68.67:53610] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxddpnU1ySsD4Tkeg4ayQAAAeo"]
[Sat Jul 18 23:15:34.586192 2026] [security2:error] [pid 831031:tid 831253] [client 27.34.68.67:53610] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxddpnU1ySsD4Tkeg4ayQAAAeo"]
[Sat Jul 18 23:15:34.683223 2026] [security2:error] [pid 831031:tid 831216] [client 4.194.24.143:24709] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/system_log.php"] [unique_id "alxddpnU1ySsD4Tkeg4azwAAAcU"]
[Sat Jul 18 23:15:34.892397 2026] [security2:error] [pid 831031:tid 831192] [client 31.171.130.20:26997] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/ioxi-o.php"] [unique_id "alxddpnU1ySsD4Tkeg4a1AAAAa0"]
[Sat Jul 18 23:15:34.911975 2026] [security2:error] [pid 831031:tid 831244] [client 31.171.130.7:44279] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/classwithtostring.php"] [unique_id "alxddpnU1ySsD4Tkeg4a1gAAAeE"]
[Sat Jul 18 23:15:34.918484 2026] [security2:error] [pid 831031:tid 831188] [client 157.52.92.60:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "expo.xp-design.co"] [uri "/index.php"] [unique_id "alxdc5nU1ySsD4Tkeg4Z9gAAAak"]
[Sat Jul 18 23:15:34.963568 2026] [security2:error] [pid 831031:tid 831259] [client 157.52.92.60:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "expo.xp-design.co"] [uri "/index.php"] [unique_id "alxdc5nU1ySsD4Tkeg4Z9QAAAfA"]
[Sat Jul 18 23:15:35.003790 2026] [security2:error] [pid 831031:tid 831170] [client 31.171.130.19:24791] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/classwithtostring.php"] [unique_id "alxdd5nU1ySsD4Tkeg4a5QAAAZc"]
[Sat Jul 18 23:15:35.065143 2026] [security2:error] [pid 831031:tid 831209] [client 45.3.45.113:19705] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxdd5nU1ySsD4Tkeg4a6gAAAb4"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:15:35.091090 2026] [security2:error] [pid 831031:tid 831185] [client 31.171.130.48:30467] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/insc.php"] [unique_id "alxdd5nU1ySsD4Tkeg4a7gAAAaY"]
[Sat Jul 18 23:15:35.128327 2026] [security2:error] [pid 831031:tid 831237] [client 31.171.130.33:44975] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/ioxi-o.php"] [unique_id "alxdd5nU1ySsD4Tkeg4a8QAAAdo"]
[Sat Jul 18 23:15:35.139044 2026] [security2:error] [pid 830701:tid 830952] [client 31.171.130.47:28771] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/classwithtostring.php"] [unique_id "alxdd8u1nEoSSDHiOXa6vQAAAYM"]
[Sat Jul 18 23:15:35.200025 2026] [security2:error] [pid 831031:tid 831285] [client 31.171.130.32:31623] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/txets.php"] [unique_id "alxdd5nU1ySsD4Tkeg4a9QAAAgo"]
[Sat Jul 18 23:15:35.211433 2026] [security2:error] [pid 830701:tid 830856] [client 31.171.130.10:33663] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/wp-content/index.php"] [unique_id "alxdd8u1nEoSSDHiOXa6vwAAASM"]
[Sat Jul 18 23:15:35.229064 2026] [security2:error] [pid 831031:tid 831249] [client 4.194.24.143:24743] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/t.php"] [unique_id "alxdd5nU1ySsD4Tkeg4a9wAAAeY"]
[Sat Jul 18 23:15:35.234449 2026] [security2:error] [pid 831031:tid 831230] [client 31.171.130.19:53247] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/classwithtostring.php"] [unique_id "alxdd5nU1ySsD4Tkeg4a-QAAAdM"]
[Sat Jul 18 23:15:35.421127 2026] [security2:error] [pid 830701:tid 830848] [client 45.86.203.62:50351] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/blurbs.php"] [unique_id "alxdd8u1nEoSSDHiOXa6wgAAARs"]
[Sat Jul 18 23:15:35.424843 2026] [security2:error] [pid 831031:tid 831191] [client 119.154.81.234:64054] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdd5nU1ySsD4Tkeg4bAAAAAaw"]
[Sat Jul 18 23:15:35.424954 2026] [security2:error] [pid 831031:tid 831191] [client 119.154.81.234:64054] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdd5nU1ySsD4Tkeg4bAAAAAaw"]
[Sat Jul 18 23:15:35.493953 2026] [security2:error] [pid 831031:tid 831175] [client 31.171.130.33:37069] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/txets.php"] [unique_id "alxdd5nU1ySsD4Tkeg4bBQAAAZw"]
[Sat Jul 18 23:15:35.586964 2026] [security2:error] [pid 830701:tid 830874] [client 31.171.130.8:48819] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/insc.php"] [unique_id "alxdd8u1nEoSSDHiOXa6xgAAATU"]
[Sat Jul 18 23:15:35.684808 2026] [security2:error] [pid 831031:tid 831273] [client 104.207.61.204:17291] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 204.61.207.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxdd5nU1ySsD4Tkeg4bDgAAAf4"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:15:35.764931 2026] [security2:error] [pid 830701:tid 830890] [client 31.171.130.42:41655] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/txets.php"] [unique_id "alxdd8u1nEoSSDHiOXa6ygAAAUU"]
[Sat Jul 18 23:15:35.769794 2026] [security2:error] [pid 830701:tid 830838] [client 31.171.130.15:37887] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/classwithtostring.php"] [unique_id "alxdd8u1nEoSSDHiOXa6ywAAARE"]
[Sat Jul 18 23:15:35.785822 2026] [security2:error] [pid 831031:tid 831260] [client 31.171.130.48:38421] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/txets.php"] [unique_id "alxdd5nU1ySsD4Tkeg4bFgAAAfE"]
[Sat Jul 18 23:15:35.812148 2026] [security2:error] [pid 830701:tid 830907] [client 31.171.130.10:56437] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxdd8u1nEoSSDHiOXa6zAAAAVY"]
[Sat Jul 18 23:15:35.823556 2026] [security2:error] [pid 831031:tid 831263] [client 31.171.130.26:36315] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/insc.php"] [unique_id "alxdd5nU1ySsD4Tkeg4bFwAAAfQ"]
[Sat Jul 18 23:15:35.825946 2026] [security2:error] [pid 830701:tid 830860] [client 31.171.130.49:50729] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/txets.php"] [unique_id "alxdd8u1nEoSSDHiOXa6zQAAASc"]
[Sat Jul 18 23:15:35.826403 2026] [security2:error] [pid 830701:tid 830888] [client 31.171.130.27:42029] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/ioxi-o.php"] [unique_id "alxdd8u1nEoSSDHiOXa6zgAAAUM"]
[Sat Jul 18 23:15:35.830607 2026] [security2:error] [pid 831031:tid 831167] [client 4.194.24.143:21764] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/term.php"] [unique_id "alxdd5nU1ySsD4Tkeg4bGAAAAZQ"]
[Sat Jul 18 23:15:35.905085 2026] [security2:error] [pid 831031:tid 831203] [client 164.52.120.14:56927] ModSecurity: Access denied with code 406 (phase 2). Match of "beginsWith %{request_headers.host}" against "TX:1" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "504"] [id "340162"] [rev "302"] [msg "Atomicorp.com WAF Rules: Remote File Injection Attack detected (Unauthorized URL detected as argument)"] [data ",TX:1"] [severity "CRITICAL"] [hostname "mollycahill.com"] [uri "/"] [unique_id "alxdd5nU1ySsD4Tkeg4bHQAAAbg"]
[Sat Jul 18 23:15:36.116975 2026] [security2:error] [pid 831031:tid 831218] [client 190.245.146.99:60494] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdeJnU1ySsD4Tkeg4bJAAAAcc"]
[Sat Jul 18 23:15:36.122962 2026] [security2:error] [pid 831031:tid 831218] [client 190.245.146.99:60494] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdeJnU1ySsD4Tkeg4bJAAAAcc"]
[Sat Jul 18 23:15:36.129330 2026] [security2:error] [pid 831031:tid 831172] [client 31.171.130.18:51799] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/classwithtostring.php"] [unique_id "alxdeJnU1ySsD4Tkeg4bJgAAAZk"]
[Sat Jul 18 23:15:36.282399 2026] [security2:error] [pid 831031:tid 831185] [client 93.86.49.238:43264] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 238.49.86.93.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdeJnU1ySsD4Tkeg4bOAAAAaY"]
[Sat Jul 18 23:15:36.282514 2026] [security2:error] [pid 831031:tid 831185] [client 93.86.49.238:43264] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdeJnU1ySsD4Tkeg4bOAAAAaY"]
[Sat Jul 18 23:15:36.310180 2026] [security2:error] [pid 831031:tid 831165] [client 31.171.130.4:37393] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxdeJnU1ySsD4Tkeg4bQQAAAZI"]
[Sat Jul 18 23:15:36.343834 2026] [security2:error] [pid 831031:tid 831214] [client 223.178.210.203:6396] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdeJnU1ySsD4Tkeg4bRQAAAcM"]
[Sat Jul 18 23:15:36.344015 2026] [security2:error] [pid 831031:tid 831214] [client 223.178.210.203:6396] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdeJnU1ySsD4Tkeg4bRQAAAcM"]
[Sat Jul 18 23:15:36.345363 2026] [security2:error] [pid 831031:tid 831282] [client 31.171.130.37:23167] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/txets.php"] [unique_id "alxdeJnU1ySsD4Tkeg4bRgAAAgc"]
[Sat Jul 18 23:15:36.348249 2026] [security2:error] [pid 830701:tid 830908] [client 45.3.40.132:42863] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.40.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxdeMu1nEoSSDHiOXa62QAAAVc"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:15:36.350696 2026] [security2:error] [pid 830701:tid 830851] [client 31.171.130.15:24653] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxdeMu1nEoSSDHiOXa62gAAAR4"]
[Sat Jul 18 23:15:36.371968 2026] [security2:error] [pid 831031:tid 831210] [client 31.171.130.52:57175] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxdeJnU1ySsD4Tkeg4bSQAAAb8"]
[Sat Jul 18 23:15:36.372169 2026] [security2:error] [pid 831031:tid 831286] [client 31.171.130.5:42645] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/wp-admin/txets.php"] [unique_id "alxdeJnU1ySsD4Tkeg4bSgAAAgs"]
[Sat Jul 18 23:15:36.379567 2026] [security2:error] [pid 830701:tid 830886] [client 31.171.130.17:33011] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/classwithtostring.php"] [unique_id "alxdeMu1nEoSSDHiOXa62wAAAUE"]
[Sat Jul 18 23:15:36.396776 2026] [security2:error] [pid 831031:tid 831225] [client 31.171.130.34:22903] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxdeJnU1ySsD4Tkeg4bTQAAAc4"]
[Sat Jul 18 23:15:36.406205 2026] [security2:error] [pid 831031:tid 831212] [client 4.194.24.143:27401] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/test.php"] [unique_id "alxdeJnU1ySsD4Tkeg4bTwAAAcE"]
[Sat Jul 18 23:15:36.412737 2026] [security2:error] [pid 831031:tid 831170] [client 31.171.130.33:48555] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/insc.php"] [unique_id "alxdeJnU1ySsD4Tkeg4bUgAAAZc"]
[Sat Jul 18 23:15:36.618819 2026] [security2:error] [pid 831031:tid 831168] [client 45.86.203.69:27833] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/akcc.php"] [unique_id "alxdeJnU1ySsD4Tkeg4bXQAAAZU"]
[Sat Jul 18 23:15:36.620661 2026] [security2:error] [pid 830701:tid 830846] [client 31.171.130.1:49609] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/txets.php"] [unique_id "alxdeMu1nEoSSDHiOXa63wAAARk"]
[Sat Jul 18 23:15:36.952464 2026] [security2:error] [pid 831031:tid 831181] [client 45.3.44.72:14157] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 72.44.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxdeJnU1ySsD4Tkeg4bdAAAAaI"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:15:36.963590 2026] [security2:error] [pid 831031:tid 831195] [client 4.194.24.143:24733] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/test1.php"] [unique_id "alxdeJnU1ySsD4Tkeg4beQAAAbA"]
[Sat Jul 18 23:15:37.021260 2026] [security2:error] [pid 831031:tid 831266] [client 31.171.130.24:28171] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/wp-admin/txets.php"] [unique_id "alxdeZnU1ySsD4Tkeg4bfgAAAfc"]
[Sat Jul 18 23:15:37.105429 2026] [security2:error] [pid 831031:tid 831167] [client 31.171.130.20:58059] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/wp-admin/txets.php"] [unique_id "alxdeZnU1ySsD4Tkeg4bhQAAAZQ"]
[Sat Jul 18 23:15:37.107828 2026] [security2:error] [pid 831031:tid 831191] [client 31.171.130.47:35053] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/wp-includes/txets.php"] [unique_id "alxdeZnU1ySsD4Tkeg4bhgAAAaw"]
[Sat Jul 18 23:15:37.109288 2026] [security2:error] [pid 830701:tid 830847] [client 31.171.130.21:41395] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxdecu1nEoSSDHiOXa65QAAARo"]
[Sat Jul 18 23:15:37.116678 2026] [security2:error] [pid 831031:tid 831203] [client 31.171.130.47:60891] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/txets.php"] [unique_id "alxdeZnU1ySsD4Tkeg4bhwAAAbg"]
[Sat Jul 18 23:15:37.122461 2026] [security2:error] [pid 831031:tid 831267] [client 31.171.130.34:61251] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/wp-admin/txets.php"] [unique_id "alxdeZnU1ySsD4Tkeg4biAAAAfg"]
[Sat Jul 18 23:15:37.145101 2026] [security2:error] [pid 831031:tid 831252] [client 31.171.130.15:47185] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/classwithtostring.php"] [unique_id "alxdeZnU1ySsD4Tkeg4bigAAAek"]
[Sat Jul 18 23:15:37.351827 2026] [security2:error] [pid 831031:tid 831236] [client 74.208.214.194:47762] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxdeZnU1ySsD4Tkeg4blQAAAdk"]
[Sat Jul 18 23:15:37.503922 2026] [security2:error] [pid 831031:tid 831219] [client 31.171.130.47:61399] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxdeZnU1ySsD4Tkeg4bmwAAAcg"]
[Sat Jul 18 23:15:37.523590 2026] [security2:error] [pid 831031:tid 831278] [client 4.194.24.143:21818] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/tfm.php"] [unique_id "alxdeZnU1ySsD4Tkeg4bngAAAgM"]
[Sat Jul 18 23:15:37.570654 2026] [security2:error] [pid 831031:tid 831286] [client 31.171.130.34:52321] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/wp-includes/txets.php"] [unique_id "alxdeZnU1ySsD4Tkeg4bnwAAAgs"]
[Sat Jul 18 23:15:37.739223 2026] [security2:error] [pid 831031:tid 831195] [client 31.171.130.27:32803] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/goods.php"] [unique_id "alxdeZnU1ySsD4Tkeg4bqgAAAbA"]
[Sat Jul 18 23:15:37.806315 2026] [security2:error] [pid 831031:tid 831183] [client 31.171.130.5:38697] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/wp-admin/txets.php"] [unique_id "alxdeZnU1ySsD4Tkeg4brAAAAaQ"]
[Sat Jul 18 23:15:37.810389 2026] [security2:error] [pid 831031:tid 831200] [client 31.171.130.21:32717] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxdeZnU1ySsD4Tkeg4brQAAAbU"]
[Sat Jul 18 23:15:37.814058 2026] [security2:error] [pid 831031:tid 831239] [client 31.171.130.34:21963] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/wp-includes/txets.php"] [unique_id "alxdeZnU1ySsD4Tkeg4brgAAAdw"]
[Sat Jul 18 23:15:38.065064 2026] [security2:error] [pid 830701:tid 830837] [client 45.86.203.41:49189] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/abcd.php"] [unique_id "alxdesu1nEoSSDHiOXa68QAAARA"]
[Sat Jul 18 23:15:38.077542 2026] [security2:error] [pid 831031:tid 831215] [client 4.194.24.143:18230] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/thebe.php"] [unique_id "alxdepnU1ySsD4Tkeg4bvwAAAcQ"]
[Sat Jul 18 23:15:38.196508 2026] [security2:error] [pid 831031:tid 831163] [client 31.171.130.6:30345] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/wp-admin/txets.php"] [unique_id "alxdepnU1ySsD4Tkeg4byAAAAZA"]
[Sat Jul 18 23:15:38.202115 2026] [security2:error] [pid 831031:tid 831268] [client 103.48.44.9:56324] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdepnU1ySsD4Tkeg4bxgAAAfk"]
[Sat Jul 18 23:15:38.202249 2026] [security2:error] [pid 831031:tid 831268] [client 103.48.44.9:56324] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdepnU1ySsD4Tkeg4bxgAAAfk"]
[Sat Jul 18 23:15:38.208818 2026] [security2:error] [pid 831031:tid 831220] [client 31.171.130.43:44765] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/wp-includes/txets.php"] [unique_id "alxdepnU1ySsD4Tkeg4byQAAAck"]
[Sat Jul 18 23:15:38.504644 2026] [security2:error] [pid 831031:tid 831233] [client 31.171.130.23:48143] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/goods.php"] [unique_id "alxdepnU1ySsD4Tkeg4b1wAAAdY"]
[Sat Jul 18 23:15:38.625136 2026] [security2:error] [pid 831031:tid 831192] [client 4.194.24.143:18191] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/themes.php"] [unique_id "alxdepnU1ySsD4Tkeg4b3QAAAa0"]
[Sat Jul 18 23:15:38.753098 2026] [security2:error] [pid 831031:tid 831287] [client 31.171.130.32:32789] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/txets.php"] [unique_id "alxdepnU1ySsD4Tkeg4b4gAAAgw"]
[Sat Jul 18 23:15:38.766303 2026] [security2:error] [pid 831031:tid 831245] [client 31.171.130.44:47995] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/wp-admin/txets.php"] [unique_id "alxdepnU1ySsD4Tkeg4b5AAAAeI"]
[Sat Jul 18 23:15:38.782610 2026] [security2:error] [pid 831031:tid 831203] [client 31.171.130.38:49053] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/goods.php"] [unique_id "alxdepnU1ySsD4Tkeg4b5QAAAbg"]
[Sat Jul 18 23:15:38.794630 2026] [security2:error] [pid 831031:tid 831267] [client 31.171.130.18:55891] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/wp-editor.php"] [unique_id "alxdepnU1ySsD4Tkeg4b5wAAAfg"]
[Sat Jul 18 23:15:38.795199 2026] [security2:error] [pid 831031:tid 831252] [client 31.171.130.14:52435] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/wp-admin/txets.php"] [unique_id "alxdepnU1ySsD4Tkeg4b6AAAAek"]
[Sat Jul 18 23:15:38.795265 2026] [security2:error] [pid 831031:tid 831243] [client 31.171.130.9:63047] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/wp-includes/txets.php"] [unique_id "alxdepnU1ySsD4Tkeg4b6QAAAeA"]
[Sat Jul 18 23:15:38.906622 2026] [security2:error] [pid 831031:tid 831218] [client 31.171.130.44:50699] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/goods.php"] [unique_id "alxdepnU1ySsD4Tkeg4b8QAAAcc"]
[Sat Jul 18 23:15:38.917858 2026] [security2:error] [pid 831031:tid 831229] [client 31.171.130.8:52313] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/wp-includes/txets.php"] [unique_id "alxdepnU1ySsD4Tkeg4b8gAAAdI"]
[Sat Jul 18 23:15:39.040429 2026] [security2:error] [pid 831031:tid 831230] [client 31.171.130.45:30253] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/wp-editor.php"] [unique_id "alxde5nU1ySsD4Tkeg4b-wAAAdM"]
[Sat Jul 18 23:15:39.154789 2026] [security2:error] [pid 830701:tid 830760] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxde8u1nEoSSDHiOXa7AgABSDo"]
[Sat Jul 18 23:15:39.154947 2026] [security2:error] [pid 830701:tid 830893] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxde8u1nEoSSDHiOXa7AgABSDo"]
[Sat Jul 18 23:15:39.168954 2026] [security2:error] [pid 831031:tid 831220] [client 4.194.24.143:18301] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/tiny.php"] [unique_id "alxde5nU1ySsD4Tkeg4cAAAAAck"]
[Sat Jul 18 23:15:39.225209 2026] [security2:error] [pid 831031:tid 831036] [remote 91.142.222.105:34308] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxde5nU1ySsD4Tkeg4cAgABtQM"]
[Sat Jul 18 23:15:39.225351 2026] [security2:error] [pid 831031:tid 831200] [client 91.142.222.105:34308] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxde5nU1ySsD4Tkeg4cAgABtQM"]
[Sat Jul 18 23:15:39.312911 2026] [security2:error] [pid 830701:tid 830954] [client 74.208.214.194:47774] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxde8u1nEoSSDHiOXa7CAAAAYU"]
[Sat Jul 18 23:15:39.393595 2026] [security2:error] [pid 831031:tid 831195] [client 45.86.203.58:31205] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/shelp.php"] [unique_id "alxde5nU1ySsD4Tkeg4cDgAAAbA"]
[Sat Jul 18 23:15:39.586367 2026] [autoindex:error] [pid 830701:tid 830777] [remote 164.68.113.190:0] AH01276: Cannot serve directory /home3/dbnvkfmy/public_html/nzfoodstory/wp-includes/widgets/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:15:39.744606 2026] [security2:error] [pid 831031:tid 831267] [client 4.194.24.143:18270] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "markmoseleycelebritygolf.org"] [uri "/tmp/byp.php"] [unique_id "alxde5nU1ySsD4Tkeg4cHgAAAfg"]
[Sat Jul 18 23:15:39.829153 2026] [security2:error] [pid 831031:tid 831284] [client 31.171.130.36:58445] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/wp-content/themes/txets.php"] [unique_id "alxde5nU1ySsD4Tkeg4cKAAAAgk"]
[Sat Jul 18 23:15:39.885912 2026] [proxy:error] [pid 831031:tid 831230] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:15:39.885982 2026] [proxy_http:error] [pid 831031:tid 831230] [client 193.47.62.168:53458] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:15:39.886558 2026] [proxy:error] [pid 831031:tid 831230] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:15:39.886583 2026] [proxy_http:error] [pid 831031:tid 831230] [client 193.47.62.168:53458] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:15:40.009673 2026] [security2:error] [pid 831031:tid 831234] [client 31.171.130.40:44265] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/wp-editor.php"] [unique_id "alxdfJnU1ySsD4Tkeg4cMAAAAdc"]
[Sat Jul 18 23:15:40.032457 2026] [security2:error] [pid 831031:tid 831250] [client 31.171.130.4:23955] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/lufix.php"] [unique_id "alxdfJnU1ySsD4Tkeg4cMQAAAec"]
[Sat Jul 18 23:15:40.061102 2026] [security2:error] [pid 831031:tid 831244] [client 31.171.130.50:64419] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/goods.php"] [unique_id "alxdfJnU1ySsD4Tkeg4cMgAAAeE"]
[Sat Jul 18 23:15:40.068888 2026] [security2:error] [pid 831031:tid 831282] [client 31.171.130.32:36619] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/wp-editor.php"] [unique_id "alxdfJnU1ySsD4Tkeg4cNQAAAgc"]
[Sat Jul 18 23:15:40.073556 2026] [security2:error] [pid 831031:tid 831202] [client 31.171.130.50:29955] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/wp-includes/txets.php"] [unique_id "alxdfJnU1ySsD4Tkeg4cNgAAAbc"]
[Sat Jul 18 23:15:40.074184 2026] [security2:error] [pid 831031:tid 831200] [client 31.171.130.49:32429] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/goods.php"] [unique_id "alxdfJnU1ySsD4Tkeg4cNwAAAbU"]
[Sat Jul 18 23:15:40.094863 2026] [security2:error] [pid 831031:tid 831279] [client 138.0.247.157:44745] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 157.247.0.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "claysharecon.com"] [uri "/xmlrpc.php"] [unique_id "alxdfJnU1ySsD4Tkeg4cOAAAAgQ"]
[Sat Jul 18 23:15:40.094958 2026] [security2:error] [pid 831031:tid 831279] [client 138.0.247.157:44745] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "claysharecon.com"] [uri "/xmlrpc.php"] [unique_id "alxdfJnU1ySsD4Tkeg4cOAAAAgQ"]
[Sat Jul 18 23:15:40.118443 2026] [security2:error] [pid 830701:tid 830859] [client 31.171.130.52:23051] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/lufix.php"] [unique_id "alxdfMu1nEoSSDHiOXa7HAAAASY"]
[Sat Jul 18 23:15:40.505014 2026] [security2:error] [pid 830701:tid 830849] [client 31.171.130.4:34037] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/wp-admin/txets.php"] [unique_id "alxdfMu1nEoSSDHiOXa7JgAAARw"]
[Sat Jul 18 23:15:40.559995 2026] [security2:error] [pid 831031:tid 831245] [client 45.86.203.66:57021] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/cord.php"] [unique_id "alxdfJnU1ySsD4Tkeg4cSwAAAeI"]
[Sat Jul 18 23:15:40.674064 2026] [security2:error] [pid 830701:tid 830843] [client 31.171.130.36:54053] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/lufix.php"] [unique_id "alxdfMu1nEoSSDHiOXa7KAAAARY"]
[Sat Jul 18 23:15:40.819888 2026] [security2:error] [pid 830701:tid 830905] [client 31.171.130.39:60153] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.waterproofgoods.com"] [uri "/style.php"] [unique_id "alxdfMu1nEoSSDHiOXa7KQAAAVQ"]
[Sat Jul 18 23:15:40.860641 2026] [security2:error] [pid 831031:tid 831280] [client 31.171.130.12:46261] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/wp-editor.php"] [unique_id "alxdfJnU1ySsD4Tkeg4cVgAAAgU"]
[Sat Jul 18 23:15:40.982273 2026] [security2:error] [pid 831031:tid 831230] [client 31.171.130.42:52495] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/wp-includes/txets.php"] [unique_id "alxdfJnU1ySsD4Tkeg4cXQAAAdM"]
[Sat Jul 18 23:15:41.122615 2026] [security2:error] [pid 831031:tid 831246] [client 34.73.232.127:47036] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "joulecommunications.com"] [uri "/wp-json/batch/v1"] [unique_id "alxdfZnU1ySsD4Tkeg4cZAAAAeM"]
[Sat Jul 18 23:15:41.198043 2026] [security2:error] [pid 830701:tid 830877] [client 124.29.246.106:64842] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdfcu1nEoSSDHiOXa7NgAAATg"]
[Sat Jul 18 23:15:41.198143 2026] [security2:error] [pid 830701:tid 830877] [client 124.29.246.106:64842] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdfcu1nEoSSDHiOXa7NgAAATg"]
[Sat Jul 18 23:15:41.240895 2026] [security2:error] [pid 831031:tid 831202] [client 31.171.130.49:58343] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/goods.php"] [unique_id "alxdfZnU1ySsD4Tkeg4caAAAAbc"]
[Sat Jul 18 23:15:41.358988 2026] [security2:error] [pid 831031:tid 831213] [client 31.171.130.15:56913] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.waterproofgoods.com"] [uri "/style.php"] [unique_id "alxdfZnU1ySsD4Tkeg4cagAAAcI"]
[Sat Jul 18 23:15:41.360243 2026] [security2:error] [pid 831031:tid 831201] [client 31.171.130.48:23413] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/lufix.php"] [unique_id "alxdfZnU1ySsD4Tkeg4cawAAAbY"]
[Sat Jul 18 23:15:41.360864 2026] [security2:error] [pid 831031:tid 831224] [client 31.171.130.36:28483] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/wp-editor.php"] [unique_id "alxdfZnU1ySsD4Tkeg4cbAAAAc0"]
[Sat Jul 18 23:15:41.738677 2026] [security2:error] [pid 831031:tid 831175] [client 31.171.130.25:36107] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.waterproofgoods.com"] [uri "/style.php"] [unique_id "alxdfZnU1ySsD4Tkeg4cgAAAAZw"]
[Sat Jul 18 23:15:41.751613 2026] [security2:error] [pid 830701:tid 830943] [client 45.86.203.51:22569] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/dex.php"] [unique_id "alxdfcu1nEoSSDHiOXa7TAAAAXo"]
[Sat Jul 18 23:15:41.911915 2026] [security2:error] [pid 830701:tid 830913] [client 31.171.130.23:31331] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/wp-includes/txets.php"] [unique_id "alxdfcu1nEoSSDHiOXa7UAAAAVw"]
[Sat Jul 18 23:15:42.065138 2026] [security2:error] [pid 830701:tid 830889] [client 31.171.130.50:27679] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/lufix.php"] [unique_id "alxdfsu1nEoSSDHiOXa7VAAAAUQ"]
[Sat Jul 18 23:15:42.102344 2026] [security2:error] [pid 831031:tid 831209] [client 3.108.60.216:38566] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxdfpnU1ySsD4Tkeg4cjgAAAb4"]
[Sat Jul 18 23:15:42.181218 2026] [security2:error] [pid 830701:tid 830825] [remote 31.42.184.154:48658] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nextlevelpressurewashing.nextlvlmarketingco.com"] [uri "/wp-login.php"] [unique_id "alxdfsu1nEoSSDHiOXa7VgABW3s"]
[Sat Jul 18 23:15:42.232454 2026] [security2:error] [pid 831031:tid 831228] [client 31.171.130.7:41973] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/goods.php"] [unique_id "alxdfpnU1ySsD4Tkeg4ckgAAAdE"]
[Sat Jul 18 23:15:42.340101 2026] [security2:error] [pid 830701:tid 830742] [remote 31.42.184.154:48670] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "timespans.org"] [uri "/wp-login.php"] [unique_id "alxdfsu1nEoSSDHiOXa7VwABESg"]
[Sat Jul 18 23:15:42.361799 2026] [security2:error] [pid 831031:tid 831174] [client 31.171.130.1:35225] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/wp-editor.php"] [unique_id "alxdfpnU1ySsD4Tkeg4cnAAAAZs"]
[Sat Jul 18 23:15:42.699271 2026] [security2:error] [pid 830701:tid 830928] [client 171.4.232.110:57267] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdfsu1nEoSSDHiOXa7YQAAAWs"]
[Sat Jul 18 23:15:42.699415 2026] [security2:error] [pid 830701:tid 830928] [client 171.4.232.110:57267] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdfsu1nEoSSDHiOXa7YQAAAWs"]
[Sat Jul 18 23:15:42.723692 2026] [security2:error] [pid 830701:tid 830849] [client 45.86.203.43:35547] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxdfsu1nEoSSDHiOXa7YwAAARw"]
[Sat Jul 18 23:15:42.765678 2026] [security2:error] [pid 830701:tid 830847] [client 31.171.130.9:51407] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.waterproofgoods.com"] [uri "/style.php"] [unique_id "alxdfsu1nEoSSDHiOXa7ZgAAARo"]
[Sat Jul 18 23:15:42.768562 2026] [security2:error] [pid 830701:tid 830924] [client 31.171.130.43:42227] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/lufix.php"] [unique_id "alxdfsu1nEoSSDHiOXa7ZwAAAWc"]
[Sat Jul 18 23:15:42.802152 2026] [security2:error] [pid 831031:tid 831236] [client 223.185.61.63:5590] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdfpnU1ySsD4Tkeg4csAAAAdk"]
[Sat Jul 18 23:15:42.807336 2026] [security2:error] [pid 831031:tid 831236] [client 223.185.61.63:5590] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdfpnU1ySsD4Tkeg4csAAAAdk"]
[Sat Jul 18 23:15:42.839159 2026] [security2:error] [pid 830701:tid 830746] [remote 31.42.184.154:48670] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "timespans.org"] [uri "/wp-login.php"] [unique_id "alxdfsu1nEoSSDHiOXa7aQABiCw"], referer: https://timespans.org/wp-login.php
[Sat Jul 18 23:15:42.899755 2026] [security2:error] [pid 830701:tid 830741] [remote 31.42.184.154:48658] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nextlevelpressurewashing.nextlvlmarketingco.com"] [uri "/wp-login.php"] [unique_id "alxdfsu1nEoSSDHiOXa7awABiSc"], referer: https://nextlevelpressurewashing.nextlvlmarketingco.com/wp-login.php
[Sat Jul 18 23:15:43.020402 2026] [security2:error] [pid 830701:tid 830865] [client 31.171.130.23:57895] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/lufix.php"] [unique_id "alxdf8u1nEoSSDHiOXa7dAAAASw"]
[Sat Jul 18 23:15:43.074972 2026] [security2:error] [pid 831031:tid 831203] [client 34.73.232.127:47036] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "joulecommunications.com"] [uri "/"] [unique_id "alxdf5nU1ySsD4Tkeg4cvgAAAbg"]
[Sat Jul 18 23:15:44.077547 2026] [security2:error] [pid 831031:tid 831227] [client 50.116.65.227:35862] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/South-Africa-Feature-Image-Day-6.jpg"] [unique_id "alxdgJnU1ySsD4Tkeg4c5gAAAdA"]
[Sat Jul 18 23:15:44.088779 2026] [security2:error] [pid 831031:tid 831183] [client 50.116.65.227:10052] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/South-Africa-Feature-Image-Day-6.jpg"] [unique_id "alxdgJnU1ySsD4Tkeg4c7AAAAaQ"]
[Sat Jul 18 23:15:44.133654 2026] [security2:error] [pid 831031:tid 831273] [client 31.171.130.45:37829] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/goods.php"] [unique_id "alxdgJnU1ySsD4Tkeg4c7gAAAf4"]
[Sat Jul 18 23:15:44.141048 2026] [security2:error] [pid 830701:tid 830943] [client 31.171.130.25:32239] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.com"] [uri "/style.php"] [unique_id "alxdgMu1nEoSSDHiOXa7jAAAAXo"]
[Sat Jul 18 23:15:44.205335 2026] [security2:error] [pid 830701:tid 830901] [client 65.0.26.70:20006] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.26.0.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxdgMu1nEoSSDHiOXa7jQAAAVA"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:15:44.257095 2026] [security2:error] [pid 831031:tid 831218] [client 45.86.203.45:46959] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/zwso.php"] [unique_id "alxdgJnU1ySsD4Tkeg4c8gAAAcc"]
[Sat Jul 18 23:15:44.394992 2026] [security2:error] [pid 831031:tid 831288] [client 31.171.130.12:20039] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.waterproofgoods.com"] [uri "/style.php"] [unique_id "alxdgJnU1ySsD4Tkeg4c9wAAAg0"]
[Sat Jul 18 23:15:44.478877 2026] [security2:error] [pid 831031:tid 831277] [client 31.171.130.48:56689] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/wp-editor.php"] [unique_id "alxdgJnU1ySsD4Tkeg4c_AAAAgI"]
[Sat Jul 18 23:15:44.520612 2026] [security2:error] [pid 831031:tid 831238] [client 31.171.130.11:57945] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.waterproofgoods.com"] [uri "/style.php"] [unique_id "alxdgJnU1ySsD4Tkeg4dAwAAAds"]
[Sat Jul 18 23:15:45.105268 2026] [security2:error] [pid 831031:tid 831191] [client 27.34.68.67:4688] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdgZnU1ySsD4Tkeg4dHAAAAaw"]
[Sat Jul 18 23:15:45.105366 2026] [security2:error] [pid 831031:tid 831191] [client 27.34.68.67:4688] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdgZnU1ySsD4Tkeg4dHAAAAaw"]
[Sat Jul 18 23:15:45.142391 2026] [security2:error] [pid 831031:tid 831253] [client 2406:2d40:76c8:3310:84c:6054:8659:c5a9:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "origine.nz"] [uri "/index.php"] [unique_id "alxdgJnU1ySsD4Tkeg4dBgAB6gI"], referer: https://origine.nz/visit/
[Sat Jul 18 23:15:45.151826 2026] [security2:error] [pid 830701:tid 830859] [client 31.171.130.18:63637] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/wp-editor.php"] [unique_id "alxdgcu1nEoSSDHiOXa7nwAAASY"]
[Sat Jul 18 23:15:45.318464 2026] [security2:error] [pid 831031:tid 831279] [client 45.86.203.70:54713] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxdgZnU1ySsD4Tkeg4dIgAAAgQ"]
[Sat Jul 18 23:15:45.953176 2026] [security2:error] [pid 831031:tid 831203] [client 119.154.81.234:64476] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdgZnU1ySsD4Tkeg4dQgAAAbg"]
[Sat Jul 18 23:15:45.953297 2026] [security2:error] [pid 831031:tid 831203] [client 119.154.81.234:64476] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdgZnU1ySsD4Tkeg4dQgAAAbg"]
[Sat Jul 18 23:15:45.996177 2026] [proxy:warn] [pid 830701:tid 830933] [client 34.38.46.249:38698] AH01092: no HTTP 0.9 request (with no host line) on incoming request and preserve host set forcing hostname to be upositive-co.youpositive.co for uri /400.shtml
[Sat Jul 18 23:15:45.996203 2026] [proxy:error] [pid 830701:tid 830933] (70014)End of file found: [client 34.38.46.249:38698] AH01095: prefetch request body failed to 127.0.0.1:8080 (127.0.0.1) from 34.38.46.249 ()
[Sat Jul 18 23:15:46.534181 2026] [security2:error] [pid 831031:tid 831287] [client 31.171.130.28:29753] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/lufix.php"] [unique_id "alxdgpnU1ySsD4Tkeg4dXgAAAgw"]
[Sat Jul 18 23:15:46.586896 2026] [security2:error] [pid 830701:tid 830799] [remote 152.228.213.32:49160] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxdgsu1nEoSSDHiOXa7yQABH2E"]
[Sat Jul 18 23:15:46.618997 2026] [core:error] [pid 830701:tid 830894] [client 34.38.46.249:38720] AH00135: Invalid method in request CXHZ / HTTP/1.1
[Sat Jul 18 23:15:46.630047 2026] [core:error] [pid 831031:tid 831259] [client 34.38.46.249:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:15:46.630065 2026] [core:error] [pid 831031:tid 831259] [client 34.38.46.249:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:15:46.633898 2026] [security2:error] [pid 830701:tid 830944] [client 190.245.146.99:60999] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdgsu1nEoSSDHiOXa7zAAAAXs"]
[Sat Jul 18 23:15:46.634023 2026] [security2:error] [pid 830701:tid 830944] [client 190.245.146.99:60999] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdgsu1nEoSSDHiOXa7zAAAAXs"]
[Sat Jul 18 23:15:47.001185 2026] [security2:error] [pid 830701:tid 830952] [client 223.178.210.203:19277] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdg8u1nEoSSDHiOXa70QAAAYM"]
[Sat Jul 18 23:15:47.001297 2026] [security2:error] [pid 830701:tid 830952] [client 223.178.210.203:19277] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdg8u1nEoSSDHiOXa70QAAAYM"]
[Sat Jul 18 23:15:47.044781 2026] [security2:error] [pid 830701:tid 830806] [remote 152.228.213.32:49160] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxdg8u1nEoSSDHiOXa70gABJ2g"], referer: https://sesamegreenbeans.com/wp-login.php
[Sat Jul 18 23:15:47.165759 2026] [security2:error] [pid 831031:tid 831211] [client 31.171.130.7:23935] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.waterproofgoods.com"] [uri "/style.php"] [unique_id "alxdg5nU1ySsD4Tkeg4dgQAAAcA"]
[Sat Jul 18 23:15:47.224669 2026] [security2:error] [pid 831031:tid 831172] [client 31.171.130.52:51929] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/lufix.php"] [unique_id "alxdg5nU1ySsD4Tkeg4diAAAAZk"]
[Sat Jul 18 23:15:47.529536 2026] [security2:error] [pid 831031:tid 831287] [client 113.160.97.242:64169] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxdg5nU1ySsD4Tkeg4dqwAAAgw"]
[Sat Jul 18 23:15:47.542008 2026] [security2:error] [pid 830701:tid 830916] [client 93.86.49.238:6777] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 238.49.86.93.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdg8u1nEoSSDHiOXa73gAAAV8"]
[Sat Jul 18 23:15:47.549703 2026] [security2:error] [pid 830701:tid 830916] [client 93.86.49.238:6777] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdg8u1nEoSSDHiOXa73gAAAV8"]
[Sat Jul 18 23:15:47.835042 2026] [security2:error] [pid 830701:tid 830953] [client 45.86.203.49:27909] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/bolt.php"] [unique_id "alxdg8u1nEoSSDHiOXa75wAAAYQ"]
[Sat Jul 18 23:15:47.973321 2026] [security2:error] [pid 831031:tid 831214] [client 34.73.232.127:20746] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "joulecommunications.com"] [uri "/wp-json/batch/v1"] [unique_id "alxdg5nU1ySsD4Tkeg4d3wAAAcM"]
[Sat Jul 18 23:15:48.551941 2026] [security2:error] [pid 831031:tid 831196] [client 34.73.232.127:20746] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "joulecommunications.com"] [uri "/"] [unique_id "alxdhJnU1ySsD4Tkeg4d-AAAAbE"]
[Sat Jul 18 23:15:48.613365 2026] [security2:error] [pid 831031:tid 831199] [client 65.111.28.252:27651] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 252.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxdhJnU1ySsD4Tkeg4d_gAAAbQ"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:15:48.660700 2026] [security2:error] [pid 830701:tid 830897] [client 103.48.44.9:57322] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdhMu1nEoSSDHiOXa7_AAAAUw"]
[Sat Jul 18 23:15:48.660869 2026] [security2:error] [pid 830701:tid 830897] [client 103.48.44.9:57322] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdhMu1nEoSSDHiOXa7_AAAAUw"]
[Sat Jul 18 23:15:48.852964 2026] [security2:error] [pid 831031:tid 831188] [client 199.96.164.225:14211] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "155"] [id "900406"] [msg "wp-login POST logging"] [data "200"] [hostname "rvprintfactory.com"] [uri "/wp-login.php"] [unique_id "alxdhJnU1ySsD4Tkeg4eBgABqQI"], referer: https://rvprintfactory.com/wp-login.php?redirect_to=https%3A%2F%2Fwww.rvprintfactory.com%2Fwp-admin%2F&reauth=1
[Sat Jul 18 23:15:48.998406 2026] [security2:error] [pid 831031:tid 831237] [client 45.86.203.46:48817] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/cjfuns.php"] [unique_id "alxdhJnU1ySsD4Tkeg4eJQAAAdo"]
[Sat Jul 18 23:15:49.170523 2026] [security2:error] [pid 831031:tid 831038] [remote 20.153.140.50:38304] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "insolario.com"] [uri "/wp-login.php"] [unique_id "alxdhZnU1ySsD4Tkeg4eMwAB1AU"]
[Sat Jul 18 23:15:49.513485 2026] [security2:error] [pid 831031:tid 831172] [client 199.96.164.225:14211] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "155"] [id "900406"] [msg "wp-login POST logging"] [data "200"] [hostname "rvprintfactory.com"] [uri "/wp-login.php"] [unique_id "alxdhZnU1ySsD4Tkeg4ePgABmTY"], referer: https://rvprintfactory.com/wp-login.php?redirect_to=https%3A%2F%2Fwww.rvprintfactory.com%2Fwp-admin%2F&reauth=1
[Sat Jul 18 23:15:49.673213 2026] [security2:error] [pid 831031:tid 831075] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdhZnU1ySsD4Tkeg4eSAABqio"]
[Sat Jul 18 23:15:49.673332 2026] [security2:error] [pid 831031:tid 831189] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdhZnU1ySsD4Tkeg4eSAABqio"]
[Sat Jul 18 23:15:49.746363 2026] [security2:error] [pid 831031:tid 831086] [remote 20.153.140.50:38304] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "insolario.com"] [uri "/wp-login.php"] [unique_id "alxdhZnU1ySsD4Tkeg4eTgABpzU"], referer: https://insolario.com/wp-login.php
[Sat Jul 18 23:15:49.836670 2026] [security2:error] [pid 830701:tid 830924] [client 31.171.130.3:52767] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "waterproofgoods.bln.noq.mybluehost.me"] [uri "/style.php"] [unique_id "alxdhcu1nEoSSDHiOXa8IAAAAWc"]
[Sat Jul 18 23:15:50.382517 2026] [security2:error] [pid 831031:tid 831280] [client 45.86.203.54:21449] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxdhpnU1ySsD4Tkeg4efQAAAgU"]
[Sat Jul 18 23:15:51.541277 2026] [security2:error] [pid 831031:tid 831288] [client 45.86.203.60:24121] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxdh5nU1ySsD4Tkeg4ezQAAAg0"]
[Sat Jul 18 23:15:51.776632 2026] [security2:error] [pid 831031:tid 831193] [client 138.0.247.157:44464] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 157.247.0.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "claysharecon.com"] [uri "/xmlrpc.php"] [unique_id "alxdh5nU1ySsD4Tkeg4e0gAAAa4"]
[Sat Jul 18 23:15:51.776784 2026] [security2:error] [pid 831031:tid 831193] [client 138.0.247.157:44464] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "claysharecon.com"] [uri "/xmlrpc.php"] [unique_id "alxdh5nU1ySsD4Tkeg4e0gAAAa4"]
[Sat Jul 18 23:15:52.176921 2026] [security2:error] [pid 831031:tid 831268] [client 124.29.246.106:52847] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdiJnU1ySsD4Tkeg4e4wAAAfk"]
[Sat Jul 18 23:15:52.177114 2026] [security2:error] [pid 831031:tid 831268] [client 124.29.246.106:52847] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdiJnU1ySsD4Tkeg4e4wAAAfk"]
[Sat Jul 18 23:15:52.356492 2026] [security2:error] [pid 830701:tid 830717] [remote 39.97.110.217:59654] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 217.110.97.39.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxdiMu1nEoSSDHiOXa8XAABZg8"]
[Sat Jul 18 23:15:52.926763 2026] [security2:error] [pid 831031:tid 831200] [client 45.86.203.59:59907] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/wp-content/index.php"] [unique_id "alxdiJnU1ySsD4Tkeg4fFgAAAbU"]
[Sat Jul 18 23:15:52.931238 2026] [security2:error] [pid 831031:tid 831068] [remote 31.42.184.154:58498] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/wp-login.php"] [unique_id "alxdiJnU1ySsD4Tkeg4fFwAB_yM"]
[Sat Jul 18 23:15:53.411180 2026] [security2:error] [pid 830701:tid 830841] [client 45.86.203.64:22647] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/ioxi-o.php"] [unique_id "alxdicu1nEoSSDHiOXa8cwAAARQ"]
[Sat Jul 18 23:15:53.471845 2026] [security2:error] [pid 830701:tid 830858] [client 223.185.61.63:22695] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdicu1nEoSSDHiOXa8dAAAASU"]
[Sat Jul 18 23:15:53.471960 2026] [security2:error] [pid 830701:tid 830858] [client 223.185.61.63:22695] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdicu1nEoSSDHiOXa8dAAAASU"]
[Sat Jul 18 23:15:53.652793 2026] [security2:error] [pid 831031:tid 831038] [remote 31.42.184.154:58498] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/wp-login.php"] [unique_id "alxdiZnU1ySsD4Tkeg4fLwABrAU"], referer: https://youpositive.co/wp-login.php
[Sat Jul 18 23:15:53.702191 2026] [security2:error] [pid 831031:tid 831167] [client 57.141.18.125:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxdiZnU1ySsD4Tkeg4fKQAAAZQ"]
[Sat Jul 18 23:15:53.796511 2026] [security2:error] [pid 831031:tid 831232] [client 65.0.26.70:14348] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.26.0.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxdiZnU1ySsD4Tkeg4fNwAAAdU"]
[Sat Jul 18 23:15:53.796612 2026] [security2:error] [pid 831031:tid 831232] [client 65.0.26.70:14348] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxdiZnU1ySsD4Tkeg4fNwAAAdU"]
[Sat Jul 18 23:15:54.229814 2026] [security2:error] [pid 831031:tid 831076] [remote 91.142.222.105:59016] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.nvy.ppp.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxdipnU1ySsD4Tkeg4fUQABkis"]
[Sat Jul 18 23:15:54.384214 2026] [security2:error] [pid 831031:tid 831268] [client 52.221.236.148:35622] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 148.236.221.52.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxdipnU1ySsD4Tkeg4fWAAAAfk"]
[Sat Jul 18 23:15:54.384389 2026] [security2:error] [pid 831031:tid 831268] [client 52.221.236.148:35622] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxdipnU1ySsD4Tkeg4fWAAAAfk"]
[Sat Jul 18 23:15:54.386292 2026] [security2:error] [pid 831031:tid 831213] [client 57.141.18.49:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "falconarrowshop.com"] [uri "/index.php"] [unique_id "alxdh5nU1ySsD4Tkeg4ewAAAAcI"]
[Sat Jul 18 23:15:54.658224 2026] [security2:error] [pid 831031:tid 831086] [remote 97.74.93.24:58188] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxdipnU1ySsD4Tkeg4faQAB2TU"]
[Sat Jul 18 23:15:54.661776 2026] [security2:error] [pid 831031:tid 831251] [client 45.86.203.42:26805] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/insc.php"] [unique_id "alxdipnU1ySsD4Tkeg4fagAAAeg"]
[Sat Jul 18 23:15:55.217023 2026] [security2:error] [pid 831031:tid 831111] [remote 97.74.93.24:58188] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxdi5nU1ySsD4Tkeg4fhQABoU4"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:15:55.677919 2026] [security2:error] [pid 831031:tid 831249] [client 217.181.90.104:19697] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.90.181.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxdi5nU1ySsD4Tkeg4foQAAAeY"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:15:55.688673 2026] [security2:error] [pid 830701:tid 830865] [client 27.34.68.67:4927] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdi8u1nEoSSDHiOXa8rQAAASw"]
[Sat Jul 18 23:15:55.688841 2026] [security2:error] [pid 830701:tid 830865] [client 27.34.68.67:4927] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdi8u1nEoSSDHiOXa8rQAAASw"]
[Sat Jul 18 23:15:55.816616 2026] [security2:error] [pid 831031:tid 831252] [client 45.86.203.65:26099] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/classwithtostring.php"] [unique_id "alxdi5nU1ySsD4Tkeg4fqQAAAek"]
[Sat Jul 18 23:15:55.874306 2026] [authz_core:error] [pid 831031:tid 831179] [client 161.118.233.30:0] AH01630: client denied by server configuration: /home2/laughio2/public_html/jenfarley/wp-includes/PHPMailer/error_log
[Sat Jul 18 23:15:56.125813 2026] [security2:error] [pid 831031:tid 831201] [client 171.4.232.110:58036] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdjJnU1ySsD4Tkeg4ftgAAAbY"]
[Sat Jul 18 23:15:56.125905 2026] [security2:error] [pid 831031:tid 831201] [client 171.4.232.110:58036] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdjJnU1ySsD4Tkeg4ftgAAAbY"]
[Sat Jul 18 23:15:56.499317 2026] [security2:error] [pid 831031:tid 831095] [remote 45.157.54.14:15163] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "wrapsbydb.nextlvlmarketingco.com"] [uri "/xmlrpc.php"] [unique_id "alxdjJnU1ySsD4Tkeg4fyQABvD4"]
[Sat Jul 18 23:15:56.499526 2026] [security2:error] [pid 831031:tid 831188] [client 119.154.81.234:64907] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdjJnU1ySsD4Tkeg4fygAAAak"]
[Sat Jul 18 23:15:56.499525 2026] [security2:error] [pid 831031:tid 831207] [client 45.157.54.14:15163] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "wrapsbydb.nextlvlmarketingco.com"] [uri "/xmlrpc.php"] [unique_id "alxdjJnU1ySsD4Tkeg4fyQABvD4"]
[Sat Jul 18 23:15:56.499631 2026] [security2:error] [pid 831031:tid 831188] [client 119.154.81.234:64907] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdjJnU1ySsD4Tkeg4fygAAAak"]
[Sat Jul 18 23:15:56.966244 2026] [security2:error] [pid 831031:tid 831118] [remote 97.74.93.24:35824] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.pfl.ail.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxdjJnU1ySsD4Tkeg4f5gAB51U"]
[Sat Jul 18 23:15:57.150639 2026] [security2:error] [pid 831031:tid 831209] [client 190.245.146.99:61505] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdjZnU1ySsD4Tkeg4f7gAAAb4"]
[Sat Jul 18 23:15:57.150757 2026] [security2:error] [pid 831031:tid 831209] [client 190.245.146.99:61505] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdjZnU1ySsD4Tkeg4f7gAAAb4"]
[Sat Jul 18 23:15:57.158991 2026] [security2:error] [pid 830701:tid 830949] [client 45.86.203.69:46069] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/txets.php"] [unique_id "alxdjcu1nEoSSDHiOXa8xQAAAYA"]
[Sat Jul 18 23:15:57.640790 2026] [security2:error] [pid 831031:tid 831152] [remote 97.74.93.24:35824] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.pfl.ail.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxdjZnU1ySsD4Tkeg4gCgABt3c"], referer: https://mail.pfl.ail.mybluehost.me/wp-login.php
[Sat Jul 18 23:15:57.703633 2026] [security2:error] [pid 830701:tid 830914] [client 223.178.210.203:4662] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdjcu1nEoSSDHiOXa80wAAAV0"]
[Sat Jul 18 23:15:57.703775 2026] [security2:error] [pid 830701:tid 830914] [client 223.178.210.203:4662] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdjcu1nEoSSDHiOXa80wAAAV0"]
[Sat Jul 18 23:15:57.911021 2026] [security2:error] [pid 831031:tid 831153] [remote 97.74.93.24:35834] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "omrobuildingcenter.com"] [uri "/wp-login.php"] [unique_id "alxdjZnU1ySsD4Tkeg4gFgABzng"]
[Sat Jul 18 23:15:58.139349 2026] [security2:error] [pid 831031:tid 831281] [client 45.86.203.67:31623] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxdjpnU1ySsD4Tkeg4gJgAAAgY"]
[Sat Jul 18 23:15:58.286514 2026] [security2:error] [pid 831031:tid 831158] [remote 97.74.93.24:35834] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "omrobuildingcenter.com"] [uri "/wp-login.php"] [unique_id "alxdjpnU1ySsD4Tkeg4gLgABtX0"], referer: https://omrobuildingcenter.com/wp-login.php
[Sat Jul 18 23:15:59.124104 2026] [security2:error] [pid 831031:tid 831191] [client 93.86.49.238:17407] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 238.49.86.93.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdj5nU1ySsD4Tkeg4gdgAAAaw"]
[Sat Jul 18 23:15:59.124204 2026] [security2:error] [pid 831031:tid 831191] [client 93.86.49.238:17407] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdj5nU1ySsD4Tkeg4gdgAAAaw"]
[Sat Jul 18 23:15:59.233064 2026] [security2:error] [pid 830701:tid 830954] [client 103.48.44.9:58126] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdj8u1nEoSSDHiOXa9EQAAAYU"]
[Sat Jul 18 23:15:59.233195 2026] [security2:error] [pid 830701:tid 830954] [client 103.48.44.9:58126] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdj8u1nEoSSDHiOXa9EQAAAYU"]
[Sat Jul 18 23:15:59.354088 2026] [security2:error] [pid 830701:tid 830752] [remote 20.153.140.50:58970] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "recruitinginsight.us"] [uri "/wp-login.php"] [unique_id "alxdj8u1nEoSSDHiOXa9FgABHTI"]
[Sat Jul 18 23:15:59.388436 2026] [security2:error] [pid 831031:tid 831128] [remote 8.217.108.67:21914] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/wp-login.php"] [unique_id "alxdj5nU1ySsD4Tkeg4gjQACCV8"]
[Sat Jul 18 23:15:59.398960 2026] [security2:error] [pid 831031:tid 831188] [client 45.86.203.68:39313] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/wp-admin/txets.php"] [unique_id "alxdj5nU1ySsD4Tkeg4gjwAAAak"]
[Sat Jul 18 23:15:59.862161 2026] [security2:error] [pid 831031:tid 831105] [remote 8.217.108.67:21914] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/wp-login.php"] [unique_id "alxdj5nU1ySsD4Tkeg4grAABskg"], referer: https://nevelow.com/wp-login.php
[Sat Jul 18 23:15:59.865424 2026] [security2:error] [pid 831031:tid 831208] [client 14.255.162.219:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "healthylifegourmet.org"] [uri "/index.php"] [unique_id "alxdj5nU1ySsD4Tkeg4gkgAAAb0"]
[Sat Jul 18 23:15:59.988821 2026] [proxy:error] [pid 831031:tid 831201] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:15:59.988885 2026] [proxy_http:error] [pid 831031:tid 831201] [client 193.47.62.168:49632] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:15:59.989320 2026] [proxy:error] [pid 831031:tid 831201] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:15:59.989348 2026] [proxy_http:error] [pid 831031:tid 831201] [client 193.47.62.168:49632] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:16:00.129675 2026] [security2:error] [pid 831031:tid 831096] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdkJnU1ySsD4Tkeg4gwQABrj8"]
[Sat Jul 18 23:16:00.129873 2026] [security2:error] [pid 831031:tid 831193] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdkJnU1ySsD4Tkeg4gwQABrj8"]
[Sat Jul 18 23:16:00.207442 2026] [security2:error] [pid 830701:tid 830761] [remote 20.153.140.50:58970] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "recruitinginsight.us"] [uri "/wp-login.php"] [unique_id "alxdkMu1nEoSSDHiOXa9LAABQTs"], referer: https://recruitinginsight.us/wp-login.php
[Sat Jul 18 23:16:00.221743 2026] [security2:error] [pid 831031:tid 831175] [client 34.147.91.161:8192] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "code.keyq8.com"] [uri "/"] [unique_id "alxdkJnU1ySsD4Tkeg4gzwAAAZw"]
[Sat Jul 18 23:16:00.221869 2026] [security2:error] [pid 831031:tid 831175] [client 34.147.91.161:8192] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "code.keyq8.com"] [uri "/"] [unique_id "alxdkJnU1ySsD4Tkeg4gzwAAAZw"]
[Sat Jul 18 23:16:00.999441 2026] [security2:error] [pid 831031:tid 831243] [client 45.86.203.49:51521] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/wp-includes/txets.php"] [unique_id "alxdkJnU1ySsD4Tkeg4g-gAAAeA"]
[Sat Jul 18 23:16:01.410805 2026] [security2:error] [pid 831031:tid 831269] [client 138.0.247.157:44261] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 157.247.0.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "claysharecon.com"] [uri "/xmlrpc.php"] [unique_id "alxdkZnU1ySsD4Tkeg4hDgAAAfo"]
[Sat Jul 18 23:16:01.410889 2026] [security2:error] [pid 831031:tid 831269] [client 138.0.247.157:44261] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "claysharecon.com"] [uri "/xmlrpc.php"] [unique_id "alxdkZnU1ySsD4Tkeg4hDgAAAfo"]
[Sat Jul 18 23:16:01.614876 2026] [security2:error] [pid 830701:tid 830770] [remote 152.228.213.32:59242] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxdkcu1nEoSSDHiOXa9SwABQkQ"]
[Sat Jul 18 23:16:01.914282 2026] [security2:error] [pid 830701:tid 830776] [remote 69.63.184.28:35526] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 28.184.63.69.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "areitoproducciones.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxdkcu1nEoSSDHiOXa9UQABhUo"], referer: https://areitoproducciones.com/instrumentos-virtuales/ap-trumpet/
[Sat Jul 18 23:16:02.143222 2026] [security2:error] [pid 830701:tid 830735] [remote 152.228.213.32:59242] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxdksu1nEoSSDHiOXa9VQABaCE"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:16:02.542917 2026] [authz_core:error] [pid 831031:tid 831278] [client 161.118.233.30:0] AH01630: client denied by server configuration: /home2/laughio2/public_html/jenfarley/wp-includes/IXR/error_log
[Sat Jul 18 23:16:03.141528 2026] [security2:error] [pid 831031:tid 831252] [client 65.0.26.70:65022] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.26.0.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxdk5nU1ySsD4Tkeg4haAAAAek"]
[Sat Jul 18 23:16:03.141605 2026] [security2:error] [pid 831031:tid 831252] [client 65.0.26.70:65022] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxdk5nU1ySsD4Tkeg4haAAAAek"]
[Sat Jul 18 23:16:03.317054 2026] [security2:error] [pid 831031:tid 831187] [client 13.250.107.25:38280] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.107.250.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxdk5nU1ySsD4Tkeg4hcQAAAag"]
[Sat Jul 18 23:16:03.454867 2026] [security2:error] [pid 830701:tid 830921] [client 45.86.203.5:51313] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/goods.php"] [unique_id "alxdk8u1nEoSSDHiOXa9eQAAAWQ"]
[Sat Jul 18 23:16:03.492772 2026] [security2:error] [pid 830701:tid 830891] [client 114.119.136.99:62035] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "keyq8.com"] [uri "/index.php"] [unique_id "alxdk8u1nEoSSDHiOXa9fAAAAUY"], referer: http://keyq8.com/
[Sat Jul 18 23:16:03.730936 2026] [security2:error] [pid 830701:tid 830785] [remote 45.157.54.14:22693] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "wrapsbydb.nextlvlmarketingco.com"] [uri "/xmlrpc.php"] [unique_id "alxdk8u1nEoSSDHiOXa9gwABDVM"]
[Sat Jul 18 23:16:03.731092 2026] [security2:error] [pid 830701:tid 830834] [client 45.157.54.14:22693] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "wrapsbydb.nextlvlmarketingco.com"] [uri "/xmlrpc.php"] [unique_id "alxdk8u1nEoSSDHiOXa9gwABDVM"]
[Sat Jul 18 23:16:04.099067 2026] [security2:error] [pid 830701:tid 830942] [client 223.185.61.63:28698] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdlMu1nEoSSDHiOXa9jgAAAXk"]
[Sat Jul 18 23:16:04.099169 2026] [security2:error] [pid 830701:tid 830942] [client 223.185.61.63:28698] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdlMu1nEoSSDHiOXa9jgAAAXk"]
[Sat Jul 18 23:16:04.278298 2026] [security2:error] [pid 831031:tid 831191] [client 18.141.144.104:58702] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.144.141.18.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxdlJnU1ySsD4Tkeg4hkwAAAaw"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:16:05.517599 2026] [security2:error] [pid 830701:tid 830847] [client 45.3.53.44:16931] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.53.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxdlcu1nEoSSDHiOXa9ywAAARo"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:16:05.736784 2026] [security2:error] [pid 831031:tid 831075] [remote 113.160.142.119:59110] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "petpawo.com"] [uri "/wp-login.php"] [unique_id "alxdlZnU1ySsD4Tkeg4hyQABsCo"]
[Sat Jul 18 23:16:06.101072 2026] [security2:error] [pid 831031:tid 831204] [client 45.86.203.57:22973] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/wp-editor.php"] [unique_id "alxdlpnU1ySsD4Tkeg4h1gAAAbk"]
[Sat Jul 18 23:16:06.216014 2026] [security2:error] [pid 831031:tid 831177] [client 27.34.68.67:1299] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdlpnU1ySsD4Tkeg4h3wAAAZ4"]
[Sat Jul 18 23:16:06.216110 2026] [security2:error] [pid 831031:tid 831177] [client 27.34.68.67:1299] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdlpnU1ySsD4Tkeg4h3wAAAZ4"]
[Sat Jul 18 23:16:06.225996 2026] [security2:error] [pid 831031:tid 831103] [remote 113.160.142.119:59110] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "petpawo.com"] [uri "/wp-login.php"] [unique_id "alxdlpnU1ySsD4Tkeg4h4QABukY"], referer: https://petpawo.com/wp-login.php
[Sat Jul 18 23:16:06.465074 2026] [security2:error] [pid 831031:tid 831201] [client 199.96.164.225:14211] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "rvprintfactory.com"] [uri "/index.php"] [unique_id "alxdlpnU1ySsD4Tkeg4h6AABtjM"]
[Sat Jul 18 23:16:07.012991 2026] [security2:error] [pid 831031:tid 831286] [client 119.154.81.234:65332] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdl5nU1ySsD4Tkeg4iAwAAAgs"]
[Sat Jul 18 23:16:07.013132 2026] [security2:error] [pid 831031:tid 831286] [client 119.154.81.234:65332] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdl5nU1ySsD4Tkeg4iAwAAAgs"]
[Sat Jul 18 23:16:07.018135 2026] [security2:error] [pid 830701:tid 830927] [client 171.4.232.110:36121] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdl8u1nEoSSDHiOXa-BAAAAWo"]
[Sat Jul 18 23:16:07.018279 2026] [security2:error] [pid 830701:tid 830927] [client 171.4.232.110:36121] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdl8u1nEoSSDHiOXa-BAAAAWo"]
[Sat Jul 18 23:16:07.320794 2026] [security2:error] [pid 831031:tid 831203] [client 45.3.45.216:45327] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxdl5nU1ySsD4Tkeg4iDwAAAbg"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:16:07.335608 2026] [security2:error] [pid 831031:tid 831233] [client 45.86.203.58:59923] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/lufix.php"] [unique_id "alxdl5nU1ySsD4Tkeg4iEQAAAdY"]
[Sat Jul 18 23:16:07.680169 2026] [security2:error] [pid 831031:tid 831259] [client 190.245.146.99:62015] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdl5nU1ySsD4Tkeg4iFgAAAfA"]
[Sat Jul 18 23:16:07.684506 2026] [security2:error] [pid 831031:tid 831259] [client 190.245.146.99:62015] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdl5nU1ySsD4Tkeg4iFgAAAfA"]
[Sat Jul 18 23:16:08.140019 2026] [security2:error] [pid 831031:tid 831131] [remote 31.42.184.154:36960] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxdmJnU1ySsD4Tkeg4iMAAB1WI"]
[Sat Jul 18 23:16:08.371042 2026] [security2:error] [pid 830701:tid 830871] [client 223.178.210.203:13514] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdmMu1nEoSSDHiOXa-PQAAATI"]
[Sat Jul 18 23:16:08.371154 2026] [security2:error] [pid 830701:tid 830871] [client 223.178.210.203:13514] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdmMu1nEoSSDHiOXa-PQAAATI"]
[Sat Jul 18 23:16:08.417185 2026] [security2:error] [pid 831031:tid 831197] [client 45.86.203.59:36171] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "serrawireless.com"] [uri "/style.php"] [unique_id "alxdmJnU1ySsD4Tkeg4iQQAAAbI"]
[Sat Jul 18 23:16:08.501240 2026] [security2:error] [pid 831031:tid 831221] [client 95.181.238.53:0] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "www.inspirespublishing.com"] [uri "/index.php"] [unique_id "alxdlpnU1ySsD4Tkeg4h_QAAAco"]
[Sat Jul 18 23:16:08.501272 2026] [security2:error] [pid 831031:tid 831221] [client 95.181.238.53:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.inspirespublishing.com"] [uri "/index.php"] [unique_id "alxdlpnU1ySsD4Tkeg4h_QAAAco"]
[Sat Jul 18 23:16:08.503952 2026] [security2:error] [pid 831031:tid 831268] [client 95.181.238.53:47663] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "www.inspirespublishing.com"] [uri "/robots.txt"] [unique_id "alxdlpnU1ySsD4Tkeg4h-wAAAfk"]
[Sat Jul 18 23:16:08.579171 2026] [security2:error] [pid 830701:tid 830782] [remote 152.228.213.32:52096] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxdmMu1nEoSSDHiOXa-RgABUVA"]
[Sat Jul 18 23:16:08.750229 2026] [security2:error] [pid 831031:tid 831108] [remote 31.42.184.154:36960] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxdmJnU1ySsD4Tkeg4iTAABx0s"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:16:08.942719 2026] [security2:error] [pid 831031:tid 831207] [client 95.181.238.53:0] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "inspirespublishing.com"] [uri "/index.php"] [unique_id "alxdmJnU1ySsD4Tkeg4iUAAAAbw"]
[Sat Jul 18 23:16:08.967720 2026] [security2:error] [pid 831031:tid 831234] [client 95.181.238.53:17272] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "inspirespublishing.com"] [uri "/robots.txt"] [unique_id "alxdmJnU1ySsD4Tkeg4iTgAAAdc"]
[Sat Jul 18 23:16:09.039258 2026] [security2:error] [pid 831031:tid 831209] [client 65.111.28.107:10199] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 107.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxdmZnU1ySsD4Tkeg4iVgAAAb4"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:16:09.456825 2026] [security2:error] [pid 830701:tid 830733] [remote 152.228.213.32:52096] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxdmcu1nEoSSDHiOXa-eAABOR8"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:16:09.463462 2026] [security2:error] [pid 830701:tid 830919] [client 95.181.238.53:0] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "www.inspirespublishing.com"] [uri "/index.php"] [unique_id "alxdmcu1nEoSSDHiOXa-cQAAAWI"]
[Sat Jul 18 23:16:09.465988 2026] [security2:error] [pid 830701:tid 830834] [client 95.181.238.53:39602] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "www.inspirespublishing.com"] [uri "/"] [unique_id "alxdmcu1nEoSSDHiOXa-awAAAQ0"]
[Sat Jul 18 23:16:09.752181 2026] [security2:error] [pid 830701:tid 830953] [client 103.48.44.9:58648] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdmcu1nEoSSDHiOXa-jwAAAYQ"]
[Sat Jul 18 23:16:09.752284 2026] [security2:error] [pid 830701:tid 830953] [client 103.48.44.9:58648] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdmcu1nEoSSDHiOXa-jwAAAYQ"]
[Sat Jul 18 23:16:09.845228 2026] [autoindex:error] [pid 830701:tid 830892] [client 170.106.84.136:33458] AH01276: Cannot serve directory /home1/thesums1/public_html/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: http://thesummercampstore.com
[Sat Jul 18 23:16:09.907437 2026] [security2:error] [pid 831031:tid 831162] [client 95.181.238.53:0] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "inspirespublishing.com"] [uri "/index.php"] [unique_id "alxdmZnU1ySsD4Tkeg4iaAAAAY8"]
[Sat Jul 18 23:16:09.931432 2026] [security2:error] [pid 831031:tid 831235] [client 95.181.238.53:17272] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "inspirespublishing.com"] [uri "/"] [unique_id "alxdmZnU1ySsD4Tkeg4iZgAAAdg"]
[Sat Jul 18 23:16:10.291846 2026] [security2:error] [pid 831031:tid 831213] [client 95.181.238.53:0] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "inspirespublishing.com"] [uri "/index.php"] [unique_id "alxdmpnU1ySsD4Tkeg4ifgAAAcI"]
[Sat Jul 18 23:16:10.293316 2026] [security2:error] [pid 831031:tid 831219] [client 95.181.238.53:17233] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "inspirespublishing.com"] [uri "/robots.txt"] [unique_id "alxdmpnU1ySsD4Tkeg4iegAAAcg"]
[Sat Jul 18 23:16:10.493369 2026] [security2:error] [pid 830701:tid 830835] [client 93.86.49.238:48076] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 238.49.86.93.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdmsu1nEoSSDHiOXa-qAAAAQ4"]
[Sat Jul 18 23:16:10.493470 2026] [security2:error] [pid 830701:tid 830835] [client 93.86.49.238:48076] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdmsu1nEoSSDHiOXa-qAAAAQ4"]
[Sat Jul 18 23:16:10.634632 2026] [security2:error] [pid 831031:tid 831234] [client 15.237.217.173:49528] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 173.217.237.15.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxdmpnU1ySsD4Tkeg4iiQAAAdc"]
[Sat Jul 18 23:16:10.682199 2026] [security2:error] [pid 831031:tid 831137] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdmpnU1ySsD4Tkeg4iigAB82g"]
[Sat Jul 18 23:16:10.682408 2026] [security2:error] [pid 831031:tid 831262] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdmpnU1ySsD4Tkeg4iigAB82g"]
[Sat Jul 18 23:16:11.283353 2026] [security2:error] [pid 831031:tid 831272] [client 95.181.238.53:25857] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "www.inspirespublishing.com"] [uri "/robots.txt"] [unique_id "alxdm5nU1ySsD4Tkeg4ikAAAAf0"]
[Sat Jul 18 23:16:11.391010 2026] [security2:error] [pid 831031:tid 831241] [client 95.181.238.53:25857] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "www.inspirespublishing.com"] [uri "/"] [unique_id "alxdm5nU1ySsD4Tkeg4ilQAAAd4"]
[Sat Jul 18 23:16:11.499657 2026] [security2:error] [pid 831031:tid 831230] [client 95.181.238.53:17233] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "inspirespublishing.com"] [uri "/wp-includes/js/jquery/jquery-migrate.min.js"] [unique_id "alxdm5nU1ySsD4Tkeg4imgAAAdM"]
[Sat Jul 18 23:16:11.503079 2026] [security2:error] [pid 830701:tid 830845] [client 65.111.28.68:10187] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 68.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxdm8u1nEoSSDHiOXa-1wAAARg"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:16:11.583412 2026] [security2:error] [pid 830701:tid 830851] [client 15.236.201.235:19114] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.201.236.15.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxdm8u1nEoSSDHiOXa-2gAAAR4"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:16:12.048474 2026] [security2:error] [pid 830701:tid 830877] [client 216.73.216.36:54667] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.project.jedalilly.com"] [uri "/index.php"] [unique_id "alxdmsu1nEoSSDHiOXa-ugABODE"]
[Sat Jul 18 23:16:12.189940 2026] [security2:error] [pid 830701:tid 830925] [client 138.0.247.157:44622] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 157.247.0.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "claysharecon.com"] [uri "/xmlrpc.php"] [unique_id "alxdnMu1nEoSSDHiOXa-9wAAAWg"]
[Sat Jul 18 23:16:12.190105 2026] [security2:error] [pid 830701:tid 830925] [client 138.0.247.157:44622] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "claysharecon.com"] [uri "/xmlrpc.php"] [unique_id "alxdnMu1nEoSSDHiOXa-9wAAAWg"]
[Sat Jul 18 23:16:12.763263 2026] [security2:error] [pid 831031:tid 831238] [client 95.181.238.53:0] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "inspirespublishing.com"] [uri "/index.php"] [unique_id "alxdnJnU1ySsD4Tkeg4itgAAAds"]
[Sat Jul 18 23:16:12.768372 2026] [security2:error] [pid 831031:tid 831222] [client 95.181.238.53:17233] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "inspirespublishing.com"] [uri "/contact/"] [unique_id "alxdnJnU1ySsD4Tkeg4iswAAAcs"]
[Sat Jul 18 23:16:13.185344 2026] [security2:error] [pid 831031:tid 831171] [client 124.29.246.106:65509] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdnZnU1ySsD4Tkeg4ixQAAAZg"]
[Sat Jul 18 23:16:13.185457 2026] [security2:error] [pid 831031:tid 831171] [client 124.29.246.106:65509] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdnZnU1ySsD4Tkeg4ixQAAAZg"]
[Sat Jul 18 23:16:13.487014 2026] [proxy:error] [pid 830701:tid 830933] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:16:13.487061 2026] [proxy_http:error] [pid 830701:tid 830933] [client 193.47.62.168:56400] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:16:13.487798 2026] [proxy:error] [pid 830701:tid 830933] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:16:13.487833 2026] [proxy_http:error] [pid 830701:tid 830933] [client 193.47.62.168:56400] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:16:13.724186 2026] [security2:error] [pid 831031:tid 831168] [client 84.17.43.213:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "undefeatedthe.com"] [uri "/wordpress/wp-includes/wlwmanifest.xml"] [unique_id "alxdnZnU1ySsD4Tkeg4iywAAAZU"]
[Sat Jul 18 23:16:13.905539 2026] [security2:error] [pid 831031:tid 831187] [client 84.17.43.213:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "undefeatedthe.com"] [uri "/website/wp-includes/wlwmanifest.xml"] [unique_id "alxdnZnU1ySsD4Tkeg4i1AAAAag"]
[Sat Jul 18 23:16:14.085491 2026] [security2:error] [pid 831031:tid 831167] [client 84.17.43.213:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "undefeatedthe.com"] [uri "/wp/wp-includes/wlwmanifest.xml"] [unique_id "alxdnpnU1ySsD4Tkeg4i8wAAAZQ"]
[Sat Jul 18 23:16:14.277107 2026] [security2:error] [pid 830701:tid 830934] [client 84.17.43.213:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "undefeatedthe.com"] [uri "/news/wp-includes/wlwmanifest.xml"] [unique_id "alxdnsu1nEoSSDHiOXa_TwAAAXE"]
[Sat Jul 18 23:16:14.279150 2026] [security2:error] [pid 831031:tid 831268] [client 95.181.238.53:17233] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "inspirespublishing.com"] [uri "/wp-includes/js/jquery/jquery.min.js"] [unique_id "alxdnpnU1ySsD4Tkeg4i_QAAAfk"]
[Sat Jul 18 23:16:14.479523 2026] [security2:error] [pid 831031:tid 831181] [client 84.17.43.213:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "undefeatedthe.com"] [uri "/2018/wp-includes/wlwmanifest.xml"] [unique_id "alxdnpnU1ySsD4Tkeg4jCgAAAaI"]
[Sat Jul 18 23:16:14.645511 2026] [security2:error] [pid 831031:tid 831046] [remote 57.141.18.80:20116] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.18.141.57.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/product/5076100"] [unique_id "alxdnpnU1ySsD4Tkeg4jEQACCQ0"]
[Sat Jul 18 23:16:14.675645 2026] [security2:error] [pid 831031:tid 831185] [client 84.17.43.213:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "undefeatedthe.com"] [uri "/2019/wp-includes/wlwmanifest.xml"] [unique_id "alxdnpnU1ySsD4Tkeg4jFAAAAaY"]
[Sat Jul 18 23:16:14.734584 2026] [security2:error] [pid 830701:tid 830899] [client 223.185.61.63:32980] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdnsu1nEoSSDHiOXa_YwAAAU4"]
[Sat Jul 18 23:16:14.734707 2026] [security2:error] [pid 830701:tid 830899] [client 223.185.61.63:32980] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdnsu1nEoSSDHiOXa_YwAAAU4"]
[Sat Jul 18 23:16:14.876205 2026] [security2:error] [pid 830701:tid 830915] [client 84.17.43.213:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "undefeatedthe.com"] [uri "/shop/wp-includes/wlwmanifest.xml"] [unique_id "alxdnsu1nEoSSDHiOXa_aQAAAV4"]
[Sat Jul 18 23:16:15.079640 2026] [security2:error] [pid 831031:tid 831266] [client 84.17.43.213:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "undefeatedthe.com"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "alxdn5nU1ySsD4Tkeg4jKwAAAfc"]
[Sat Jul 18 23:16:15.181768 2026] [security2:error] [pid 830701:tid 830811] [remote 31.42.184.154:46362] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "elitetax-mi.com"] [uri "/wp-login.php"] [unique_id "alxdn8u1nEoSSDHiOXa_cwABZ20"]
[Sat Jul 18 23:16:15.281945 2026] [security2:error] [pid 831031:tid 831280] [client 84.17.43.213:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "undefeatedthe.com"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "alxdn5nU1ySsD4Tkeg4jNwAAAgU"]
[Sat Jul 18 23:16:15.613400 2026] [security2:error] [pid 831031:tid 831254] [client 84.17.43.213:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "undefeatedthe.com"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "alxdn5nU1ySsD4Tkeg4jSQAAAes"]
[Sat Jul 18 23:16:15.806537 2026] [security2:error] [pid 831031:tid 831204] [client 84.17.43.213:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "undefeatedthe.com"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "alxdn5nU1ySsD4Tkeg4jWAAAAbk"]
[Sat Jul 18 23:16:15.991810 2026] [security2:error] [pid 830701:tid 830942] [client 95.181.238.53:0] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "inspirespublishing.com"] [uri "/index.php"] [unique_id "alxdn8u1nEoSSDHiOXa_gQAAAXk"]
[Sat Jul 18 23:16:16.006151 2026] [security2:error] [pid 830701:tid 830891] [client 84.17.43.213:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "undefeatedthe.com"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "alxdoMu1nEoSSDHiOXa_iQAAAUY"]
[Sat Jul 18 23:16:16.006809 2026] [security2:error] [pid 830701:tid 830878] [client 95.181.238.53:2052] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "inspirespublishing.com"] [uri "/about/"] [unique_id "alxdn8u1nEoSSDHiOXa_fgAAATk"]
[Sat Jul 18 23:16:16.074628 2026] [security2:error] [pid 830701:tid 830897] [client 122.63.145.191:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "littleaosta.nz"] [uri "/index.php"] [unique_id "alxdn8u1nEoSSDHiOXa_hgAAAUw"], referer: https://littleaosta.nz/
[Sat Jul 18 23:16:16.208742 2026] [security2:error] [pid 830701:tid 830926] [client 84.17.43.213:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "undefeatedthe.com"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "alxdoMu1nEoSSDHiOXa_jQAAAWk"]
[Sat Jul 18 23:16:16.247812 2026] [security2:error] [pid 830701:tid 830871] [client 222.254.243.229:56245] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "thewelloiledlife.com"] [uri "/index.php"] [unique_id "alxdoMu1nEoSSDHiOXa_jAAAATI"], referer: https://thewelloiledlife.com/
[Sat Jul 18 23:16:16.250118 2026] [security2:error] [pid 830701:tid 830800] [remote 31.42.184.154:46362] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "elitetax-mi.com"] [uri "/wp-login.php"] [unique_id "alxdoMu1nEoSSDHiOXa_jwABUmI"], referer: https://elitetax-mi.com/wp-login.php
[Sat Jul 18 23:16:16.390731 2026] [proxy:error] [pid 831031:tid 831264] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:16:16.390807 2026] [proxy_http:error] [pid 831031:tid 831264] [client 64.227.107.75:54258] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:16:16.391273 2026] [proxy:error] [pid 831031:tid 831264] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:16:16.391302 2026] [proxy_http:error] [pid 831031:tid 831264] [client 64.227.107.75:54258] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:16:16.405493 2026] [security2:error] [pid 830701:tid 830831] [client 84.17.43.213:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "undefeatedthe.com"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "alxdoMu1nEoSSDHiOXa_mAAAAQo"]
[Sat Jul 18 23:16:16.439078 2026] [proxy:error] [pid 830701:tid 830913] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:16:16.439132 2026] [proxy_http:error] [pid 830701:tid 830913] [client 64.227.107.75:54260] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: http://cpcalendars.koaconsultants.com/
[Sat Jul 18 23:16:16.439553 2026] [proxy:error] [pid 830701:tid 830913] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:16:16.439578 2026] [proxy_http:error] [pid 830701:tid 830913] [client 64.227.107.75:54260] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: http://cpcalendars.koaconsultants.com/
[Sat Jul 18 23:16:16.615066 2026] [core:error] [pid 831031:tid 831204] [client 64.227.107.75:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:16:16.615083 2026] [core:error] [pid 831031:tid 831204] [client 64.227.107.75:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:16:16.870809 2026] [security2:error] [pid 830701:tid 830847] [client 74.208.214.194:51158] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxdoMu1nEoSSDHiOXa_oQAAARo"]
[Sat Jul 18 23:16:16.878003 2026] [security2:error] [pid 830701:tid 830888] [client 27.34.68.67:33746] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdoMu1nEoSSDHiOXa_ogAAAUM"]
[Sat Jul 18 23:16:16.878097 2026] [security2:error] [pid 830701:tid 830888] [client 27.34.68.67:33746] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdoMu1nEoSSDHiOXa_ogAAAUM"]
[Sat Jul 18 23:16:17.345682 2026] [security2:error] [pid 830701:tid 830948] [client 95.181.238.53:2052] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "inspirespublishing.com"] [uri "/wp-content/plugins/bluehost-wordpress-plugin/vendor/newfold-labs/wp-module-performance/build/assets/link-prefetch.min.js"] [unique_id "alxdocu1nEoSSDHiOXa_qwAAAX8"]
[Sat Jul 18 23:16:17.449060 2026] [core:error] [pid 831031:tid 831232] [client 64.227.107.75:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace., referer: https://cpcalendars.koaconsultants.com/
[Sat Jul 18 23:16:17.449079 2026] [core:error] [pid 831031:tid 831232] [client 64.227.107.75:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace., referer: https://cpcalendars.koaconsultants.com/
[Sat Jul 18 23:16:17.563083 2026] [security2:error] [pid 830701:tid 830815] [remote 185.242.3.189:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 189.3.242.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "benbayly.co.nz"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "alxdocu1nEoSSDHiOXa_sgABVHE"], referer: www.google.com
[Sat Jul 18 23:16:17.569495 2026] [security2:error] [pid 830701:tid 830820] [remote 185.242.3.189:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 189.3.242.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "benbayly.co.nz"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "alxdocu1nEoSSDHiOXa_swABW3Y"]
[Sat Jul 18 23:16:17.575333 2026] [security2:error] [pid 831031:tid 831113] [remote 185.242.3.189:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 189.3.242.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "benbayly.co.nz"] [uri "/wp-plain.php"] [unique_id "alxdoZnU1ySsD4Tkeg4jxAAB61A"], referer: www.google.com
[Sat Jul 18 23:16:17.590270 2026] [security2:error] [pid 831031:tid 831231] [client 171.4.232.110:36441] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdoZnU1ySsD4Tkeg4jxgAAAdQ"]
[Sat Jul 18 23:16:17.590370 2026] [security2:error] [pid 831031:tid 831231] [client 171.4.232.110:36441] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdoZnU1ySsD4Tkeg4jxgAAAdQ"]
[Sat Jul 18 23:16:17.739324 2026] [security2:error] [pid 831031:tid 831173] [client 119.154.81.234:49386] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdoZnU1ySsD4Tkeg4jzwAAAZo"]
[Sat Jul 18 23:16:17.739418 2026] [security2:error] [pid 831031:tid 831173] [client 119.154.81.234:49386] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdoZnU1ySsD4Tkeg4jzwAAAZo"]
[Sat Jul 18 23:16:17.826405 2026] [security2:error] [pid 831031:tid 831224] [client 95.181.238.53:0] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "www.inspirespublishing.com"] [uri "/index.php"] [unique_id "alxdoZnU1ySsD4Tkeg4jzQAAAc0"]
[Sat Jul 18 23:16:17.828778 2026] [security2:error] [pid 831031:tid 831192] [client 95.181.238.53:30616] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "www.inspirespublishing.com"] [uri "/"] [unique_id "alxdoZnU1ySsD4Tkeg4jzAAAAa0"]
[Sat Jul 18 23:16:18.026366 2026] [security2:error] [pid 830701:tid 830936] [client 57.141.18.19:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxdocu1nEoSSDHiOXa_wQAAAXM"]
[Sat Jul 18 23:16:18.080916 2026] [security2:error] [pid 831031:tid 831279] [client 95.181.238.53:0] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "inspirespublishing.com"] [uri "/index.php"] [unique_id "alxdoZnU1ySsD4Tkeg4j3QAAAgQ"]
[Sat Jul 18 23:16:18.122020 2026] [security2:error] [pid 830701:tid 830754] [remote 185.242.3.189:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 189.3.242.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "benbayly.co.nz"] [uri "/crdcgpun.php"] [unique_id "alxdosu1nEoSSDHiOXa_zQABEjQ"], referer: www.google.com
[Sat Jul 18 23:16:18.139456 2026] [security2:error] [pid 831031:tid 831118] [remote 185.242.3.189:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 189.3.242.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "benbayly.co.nz"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "alxdopnU1ySsD4Tkeg4j4wABoVU"], referer: www.google.com
[Sat Jul 18 23:16:18.147523 2026] [security2:error] [pid 830701:tid 830925] [client 190.245.146.99:62529] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdosu1nEoSSDHiOXa_zgAAAWg"]
[Sat Jul 18 23:16:18.148973 2026] [security2:error] [pid 831031:tid 831129] [remote 185.242.3.189:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 189.3.242.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "benbayly.co.nz"] [uri "/wp-content/plugins/apikey/apikey.php"] [unique_id "alxdopnU1ySsD4Tkeg4j5AAB_mA"]
[Sat Jul 18 23:16:18.153242 2026] [security2:error] [pid 830701:tid 830925] [client 190.245.146.99:62529] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdosu1nEoSSDHiOXa_zgAAAWg"]
[Sat Jul 18 23:16:18.154295 2026] [security2:error] [pid 830701:tid 830874] [client 95.181.238.53:2052] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "inspirespublishing.com"] [uri "/"] [unique_id "alxdocu1nEoSSDHiOXa_xgAAASU"]
[Sat Jul 18 23:16:18.196671 2026] [security2:error] [pid 831031:tid 831149] [remote 97.74.93.24:36348] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "amalia-capital.com"] [uri "/wp-login.php"] [unique_id "alxdopnU1ySsD4Tkeg4j5QABu3Q"]
[Sat Jul 18 23:16:18.349273 2026] [security2:error] [pid 831031:tid 831150] [remote 185.242.3.189:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 189.3.242.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "benbayly.co.nz"] [uri "/plugins/content/apismtp/apismtp.php"] [unique_id "alxdopnU1ySsD4Tkeg4j-QABmXU"]
[Sat Jul 18 23:16:18.430294 2026] [security2:error] [pid 830701:tid 830881] [client 65.111.28.185:48443] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxdosu1nEoSSDHiOXa_0gAAATw"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:16:18.480158 2026] [security2:error] [pid 830701:tid 830845] [client 95.181.238.53:2052] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "inspirespublishing.com"] [uri "/wp-includes/js/jquery/jquery-migrate.min.js"] [unique_id "alxdosu1nEoSSDHiOXa_0wAAARg"]
[Sat Jul 18 23:16:18.561764 2026] [security2:error] [pid 830701:tid 830749] [remote 185.242.3.189:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 189.3.242.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "benbayly.co.nz"] [uri "/wp-content/plugins/apikey/apikey.php.suspected"] [unique_id "alxdosu1nEoSSDHiOXa_1QABHi8"]
[Sat Jul 18 23:16:18.748982 2026] [security2:error] [pid 830701:tid 830760] [remote 185.242.3.189:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 189.3.242.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "benbayly.co.nz"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "alxdosu1nEoSSDHiOXa_2gABOzo"]
[Sat Jul 18 23:16:18.798781 2026] [security2:error] [pid 831031:tid 831133] [remote 97.74.93.24:36348] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "amalia-capital.com"] [uri "/wp-login.php"] [unique_id "alxdopnU1ySsD4Tkeg4kCgAB3mQ"], referer: https://amalia-capital.com/wp-login.php
[Sat Jul 18 23:16:18.916265 2026] [security2:error] [pid 831031:tid 831194] [client 65.0.26.70:21480] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.26.0.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxdopnU1ySsD4Tkeg4kEAAAAa8"]
[Sat Jul 18 23:16:18.916367 2026] [security2:error] [pid 831031:tid 831194] [client 65.0.26.70:21480] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxdopnU1ySsD4Tkeg4kEAAAAa8"]
[Sat Jul 18 23:16:18.991651 2026] [security2:error] [pid 831031:tid 831164] [client 223.178.210.203:8695] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdopnU1ySsD4Tkeg4kEwAAAZE"]
[Sat Jul 18 23:16:18.991786 2026] [security2:error] [pid 831031:tid 831164] [client 223.178.210.203:8695] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdopnU1ySsD4Tkeg4kEwAAAZE"]
[Sat Jul 18 23:16:19.276682 2026] [security2:error] [pid 830701:tid 830783] [remote 8.217.108.67:28752] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.whiteoutcb.com"] [uri "/wp-login.php"] [unique_id "alxdo8u1nEoSSDHiOXa_5gABIlE"]
[Sat Jul 18 23:16:19.362303 2026] [security2:error] [pid 830701:tid 830862] [client 161.118.233.30:60467] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 30.233.118.161.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "jenfarley.com"] [uri "/wp-login.php"] [unique_id "alxdo8u1nEoSSDHiOXa_6AAAASk"]
[Sat Jul 18 23:16:19.614030 2026] [autoindex:error] [pid 831031:tid 831139] [remote 164.68.113.190:0] AH01276: Cannot serve directory /home3/dbnvkfmy/public_html/nzfoodstory/wp-content/uploads/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:16:19.672639 2026] [security2:error] [pid 830701:tid 830751] [remote 8.217.108.67:28752] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.whiteoutcb.com"] [uri "/wp-login.php"] [unique_id "alxdo8u1nEoSSDHiOXa_9AABYTE"], referer: https://mail.whiteoutcb.com/wp-login.php
[Sat Jul 18 23:16:19.742672 2026] [security2:error] [pid 831031:tid 831229] [client 95.181.238.53:0] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "inspirespublishing.com"] [uri "/index.php"] [unique_id "alxdo5nU1ySsD4Tkeg4kLgAAAdI"]
[Sat Jul 18 23:16:19.747911 2026] [security2:error] [pid 830701:tid 830943] [client 95.181.238.53:2052] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "inspirespublishing.com"] [uri "/about/"] [unique_id "alxdo8u1nEoSSDHiOXa_8gAAAXo"]
[Sat Jul 18 23:16:20.280445 2026] [security2:error] [pid 831031:tid 831165] [client 103.48.44.9:59155] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdpJnU1ySsD4Tkeg4kOgAAAZI"]
[Sat Jul 18 23:16:20.280533 2026] [security2:error] [pid 831031:tid 831165] [client 103.48.44.9:59155] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdpJnU1ySsD4Tkeg4kOgAAAZI"]
[Sat Jul 18 23:16:20.337461 2026] [security2:error] [pid 830701:tid 830885] [client 45.3.45.54:57723] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxdpMu1nEoSSDHiOXbACwAAAUA"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:16:20.636235 2026] [security2:error] [pid 831031:tid 831042] [remote 202.51.202.242:34786] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 242.202.51.202.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxdpJnU1ySsD4Tkeg4kRQABqAk"]
[Sat Jul 18 23:16:21.077238 2026] [security2:error] [pid 831031:tid 831062] [remote 202.51.202.242:34786] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 242.202.51.202.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxdpZnU1ySsD4Tkeg4kWQAB4B0"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:16:21.114305 2026] [security2:error] [pid 831031:tid 831061] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdpZnU1ySsD4Tkeg4kWwAB8Bw"]
[Sat Jul 18 23:16:21.114524 2026] [security2:error] [pid 831031:tid 831259] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdpZnU1ySsD4Tkeg4kWwAB8Bw"]
[Sat Jul 18 23:16:21.265431 2026] [security2:error] [pid 830701:tid 830847] [client 95.181.238.53:19888] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "inspirespublishing.com"] [uri "/wp-content/plugins/essential-addons-for-elementor-lite/assets/front-end/js/view/general.min.js"] [unique_id "alxdpcu1nEoSSDHiOXbALQAAARo"]
[Sat Jul 18 23:16:21.389148 2026] [security2:error] [pid 831031:tid 831257] [client 3.108.60.216:37234] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxdpZnU1ySsD4Tkeg4kYwAAAe4"]
[Sat Jul 18 23:16:21.734953 2026] [security2:error] [pid 831031:tid 831230] [client 93.86.49.238:47520] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 238.49.86.93.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdpZnU1ySsD4Tkeg4keAAAAdM"]
[Sat Jul 18 23:16:21.738674 2026] [security2:error] [pid 831031:tid 831230] [client 93.86.49.238:47520] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdpZnU1ySsD4Tkeg4keAAAAdM"]
[Sat Jul 18 23:16:22.414512 2026] [security2:error] [pid 831031:tid 831228] [client 65.111.28.192:29219] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 192.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxdppnU1ySsD4Tkeg4kmAAAAdE"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:16:22.515512 2026] [security2:error] [pid 830701:tid 830894] [client 95.181.238.53:23307] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "inspirespublishing.com"] [uri "/wp-includes/js/jquery/ui/core.min.js"] [unique_id "alxdpsu1nEoSSDHiOXbATAAAAUk"]
[Sat Jul 18 23:16:22.582957 2026] [security2:error] [pid 831031:tid 831236] [client 65.0.26.70:21488] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.26.0.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxdppnU1ySsD4Tkeg4koQAAAdk"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:16:22.670398 2026] [proxy:error] [pid 831031:tid 831212] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:16:22.670504 2026] [proxy_http:error] [pid 831031:tid 831212] [client 193.47.62.168:58386] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:16:22.671801 2026] [proxy:error] [pid 831031:tid 831212] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:16:22.671875 2026] [proxy_http:error] [pid 831031:tid 831212] [client 193.47.62.168:58386] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:16:22.818916 2026] [security2:error] [pid 830701:tid 830792] [remote 39.97.110.217:34988] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 217.110.97.39.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxdpsu1nEoSSDHiOXbAUwABEVo"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:16:22.831141 2026] [security2:error] [pid 830701:tid 830897] [client 138.0.247.157:44372] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 157.247.0.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "claysharecon.com"] [uri "/xmlrpc.php"] [unique_id "alxdpsu1nEoSSDHiOXbAVAAAAUw"]
[Sat Jul 18 23:16:22.831226 2026] [security2:error] [pid 830701:tid 830897] [client 138.0.247.157:44372] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "claysharecon.com"] [uri "/xmlrpc.php"] [unique_id "alxdpsu1nEoSSDHiOXbAVAAAAUw"]
[Sat Jul 18 23:16:22.904948 2026] [security2:error] [pid 831031:tid 831287] [client 103.161.153.189:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mtlegnews.gov"] [uri "/index.php"] [unique_id "alxdppnU1ySsD4Tkeg4kpAAAAgw"]
[Sat Jul 18 23:16:22.974925 2026] [security2:error] [pid 830701:tid 830948] [client 95.181.238.53:0] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "www.inspirespublishing.com"] [uri "/index.php"] [unique_id "alxdpsu1nEoSSDHiOXbAVQAAAX8"]
[Sat Jul 18 23:16:22.996640 2026] [security2:error] [pid 831031:tid 831253] [client 95.181.238.53:51478] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "www.inspirespublishing.com"] [uri "/"] [unique_id "alxdppnU1ySsD4Tkeg4ktAAAAeo"]
[Sat Jul 18 23:16:23.007657 2026] [security2:error] [pid 831031:tid 831187] [client 44.247.29.10:33356] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdppnU1ySsD4Tkeg4kuAAAAag"]
[Sat Jul 18 23:16:23.172388 2026] [autoindex:error] [pid 830701:tid 830793] [remote 164.68.113.190:0] AH01276: Cannot serve directory /home3/dbnvkfmy/public_html/nzfoodstory/wp-content/upgrade/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:16:23.186376 2026] [security2:error] [pid 831031:tid 831186] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/.env"] [unique_id "alxdp5nU1ySsD4Tkeg4kxgAAAac"]
[Sat Jul 18 23:16:23.216492 2026] [security2:error] [pid 830701:tid 830849] [client 124.29.207.185:54196] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdp8u1nEoSSDHiOXbAWgAAARw"]
[Sat Jul 18 23:16:23.216610 2026] [security2:error] [pid 830701:tid 830849] [client 124.29.207.185:54196] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdp8u1nEoSSDHiOXbAWgAAARw"]
[Sat Jul 18 23:16:23.329640 2026] [security2:error] [pid 831031:tid 831257] [client 44.247.29.10:33356] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdp5nU1ySsD4Tkeg4kyAAAAe4"]
[Sat Jul 18 23:16:23.458212 2026] [security2:error] [pid 831031:tid 831168] [client 44.247.29.10:33356] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdp5nU1ySsD4Tkeg4k0AAAAZU"]
[Sat Jul 18 23:16:23.577430 2026] [security2:error] [pid 830701:tid 830918] [client 95.181.238.53:0] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "inspirespublishing.com"] [uri "/index.php"] [unique_id "alxdp8u1nEoSSDHiOXbAYAAAAWE"]
[Sat Jul 18 23:16:23.616123 2026] [security2:error] [pid 831031:tid 831169] [client 44.247.29.10:33356] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdp5nU1ySsD4Tkeg4k1QAAAZY"]
[Sat Jul 18 23:16:23.647450 2026] [security2:error] [pid 831031:tid 831254] [client 95.181.238.53:16795] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "inspirespublishing.com"] [uri "/"] [unique_id "alxdp5nU1ySsD4Tkeg4k0gAAAes"]
[Sat Jul 18 23:16:23.756357 2026] [security2:error] [pid 831031:tid 831237] [client 44.247.29.10:33356] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdp5nU1ySsD4Tkeg4k4QAAAdo"]
[Sat Jul 18 23:16:23.886399 2026] [security2:error] [pid 831031:tid 831184] [client 44.247.29.10:33356] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdp5nU1ySsD4Tkeg4k6QAAAaU"]
[Sat Jul 18 23:16:24.013434 2026] [security2:error] [pid 831031:tid 831177] [client 44.247.29.10:33356] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdp5nU1ySsD4Tkeg4k8AAAAZ4"]
[Sat Jul 18 23:16:24.027728 2026] [security2:error] [pid 831031:tid 831280] [client 18.195.15.81:23586] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 81.15.195.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-comments-post.php"] [unique_id "alxdp5nU1ySsD4Tkeg4k8QAAAgU"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:16:24.048769 2026] [security2:error] [pid 831031:tid 831258] [client 95.181.238.53:35650] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "inspirespublishing.com"] [uri "/about/"] [unique_id "alxdqJnU1ySsD4Tkeg4k-QAAAe8"]
[Sat Jul 18 23:16:24.057192 2026] [security2:error] [pid 831031:tid 831206] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\.bak|\\\\.bak\\\\.php)$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1260"] [id "390582"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that nclude .bak)"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/.env.bak"] [unique_id "alxdqJnU1ySsD4Tkeg4k_AAAAbs"]
[Sat Jul 18 23:16:24.093608 2026] [security2:error] [pid 831031:tid 831280] [client 18.195.15.81:23586] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/wp-comments-post.php"] [unique_id "alxdp5nU1ySsD4Tkeg4k8QAAAgU"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:16:24.101123 2026] [security2:error] [pid 831031:tid 831238] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.backup$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1279"] [id "390588"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .backup)"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/.env.backup"] [unique_id "alxdqJnU1ySsD4Tkeg4lAAAAAds"]
[Sat Jul 18 23:16:24.235645 2026] [security2:error] [pid 831031:tid 831259] [client 44.247.29.10:33356] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdqJnU1ySsD4Tkeg4lAgAAAfA"]
[Sat Jul 18 23:16:24.279970 2026] [security2:error] [pid 831031:tid 831181] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.old$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1263"] [id "390583"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .old)"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/.env.old"] [unique_id "alxdqJnU1ySsD4Tkeg4lBQAAAaI"]
[Sat Jul 18 23:16:24.291280 2026] [security2:error] [pid 831031:tid 831235] [client 3.64.55.230:60694] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.55.64.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxdqJnU1ySsD4Tkeg4lBgAAAdg"]
[Sat Jul 18 23:16:24.408916 2026] [security2:error] [pid 831031:tid 831277] [client 44.247.29.10:33356] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdqJnU1ySsD4Tkeg4lCAAAAgI"]
[Sat Jul 18 23:16:24.546122 2026] [security2:error] [pid 831031:tid 831165] [client 44.247.29.10:33356] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdqJnU1ySsD4Tkeg4lDwAAAZI"]
[Sat Jul 18 23:16:24.678100 2026] [security2:error] [pid 831031:tid 831226] [client 44.247.29.10:33356] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdqJnU1ySsD4Tkeg4lFAAAAc8"]
[Sat Jul 18 23:16:24.808714 2026] [security2:error] [pid 831031:tid 831267] [client 44.247.29.10:33356] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdqJnU1ySsD4Tkeg4lGQAAAfg"]
[Sat Jul 18 23:16:24.935441 2026] [security2:error] [pid 831031:tid 831178] [client 44.247.29.10:33356] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdqJnU1ySsD4Tkeg4lHAAAAZ8"]
[Sat Jul 18 23:16:25.065165 2026] [security2:error] [pid 831031:tid 831286] [client 44.247.29.10:33356] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdqJnU1ySsD4Tkeg4lIgAAAgs"]
[Sat Jul 18 23:16:25.198848 2026] [security2:error] [pid 831031:tid 831197] [client 44.247.29.10:33356] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdqZnU1ySsD4Tkeg4lKwAAAbI"]
[Sat Jul 18 23:16:25.326268 2026] [security2:error] [pid 831031:tid 831253] [client 44.247.29.10:33356] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdqZnU1ySsD4Tkeg4lMQAAAeo"]
[Sat Jul 18 23:16:25.345634 2026] [security2:error] [pid 831031:tid 831184] [client 18.193.106.195:24358] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 195.106.193.18.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxdqZnU1ySsD4Tkeg4lMgAAAaU"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:16:25.463497 2026] [security2:error] [pid 831031:tid 831200] [client 44.247.29.10:33356] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdqZnU1ySsD4Tkeg4lOwAAAbU"]
[Sat Jul 18 23:16:25.464512 2026] [security2:error] [pid 831031:tid 831230] [client 223.185.61.63:27602] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdqZnU1ySsD4Tkeg4lQAAAAdM"]
[Sat Jul 18 23:16:25.464639 2026] [security2:error] [pid 831031:tid 831230] [client 223.185.61.63:27602] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdqZnU1ySsD4Tkeg4lQAAAAdM"]
[Sat Jul 18 23:16:25.599266 2026] [security2:error] [pid 831031:tid 831209] [client 44.247.29.10:33356] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdqZnU1ySsD4Tkeg4lQQAAAb4"]
[Sat Jul 18 23:16:25.729310 2026] [security2:error] [pid 831031:tid 831219] [client 44.247.29.10:33356] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdqZnU1ySsD4Tkeg4lRgAAAcg"]
[Sat Jul 18 23:16:25.753202 2026] [security2:error] [pid 830701:tid 830871] [client 16.148.117.254:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "mollycahill.com"] [uri "/index.php"] [unique_id "alxdqcu1nEoSSDHiOXbAhgAAATI"]
[Sat Jul 18 23:16:25.772487 2026] [security2:error] [pid 831031:tid 831278] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.sw[a-z]$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1275"] [id "390587"] [rev "5"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .sw)"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/.env.swp"] [unique_id "alxdqZnU1ySsD4Tkeg4lSwAAAgM"]
[Sat Jul 18 23:16:25.817561 2026] [security2:error] [pid 831031:tid 831168] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "[a-z0-9]~$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1257"] [id "390581"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data Leakage - attempt to access backup file (disable this rule if you require access to files that end with a tilde)"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/.env~"] [unique_id "alxdqZnU1ySsD4Tkeg4lTQAAAZU"]
[Sat Jul 18 23:16:25.949386 2026] [security2:error] [pid 831031:tid 831218] [client 44.247.29.10:33356] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdqZnU1ySsD4Tkeg4lTgAAAcc"]
[Sat Jul 18 23:16:26.082105 2026] [security2:error] [pid 831031:tid 831173] [client 44.247.29.10:33356] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdqZnU1ySsD4Tkeg4lVAAAAZo"]
[Sat Jul 18 23:16:26.209708 2026] [security2:error] [pid 831031:tid 831169] [client 44.247.29.10:33356] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdqpnU1ySsD4Tkeg4lVwAAAZY"]
[Sat Jul 18 23:16:26.340275 2026] [security2:error] [pid 831031:tid 831284] [client 44.247.29.10:33356] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdqpnU1ySsD4Tkeg4lXwAAAgk"]
[Sat Jul 18 23:16:26.475852 2026] [security2:error] [pid 831031:tid 831183] [client 44.247.29.10:33356] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdqpnU1ySsD4Tkeg4lYQAAAaQ"]
[Sat Jul 18 23:16:26.603785 2026] [security2:error] [pid 831031:tid 831196] [client 44.247.29.10:33356] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdqpnU1ySsD4Tkeg4laAAAAbE"]
[Sat Jul 18 23:16:26.737465 2026] [security2:error] [pid 831031:tid 831250] [client 44.247.29.10:33356] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdqpnU1ySsD4Tkeg4lbwAAAec"]
[Sat Jul 18 23:16:26.780698 2026] [security2:error] [pid 831031:tid 831170] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/app/.env"] [unique_id "alxdqpnU1ySsD4Tkeg4ldAAAAZc"]
[Sat Jul 18 23:16:26.823839 2026] [security2:error] [pid 831031:tid 831209] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/apps/.env"] [unique_id "alxdqpnU1ySsD4Tkeg4ldQAAAb4"]
[Sat Jul 18 23:16:26.867708 2026] [security2:error] [pid 831031:tid 831201] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/api/.env"] [unique_id "alxdqpnU1ySsD4Tkeg4leAAAAbY"]
[Sat Jul 18 23:16:26.910884 2026] [security2:error] [pid 831031:tid 831181] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/web/.env"] [unique_id "alxdqpnU1ySsD4Tkeg4lewAAAaI"]
[Sat Jul 18 23:16:26.954357 2026] [security2:error] [pid 831031:tid 831185] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/site/.env"] [unique_id "alxdqpnU1ySsD4Tkeg4lfAAAAaY"]
[Sat Jul 18 23:16:26.997251 2026] [security2:error] [pid 831031:tid 831235] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/public/.env"] [unique_id "alxdqpnU1ySsD4Tkeg4lfgAAAdg"]
[Sat Jul 18 23:16:27.136127 2026] [security2:error] [pid 831031:tid 831216] [client 44.247.29.10:33356] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdq5nU1ySsD4Tkeg4lggAAAcU"]
[Sat Jul 18 23:16:27.179444 2026] [security2:error] [pid 831031:tid 831269] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/backend/.env"] [unique_id "alxdq5nU1ySsD4Tkeg4liwAAAfo"]
[Sat Jul 18 23:16:27.221682 2026] [security2:error] [pid 831031:tid 831165] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/server/.env"] [unique_id "alxdq5nU1ySsD4Tkeg4ljAAAAZI"]
[Sat Jul 18 23:16:27.263650 2026] [security2:error] [pid 831031:tid 831199] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/frontend/.env"] [unique_id "alxdq5nU1ySsD4Tkeg4lkQAAAbQ"]
[Sat Jul 18 23:16:27.306353 2026] [security2:error] [pid 831031:tid 831222] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/src/.env"] [unique_id "alxdq5nU1ySsD4Tkeg4lkgAAAcs"]
[Sat Jul 18 23:16:27.349198 2026] [security2:error] [pid 831031:tid 831279] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/core/.env"] [unique_id "alxdq5nU1ySsD4Tkeg4llAAAAgQ"]
[Sat Jul 18 23:16:27.391530 2026] [security2:error] [pid 831031:tid 831255] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/core/app/.env"] [unique_id "alxdq5nU1ySsD4Tkeg4llQAAAew"]
[Sat Jul 18 23:16:27.422779 2026] [security2:error] [pid 831031:tid 831276] [client 27.34.68.67:52519] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdq5nU1ySsD4Tkeg4llgAAAgE"]
[Sat Jul 18 23:16:27.422857 2026] [security2:error] [pid 831031:tid 831276] [client 27.34.68.67:52519] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdq5nU1ySsD4Tkeg4llgAAAgE"]
[Sat Jul 18 23:16:27.433406 2026] [security2:error] [pid 831031:tid 831249] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/config/.env"] [unique_id "alxdq5nU1ySsD4Tkeg4lmAAAAeY"]
[Sat Jul 18 23:16:27.476679 2026] [security2:error] [pid 831031:tid 831242] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/private/.env"] [unique_id "alxdq5nU1ySsD4Tkeg4lmQAAAd8"]
[Sat Jul 18 23:16:27.518768 2026] [security2:error] [pid 831031:tid 831257] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/application/.env"] [unique_id "alxdq5nU1ySsD4Tkeg4lmwAAAe4"]
[Sat Jul 18 23:16:27.563409 2026] [security2:error] [pid 831031:tid 831263] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/bootstrap/.env"] [unique_id "alxdq5nU1ySsD4Tkeg4lngAAAfQ"]
[Sat Jul 18 23:16:27.605262 2026] [security2:error] [pid 831031:tid 831265] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/database/.env"] [unique_id "alxdq5nU1ySsD4Tkeg4loAAAAfY"]
[Sat Jul 18 23:16:27.647791 2026] [security2:error] [pid 831031:tid 831241] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/storage/.env"] [unique_id "alxdq5nU1ySsD4Tkeg4lpAAAAd4"]
[Sat Jul 18 23:16:27.690691 2026] [security2:error] [pid 831031:tid 831214] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/var/www/.env"] [unique_id "alxdq5nU1ySsD4Tkeg4lpwAAAcM"]
[Sat Jul 18 23:16:27.733049 2026] [security2:error] [pid 831031:tid 831166] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/var/www/html/.env"] [unique_id "alxdq5nU1ySsD4Tkeg4lrQAAAZM"]
[Sat Jul 18 23:16:27.776130 2026] [security2:error] [pid 831031:tid 831187] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/current/.env"] [unique_id "alxdq5nU1ySsD4Tkeg4lrwAAAag"]
[Sat Jul 18 23:16:27.818616 2026] [security2:error] [pid 831031:tid 831239] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/release/.env"] [unique_id "alxdq5nU1ySsD4Tkeg4lsQAAAdw"]
[Sat Jul 18 23:16:27.861705 2026] [security2:error] [pid 831031:tid 831225] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/releases/.env"] [unique_id "alxdq5nU1ySsD4Tkeg4lsgAAAc4"]
[Sat Jul 18 23:16:27.904907 2026] [security2:error] [pid 831031:tid 831164] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/shared/.env"] [unique_id "alxdq5nU1ySsD4Tkeg4ltQAAAZE"]
[Sat Jul 18 23:16:27.949019 2026] [security2:error] [pid 831031:tid 831262] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/deploy/.env"] [unique_id "alxdq5nU1ySsD4Tkeg4ltwAAAfM"]
[Sat Jul 18 23:16:27.992521 2026] [security2:error] [pid 831031:tid 831268] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/build/.env"] [unique_id "alxdq5nU1ySsD4Tkeg4lugAAAfk"]
[Sat Jul 18 23:16:28.035695 2026] [security2:error] [pid 831031:tid 831200] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/dist/.env"] [unique_id "alxdrJnU1ySsD4Tkeg4luwAAAbU"]
[Sat Jul 18 23:16:28.077991 2026] [security2:error] [pid 831031:tid 831170] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/public_html/.env"] [unique_id "alxdrJnU1ySsD4Tkeg4lvQAAAZc"]
[Sat Jul 18 23:16:28.120381 2026] [security2:error] [pid 831031:tid 831171] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/htdocs/.env"] [unique_id "alxdrJnU1ySsD4Tkeg4lvgAAAZg"]
[Sat Jul 18 23:16:28.163945 2026] [security2:error] [pid 831031:tid 831259] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/www/.env"] [unique_id "alxdrJnU1ySsD4Tkeg4lwAAAAfA"]
[Sat Jul 18 23:16:28.207217 2026] [security2:error] [pid 831031:tid 831209] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/html/.env"] [unique_id "alxdrJnU1ySsD4Tkeg4lwQAAAb4"]
[Sat Jul 18 23:16:28.250589 2026] [security2:error] [pid 831031:tid 831248] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/live/.env"] [unique_id "alxdrJnU1ySsD4Tkeg4lwwAAAeU"]
[Sat Jul 18 23:16:28.289454 2026] [security2:error] [pid 831031:tid 831281] [client 119.154.81.234:49834] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdrJnU1ySsD4Tkeg4lxAAAAgY"]
[Sat Jul 18 23:16:28.289538 2026] [security2:error] [pid 831031:tid 831281] [client 119.154.81.234:49834] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdrJnU1ySsD4Tkeg4lxAAAAgY"]
[Sat Jul 18 23:16:28.293639 2026] [security2:error] [pid 831031:tid 831258] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/prod/.env"] [unique_id "alxdrJnU1ySsD4Tkeg4lxQAAAe8"]
[Sat Jul 18 23:16:28.336867 2026] [security2:error] [pid 831031:tid 831206] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/dev/.env"] [unique_id "alxdrJnU1ySsD4Tkeg4lxgAAAbs"]
[Sat Jul 18 23:16:28.380916 2026] [security2:error] [pid 831031:tid 831233] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/staging/.env"] [unique_id "alxdrJnU1ySsD4Tkeg4lygAAAdY"]
[Sat Jul 18 23:16:28.382487 2026] [security2:error] [pid 831031:tid 831076] [remote 152.228.213.32:55154] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxdrJnU1ySsD4Tkeg4lyAACBSs"]
[Sat Jul 18 23:16:28.424722 2026] [security2:error] [pid 831031:tid 831245] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/opt/.env"] [unique_id "alxdrJnU1ySsD4Tkeg4lywAAAeI"]
[Sat Jul 18 23:16:28.467825 2026] [security2:error] [pid 831031:tid 831216] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/laravel/.env"] [unique_id "alxdrJnU1ySsD4Tkeg4lzgAAAcU"]
[Sat Jul 18 23:16:28.483054 2026] [security2:error] [pid 830701:tid 830897] [client 171.4.232.110:59551] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdrMu1nEoSSDHiOXbBBQAAAUw"]
[Sat Jul 18 23:16:28.483167 2026] [security2:error] [pid 830701:tid 830897] [client 171.4.232.110:59551] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdrMu1nEoSSDHiOXbBBQAAAUw"]
[Sat Jul 18 23:16:28.510557 2026] [security2:error] [pid 831031:tid 831277] [client 44.247.29.10:33356] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/symfony/.env"] [unique_id "alxdrJnU1ySsD4Tkeg4l1AAAAgI"]
[Sat Jul 18 23:16:28.635455 2026] [security2:error] [pid 830701:tid 830892] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/wordpress/.env"] [unique_id "alxdrMu1nEoSSDHiOXbBCQAAAUc"]
[Sat Jul 18 23:16:28.675629 2026] [security2:error] [pid 831031:tid 831275] [client 190.245.146.99:63041] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdrJnU1ySsD4Tkeg4l3gAAAgA"]
[Sat Jul 18 23:16:28.677606 2026] [security2:error] [pid 830701:tid 830911] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/wp/.env"] [unique_id "alxdrMu1nEoSSDHiOXbBCwAAAVo"]
[Sat Jul 18 23:16:28.681222 2026] [security2:error] [pid 831031:tid 831275] [client 190.245.146.99:63041] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdrJnU1ySsD4Tkeg4l3gAAAgA"]
[Sat Jul 18 23:16:28.720528 2026] [security2:error] [pid 830701:tid 830912] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/cms/.env"] [unique_id "alxdrMu1nEoSSDHiOXbBDQAAAVs"]
[Sat Jul 18 23:16:28.721544 2026] [security2:error] [pid 830701:tid 830872] [client 62.150.67.110:48535] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "ali-alghanim.net"] [uri "/index.php"] [unique_id "alxdrMu1nEoSSDHiOXbBBAAAATM"]
[Sat Jul 18 23:16:28.762620 2026] [security2:error] [pid 830701:tid 830920] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/drupal/.env"] [unique_id "alxdrMu1nEoSSDHiOXbBDwAAAWM"]
[Sat Jul 18 23:16:28.804718 2026] [security2:error] [pid 830701:tid 830905] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/joomla/.env"] [unique_id "alxdrMu1nEoSSDHiOXbBEQAAAVQ"]
[Sat Jul 18 23:16:28.847729 2026] [security2:error] [pid 830701:tid 830837] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/magento/.env"] [unique_id "alxdrMu1nEoSSDHiOXbBFQAAARA"]
[Sat Jul 18 23:16:28.889326 2026] [security2:error] [pid 830701:tid 830929] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/shopify/.env"] [unique_id "alxdrMu1nEoSSDHiOXbBFgAAAWw"]
[Sat Jul 18 23:16:28.931399 2026] [security2:error] [pid 830701:tid 830879] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/prestashop/.env"] [unique_id "alxdrMu1nEoSSDHiOXbBGgAAATo"]
[Sat Jul 18 23:16:28.973475 2026] [security2:error] [pid 830701:tid 830931] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/codeigniter/.env"] [unique_id "alxdrMu1nEoSSDHiOXbBGwAAAW4"]
[Sat Jul 18 23:16:29.003484 2026] [security2:error] [pid 831031:tid 831086] [remote 152.228.213.32:55154] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxdrJnU1ySsD4Tkeg4l6AAB3jU"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:16:29.015542 2026] [security2:error] [pid 830701:tid 830860] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/cakephp/.env"] [unique_id "alxdrcu1nEoSSDHiOXbBHAAAASc"]
[Sat Jul 18 23:16:29.058604 2026] [security2:error] [pid 830701:tid 830909] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/zend/.env"] [unique_id "alxdrcu1nEoSSDHiOXbBHQAAAVg"]
[Sat Jul 18 23:16:29.100582 2026] [security2:error] [pid 830701:tid 830906] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/yii/.env"] [unique_id "alxdrcu1nEoSSDHiOXbBHwAAAVU"]
[Sat Jul 18 23:16:29.141714 2026] [security2:error] [pid 830701:tid 830891] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/laravel5/.env"] [unique_id "alxdrcu1nEoSSDHiOXbBIwAAAUY"]
[Sat Jul 18 23:16:29.184018 2026] [security2:error] [pid 830701:tid 830856] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/v1/.env"] [unique_id "alxdrcu1nEoSSDHiOXbBJQAAASM"]
[Sat Jul 18 23:16:29.225791 2026] [security2:error] [pid 830701:tid 830844] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/v2/.env"] [unique_id "alxdrcu1nEoSSDHiOXbBJwAAARc"]
[Sat Jul 18 23:16:29.267463 2026] [security2:error] [pid 830701:tid 830942] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/v3/.env"] [unique_id "alxdrcu1nEoSSDHiOXbBKgAAAXk"]
[Sat Jul 18 23:16:29.309474 2026] [security2:error] [pid 830701:tid 830917] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/api/v1/.env"] [unique_id "alxdrcu1nEoSSDHiOXbBKwAAAWA"]
[Sat Jul 18 23:16:29.351580 2026] [security2:error] [pid 830701:tid 830925] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/api/v2/.env"] [unique_id "alxdrcu1nEoSSDHiOXbBLAAAAWg"]
[Sat Jul 18 23:16:29.393723 2026] [security2:error] [pid 830701:tid 830831] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/rest/.env"] [unique_id "alxdrcu1nEoSSDHiOXbBLQAAAQo"]
[Sat Jul 18 23:16:29.436087 2026] [security2:error] [pid 830701:tid 830874] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/graphql/.env"] [unique_id "alxdrcu1nEoSSDHiOXbBLgAAATU"]
[Sat Jul 18 23:16:29.478355 2026] [security2:error] [pid 830701:tid 830876] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/gateway/.env"] [unique_id "alxdrcu1nEoSSDHiOXbBLwAAATc"]
[Sat Jul 18 23:16:29.520649 2026] [security2:error] [pid 830701:tid 830845] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/microservice/.env"] [unique_id "alxdrcu1nEoSSDHiOXbBMAAAARg"]
[Sat Jul 18 23:16:29.562459 2026] [security2:error] [pid 830701:tid 830926] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/service/.env"] [unique_id "alxdrcu1nEoSSDHiOXbBMQAAAWk"]
[Sat Jul 18 23:16:29.604785 2026] [security2:error] [pid 830701:tid 830902] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/api/v3/.env"] [unique_id "alxdrcu1nEoSSDHiOXbBNAAAAVE"]
[Sat Jul 18 23:16:29.646407 2026] [security2:error] [pid 830701:tid 830894] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/api/dev/.env"] [unique_id "alxdrcu1nEoSSDHiOXbBOAAAAUk"]
[Sat Jul 18 23:16:29.688288 2026] [security2:error] [pid 830701:tid 830861] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/api/staging/.env"] [unique_id "alxdrcu1nEoSSDHiOXbBOwAAASg"]
[Sat Jul 18 23:16:29.720905 2026] [security2:error] [pid 830701:tid 830833] [client 223.178.210.203:28994] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdrcu1nEoSSDHiOXbBPQAAAQw"]
[Sat Jul 18 23:16:29.721041 2026] [security2:error] [pid 830701:tid 830833] [client 223.178.210.203:28994] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdrcu1nEoSSDHiOXbBPQAAAQw"]
[Sat Jul 18 23:16:29.730132 2026] [security2:error] [pid 830701:tid 830887] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/vendor/.env"] [unique_id "alxdrcu1nEoSSDHiOXbBPgAAAUI"]
[Sat Jul 18 23:16:29.771778 2026] [security2:error] [pid 830701:tid 830832] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/lib/.env"] [unique_id "alxdrcu1nEoSSDHiOXbBQQAAAQs"]
[Sat Jul 18 23:16:29.814080 2026] [security2:error] [pid 830701:tid 830858] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/resources/.env"] [unique_id "alxdrcu1nEoSSDHiOXbBQgAAASU"]
[Sat Jul 18 23:16:29.856838 2026] [security2:error] [pid 830701:tid 830916] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/assets/.env"] [unique_id "alxdrcu1nEoSSDHiOXbBQwAAAV8"]
[Sat Jul 18 23:16:29.899598 2026] [security2:error] [pid 830701:tid 830842] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/uploads/.env"] [unique_id "alxdrcu1nEoSSDHiOXbBRQAAARU"]
[Sat Jul 18 23:16:29.941953 2026] [security2:error] [pid 830701:tid 830914] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/internal/.env"] [unique_id "alxdrcu1nEoSSDHiOXbBSgAAAV0"]
[Sat Jul 18 23:16:29.983865 2026] [security2:error] [pid 830701:tid 830838] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/tools/.env"] [unique_id "alxdrcu1nEoSSDHiOXbBTAAAARE"]
[Sat Jul 18 23:16:30.025840 2026] [security2:error] [pid 830701:tid 830862] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/scripts/.env"] [unique_id "alxdrsu1nEoSSDHiOXbBTwAAASk"]
[Sat Jul 18 23:16:30.067590 2026] [security2:error] [pid 830701:tid 830863] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/bin/.env"] [unique_id "alxdrsu1nEoSSDHiOXbBUAAAASo"]
[Sat Jul 18 23:16:30.109600 2026] [security2:error] [pid 830701:tid 830944] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/sbin/.env"] [unique_id "alxdrsu1nEoSSDHiOXbBUgAAAXs"]
[Sat Jul 18 23:16:30.151843 2026] [security2:error] [pid 830701:tid 830922] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/local/.env"] [unique_id "alxdrsu1nEoSSDHiOXbBUwAAAWU"]
[Sat Jul 18 23:16:30.193715 2026] [security2:error] [pid 830701:tid 830848] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/portal/.env"] [unique_id "alxdrsu1nEoSSDHiOXbBVAAAARs"]
[Sat Jul 18 23:16:30.234891 2026] [security2:error] [pid 830701:tid 830886] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/dashboard/.env"] [unique_id "alxdrsu1nEoSSDHiOXbBWAAAAUE"]
[Sat Jul 18 23:16:30.276040 2026] [security2:error] [pid 830701:tid 830851] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/panel/.env"] [unique_id "alxdrsu1nEoSSDHiOXbBXAAAAR4"]
[Sat Jul 18 23:16:30.285261 2026] [security2:error] [pid 831031:tid 831211] [client 43.165.65.117:47662] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "techtradeinc.com"] [uri "/index.php"] [unique_id "alxdrZnU1ySsD4Tkeg4l_AAAAcA"], referer: https://techtradeinc.com/
[Sat Jul 18 23:16:30.317700 2026] [security2:error] [pid 830701:tid 830907] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/crm/.env"] [unique_id "alxdrsu1nEoSSDHiOXbBXwAAAVY"]
[Sat Jul 18 23:16:30.359778 2026] [security2:error] [pid 830701:tid 830849] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/erp/.env"] [unique_id "alxdrsu1nEoSSDHiOXbBZAAAARw"]
[Sat Jul 18 23:16:30.403082 2026] [security2:error] [pid 830701:tid 830897] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/shop/.env"] [unique_id "alxdrsu1nEoSSDHiOXbBZQAAAUw"]
[Sat Jul 18 23:16:30.444782 2026] [security2:error] [pid 830701:tid 830915] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/store/.env"] [unique_id "alxdrsu1nEoSSDHiOXbBZwAAAV4"]
[Sat Jul 18 23:16:30.487398 2026] [security2:error] [pid 830701:tid 830945] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/saas/.env"] [unique_id "alxdrsu1nEoSSDHiOXbBaAAAAXw"]
[Sat Jul 18 23:16:30.528921 2026] [security2:error] [pid 830701:tid 830936] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/client/.env"] [unique_id "alxdrsu1nEoSSDHiOXbBaQAAAXM"]
[Sat Jul 18 23:16:30.571365 2026] [security2:error] [pid 830701:tid 830889] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/project/.env"] [unique_id "alxdrsu1nEoSSDHiOXbBagAAAUQ"]
[Sat Jul 18 23:16:30.613616 2026] [security2:error] [pid 830701:tid 830911] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/admin-panel/.env"] [unique_id "alxdrsu1nEoSSDHiOXbBawAAAVo"]
[Sat Jul 18 23:16:30.655289 2026] [security2:error] [pid 830701:tid 830912] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/control-panel/.env"] [unique_id "alxdrsu1nEoSSDHiOXbBbAAAAVs"]
[Sat Jul 18 23:16:30.697072 2026] [security2:error] [pid 830701:tid 830939] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/user-panel/.env"] [unique_id "alxdrsu1nEoSSDHiOXbBbgAAAXY"]
[Sat Jul 18 23:16:30.738604 2026] [security2:error] [pid 830701:tid 830867] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/node/.env"] [unique_id "alxdrsu1nEoSSDHiOXbBcAAAAS4"]
[Sat Jul 18 23:16:30.780570 2026] [security2:error] [pid 830701:tid 830923] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/express/.env"] [unique_id "alxdrsu1nEoSSDHiOXbBcgAAAWY"]
[Sat Jul 18 23:16:30.806691 2026] [security2:error] [pid 830701:tid 830871] [client 103.48.44.9:59672] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdrsu1nEoSSDHiOXbBdQAAATI"]
[Sat Jul 18 23:16:30.807033 2026] [security2:error] [pid 830701:tid 830871] [client 103.48.44.9:59672] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdrsu1nEoSSDHiOXbBdQAAATI"]
[Sat Jul 18 23:16:30.823227 2026] [security2:error] [pid 830701:tid 830883] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/next/.env"] [unique_id "alxdrsu1nEoSSDHiOXbBdgAAAT4"]
[Sat Jul 18 23:16:30.864689 2026] [security2:error] [pid 830701:tid 830930] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/nuxt/.env"] [unique_id "alxdrsu1nEoSSDHiOXbBegAAAW0"]
[Sat Jul 18 23:16:30.906245 2026] [security2:error] [pid 830701:tid 830921] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/nest/.env"] [unique_id "alxdrsu1nEoSSDHiOXbBfgAAAWQ"]
[Sat Jul 18 23:16:30.920290 2026] [security2:error] [pid 830701:tid 830892] [client 31.152.190.160:1467] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.190.152.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "vinovinhowine.com"] [uri "/xmlrpc.php"] [unique_id "alxdrsu1nEoSSDHiOXbBfAAAAUc"]
[Sat Jul 18 23:16:30.920459 2026] [security2:error] [pid 830701:tid 830892] [client 31.152.190.160:1467] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "vinovinhowine.com"] [uri "/xmlrpc.php"] [unique_id "alxdrsu1nEoSSDHiOXbBfAAAAUc"]
[Sat Jul 18 23:16:30.933466 2026] [security2:error] [pid 831031:tid 831167] [client 74.6.168.250:37646] ModSecurity: Access denied with code 429 (phase 2). Pattern match "Mozilla\\\\/5\\\\.0 \\\\(compatible; Yahoo\\\\! Slurp; http:\\\\/\\\\/help\\\\.yahoo\\\\.com\\\\/help\\\\/us\\\\/ysearch\\\\/slurp\\\\)" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/yahoo.conf"] [line "4"] [id "901005"] [msg "Yahoo Crawler 429 ADDED BY MONITORING DO NOT WHITELIST"] [hostname "www.thecreole.com"] [uri "/"] [unique_id "alxdrpnU1ySsD4Tkeg4mXQAAAZQ"]
[Sat Jul 18 23:16:30.948694 2026] [security2:error] [pid 830701:tid 830909] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/react/.env"] [unique_id "alxdrsu1nEoSSDHiOXbBfwAAAVg"]
[Sat Jul 18 23:16:30.990229 2026] [security2:error] [pid 830701:tid 830878] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/vue/.env"] [unique_id "alxdrsu1nEoSSDHiOXbBgQAAATk"]
[Sat Jul 18 23:16:31.031795 2026] [security2:error] [pid 830701:tid 830891] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/angular/.env"] [unique_id "alxdr8u1nEoSSDHiOXbBhAAAAUY"]
[Sat Jul 18 23:16:31.073928 2026] [security2:error] [pid 830701:tid 830840] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/svelte/.env"] [unique_id "alxdr8u1nEoSSDHiOXbBhQAAARM"]
[Sat Jul 18 23:16:31.115695 2026] [security2:error] [pid 830701:tid 830868] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/vite/.env"] [unique_id "alxdr8u1nEoSSDHiOXbBhgAAAS8"]
[Sat Jul 18 23:16:31.157604 2026] [security2:error] [pid 830701:tid 830952] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/backup/.env"] [unique_id "alxdr8u1nEoSSDHiOXbBhwAAAYM"]
[Sat Jul 18 23:16:31.200301 2026] [security2:error] [pid 830701:tid 830853] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/backups/.env"] [unique_id "alxdr8u1nEoSSDHiOXbBiQAAASA"]
[Sat Jul 18 23:16:31.242403 2026] [security2:error] [pid 830701:tid 830918] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/old/.env"] [unique_id "alxdr8u1nEoSSDHiOXbBigAAAWE"]
[Sat Jul 18 23:16:31.284397 2026] [security2:error] [pid 830701:tid 830958] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/tmp/.env"] [unique_id "alxdr8u1nEoSSDHiOXbBjAAAAYk"]
[Sat Jul 18 23:16:31.327011 2026] [security2:error] [pid 830701:tid 830934] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/temp/.env"] [unique_id "alxdr8u1nEoSSDHiOXbBjgAAAXE"]
[Sat Jul 18 23:16:31.368794 2026] [security2:error] [pid 830701:tid 830885] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/lab/.env"] [unique_id "alxdr8u1nEoSSDHiOXbBkAAAAUA"]
[Sat Jul 18 23:16:31.410601 2026] [security2:error] [pid 830701:tid 830876] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/cronlab/.env"] [unique_id "alxdr8u1nEoSSDHiOXbBlAAAATc"]
[Sat Jul 18 23:16:31.452493 2026] [security2:error] [pid 830701:tid 830845] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/cron/.env"] [unique_id "alxdr8u1nEoSSDHiOXbBlQAAARg"]
[Sat Jul 18 23:16:31.494675 2026] [security2:error] [pid 830701:tid 830894] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/en/.env"] [unique_id "alxdr8u1nEoSSDHiOXbBlgAAAUk"]
[Sat Jul 18 23:16:31.613658 2026] [security2:error] [pid 830701:tid 830861] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/administrator/.env"] [unique_id "alxdr8u1nEoSSDHiOXbBlwAAASg"]
[Sat Jul 18 23:16:31.655598 2026] [security2:error] [pid 830701:tid 830877] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/psnlink/.env"] [unique_id "alxdr8u1nEoSSDHiOXbBmAAAATg"]
[Sat Jul 18 23:16:31.697835 2026] [security2:error] [pid 830701:tid 830833] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/exapi/.env"] [unique_id "alxdr8u1nEoSSDHiOXbBmgAAAQw"]
[Sat Jul 18 23:16:31.703850 2026] [security2:error] [pid 831031:tid 831090] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdr5nU1ySsD4Tkeg4mhQACAzk"]
[Sat Jul 18 23:16:31.703979 2026] [security2:error] [pid 831031:tid 831278] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdr5nU1ySsD4Tkeg4mhQACAzk"]
[Sat Jul 18 23:16:31.739567 2026] [security2:error] [pid 830701:tid 830887] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/sitemaps/.env"] [unique_id "alxdr8u1nEoSSDHiOXbBmwAAAUI"]
[Sat Jul 18 23:16:31.805944 2026] [security2:error] [pid 831031:tid 831227] [client 34.210.88.185:44240] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.88.210.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cryptomeaning.com"] [uri "/wp-cron.php"] [unique_id "alxdr5nU1ySsD4Tkeg4miwAAAdA"]
[Sat Jul 18 23:16:31.872988 2026] [security2:error] [pid 830701:tid 830832] [client 44.247.29.10:45998] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdr8u1nEoSSDHiOXbBnQAAAQs"]
[Sat Jul 18 23:16:32.038437 2026] [security2:error] [pid 830701:tid 830955] [client 44.247.29.10:45998] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdr8u1nEoSSDHiOXbBpgAAAYY"]
[Sat Jul 18 23:16:32.080072 2026] [security2:error] [pid 830701:tid 830851] [client 44.247.29.10:45998] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/logs/.env"] [unique_id "alxdsMu1nEoSSDHiOXbBqAAAAR4"]
[Sat Jul 18 23:16:32.210537 2026] [security2:error] [pid 831031:tid 831274] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/cache/.env"] [unique_id "alxdsJnU1ySsD4Tkeg4mmgAAAf8"]
[Sat Jul 18 23:16:32.254366 2026] [security2:error] [pid 831031:tid 831180] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/mailer/.env"] [unique_id "alxdsJnU1ySsD4Tkeg4mnQAAAaE"]
[Sat Jul 18 23:16:32.298352 2026] [security2:error] [pid 831031:tid 831281] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/mail/.env"] [unique_id "alxdsJnU1ySsD4Tkeg4mogAAAgY"]
[Sat Jul 18 23:16:32.342317 2026] [security2:error] [pid 831031:tid 831252] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/email/.env"] [unique_id "alxdsJnU1ySsD4Tkeg4mpgAAAek"]
[Sat Jul 18 23:16:32.386976 2026] [security2:error] [pid 831031:tid 831221] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/smtp/.env"] [unique_id "alxdsJnU1ySsD4Tkeg4mqAAAAco"]
[Sat Jul 18 23:16:32.430795 2026] [security2:error] [pid 831031:tid 831277] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/mailing/.env"] [unique_id "alxdsJnU1ySsD4Tkeg4mqgAAAgI"]
[Sat Jul 18 23:16:32.475049 2026] [security2:error] [pid 831031:tid 831188] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/notifications/.env"] [unique_id "alxdsJnU1ySsD4Tkeg4mrQAAAak"]
[Sat Jul 18 23:16:32.520243 2026] [security2:error] [pid 831031:tid 831181] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/notify/.env"] [unique_id "alxdsJnU1ySsD4Tkeg4mrgAAAaI"]
[Sat Jul 18 23:16:32.564249 2026] [security2:error] [pid 831031:tid 831205] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/sender/.env"] [unique_id "alxdsJnU1ySsD4Tkeg4msAAAAbo"]
[Sat Jul 18 23:16:32.608371 2026] [security2:error] [pid 831031:tid 831199] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/campaign/.env"] [unique_id "alxdsJnU1ySsD4Tkeg4msgAAAbQ"]
[Sat Jul 18 23:16:32.652258 2026] [security2:error] [pid 831031:tid 831275] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/newsletter/.env"] [unique_id "alxdsJnU1ySsD4Tkeg4mtQAAAgA"]
[Sat Jul 18 23:16:32.696419 2026] [security2:error] [pid 831031:tid 831272] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/ses/.env"] [unique_id "alxdsJnU1ySsD4Tkeg4mtgAAAf0"]
[Sat Jul 18 23:16:32.739383 2026] [security2:error] [pid 831031:tid 831238] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/sendgrid/.env"] [unique_id "alxdsJnU1ySsD4Tkeg4mvQAAAds"]
[Sat Jul 18 23:16:32.783122 2026] [security2:error] [pid 831031:tid 831229] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/sparkpost/.env"] [unique_id "alxdsJnU1ySsD4Tkeg4mvwAAAdI"]
[Sat Jul 18 23:16:32.827040 2026] [security2:error] [pid 831031:tid 831246] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/postmark/.env"] [unique_id "alxdsJnU1ySsD4Tkeg4mwgAAAeM"]
[Sat Jul 18 23:16:32.870629 2026] [security2:error] [pid 831031:tid 831276] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/mailgun/.env"] [unique_id "alxdsJnU1ySsD4Tkeg4mxAAAAgE"]
[Sat Jul 18 23:16:32.914421 2026] [security2:error] [pid 831031:tid 831173] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/mandrill/.env"] [unique_id "alxdsJnU1ySsD4Tkeg4mxwAAAZo"]
[Sat Jul 18 23:16:32.958589 2026] [security2:error] [pid 831031:tid 831283] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/mailjet/.env"] [unique_id "alxdsJnU1ySsD4Tkeg4myQAAAgg"]
[Sat Jul 18 23:16:33.002477 2026] [security2:error] [pid 831031:tid 831241] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/brevo/.env"] [unique_id "alxdsZnU1ySsD4Tkeg4mzAAAAd4"]
[Sat Jul 18 23:16:33.021765 2026] [security2:error] [pid 831031:tid 831236] [client 93.86.49.238:11601] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 238.49.86.93.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdsZnU1ySsD4Tkeg4mzQAAAdk"]
[Sat Jul 18 23:16:33.021897 2026] [security2:error] [pid 831031:tid 831236] [client 93.86.49.238:11601] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdsZnU1ySsD4Tkeg4mzQAAAdk"]
[Sat Jul 18 23:16:33.045652 2026] [security2:error] [pid 831031:tid 831178] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/transactional/.env"] [unique_id "alxdsZnU1ySsD4Tkeg4m0AAAAZ8"]
[Sat Jul 18 23:16:33.089577 2026] [security2:error] [pid 831031:tid 831169] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/bulk/.env"] [unique_id "alxdsZnU1ySsD4Tkeg4m1AAAAZY"]
[Sat Jul 18 23:16:33.133242 2026] [security2:error] [pid 831031:tid 831186] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/aws/.env"] [unique_id "alxdsZnU1ySsD4Tkeg4m1wAAAac"]
[Sat Jul 18 23:16:33.175952 2026] [security2:error] [pid 831031:tid 831250] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/azure/.env"] [unique_id "alxdsZnU1ySsD4Tkeg4m3QAAAec"]
[Sat Jul 18 23:16:33.219033 2026] [security2:error] [pid 831031:tid 831180] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/gcp/.env"] [unique_id "alxdsZnU1ySsD4Tkeg4m4wAAAaE"]
[Sat Jul 18 23:16:33.262328 2026] [security2:error] [pid 831031:tid 831258] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/cloud/.env"] [unique_id "alxdsZnU1ySsD4Tkeg4m5gAAAe8"]
[Sat Jul 18 23:16:33.307945 2026] [security2:error] [pid 831031:tid 831239] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/infrastructure/.env"] [unique_id "alxdsZnU1ySsD4Tkeg4m6AAAAdw"]
[Sat Jul 18 23:16:33.352102 2026] [security2:error] [pid 831031:tid 831237] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/docker/.env"] [unique_id "alxdsZnU1ySsD4Tkeg4m7AAAAdo"]
[Sat Jul 18 23:16:33.396222 2026] [security2:error] [pid 831031:tid 831216] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/k8s/.env"] [unique_id "alxdsZnU1ySsD4Tkeg4m7QAAAcU"]
[Sat Jul 18 23:16:33.440919 2026] [security2:error] [pid 831031:tid 831221] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/kubernetes/.env"] [unique_id "alxdsZnU1ySsD4Tkeg4m7gAAAco"]
[Sat Jul 18 23:16:33.484620 2026] [security2:error] [pid 831031:tid 831163] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/terraform/.env"] [unique_id "alxdsZnU1ySsD4Tkeg4m8gAAAZA"]
[Sat Jul 18 23:16:33.528555 2026] [security2:error] [pid 831031:tid 831279] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/ansible/.env"] [unique_id "alxdsZnU1ySsD4Tkeg4m8wAAAgQ"]
[Sat Jul 18 23:16:33.572963 2026] [security2:error] [pid 831031:tid 831247] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/.git/.env"] [unique_id "alxdsZnU1ySsD4Tkeg4m9gAAAeQ"]
[Sat Jul 18 23:16:33.618256 2026] [security2:error] [pid 831031:tid 831199] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/ci/.env"] [unique_id "alxdsZnU1ySsD4Tkeg4m9wAAAbQ"]
[Sat Jul 18 23:16:33.661592 2026] [security2:error] [pid 831031:tid 831182] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/cd/.env"] [unique_id "alxdsZnU1ySsD4Tkeg4m-QAAAaM"]
[Sat Jul 18 23:16:33.705869 2026] [security2:error] [pid 831031:tid 831275] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/jenkins/.env"] [unique_id "alxdsZnU1ySsD4Tkeg4m-gAAAgA"]
[Sat Jul 18 23:16:33.749489 2026] [security2:error] [pid 831031:tid 831266] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/gitlab/.env"] [unique_id "alxdsZnU1ySsD4Tkeg4m_gAAAfc"]
[Sat Jul 18 23:16:33.794059 2026] [security2:error] [pid 831031:tid 831244] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/github/.env"] [unique_id "alxdsZnU1ySsD4Tkeg4nAAAAAeE"]
[Sat Jul 18 23:16:33.837455 2026] [security2:error] [pid 831031:tid 831215] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/actions/.env"] [unique_id "alxdsZnU1ySsD4Tkeg4nBAAAAcQ"]
[Sat Jul 18 23:16:33.841370 2026] [security2:error] [pid 831031:tid 831123] [remote 31.42.184.154:54042] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "worbals.com"] [uri "/wp-login.php"] [unique_id "alxdsZnU1ySsD4Tkeg4nBQAB5Vo"]
[Sat Jul 18 23:16:33.881683 2026] [security2:error] [pid 831031:tid 831286] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/circleci/.env"] [unique_id "alxdsZnU1ySsD4Tkeg4nBgAAAgs"]
[Sat Jul 18 23:16:33.926787 2026] [security2:error] [pid 831031:tid 831267] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/travis/.env"] [unique_id "alxdsZnU1ySsD4Tkeg4nCQAAAfg"]
[Sat Jul 18 23:16:33.970828 2026] [security2:error] [pid 831031:tid 831284] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/buildkite/.env"] [unique_id "alxdsZnU1ySsD4Tkeg4nDAAAAgk"]
[Sat Jul 18 23:16:34.014421 2026] [security2:error] [pid 831031:tid 831198] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/mysql/.env"] [unique_id "alxdspnU1ySsD4Tkeg4nEAAAAbM"]
[Sat Jul 18 23:16:34.058433 2026] [security2:error] [pid 831031:tid 831278] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/postgres/.env"] [unique_id "alxdspnU1ySsD4Tkeg4nEQAAAgM"]
[Sat Jul 18 23:16:34.101379 2026] [security2:error] [pid 831031:tid 831168] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/mongodb/.env"] [unique_id "alxdspnU1ySsD4Tkeg4nEwAAAZU"]
[Sat Jul 18 23:16:34.144529 2026] [security2:error] [pid 831031:tid 831227] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/redis/.env"] [unique_id "alxdspnU1ySsD4Tkeg4nFAAAAdA"]
[Sat Jul 18 23:16:34.188731 2026] [security2:error] [pid 831031:tid 831189] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/elasticsearch/.env"] [unique_id "alxdspnU1ySsD4Tkeg4nFwAAAao"]
[Sat Jul 18 23:16:34.232504 2026] [security2:error] [pid 831031:tid 831261] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/rabbitmq/.env"] [unique_id "alxdspnU1ySsD4Tkeg4nHAAAAfI"]
[Sat Jul 18 23:16:34.257152 2026] [security2:error] [pid 831031:tid 831253] [client 114.119.133.182:62347] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "techtradeinc.com"] [uri "/resources"] [unique_id "alxdspnU1ySsD4Tkeg4nHQAAAeo"], referer: http://techtradeinc.com/resources
[Sat Jul 18 23:16:34.275130 2026] [security2:error] [pid 830701:tid 830926] [client 124.29.207.185:37788] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdssu1nEoSSDHiOXbB4AAAAWk"]
[Sat Jul 18 23:16:34.275250 2026] [security2:error] [pid 830701:tid 830926] [client 124.29.207.185:37788] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdssu1nEoSSDHiOXbB4AAAAWk"]
[Sat Jul 18 23:16:34.275553 2026] [security2:error] [pid 831031:tid 831177] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/kafka/.env"] [unique_id "alxdspnU1ySsD4Tkeg4nHwAAAZ4"]
[Sat Jul 18 23:16:34.313889 2026] [security2:error] [pid 831031:tid 831243] [client 34.210.88.185:44256] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.88.210.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxdspnU1ySsD4Tkeg4nIAAAAeA"]
[Sat Jul 18 23:16:34.319329 2026] [security2:error] [pid 831031:tid 831180] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/queue/.env"] [unique_id "alxdspnU1ySsD4Tkeg4nIQAAAaE"]
[Sat Jul 18 23:16:34.351188 2026] [security2:error] [pid 830701:tid 830884] [client 65.111.27.43:50233] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 43.27.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxdssu1nEoSSDHiOXbB4QAAAT8"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:16:34.362960 2026] [security2:error] [pid 831031:tid 831179] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/worker/.env"] [unique_id "alxdspnU1ySsD4Tkeg4nIwAAAaA"]
[Sat Jul 18 23:16:34.406649 2026] [security2:error] [pid 831031:tid 831258] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/job/.env"] [unique_id "alxdspnU1ySsD4Tkeg4nJQAAAe8"]
[Sat Jul 18 23:16:34.450340 2026] [security2:error] [pid 831031:tid 831237] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/test/.env"] [unique_id "alxdspnU1ySsD4Tkeg4nKAAAAdo"]
[Sat Jul 18 23:16:34.493726 2026] [security2:error] [pid 831031:tid 831252] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/qa/.env"] [unique_id "alxdspnU1ySsD4Tkeg4nKwAAAek"]
[Sat Jul 18 23:16:34.537290 2026] [security2:error] [pid 831031:tid 831192] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/preview/.env"] [unique_id "alxdspnU1ySsD4Tkeg4nLAAAAa0"]
[Sat Jul 18 23:16:34.581205 2026] [security2:error] [pid 831031:tid 831185] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/beta/.env"] [unique_id "alxdspnU1ySsD4Tkeg4nLgAAAaY"]
[Sat Jul 18 23:16:34.624694 2026] [security2:error] [pid 831031:tid 831170] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/uat/.env"] [unique_id "alxdspnU1ySsD4Tkeg4nLwAAAZc"]
[Sat Jul 18 23:16:34.668676 2026] [security2:error] [pid 831031:tid 831226] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/stage/.env"] [unique_id "alxdspnU1ySsD4Tkeg4nMQAAAc8"]
[Sat Jul 18 23:16:34.712361 2026] [security2:error] [pid 831031:tid 831206] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/development/.env"] [unique_id "alxdspnU1ySsD4Tkeg4nNwAAAbs"]
[Sat Jul 18 23:16:34.756806 2026] [security2:error] [pid 831031:tid 831207] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/production/.env"] [unique_id "alxdspnU1ySsD4Tkeg4nOQAAAbw"]
[Sat Jul 18 23:16:34.800814 2026] [security2:error] [pid 831031:tid 831247] [client 44.247.29.10:46002] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/config/app/.env"] [unique_id "alxdspnU1ySsD4Tkeg4nOwAAAeQ"]
[Sat Jul 18 23:16:34.825017 2026] [security2:error] [pid 831031:tid 831099] [remote 31.42.184.154:54042] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "worbals.com"] [uri "/wp-login.php"] [unique_id "alxdspnU1ySsD4Tkeg4nPQAB6EI"], referer: https://worbals.com/wp-login.php
[Sat Jul 18 23:16:34.905885 2026] [security2:error] [pid 830701:tid 830905] [client 74.7.227.179:50188] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxdssu1nEoSSDHiOXbB8gABVAs"], referer: https://tejasenvironmental.com/p=1330611
[Sat Jul 18 23:16:34.965257 2026] [security2:error] [pid 831031:tid 831275] [client 44.247.29.10:46002] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdspnU1ySsD4Tkeg4nPwAAAgA"]
[Sat Jul 18 23:16:35.043798 2026] [security2:error] [pid 830701:tid 830760] [remote 20.87.239.85:16395] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 85.239.87.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tbd.jxc.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxds8u1nEoSSDHiOXbB-wABWTo"]
[Sat Jul 18 23:16:35.139854 2026] [security2:error] [pid 831031:tid 831244] [client 44.247.29.10:46002] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxds5nU1ySsD4Tkeg4nRgAAAeE"]
[Sat Jul 18 23:16:35.274237 2026] [security2:error] [pid 831031:tid 831264] [client 44.247.29.10:46002] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxds5nU1ySsD4Tkeg4nSgAAAfU"]
[Sat Jul 18 23:16:35.408855 2026] [security2:error] [pid 831031:tid 831265] [client 44.247.29.10:46002] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxds5nU1ySsD4Tkeg4nTgAAAfY"]
[Sat Jul 18 23:16:35.539401 2026] [security2:error] [pid 831031:tid 831168] [client 44.247.29.10:46002] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxds5nU1ySsD4Tkeg4nVAAAAZU"]
[Sat Jul 18 23:16:35.541606 2026] [security2:error] [pid 830701:tid 830783] [remote 20.87.239.85:16395] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 85.239.87.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tbd.jxc.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxds8u1nEoSSDHiOXbCBAABeVE"], referer: https://tbd.jxc.mybluehost.me/wp-login.php
[Sat Jul 18 23:16:35.570155 2026] [security2:error] [pid 830701:tid 830896] [client 74.208.214.194:48542] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxds8u1nEoSSDHiOXbCBwAAAUs"]
[Sat Jul 18 23:16:35.673874 2026] [security2:error] [pid 831031:tid 831259] [client 44.247.29.10:46002] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxds5nU1ySsD4Tkeg4nWgAAAfA"]
[Sat Jul 18 23:16:35.803299 2026] [security2:error] [pid 831031:tid 831180] [client 44.247.29.10:46002] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxds5nU1ySsD4Tkeg4nXQAAAaE"]
[Sat Jul 18 23:16:35.885604 2026] [security2:error] [pid 831031:tid 831263] [client 44.247.29.10:46002] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/phpinfo.php"] [unique_id "alxds5nU1ySsD4Tkeg4nYQAAAfQ"]
[Sat Jul 18 23:16:36.010559 2026] [security2:error] [pid 831031:tid 831262] [client 44.247.29.10:57528] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/info.php"] [unique_id "alxdtJnU1ySsD4Tkeg4naQAAAfM"]
[Sat Jul 18 23:16:36.042201 2026] [security2:error] [pid 831031:tid 831217] [client 223.185.61.63:25605] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdtJnU1ySsD4Tkeg4nagAAAcY"]
[Sat Jul 18 23:16:36.042319 2026] [security2:error] [pid 831031:tid 831217] [client 223.185.61.63:25605] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdtJnU1ySsD4Tkeg4nagAAAcY"]
[Sat Jul 18 23:16:36.133219 2026] [security2:error] [pid 831031:tid 831231] [client 44.247.29.10:57540] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/php.php"] [unique_id "alxdtJnU1ySsD4Tkeg4ndAAAAdQ"]
[Sat Jul 18 23:16:36.261512 2026] [security2:error] [pid 831031:tid 831205] [client 44.247.29.10:57554] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/i.php"] [unique_id "alxdtJnU1ySsD4Tkeg4negAAAbo"]
[Sat Jul 18 23:16:36.303286 2026] [security2:error] [pid 831031:tid 831239] [client 49.224.92.97:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "aosta.nz"] [uri "/index.php"] [unique_id "alxds5nU1ySsD4Tkeg4nZwAAAdw"], referer: https://aosta.nz/
[Sat Jul 18 23:16:36.308463 2026] [security2:error] [pid 831031:tid 831074] [remote 31.42.184.154:54026] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxdtJnU1ySsD4Tkeg4nfQABqik"]
[Sat Jul 18 23:16:36.308597 2026] [security2:error] [pid 831031:tid 831189] [client 31.42.184.154:54026] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxdtJnU1ySsD4Tkeg4nfQABqik"]
[Sat Jul 18 23:16:36.384786 2026] [security2:error] [pid 831031:tid 831228] [client 44.247.29.10:57558] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/pi.php"] [unique_id "alxdtJnU1ySsD4Tkeg4nfwAAAdE"]
[Sat Jul 18 23:16:36.509483 2026] [security2:error] [pid 830701:tid 830914] [client 44.247.29.10:57570] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/pinfo.php"] [unique_id "alxdtMu1nEoSSDHiOXbCGQAAAV0"]
[Sat Jul 18 23:16:36.639437 2026] [security2:error] [pid 831031:tid 831249] [client 44.247.29.10:57572] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/test.php"] [unique_id "alxdtJnU1ySsD4Tkeg4nlQAAAeY"]
[Sat Jul 18 23:16:36.853891 2026] [security2:error] [pid 831031:tid 831167] [client 44.247.29.10:57580] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdtJnU1ySsD4Tkeg4nmAAAAZQ"]
[Sat Jul 18 23:16:36.937039 2026] [security2:error] [pid 831031:tid 831196] [client 44.247.29.10:57580] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/p.php"] [unique_id "alxdtJnU1ySsD4Tkeg4nnQAAAbE"]
[Sat Jul 18 23:16:37.064566 2026] [security2:error] [pid 831031:tid 831268] [client 44.247.29.10:57582] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/debug.php"] [unique_id "alxdtZnU1ySsD4Tkeg4npAAAAfk"]
[Sat Jul 18 23:16:37.186314 2026] [security2:error] [pid 831031:tid 831170] [client 44.247.29.10:57588] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/admin/phpinfo.php"] [unique_id "alxdtZnU1ySsD4Tkeg4nqgAAAZc"]
[Sat Jul 18 23:16:37.311367 2026] [security2:error] [pid 830701:tid 830889] [client 44.247.29.10:57602] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/test/phpinfo.php"] [unique_id "alxdtcu1nEoSSDHiOXbCIwAAAUQ"]
[Sat Jul 18 23:16:37.436402 2026] [security2:error] [pid 831031:tid 831275] [client 44.247.29.10:57608] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/dev/phpinfo.php"] [unique_id "alxdtZnU1ySsD4Tkeg4nsQAAAgA"]
[Sat Jul 18 23:16:37.559864 2026] [security2:error] [pid 831031:tid 831277] [client 44.247.29.10:57622] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/old/phpinfo.php"] [unique_id "alxdtZnU1ySsD4Tkeg4ntwAAAgI"]
[Sat Jul 18 23:16:37.684190 2026] [security2:error] [pid 831031:tid 831246] [client 44.247.29.10:57636] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/tmp/phpinfo.php"] [unique_id "alxdtZnU1ySsD4Tkeg4nugAAAeM"]
[Sat Jul 18 23:16:37.808106 2026] [security2:error] [pid 831031:tid 831282] [client 44.247.29.10:57648] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/public/phpinfo.php"] [unique_id "alxdtZnU1ySsD4Tkeg4nwQAAAgc"]
[Sat Jul 18 23:16:37.960170 2026] [security2:error] [pid 831031:tid 831235] [client 27.34.68.67:33043] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdtZnU1ySsD4Tkeg4n0gAAAdg"]
[Sat Jul 18 23:16:37.960319 2026] [security2:error] [pid 831031:tid 831235] [client 27.34.68.67:33043] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdtZnU1ySsD4Tkeg4n0gAAAdg"]
[Sat Jul 18 23:16:38.042215 2026] [security2:error] [pid 830701:tid 830843] [client 44.247.29.10:57654] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdtcu1nEoSSDHiOXbCMgAAARY"]
[Sat Jul 18 23:16:38.125667 2026] [security2:error] [pid 830701:tid 830888] [client 44.247.29.10:57654] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/php-info.php"] [unique_id "alxdtsu1nEoSSDHiOXbCNQAAAUM"]
[Sat Jul 18 23:16:38.249176 2026] [security2:error] [pid 831031:tid 831192] [client 44.247.29.10:57666] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/phpversion.php"] [unique_id "alxdtpnU1ySsD4Tkeg4n5wAAAa0"]
[Sat Jul 18 23:16:38.378303 2026] [security2:error] [pid 831031:tid 831245] [client 44.247.29.10:57672] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/_phpinfo.php"] [unique_id "alxdtpnU1ySsD4Tkeg4n6QAAAeI"]
[Sat Jul 18 23:16:38.503864 2026] [security2:error] [pid 830701:tid 830895] [client 44.247.29.10:57682] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/old_phpinfo.php"] [unique_id "alxdtsu1nEoSSDHiOXbCOgAAAUo"]
[Sat Jul 18 23:16:38.625613 2026] [security2:error] [pid 830701:tid 830903] [client 44.247.29.10:57686] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/server-info.php"] [unique_id "alxdtsu1nEoSSDHiOXbCPgAAAVI"]
[Sat Jul 18 23:16:38.638924 2026] [security2:error] [pid 831031:tid 831081] [remote 31.42.184.154:54056] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "michiganhomecaregroup.com"] [uri "/wp-login.php"] [unique_id "alxdtpnU1ySsD4Tkeg4n8QABpjA"]
[Sat Jul 18 23:16:38.747267 2026] [security2:error] [pid 830701:tid 830943] [client 44.247.29.10:57696] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/server-status.php"] [unique_id "alxdtsu1nEoSSDHiOXbCRQAAAXo"]
[Sat Jul 18 23:16:38.853856 2026] [security2:error] [pid 831031:tid 831214] [client 119.154.81.234:50529] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdtpnU1ySsD4Tkeg4n_AAAAcM"]
[Sat Jul 18 23:16:38.854027 2026] [security2:error] [pid 831031:tid 831214] [client 119.154.81.234:50529] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdtpnU1ySsD4Tkeg4n_AAAAcM"]
[Sat Jul 18 23:16:38.958128 2026] [security2:error] [pid 830701:tid 830952] [client 44.247.29.10:57710] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdtsu1nEoSSDHiOXbCSQAAAYM"]
[Sat Jul 18 23:16:39.057901 2026] [security2:error] [pid 831031:tid 831272] [client 171.4.232.110:37077] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdt5nU1ySsD4Tkeg4oAQAAAf0"]
[Sat Jul 18 23:16:39.058051 2026] [security2:error] [pid 831031:tid 831272] [client 171.4.232.110:37077] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdt5nU1ySsD4Tkeg4oAQAAAf0"]
[Sat Jul 18 23:16:39.121635 2026] [security2:error] [pid 830701:tid 830848] [client 44.247.29.10:57710] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/index.php"] [unique_id "alxdt8u1nEoSSDHiOXbCTAAAARs"]
[Sat Jul 18 23:16:39.157726 2026] [security2:error] [pid 831031:tid 831228] [client 190.245.146.99:63558] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdt5nU1ySsD4Tkeg4oBQAAAdE"]
[Sat Jul 18 23:16:39.157844 2026] [security2:error] [pid 831031:tid 831228] [client 190.245.146.99:63558] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdt5nU1ySsD4Tkeg4oBQAAAdE"]
[Sat Jul 18 23:16:39.162317 2026] [security2:error] [pid 830701:tid 830861] [client 44.247.29.10:57710] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/webroot/index.php/_environment"] [unique_id "alxdt8u1nEoSSDHiOXbCTwAAASg"]
[Sat Jul 18 23:16:39.182970 2026] [security2:error] [pid 831031:tid 831053] [remote 31.42.184.154:54056] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "michiganhomecaregroup.com"] [uri "/wp-login.php"] [unique_id "alxdt5nU1ySsD4Tkeg4oBgAB4RQ"], referer: https://michiganhomecaregroup.com/wp-login.php
[Sat Jul 18 23:16:39.290974 2026] [security2:error] [pid 830701:tid 830858] [client 44.247.29.10:57716] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/mail/phpinfo.php"] [unique_id "alxdt8u1nEoSSDHiOXbCWAAAASU"]
[Sat Jul 18 23:16:39.415129 2026] [security2:error] [pid 831031:tid 831285] [client 44.247.29.10:57720] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/cpanel/phpinfo.php"] [unique_id "alxdt5nU1ySsD4Tkeg4oDAAAAgo"]
[Sat Jul 18 23:16:39.539584 2026] [security2:error] [pid 830701:tid 830908] [client 44.247.29.10:57726] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/hosting/phpinfo.php"] [unique_id "alxdt8u1nEoSSDHiOXbCWQAAAVc"]
[Sat Jul 18 23:16:39.664770 2026] [security2:error] [pid 830701:tid 830855] [client 44.247.29.10:57732] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/webmail/phpinfo.php"] [unique_id "alxdt8u1nEoSSDHiOXbCZwAAASI"]
[Sat Jul 18 23:16:39.698815 2026] [security2:error] [pid 830701:tid 830839] [client 20.104.96.117:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/index.php"] [unique_id "alxdt8u1nEoSSDHiOXbCVAAAARI"]
[Sat Jul 18 23:16:39.793545 2026] [security2:error] [pid 831031:tid 831179] [client 44.247.29.10:57744] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/smtp/phpinfo.php"] [unique_id "alxdt5nU1ySsD4Tkeg4oFwAAAaA"]
[Sat Jul 18 23:16:39.863229 2026] [security2:error] [pid 831031:tid 831275] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdt5nU1ySsD4Tkeg4oBwAAAgA"]
[Sat Jul 18 23:16:39.921165 2026] [security2:error] [pid 830701:tid 830857] [client 44.247.29.10:57748] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/phpinfo.php.bak"] [unique_id "alxdt8u1nEoSSDHiOXbCcgAAASQ"]
[Sat Jul 18 23:16:39.979919 2026] [security2:error] [pid 830701:tid 830741] [remote 112.213.89.115:42892] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.89.213.112.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.holistichealthmassagenz.com"] [uri "/wp-login.php"] [unique_id "alxdt8u1nEoSSDHiOXbCcwABXCc"]
[Sat Jul 18 23:16:40.049968 2026] [security2:error] [pid 831031:tid 831172] [client 44.247.29.10:57750] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/phpinfo.php.old"] [unique_id "alxduJnU1ySsD4Tkeg4oHQAAAZk"]
[Sat Jul 18 23:16:40.172317 2026] [security2:error] [pid 831031:tid 831219] [client 44.247.29.10:57758] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/phpinfo.php~"] [unique_id "alxduJnU1ySsD4Tkeg4oIAAAAcg"]
[Sat Jul 18 23:16:40.299138 2026] [security2:error] [pid 831031:tid 831245] [client 44.247.29.10:57774] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/info.php.bak"] [unique_id "alxduJnU1ySsD4Tkeg4oIgAAAeI"]
[Sat Jul 18 23:16:40.399952 2026] [security2:error] [pid 831031:tid 831217] [client 223.178.210.203:27419] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxduJnU1ySsD4Tkeg4oJgAAAcY"]
[Sat Jul 18 23:16:40.400046 2026] [security2:error] [pid 831031:tid 831217] [client 223.178.210.203:27419] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxduJnU1ySsD4Tkeg4oJgAAAcY"]
[Sat Jul 18 23:16:40.427415 2026] [security2:error] [pid 831031:tid 831254] [client 44.247.29.10:57790] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/phpinfo.php.save"] [unique_id "alxduJnU1ySsD4Tkeg4oJwAAAes"]
[Sat Jul 18 23:16:40.551533 2026] [security2:error] [pid 830701:tid 830835] [client 44.247.29.10:57792] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/staging/phpinfo.php"] [unique_id "alxduMu1nEoSSDHiOXbCfwAAAQ4"]
[Sat Jul 18 23:16:40.593546 2026] [security2:error] [pid 831031:tid 831199] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxduJnU1ySsD4Tkeg4oKQAAAbQ"]
[Sat Jul 18 23:16:40.675508 2026] [security2:error] [pid 830701:tid 830854] [client 44.247.29.10:57802] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/beta/phpinfo.php"] [unique_id "alxduMu1nEoSSDHiOXbCgAAAASE"]
[Sat Jul 18 23:16:40.700007 2026] [proxy:error] [pid 831031:tid 831224] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:16:40.700074 2026] [proxy_http:error] [pid 831031:tid 831224] [client 193.47.62.168:33098] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:16:40.700596 2026] [proxy:error] [pid 831031:tid 831224] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:16:40.700631 2026] [proxy_http:error] [pid 831031:tid 831224] [client 193.47.62.168:33098] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:16:40.738772 2026] [security2:error] [pid 830701:tid 830710] [remote 112.213.89.115:42892] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.89.213.112.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.holistichealthmassagenz.com"] [uri "/wp-login.php"] [unique_id "alxduMu1nEoSSDHiOXbChAABUwg"], referer: https://mail.holistichealthmassagenz.com/wp-login.php
[Sat Jul 18 23:16:40.803498 2026] [security2:error] [pid 831031:tid 831240] [client 44.247.29.10:57818] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/uat/phpinfo.php"] [unique_id "alxduJnU1ySsD4Tkeg4oNQAAAd0"]
[Sat Jul 18 23:16:40.930021 2026] [security2:error] [pid 831031:tid 831203] [client 44.247.29.10:57822] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/qa/phpinfo.php"] [unique_id "alxduJnU1ySsD4Tkeg4oPQAAAbg"]
[Sat Jul 18 23:16:40.966072 2026] [security2:error] [pid 831031:tid 831267] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxduJnU1ySsD4Tkeg4oPgAAAfg"]
[Sat Jul 18 23:16:41.055427 2026] [security2:error] [pid 831031:tid 831284] [client 44.247.29.10:57828] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/preview/phpinfo.php"] [unique_id "alxduZnU1ySsD4Tkeg4oRgAAAgk"]
[Sat Jul 18 23:16:41.180962 2026] [security2:error] [pid 831031:tid 831238] [client 44.247.29.10:57832] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/www/phpinfo.php"] [unique_id "alxduZnU1ySsD4Tkeg4oTgAAAds"]
[Sat Jul 18 23:16:41.264673 2026] [security2:error] [pid 831031:tid 831164] [client 103.48.44.9:60187] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxduZnU1ySsD4Tkeg4oVQAAAZE"]
[Sat Jul 18 23:16:41.264785 2026] [security2:error] [pid 831031:tid 831164] [client 103.48.44.9:60187] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxduZnU1ySsD4Tkeg4oVQAAAZE"]
[Sat Jul 18 23:16:41.278977 2026] [security2:error] [pid 831031:tid 831274] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxduZnU1ySsD4Tkeg4oUwAAAf8"]
[Sat Jul 18 23:16:41.307731 2026] [security2:error] [pid 831031:tid 831197] [client 44.247.29.10:57846] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/htdocs/phpinfo.php"] [unique_id "alxduZnU1ySsD4Tkeg4oWAAAAbI"]
[Sat Jul 18 23:16:41.438278 2026] [security2:error] [pid 831031:tid 831237] [client 44.247.29.10:57860] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/public_html/phpinfo.php"] [unique_id "alxduZnU1ySsD4Tkeg4oYgAAAdo"]
[Sat Jul 18 23:16:41.564618 2026] [security2:error] [pid 831031:tid 831170] [client 44.247.29.10:57866] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/site/phpinfo.php"] [unique_id "alxduZnU1ySsD4Tkeg4oZQAAAZc"]
[Sat Jul 18 23:16:41.597511 2026] [security2:error] [pid 831031:tid 831239] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxduZnU1ySsD4Tkeg4oZAAAAdw"]
[Sat Jul 18 23:16:41.652709 2026] [security2:error] [pid 830701:tid 830875] [client 45.3.45.252:23287] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 252.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxducu1nEoSSDHiOXbCmAAAATY"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:16:41.689013 2026] [security2:error] [pid 831031:tid 831240] [client 44.247.29.10:57878] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/docs/phpinfo.php"] [unique_id "alxduZnU1ySsD4Tkeg4obgAAAd0"]
[Sat Jul 18 23:16:41.704987 2026] [security2:error] [pid 830701:tid 830786] [remote 14.128.14.9:48476] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.14.128.14.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "musichaven.info"] [uri "/wp-login.php"] [unique_id "alxducu1nEoSSDHiOXbCmgABUVQ"]
[Sat Jul 18 23:16:41.811911 2026] [security2:error] [pid 831031:tid 831246] [client 44.247.29.10:57882] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/wp-admin/phpinfo.php"] [unique_id "alxduZnU1ySsD4Tkeg4ocQAAAeM"]
[Sat Jul 18 23:16:41.933621 2026] [security2:error] [pid 831031:tid 831269] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxduZnU1ySsD4Tkeg4oeQAAAfo"]
[Sat Jul 18 23:16:41.934183 2026] [security2:error] [pid 831031:tid 831253] [client 44.247.29.10:57890] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/administrator/phpinfo.php"] [unique_id "alxduZnU1ySsD4Tkeg4ofQAAAeo"]
[Sat Jul 18 23:16:42.040759 2026] [core:error] [pid 830701:tid 830733] [remote 220.181.108.144:48442] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:16:42.040787 2026] [core:error] [pid 830701:tid 830733] [remote 220.181.108.144:48442] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:16:42.060194 2026] [security2:error] [pid 831031:tid 831194] [client 44.247.29.10:57906] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/core/phpinfo.php"] [unique_id "alxdupnU1ySsD4Tkeg4ohAAAAa8"]
[Sat Jul 18 23:16:42.089976 2026] [security2:error] [pid 831031:tid 831255] [client 223.228.182.224:28452] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxdupnU1ySsD4Tkeg4ogwAAAew"]
[Sat Jul 18 23:16:42.090154 2026] [security2:error] [pid 831031:tid 831255] [client 223.228.182.224:28452] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxdupnU1ySsD4Tkeg4ogwAAAew"]
[Sat Jul 18 23:16:42.128627 2026] [security2:error] [pid 831031:tid 831122] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdupnU1ySsD4Tkeg4ohQAB8Fk"]
[Sat Jul 18 23:16:42.128804 2026] [security2:error] [pid 831031:tid 831259] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdupnU1ySsD4Tkeg4ohQAB8Fk"]
[Sat Jul 18 23:16:42.131882 2026] [security2:error] [pid 831031:tid 831193] [client 163.61.50.7:60007] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "coltinnovate.com"] [uri "/wp-comments-post.php"] [unique_id "alxdupnU1ySsD4Tkeg4oggAAAa4"]
[Sat Jul 18 23:16:42.177873 2026] [security2:error] [pid 831031:tid 831193] [client 163.61.50.7:60007] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "403"] [hostname "coltinnovate.com"] [uri "/wp-comments-post.php"] [unique_id "alxdupnU1ySsD4Tkeg4oggAAAa4"]
[Sat Jul 18 23:16:42.187104 2026] [security2:error] [pid 830701:tid 830935] [client 44.247.29.10:57912] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.29.247.44.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.ctd.ann.mybluehost.me"] [uri "/includes/phpinfo.php"] [unique_id "alxdusu1nEoSSDHiOXbCqgAAAXI"]
[Sat Jul 18 23:16:42.201700 2026] [security2:error] [pid 830701:tid 830766] [remote 14.128.14.9:48476] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.14.128.14.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "musichaven.info"] [uri "/wp-login.php"] [unique_id "alxdusu1nEoSSDHiOXbCqwABPUA"], referer: https://musichaven.info/wp-login.php
[Sat Jul 18 23:16:42.327089 2026] [security2:error] [pid 831031:tid 831275] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdupnU1ySsD4Tkeg4ojgAAAgA"]
[Sat Jul 18 23:16:42.618653 2026] [security2:error] [pid 831031:tid 831254] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdupnU1ySsD4Tkeg4onQAAAes"]
[Sat Jul 18 23:16:42.755329 2026] [security2:error] [pid 831031:tid 831200] [client 45.3.45.55:31793] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 55.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxdupnU1ySsD4Tkeg4opAAAAbU"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:16:42.892527 2026] [security2:error] [pid 831031:tid 831265] [client 47.128.41.59:19462] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "healthylifegourmet.org"] [uri "/robots.txt"] [unique_id "alxdupnU1ySsD4Tkeg4orAAAAfY"]
[Sat Jul 18 23:16:42.946576 2026] [security2:error] [pid 831031:tid 831277] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdupnU1ySsD4Tkeg4osAAAAgI"]
[Sat Jul 18 23:16:43.237708 2026] [security2:error] [pid 831031:tid 831158] [remote 31.42.184.154:45642] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "grndl.com"] [uri "/wp-login.php"] [unique_id "alxdu5nU1ySsD4Tkeg4ovgAB-X0"]
[Sat Jul 18 23:16:43.770272 2026] [security2:error] [pid 831031:tid 831058] [remote 31.42.184.154:45642] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "grndl.com"] [uri "/wp-login.php"] [unique_id "alxdu5nU1ySsD4Tkeg4o0AAB2hk"], referer: https://grndl.com/wp-login.php
[Sat Jul 18 23:16:44.100177 2026] [security2:error] [pid 831031:tid 831245] [client 93.86.49.238:12766] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 238.49.86.93.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdvJnU1ySsD4Tkeg4o6AAAAeI"]
[Sat Jul 18 23:16:44.100260 2026] [security2:error] [pid 831031:tid 831245] [client 93.86.49.238:12766] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdvJnU1ySsD4Tkeg4o6AAAAeI"]
[Sat Jul 18 23:16:44.223978 2026] [core:error] [pid 831031:tid 831059] [remote 111.225.214.153:29122] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:16:44.223998 2026] [core:error] [pid 831031:tid 831059] [remote 111.225.214.153:29122] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:16:44.293212 2026] [security2:error] [pid 831031:tid 831269] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdvJnU1ySsD4Tkeg4o7gAAAfo"]
[Sat Jul 18 23:16:44.301358 2026] [security2:error] [pid 831031:tid 831217] [client 124.29.207.185:55073] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdvJnU1ySsD4Tkeg4o8QAAAcY"]
[Sat Jul 18 23:16:44.301437 2026] [security2:error] [pid 831031:tid 831217] [client 124.29.207.185:55073] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxdvJnU1ySsD4Tkeg4o8QAAAcY"]
[Sat Jul 18 23:16:44.355270 2026] [security2:error] [pid 830701:tid 830831] [client 49.224.92.97:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "aosta.nz"] [uri "/index.php"] [unique_id "alxdvMu1nEoSSDHiOXbC1AAAAQo"], referer: https://aosta.nz/
[Sat Jul 18 23:16:44.623859 2026] [security2:error] [pid 831031:tid 831271] [client 20.104.96.117:38865] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.104.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "laceycaraccident.fiq.jjc.mybluehost.me"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "alxdvJnU1ySsD4Tkeg4pCQAAAfw"]
[Sat Jul 18 23:16:44.623952 2026] [security2:error] [pid 831031:tid 831271] [client 20.104.96.117:38865] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "laceycaraccident.fiq.jjc.mybluehost.me"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "alxdvJnU1ySsD4Tkeg4pCQAAAfw"]
[Sat Jul 18 23:16:44.628554 2026] [security2:error] [pid 831031:tid 831262] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdvJnU1ySsD4Tkeg4pBgAAAfM"]
[Sat Jul 18 23:16:44.763999 2026] [autoindex:error] [pid 831031:tid 831038] [remote 164.68.113.190:0] AH01276: Cannot serve directory /home3/dbnvkfmy/public_html/nzfoodstory/.well-known/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:16:44.969843 2026] [security2:error] [pid 831031:tid 831214] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdvJnU1ySsD4Tkeg4pFgAAAcM"]
[Sat Jul 18 23:16:45.255461 2026] [core:error] [pid 831031:tid 831045] [remote 111.225.214.137:38029] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:16:45.255477 2026] [core:error] [pid 831031:tid 831045] [remote 111.225.214.137:38029] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:16:45.270955 2026] [security2:error] [pid 831031:tid 831219] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdvZnU1ySsD4Tkeg4pIgAAAcg"]
[Sat Jul 18 23:16:45.342904 2026] [security2:error] [pid 830701:tid 830882] [client 101.128.96.123:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.adambergeron.com"] [uri "/index.php"] [unique_id "alxdvcu1nEoSSDHiOXbC6gAAAT0"]
[Sat Jul 18 23:16:45.631161 2026] [security2:error] [pid 831031:tid 831263] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdvZnU1ySsD4Tkeg4pLwAAAfQ"]
[Sat Jul 18 23:16:45.995200 2026] [security2:error] [pid 831031:tid 831190] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdvZnU1ySsD4Tkeg4pPQAAAas"]
[Sat Jul 18 23:16:46.369684 2026] [security2:error] [pid 831031:tid 831240] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdvpnU1ySsD4Tkeg4pTgAAAd0"]
[Sat Jul 18 23:16:46.687916 2026] [security2:error] [pid 831031:tid 831219] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdvpnU1ySsD4Tkeg4pYQAAAcg"]
[Sat Jul 18 23:16:46.693581 2026] [security2:error] [pid 830701:tid 830878] [client 223.185.61.63:20392] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdvsu1nEoSSDHiOXbDEwAAATk"]
[Sat Jul 18 23:16:46.693668 2026] [security2:error] [pid 830701:tid 830878] [client 223.185.61.63:20392] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdvsu1nEoSSDHiOXbDEwAAATk"]
[Sat Jul 18 23:16:46.973009 2026] [security2:error] [pid 831031:tid 831194] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdvpnU1ySsD4Tkeg4pbAAAAa8"]
[Sat Jul 18 23:16:47.258216 2026] [security2:error] [pid 831031:tid 831243] [client 189.219.189.1:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "adambergeron.com"] [uri "/index.php"] [unique_id "alxdv5nU1ySsD4Tkeg4pdQAAAeA"]
[Sat Jul 18 23:16:47.266228 2026] [security2:error] [pid 831031:tid 831111] [remote 113.160.142.119:34472] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "hedgerow-crafts.com"] [uri "/wp-login.php"] [unique_id "alxdv5nU1ySsD4Tkeg4piQACCU4"]
[Sat Jul 18 23:16:47.271704 2026] [security2:error] [pid 831031:tid 831239] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdv5nU1ySsD4Tkeg4piAAAAdw"]
[Sat Jul 18 23:16:47.390727 2026] [security2:error] [pid 830701:tid 830767] [remote 41.76.213.235:50930] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxdv8u1nEoSSDHiOXbDHgABJUE"]
[Sat Jul 18 23:16:47.593002 2026] [security2:error] [pid 831031:tid 831232] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdv5nU1ySsD4Tkeg4poAAAAdU"]
[Sat Jul 18 23:16:47.762975 2026] [security2:error] [pid 831031:tid 831212] [client 164.68.113.190:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxdv5nU1ySsD4Tkeg4peQABwUo"]
[Sat Jul 18 23:16:47.822588 2026] [security2:error] [pid 831031:tid 831136] [remote 113.160.142.119:34472] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "hedgerow-crafts.com"] [uri "/wp-login.php"] [unique_id "alxdv5nU1ySsD4Tkeg4pqQAB92c"], referer: https://hedgerow-crafts.com/wp-login.php
[Sat Jul 18 23:16:47.894594 2026] [security2:error] [pid 831031:tid 831171] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdv5nU1ySsD4Tkeg4prgAAAZg"]
[Sat Jul 18 23:16:48.163995 2026] [security2:error] [pid 830701:tid 830776] [remote 41.76.213.235:50930] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxdwMu1nEoSSDHiOXbDNgABeEo"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:16:48.206722 2026] [security2:error] [pid 831031:tid 831225] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdwJnU1ySsD4Tkeg4pugAAAc4"]
[Sat Jul 18 23:16:48.309468 2026] [security2:error] [pid 830701:tid 830883] [client 50.116.65.227:11120] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.rvprintfactory.com"] [uri "/index.php"] [unique_id "alxdwMu1nEoSSDHiOXbDNwAAAT4"]
[Sat Jul 18 23:16:48.448835 2026] [security2:error] [pid 830701:tid 830947] [client 50.116.65.227:11126] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.rvprintfactory.com"] [uri "/index.php"] [unique_id "alxdwMu1nEoSSDHiOXbDOwAAAX4"]
[Sat Jul 18 23:16:48.515922 2026] [security2:error] [pid 831031:tid 831277] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdwJnU1ySsD4Tkeg4p0QAAAgI"]
[Sat Jul 18 23:16:48.603520 2026] [security2:error] [pid 831031:tid 831189] [client 27.34.68.67:12182] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdwJnU1ySsD4Tkeg4p1gAAAao"]
[Sat Jul 18 23:16:48.603672 2026] [security2:error] [pid 831031:tid 831189] [client 27.34.68.67:12182] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdwJnU1ySsD4Tkeg4p1gAAAao"]
[Sat Jul 18 23:16:48.831379 2026] [security2:error] [pid 831031:tid 831230] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdwJnU1ySsD4Tkeg4p6QAAAdM"]
[Sat Jul 18 23:16:49.103728 2026] [security2:error] [pid 831031:tid 831204] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdwZnU1ySsD4Tkeg4p8AAAAbk"]
[Sat Jul 18 23:16:49.414713 2026] [security2:error] [pid 831031:tid 831271] [client 119.154.81.234:51183] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdwZnU1ySsD4Tkeg4qBwAAAfw"]
[Sat Jul 18 23:16:49.414838 2026] [security2:error] [pid 831031:tid 831271] [client 119.154.81.234:51183] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdwZnU1ySsD4Tkeg4qBwAAAfw"]
[Sat Jul 18 23:16:49.428939 2026] [security2:error] [pid 831031:tid 831261] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdwZnU1ySsD4Tkeg4qBAAAAfI"]
[Sat Jul 18 23:16:49.459789 2026] [security2:error] [pid 831031:tid 831158] [remote 199.189.225.167:33053] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.225.189.199.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxdwZnU1ySsD4Tkeg4qCAAB5X0"]
[Sat Jul 18 23:16:49.649089 2026] [security2:error] [pid 831031:tid 831229] [client 190.245.146.99:64381] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdwZnU1ySsD4Tkeg4qDgAAAdI"]
[Sat Jul 18 23:16:49.654856 2026] [security2:error] [pid 831031:tid 831229] [client 190.245.146.99:64381] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdwZnU1ySsD4Tkeg4qDgAAAdI"]
[Sat Jul 18 23:16:49.704460 2026] [security2:error] [pid 831031:tid 831182] [client 171.4.232.110:60549] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdwZnU1ySsD4Tkeg4qEQAAAaM"]
[Sat Jul 18 23:16:49.704561 2026] [security2:error] [pid 831031:tid 831182] [client 171.4.232.110:60549] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdwZnU1ySsD4Tkeg4qEQAAAaM"]
[Sat Jul 18 23:16:49.768213 2026] [security2:error] [pid 831031:tid 831203] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdwZnU1ySsD4Tkeg4qEwAAAbg"]
[Sat Jul 18 23:16:49.982830 2026] [security2:error] [pid 831031:tid 831139] [remote 199.189.225.167:33053] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.225.189.199.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxdwZnU1ySsD4Tkeg4qHwABl2o"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:16:50.069071 2026] [security2:error] [pid 831031:tid 831066] [remote 14.128.14.9:34262] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.14.128.14.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "samueldcohen.com"] [uri "/wp-login.php"] [unique_id "alxdwpnU1ySsD4Tkeg4qJgACCiE"]
[Sat Jul 18 23:16:50.076230 2026] [security2:error] [pid 831031:tid 831190] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdwpnU1ySsD4Tkeg4qJAAAAas"]
[Sat Jul 18 23:16:50.375448 2026] [security2:error] [pid 831031:tid 831184] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdwpnU1ySsD4Tkeg4qMgAAAaU"]
[Sat Jul 18 23:16:50.641978 2026] [security2:error] [pid 831031:tid 831164] [client 128.254.188.141:34076] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "allergyantidotes.com"] [uri "/index.php"] [unique_id "alxdwpnU1ySsD4Tkeg4qQAAAAZE"]
[Sat Jul 18 23:16:50.661271 2026] [security2:error] [pid 831031:tid 831233] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdwpnU1ySsD4Tkeg4qRAAAAdY"]
[Sat Jul 18 23:16:50.684733 2026] [security2:error] [pid 831031:tid 831060] [remote 14.128.14.9:34262] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.14.128.14.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "samueldcohen.com"] [uri "/wp-login.php"] [unique_id "alxdwpnU1ySsD4Tkeg4qSgACCBs"], referer: https://samueldcohen.com/wp-login.php
[Sat Jul 18 23:16:50.962798 2026] [security2:error] [pid 831031:tid 831247] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdwpnU1ySsD4Tkeg4qWgAAAeQ"]
[Sat Jul 18 23:16:51.021316 2026] [security2:error] [pid 830701:tid 830875] [client 223.178.210.203:15848] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdw8u1nEoSSDHiOXbDZgAAATY"]
[Sat Jul 18 23:16:51.021420 2026] [security2:error] [pid 830701:tid 830875] [client 223.178.210.203:15848] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdw8u1nEoSSDHiOXbDZgAAATY"]
[Sat Jul 18 23:16:51.305480 2026] [security2:error] [pid 831031:tid 831195] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdw5nU1ySsD4Tkeg4qawAAAbA"]
[Sat Jul 18 23:16:51.602616 2026] [security2:error] [pid 831031:tid 831199] [client 164.68.113.190:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxdw5nU1ySsD4Tkeg4qZgABtG0"]
[Sat Jul 18 23:16:51.633362 2026] [security2:error] [pid 831031:tid 831266] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdw5nU1ySsD4Tkeg4qeAAAAfc"]
[Sat Jul 18 23:16:51.773504 2026] [security2:error] [pid 831031:tid 831258] [client 103.48.44.9:60698] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdw5nU1ySsD4Tkeg4qgAAAAe8"]
[Sat Jul 18 23:16:51.773676 2026] [security2:error] [pid 831031:tid 831258] [client 103.48.44.9:60698] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdw5nU1ySsD4Tkeg4qgAAAAe8"]
[Sat Jul 18 23:16:51.780380 2026] [security2:error] [pid 830701:tid 830710] [remote 62.210.185.4:48974] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 4.185.210.62.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxdw8u1nEoSSDHiOXbDfAABJAg"]
[Sat Jul 18 23:16:51.780591 2026] [security2:error] [pid 830701:tid 830857] [client 62.210.185.4:48974] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxdw8u1nEoSSDHiOXbDfAABJAg"]
[Sat Jul 18 23:16:51.929267 2026] [security2:error] [pid 831031:tid 831285] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdw5nU1ySsD4Tkeg4qiQAAAgo"]
[Sat Jul 18 23:16:52.466255 2026] [security2:error] [pid 831031:tid 831279] [client 50.116.65.227:58886] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "recruitinginsight.us"] [uri "/wp-cron.php"] [unique_id "alxdxJnU1ySsD4Tkeg4qpAAAAgQ"]
[Sat Jul 18 23:16:52.615865 2026] [security2:error] [pid 831031:tid 831176] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdxJnU1ySsD4Tkeg4qpwAAAZ0"]
[Sat Jul 18 23:16:52.622845 2026] [security2:error] [pid 831031:tid 831192] [client 223.228.182.224:51376] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxdxJnU1ySsD4Tkeg4qqwAAAa0"]
[Sat Jul 18 23:16:52.622938 2026] [security2:error] [pid 831031:tid 831192] [client 223.228.182.224:51376] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxdxJnU1ySsD4Tkeg4qqwAAAa0"]
[Sat Jul 18 23:16:52.709434 2026] [security2:error] [pid 830701:tid 830942] [client 100.27.85.243:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxdxMu1nEoSSDHiOXbDkwABeQQ"]
[Sat Jul 18 23:16:52.712167 2026] [security2:error] [pid 830701:tid 830795] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdxMu1nEoSSDHiOXbDlAABC10"]
[Sat Jul 18 23:16:52.712289 2026] [security2:error] [pid 830701:tid 830832] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdxMu1nEoSSDHiOXbDlAABC10"]
[Sat Jul 18 23:16:52.941276 2026] [security2:error] [pid 831031:tid 831180] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdxJnU1ySsD4Tkeg4qtgAAAaE"]
[Sat Jul 18 23:16:53.064144 2026] [security2:error] [pid 831031:tid 831182] [client 164.68.113.190:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxdxJnU1ySsD4Tkeg4qpgABo1g"]
[Sat Jul 18 23:16:53.066537 2026] [security2:error] [pid 831031:tid 831117] [remote 152.228.213.32:35482] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "wgs.doq.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxdxZnU1ySsD4Tkeg4qvgAB0lQ"]
[Sat Jul 18 23:16:53.066675 2026] [security2:error] [pid 831031:tid 831229] [client 152.228.213.32:35482] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "wgs.doq.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxdxZnU1ySsD4Tkeg4qvgAB0lQ"]
[Sat Jul 18 23:16:53.167471 2026] [security2:error] [pid 830701:tid 830704] [remote 163.227.186.27:41638] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxdxcu1nEoSSDHiOXbDmQABNwI"]
[Sat Jul 18 23:16:53.262231 2026] [security2:error] [pid 831031:tid 831260] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdxZnU1ySsD4Tkeg4qxAAAAfE"]
[Sat Jul 18 23:16:53.587571 2026] [security2:error] [pid 831031:tid 831183] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdxZnU1ySsD4Tkeg4q1gAAAaQ"]
[Sat Jul 18 23:16:53.646378 2026] [security2:error] [pid 830701:tid 830801] [remote 163.227.186.27:41638] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxdxcu1nEoSSDHiOXbDpgABiWM"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:16:53.917075 2026] [security2:error] [pid 831031:tid 831191] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdxZnU1ySsD4Tkeg4q6QAAAaw"]
[Sat Jul 18 23:16:54.261084 2026] [security2:error] [pid 831031:tid 831190] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdxpnU1ySsD4Tkeg4q9QAAAas"]
[Sat Jul 18 23:16:56.672063 2026] [security2:error] [pid 831031:tid 831264] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdyJnU1ySsD4Tkeg4rRAAAAfU"]
[Sat Jul 18 23:16:57.013996 2026] [security2:error] [pid 831031:tid 831173] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdyJnU1ySsD4Tkeg4rTwAAAZo"]
[Sat Jul 18 23:16:57.308362 2026] [security2:error] [pid 831031:tid 831176] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdyZnU1ySsD4Tkeg4rWAAAAZ0"]
[Sat Jul 18 23:16:57.388711 2026] [security2:error] [pid 830701:tid 830901] [client 223.185.61.63:33162] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdycu1nEoSSDHiOXbEBAAAAVA"]
[Sat Jul 18 23:16:57.388814 2026] [security2:error] [pid 830701:tid 830901] [client 223.185.61.63:33162] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdycu1nEoSSDHiOXbEBAAAAVA"]
[Sat Jul 18 23:16:57.413536 2026] [proxy:error] [pid 830701:tid 830889] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:16:57.413612 2026] [proxy_http:error] [pid 830701:tid 830889] [client 193.47.62.168:60016] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:16:57.414256 2026] [proxy:error] [pid 830701:tid 830889] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:16:57.414286 2026] [proxy_http:error] [pid 830701:tid 830889] [client 193.47.62.168:60016] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:16:57.628731 2026] [security2:error] [pid 831031:tid 831266] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdyZnU1ySsD4Tkeg4rZQAAAfc"]
[Sat Jul 18 23:16:57.780860 2026] [security2:error] [pid 831031:tid 831235] [client 93.86.49.238:33065] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 238.49.86.93.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdyZnU1ySsD4Tkeg4rawAAAdg"]
[Sat Jul 18 23:16:57.780957 2026] [security2:error] [pid 831031:tid 831235] [client 93.86.49.238:33065] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "giftsurprizo.com"] [uri "/xmlrpc.php"] [unique_id "alxdyZnU1ySsD4Tkeg4rawAAAdg"]
[Sat Jul 18 23:16:58.050912 2026] [security2:error] [pid 831031:tid 831190] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdypnU1ySsD4Tkeg4rdgAAAas"]
[Sat Jul 18 23:16:58.268440 2026] [security2:error] [pid 831031:tid 831288] [client 164.68.113.190:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxdyZnU1ySsD4Tkeg4rbAACDR8"]
[Sat Jul 18 23:16:58.778717 2026] [security2:error] [pid 830701:tid 830894] [client 173.252.70.59:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.factsandminds.com"] [uri "/index.php"] [unique_id "alxdyMu1nEoSSDHiOXbD9gAAAUk"]
[Sat Jul 18 23:16:59.033669 2026] [security2:error] [pid 831031:tid 831181] [client 27.34.68.67:11076] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdy5nU1ySsD4Tkeg4rnQAAAaI"]
[Sat Jul 18 23:16:59.033848 2026] [security2:error] [pid 831031:tid 831181] [client 27.34.68.67:11076] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxdy5nU1ySsD4Tkeg4rnQAAAaI"]
[Sat Jul 18 23:16:59.700181 2026] [security2:error] [pid 831031:tid 831245] [client 64.233.173.203:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.thesoloceos.com"] [uri "/index.php"] [unique_id "alxdypnU1ySsD4Tkeg4rcwAAAeI"]
[Sat Jul 18 23:16:59.968700 2026] [security2:error] [pid 830701:tid 830883] [client 119.154.81.234:51645] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdy8u1nEoSSDHiOXbENAAAAT4"]
[Sat Jul 18 23:16:59.968872 2026] [security2:error] [pid 830701:tid 830883] [client 119.154.81.234:51645] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxdy8u1nEoSSDHiOXbENAAAAT4"]
[Sat Jul 18 23:17:00.019374 2026] [security2:error] [pid 831031:tid 831276] [client 20.104.96.117:36565] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.savilerowtravel.com"] [uri "/"] [unique_id "alxdy5nU1ySsD4Tkeg4rxgAAAgE"]
[Sat Jul 18 23:17:00.182171 2026] [security2:error] [pid 831031:tid 831240] [client 190.245.146.99:65027] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdzJnU1ySsD4Tkeg4rzwAAAd0"]
[Sat Jul 18 23:17:00.188548 2026] [security2:error] [pid 831031:tid 831240] [client 190.245.146.99:65027] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxdzJnU1ySsD4Tkeg4rzwAAAd0"]
[Sat Jul 18 23:17:00.309061 2026] [security2:error] [pid 830701:tid 830929] [client 171.4.232.110:37713] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdzMu1nEoSSDHiOXbEPwAAAWw"]
[Sat Jul 18 23:17:00.309194 2026] [security2:error] [pid 830701:tid 830929] [client 171.4.232.110:37713] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdzMu1nEoSSDHiOXbEPwAAAWw"]
[Sat Jul 18 23:17:01.646186 2026] [security2:error] [pid 831031:tid 831251] [client 223.178.210.203:32926] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdzZnU1ySsD4Tkeg4sCgAAAeg"]
[Sat Jul 18 23:17:01.646270 2026] [security2:error] [pid 831031:tid 831251] [client 223.178.210.203:32926] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxdzZnU1ySsD4Tkeg4sCgAAAeg"]
[Sat Jul 18 23:17:02.262346 2026] [security2:error] [pid 830701:tid 830869] [client 103.48.44.9:61207] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdzsu1nEoSSDHiOXbEYQAAATA"]
[Sat Jul 18 23:17:02.262459 2026] [security2:error] [pid 830701:tid 830869] [client 103.48.44.9:61207] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxdzsu1nEoSSDHiOXbEYQAAATA"]
[Sat Jul 18 23:17:03.134438 2026] [security2:error] [pid 831031:tid 831147] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdz5nU1ySsD4Tkeg4sMwABzXI"]
[Sat Jul 18 23:17:03.134601 2026] [security2:error] [pid 831031:tid 831224] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxdz5nU1ySsD4Tkeg4sMwABzXI"]
[Sat Jul 18 23:17:03.439148 2026] [security2:error] [pid 830701:tid 830810] [remote 154.61.75.100:43500] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxdz8u1nEoSSDHiOXbEewABXWw"]
[Sat Jul 18 23:17:03.478373 2026] [security2:error] [pid 830701:tid 830837] [client 223.228.182.224:52521] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxdz8u1nEoSSDHiOXbEfAAAARA"]
[Sat Jul 18 23:17:03.478504 2026] [security2:error] [pid 830701:tid 830837] [client 223.228.182.224:52521] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxdz8u1nEoSSDHiOXbEfAAAARA"]
[Sat Jul 18 23:17:03.674977 2026] [security2:error] [pid 831031:tid 831145] [remote 113.160.142.119:43694] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "phillipbloch.com"] [uri "/wp-login.php"] [unique_id "alxdz5nU1ySsD4Tkeg4sSQABxXA"]
[Sat Jul 18 23:17:04.176151 2026] [security2:error] [pid 831031:tid 831036] [remote 113.160.142.119:43694] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "phillipbloch.com"] [uri "/wp-login.php"] [unique_id "alxd0JnU1ySsD4Tkeg4sWwABywM"], referer: https://phillipbloch.com/wp-login.php
[Sat Jul 18 23:17:04.433995 2026] [security2:error] [pid 830701:tid 830889] [client 45.3.45.60:57179] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "155"] [id "900406"] [msg "wp-login POST logging"] [data "200"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxd0Mu1nEoSSDHiOXbEhAAAAUQ"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:17:04.544554 2026] [core:error] [pid 831031:tid 831214] [client 50.116.65.227:13070] AH00135: Invalid method in request PURGE /.* HTTP/1.1
[Sat Jul 18 23:17:04.558109 2026] [core:error] [pid 831031:tid 831215] [client 50.116.65.227:13078] AH00135: Invalid method in request PURGE /.* HTTP/1.1
[Sat Jul 18 23:17:05.592812 2026] [security2:error] [pid 830701:tid 830791] [remote 185.115.217.185:47792] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.217.115.185.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxd0cu1nEoSSDHiOXbEoAABDlk"]
[Sat Jul 18 23:17:06.276556 2026] [security2:error] [pid 830701:tid 830803] [remote 185.115.217.185:47792] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.217.115.185.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxd0su1nEoSSDHiOXbEtAABQWU"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:17:06.306356 2026] [security2:error] [pid 830701:tid 830869] [client 164.68.113.190:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxd0cu1nEoSSDHiOXbEsAABMGM"]
[Sat Jul 18 23:17:07.193613 2026] [security2:error] [pid 831031:tid 831103] [remote 45.157.54.14:34267] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nmu.ags.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxd05nU1ySsD4Tkeg4sygAB40Y"]
[Sat Jul 18 23:17:07.193735 2026] [security2:error] [pid 831031:tid 831246] [client 45.157.54.14:34267] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nmu.ags.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxd05nU1ySsD4Tkeg4sygAB40Y"]
[Sat Jul 18 23:17:07.203849 2026] [security2:error] [pid 830701:tid 830811] [remote 45.157.54.14:34252] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nmu.ags.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxd08u1nEoSSDHiOXbEzAABIG0"]
[Sat Jul 18 23:17:07.203982 2026] [security2:error] [pid 830701:tid 830853] [client 45.157.54.14:34252] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nmu.ags.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxd08u1nEoSSDHiOXbEzAABIG0"]
[Sat Jul 18 23:17:07.378000 2026] [security2:error] [pid 831031:tid 831097] [remote 97.74.93.24:56288] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "boz.rnn.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxd05nU1ySsD4Tkeg4szgABn0A"]
[Sat Jul 18 23:17:07.532577 2026] [security2:error] [pid 830701:tid 830817] [remote 152.228.213.32:41468] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxd08u1nEoSSDHiOXbE1QABM3M"]
[Sat Jul 18 23:17:07.657549 2026] [security2:error] [pid 831031:tid 831117] [remote 68.178.160.25:34962] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "wgs.doq.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxd05nU1ySsD4Tkeg4s2gAB8VQ"]
[Sat Jul 18 23:17:07.657745 2026] [security2:error] [pid 831031:tid 831260] [client 68.178.160.25:34962] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "wgs.doq.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxd05nU1ySsD4Tkeg4s2gAB8VQ"]
[Sat Jul 18 23:17:07.795875 2026] [security2:error] [pid 831031:tid 831128] [remote 97.74.93.24:56288] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "boz.rnn.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxd05nU1ySsD4Tkeg4s4AAB7l8"], referer: https://boz.rnn.mybluehost.me/wp-login.php
[Sat Jul 18 23:17:07.908689 2026] [security2:error] [pid 830701:tid 830831] [client 223.185.61.63:14860] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxd08u1nEoSSDHiOXbE4AAAAQo"]
[Sat Jul 18 23:17:07.908851 2026] [security2:error] [pid 830701:tid 830831] [client 223.185.61.63:14860] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxd08u1nEoSSDHiOXbE4AAAAQo"]
[Sat Jul 18 23:17:08.004773 2026] [security2:error] [pid 830701:tid 830762] [remote 152.228.213.32:41468] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxd08u1nEoSSDHiOXbE5AABHTw"], referer: https://mezzacraft.com/wp-login.php
[Sat Jul 18 23:17:08.376011 2026] [security2:error] [pid 831031:tid 831130] [remote 20.153.140.50:47414] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxd1JnU1ySsD4Tkeg4s7wABtGE"]
[Sat Jul 18 23:17:08.817396 2026] [security2:error] [pid 831031:tid 831126] [remote 20.153.140.50:47414] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxd1JnU1ySsD4Tkeg4s-QACDV0"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:17:09.315688 2026] [security2:error] [pid 831031:tid 831170] [client 47.128.117.235:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "innovativecleaningsvs.com"] [uri "/index.php"] [unique_id "alxd05nU1ySsD4Tkeg4sxwABlx4"]
[Sat Jul 18 23:17:09.695854 2026] [security2:error] [pid 830701:tid 830899] [client 27.34.68.67:44300] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxd1cu1nEoSSDHiOXbE_wAAAU4"]
[Sat Jul 18 23:17:09.695981 2026] [security2:error] [pid 830701:tid 830899] [client 27.34.68.67:44300] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxd1cu1nEoSSDHiOXbE_wAAAU4"]
[Sat Jul 18 23:17:09.994310 2026] [security2:error] [pid 831031:tid 831281] [client 124.13.193.140:52411] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 140.193.13.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "verdunestate.com"] [uri "/xmlrpc.php"] [unique_id "alxd1ZnU1ySsD4Tkeg4tJgAAAgY"]
[Sat Jul 18 23:17:09.994442 2026] [security2:error] [pid 831031:tid 831281] [client 124.13.193.140:52411] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "verdunestate.com"] [uri "/xmlrpc.php"] [unique_id "alxd1ZnU1ySsD4Tkeg4tJgAAAgY"]
[Sat Jul 18 23:17:10.167967 2026] [security2:error] [pid 830701:tid 830896] [client 57.141.18.76:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxd1cu1nEoSSDHiOXbFBgAAAUs"]
[Sat Jul 18 23:17:10.498678 2026] [security2:error] [pid 831031:tid 831261] [client 119.154.81.234:52079] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxd1pnU1ySsD4Tkeg4tPgAAAfI"]
[Sat Jul 18 23:17:10.498913 2026] [security2:error] [pid 831031:tid 831261] [client 119.154.81.234:52079] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxd1pnU1ySsD4Tkeg4tPgAAAfI"]
[Sat Jul 18 23:17:10.701631 2026] [security2:error] [pid 831031:tid 831259] [client 190.245.146.99:49153] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxd1pnU1ySsD4Tkeg4tTQAAAfA"]
[Sat Jul 18 23:17:10.701783 2026] [security2:error] [pid 831031:tid 831259] [client 190.245.146.99:49153] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxd1pnU1ySsD4Tkeg4tTQAAAfA"]
[Sat Jul 18 23:17:10.908892 2026] [security2:error] [pid 831031:tid 831228] [client 171.4.232.110:38007] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxd1pnU1ySsD4Tkeg4tUAAAAdE"]
[Sat Jul 18 23:17:10.909081 2026] [security2:error] [pid 831031:tid 831228] [client 171.4.232.110:38007] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxd1pnU1ySsD4Tkeg4tUAAAAdE"]
[Sat Jul 18 23:17:10.985048 2026] [security2:error] [pid 830701:tid 830897] [client 130.195.241.7:6930] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "nomorewetsheets.net"] [uri "/index.php"] [unique_id "alxd1su1nEoSSDHiOXbFEgAAAUw"]
[Sat Jul 18 23:17:11.379972 2026] [security2:error] [pid 831031:tid 831162] [client 57.141.18.39:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxd15nU1ySsD4Tkeg4tXwAAAY8"]
[Sat Jul 18 23:17:11.420868 2026] [security2:error] [pid 831031:tid 831172] [client 65.111.28.41:41003] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxd15nU1ySsD4Tkeg4tbAAAAZk"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:17:12.026054 2026] [fcgid:warn] [pid 831031:tid 831178] (70014)End of file found: [client 91.238.181.10:64080] mod_fcgid: can't get data from http client
[Sat Jul 18 23:17:12.118728 2026] [security2:error] [pid 831031:tid 831190] [client 65.111.31.179:26419] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 179.31.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxd2JnU1ySsD4Tkeg4tgQAAAas"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:17:12.244361 2026] [security2:error] [pid 831031:tid 831280] [client 223.178.210.203:2426] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxd2JnU1ySsD4Tkeg4tiwAAAgU"]
[Sat Jul 18 23:17:12.244447 2026] [security2:error] [pid 831031:tid 831280] [client 223.178.210.203:2426] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxd2JnU1ySsD4Tkeg4tiwAAAgU"]
[Sat Jul 18 23:17:12.763505 2026] [security2:error] [pid 831031:tid 831213] [client 65.111.27.205:39861] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 205.27.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxd2JnU1ySsD4Tkeg4tnwAAAcI"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:17:12.842454 2026] [security2:error] [pid 831031:tid 831232] [client 103.48.44.9:61720] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxd2JnU1ySsD4Tkeg4tpgAAAdU"]
[Sat Jul 18 23:17:12.842562 2026] [security2:error] [pid 831031:tid 831232] [client 103.48.44.9:61720] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxd2JnU1ySsD4Tkeg4tpgAAAdU"]
[Sat Jul 18 23:17:13.409360 2026] [security2:error] [pid 831031:tid 831185] [client 65.111.28.5:19347] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxd2ZnU1ySsD4Tkeg4twQAAAaY"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:17:13.749190 2026] [security2:error] [pid 831031:tid 831044] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxd2ZnU1ySsD4Tkeg4tzAABsws"]
[Sat Jul 18 23:17:13.749343 2026] [security2:error] [pid 831031:tid 831198] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxd2ZnU1ySsD4Tkeg4tzAABsws"]
[Sat Jul 18 23:17:13.931046 2026] [security2:error] [pid 830701:tid 830726] [remote 31.42.184.154:54094] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxd2cu1nEoSSDHiOXbFSAABShg"]
[Sat Jul 18 23:17:13.931234 2026] [security2:error] [pid 830701:tid 830895] [client 31.42.184.154:54094] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxd2cu1nEoSSDHiOXbFSAABShg"]
[Sat Jul 18 23:17:14.211921 2026] [ssl:error] [pid 831031:tid 831169] [client 18.235.110.182:59308] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname cpanel.sya.yfm.mybluehost.me provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:17:14.248863 2026] [security2:error] [pid 830701:tid 830843] [client 223.228.182.224:28456] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxd2su1nEoSSDHiOXbFTQAAARY"]
[Sat Jul 18 23:17:14.253235 2026] [security2:error] [pid 830701:tid 830843] [client 223.228.182.224:28456] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxd2su1nEoSSDHiOXbFTQAAARY"]
[Sat Jul 18 23:17:15.298237 2026] [security2:error] [pid 831031:tid 831174] [client 45.3.45.195:12549] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 195.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxd25nU1ySsD4Tkeg4uAgAAAZs"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:17:16.186129 2026] [security2:error] [pid 831031:tid 831225] [client 124.29.207.185:37813] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxd3JnU1ySsD4Tkeg4uMgAAAc4"]
[Sat Jul 18 23:17:16.186258 2026] [security2:error] [pid 831031:tid 831225] [client 124.29.207.185:37813] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxd3JnU1ySsD4Tkeg4uMgAAAc4"]
[Sat Jul 18 23:17:16.548202 2026] [security2:error] [pid 831031:tid 831147] [remote 68.178.160.25:43002] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.idf.ldc.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxd3JnU1ySsD4Tkeg4uPgAB7HI"]
[Sat Jul 18 23:17:16.548329 2026] [security2:error] [pid 831031:tid 831255] [client 68.178.160.25:43002] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "mail.idf.ldc.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxd3JnU1ySsD4Tkeg4uPgAB7HI"]
[Sat Jul 18 23:17:16.874375 2026] [security2:error] [pid 830701:tid 830839] [client 84.238.75.234:33080] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "toddnielsen.com"] [uri "/index.php"] [unique_id "alxd3Mu1nEoSSDHiOXbFZgABEho"], referer: https://toddnielsen.com
[Sat Jul 18 23:17:16.938626 2026] [security2:error] [pid 831031:tid 831209] [client 47.82.124.222:60409] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "www.appelmanimages.com"] [uri "/wp-content/uploads/2014/01/08-2802-page/242-365-2014-Sibling-kids-piggy-back-game-with-preschool-children-by-naperville-photographer.jpg"] [unique_id "alxd3JnU1ySsD4Tkeg4uRgAAAb4"]
[Sat Jul 18 23:17:17.201359 2026] [security2:error] [pid 830701:tid 830792] [remote 157.66.47.83:37256] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxd3cu1nEoSSDHiOXbFfwABK1o"]
[Sat Jul 18 23:17:17.269174 2026] [security2:error] [pid 830701:tid 830710] [remote 41.76.213.235:58642] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "narv.co"] [uri "/xmlrpc.php"] [unique_id "alxd3cu1nEoSSDHiOXbFggABawg"]
[Sat Jul 18 23:17:17.269335 2026] [security2:error] [pid 830701:tid 830928] [client 41.76.213.235:58642] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "narv.co"] [uri "/xmlrpc.php"] [unique_id "alxd3cu1nEoSSDHiOXbFggABawg"]
[Sat Jul 18 23:17:17.610198 2026] [security2:error] [pid 830701:tid 830715] [remote 157.66.47.83:37256] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxd3cu1nEoSSDHiOXbFhgABcQ0"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:17:18.050182 2026] [security2:error] [pid 831031:tid 831133] [remote 31.42.184.154:54116] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "allergyantidotes.com"] [uri "/wp-login.php"] [unique_id "alxd3pnU1ySsD4Tkeg4ufwABoGQ"]
[Sat Jul 18 23:17:18.287026 2026] [security2:error] [pid 831031:tid 831055] [remote 31.42.184.154:54116] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "allergyantidotes.com"] [uri "/wp-login.php"] [unique_id "alxd3pnU1ySsD4Tkeg4uhwABxRY"], referer: https://allergyantidotes.com/wp-login.php
[Sat Jul 18 23:17:18.341804 2026] [security2:error] [pid 831031:tid 831228] [client 47.82.124.46:47007] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "www.appelmanimages.com"] [uri "/wp-content/uploads/2014/01/08-2802-page/242-365-2014-Sibling-kids-piggy-back-game-with-preschool-children-by-naperville-photographer.jpg"] [unique_id "alxd3pnU1ySsD4Tkeg4uiwAAAdE"]
[Sat Jul 18 23:17:18.462977 2026] [security2:error] [pid 831031:tid 831194] [client 223.185.61.63:11875] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxd3pnU1ySsD4Tkeg4ukgAAAa8"]
[Sat Jul 18 23:17:18.467583 2026] [security2:error] [pid 831031:tid 831194] [client 223.185.61.63:11875] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxd3pnU1ySsD4Tkeg4ukgAAAa8"]
[Sat Jul 18 23:17:18.539420 2026] [security2:error] [pid 831031:tid 831169] [client 3.108.60.216:28922] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxd3pnU1ySsD4Tkeg4ulQAAAZY"]
[Sat Jul 18 23:17:18.539507 2026] [security2:error] [pid 831031:tid 831169] [client 3.108.60.216:28922] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxd3pnU1ySsD4Tkeg4ulQAAAZY"]
[Sat Jul 18 23:17:18.994110 2026] [security2:error] [pid 831031:tid 831220] [client 141.255.164.66:45722] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\w ?(?:user|and)(\\\\w+)char ?\\\\([0-9]| \\\\b(?:execute|convert) ?\\\\(|; ?\\\\bdelete\\\\b.{1,100}?; ?(?:insert|declare @|varchar) ?|\\\\bdrop\\\\b .{1,100} table |(?:declare|convert) .{1,100} varchar\\\\(|null ?, ?null ?, ?(?:accesslevel|user_?name) ?,|\\\\bconcat ..." at ARGS:requests.requests.body.requests.requests.path. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "395"] [id "340157"] [rev "38"] [msg "Atomicorp.com WAF Rules: Generic SQL inline command protection"] [data "union select ,ARGS:requests.requests.body.requests.requests.path"] [severity "CRITICAL"] [tag "SQLi"] [hostname "joulecommunications.com"] [uri "/"] [unique_id "alxd3pnU1ySsD4Tkeg4ulwAAAck"]
[Sat Jul 18 23:17:19.406840 2026] [security2:error] [pid 831031:tid 831040] [remote 102.134.101.35:38100] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 35.101.134.102.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxd35nU1ySsD4Tkeg4utQABuwc"]
[Sat Jul 18 23:17:19.895644 2026] [security2:error] [pid 831031:tid 831086] [remote 102.134.101.35:38100] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 35.101.134.102.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxd35nU1ySsD4Tkeg4uygAB2TU"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:17:20.226416 2026] [security2:error] [pid 831031:tid 831218] [client 27.34.68.67:59522] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxd4JnU1ySsD4Tkeg4u1wAAAcc"]
[Sat Jul 18 23:17:20.226510 2026] [security2:error] [pid 831031:tid 831218] [client 27.34.68.67:59522] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxd4JnU1ySsD4Tkeg4u1wAAAcc"]
[Sat Jul 18 23:17:20.878393 2026] [security2:error] [pid 831031:tid 831252] [client 47.82.124.212:63361] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "www.appelmanimages.com"] [uri "/wp-content/uploads/2014/01/08-2802-page/242-365-2014-Sibling-kids-piggy-back-game-with-preschool-children-by-naperville-photographer.jpg"] [unique_id "alxd4JnU1ySsD4Tkeg4u9wAAAek"]
[Sat Jul 18 23:17:21.079269 2026] [security2:error] [pid 831031:tid 831267] [client 119.154.81.234:52523] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxd4ZnU1ySsD4Tkeg4u_QAAAfg"]
[Sat Jul 18 23:17:21.079361 2026] [security2:error] [pid 831031:tid 831267] [client 119.154.81.234:52523] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxd4ZnU1ySsD4Tkeg4u_QAAAfg"]
[Sat Jul 18 23:17:21.224535 2026] [security2:error] [pid 830701:tid 830875] [client 190.245.146.99:49676] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxd4cu1nEoSSDHiOXbFxgAAATY"]
[Sat Jul 18 23:17:21.230441 2026] [security2:error] [pid 830701:tid 830875] [client 190.245.146.99:49676] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxd4cu1nEoSSDHiOXbFxgAAATY"]
[Sat Jul 18 23:17:21.489252 2026] [security2:error] [pid 831031:tid 831119] [remote 97.74.93.24:57916] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "latiendadejorge.com.gt"] [uri "/wp-login.php"] [unique_id "alxd4ZnU1ySsD4Tkeg4vCAAB2VY"]
[Sat Jul 18 23:17:21.499840 2026] [security2:error] [pid 831031:tid 831246] [client 171.4.232.110:62074] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxd4ZnU1ySsD4Tkeg4vCQAAAeM"]
[Sat Jul 18 23:17:21.499928 2026] [security2:error] [pid 831031:tid 831246] [client 171.4.232.110:62074] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxd4ZnU1ySsD4Tkeg4vCQAAAeM"]
[Sat Jul 18 23:17:21.949889 2026] [security2:error] [pid 831031:tid 831136] [remote 97.74.93.24:57916] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "latiendadejorge.com.gt"] [uri "/wp-login.php"] [unique_id "alxd4ZnU1ySsD4Tkeg4vIAAB3Wc"], referer: https://latiendadejorge.com.gt/wp-login.php
[Sat Jul 18 23:17:22.436197 2026] [security2:error] [pid 830701:tid 830929] [client 47.82.124.169:46894] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "www.appelmanimages.com"] [uri "/wp-content/uploads/2014/01/08-2802-page/242-365-2014-Sibling-kids-piggy-back-game-with-preschool-children-by-naperville-photographer.jpg"] [unique_id "alxd4su1nEoSSDHiOXbF2AAAAWw"]
[Sat Jul 18 23:17:22.956074 2026] [security2:error] [pid 831031:tid 831265] [client 223.178.210.203:7567] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxd4pnU1ySsD4Tkeg4vTgAAAfY"]
[Sat Jul 18 23:17:22.956205 2026] [security2:error] [pid 831031:tid 831265] [client 223.178.210.203:7567] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxd4pnU1ySsD4Tkeg4vTgAAAfY"]
[Sat Jul 18 23:17:23.288281 2026] [security2:error] [pid 831031:tid 831270] [client 45.3.44.214:59589] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 214.44.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxd45nU1ySsD4Tkeg4vWQAAAfs"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:17:23.372863 2026] [security2:error] [pid 830701:tid 830946] [client 103.48.44.9:62227] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxd48u1nEoSSDHiOXbF6wAAAX0"]
[Sat Jul 18 23:17:23.373016 2026] [security2:error] [pid 830701:tid 830946] [client 103.48.44.9:62227] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxd48u1nEoSSDHiOXbF6wAAAX0"]
[Sat Jul 18 23:17:24.081558 2026] [security2:error] [pid 831031:tid 831187] [client 47.82.124.123:4009] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "www.appelmanimages.com"] [uri "/wp-content/uploads/2014/01/08-2802-page/242-365-2014-Sibling-kids-piggy-back-game-with-preschool-children-by-naperville-photographer.jpg"] [unique_id "alxd5JnU1ySsD4Tkeg4viQAAAag"]
[Sat Jul 18 23:17:24.341003 2026] [security2:error] [pid 831031:tid 831046] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxd5JnU1ySsD4Tkeg4vkQABtg0"]
[Sat Jul 18 23:17:24.341194 2026] [security2:error] [pid 831031:tid 831201] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxd5JnU1ySsD4Tkeg4vkQABtg0"]
[Sat Jul 18 23:17:24.382087 2026] [security2:error] [pid 830701:tid 830759] [remote 31.42.184.154:40090] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxd5Mu1nEoSSDHiOXbF-wABMjk"]
[Sat Jul 18 23:17:24.609362 2026] [security2:error] [pid 831031:tid 831269] [client 3.108.60.216:42806] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxd5JnU1ySsD4Tkeg4vnAAAAfo"]
[Sat Jul 18 23:17:24.626931 2026] [security2:error] [pid 830701:tid 830713] [remote 31.42.184.154:40090] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxd5Mu1nEoSSDHiOXbGAgABggs"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:17:25.183566 2026] [security2:error] [pid 831031:tid 831285] [client 223.228.182.224:43222] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxd5ZnU1ySsD4Tkeg4vvAAAAgo"]
[Sat Jul 18 23:17:25.183702 2026] [security2:error] [pid 831031:tid 831285] [client 223.228.182.224:43222] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxd5ZnU1ySsD4Tkeg4vvAAAAgo"]
[Sat Jul 18 23:17:25.426424 2026] [security2:error] [pid 830701:tid 830909] [client 47.82.124.180:13480] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "www.appelmanimages.com"] [uri "/wp-content/uploads/2014/01/08-2802-page/242-365-2014-Sibling-kids-piggy-back-game-with-preschool-children-by-naperville-photographer.jpg"] [unique_id "alxd5cu1nEoSSDHiOXbGGAAAAVg"]
[Sat Jul 18 23:17:25.615436 2026] [security2:error] [pid 830701:tid 830761] [remote 31.42.184.154:40110] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "soloceos.com"] [uri "/wp-login.php"] [unique_id "alxd5cu1nEoSSDHiOXbGHwABhTs"]
[Sat Jul 18 23:17:25.714656 2026] [security2:error] [pid 831031:tid 831204] [client 65.0.26.70:23546] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.26.0.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxd5ZnU1ySsD4Tkeg4v1gAAAbk"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:17:25.837605 2026] [security2:error] [pid 830701:tid 830819] [remote 31.42.184.154:46768] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxd5cu1nEoSSDHiOXbGJgABKHU"]
[Sat Jul 18 23:17:26.054725 2026] [security2:error] [pid 830701:tid 830777] [remote 31.42.184.154:40110] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "soloceos.com"] [uri "/wp-login.php"] [unique_id "alxd5su1nEoSSDHiOXbGKQABC0s"], referer: https://soloceos.com/wp-login.php
[Sat Jul 18 23:17:26.188781 2026] [security2:error] [pid 830701:tid 830957] [client 57.141.18.96:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxd5su1nEoSSDHiOXbGKAAAAYg"]
[Sat Jul 18 23:17:26.203886 2026] [security2:error] [pid 830701:tid 830929] [client 124.29.246.106:56850] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxd5su1nEoSSDHiOXbGLAAAAWw"]
[Sat Jul 18 23:17:26.204001 2026] [security2:error] [pid 830701:tid 830929] [client 124.29.246.106:56850] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxd5su1nEoSSDHiOXbGLAAAAWw"]
[Sat Jul 18 23:17:26.219950 2026] [ssl:error] [pid 830701:tid 830876] [client 13.219.121.241:46355] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname autodiscover.heatherbowman.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:17:26.448804 2026] [security2:error] [pid 830701:tid 830926] [client 5.255.231.8:44304] ModSecurity: Access denied with code 429 (phase 2). Pattern match "Mozilla\\\\/5\\\\.0 \\\\(compatible; YandexBot\\\\/3\\\\.0; \\\\+http:\\\\/\\\\/yandex\\\\.com\\\\/bots\\\\)" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/othercrawler.conf"] [line "3"] [id "901008"] [msg "Yandex Crawler 429 ADDED BY MONITORING DO NOT WHITELIST"] [hostname "heroesoftomorrow.us"] [uri "/robots.txt"] [unique_id "alxd5su1nEoSSDHiOXbGMgAAAWk"]
[Sat Jul 18 23:17:26.867637 2026] [security2:error] [pid 830701:tid 830771] [remote 31.42.184.154:46768] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxd5su1nEoSSDHiOXbGQAABHkU"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:17:27.061683 2026] [security2:error] [pid 831031:tid 831131] [remote 154.61.75.100:59004] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxd55nU1ySsD4Tkeg4wCQAB2WI"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:17:27.147868 2026] [security2:error] [pid 830701:tid 830726] [remote 31.42.184.154:40138] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "friendlyspreadsheet.com"] [uri "/wp-login.php"] [unique_id "alxd58u1nEoSSDHiOXbGRAABOxg"]
[Sat Jul 18 23:17:27.441675 2026] [security2:error] [pid 830701:tid 830705] [remote 31.42.184.154:40138] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "friendlyspreadsheet.com"] [uri "/wp-login.php"] [unique_id "alxd58u1nEoSSDHiOXbGUwABZQM"], referer: https://friendlyspreadsheet.com/wp-login.php
[Sat Jul 18 23:17:28.185374 2026] [security2:error] [pid 831031:tid 831116] [remote 68.178.160.25:45678] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxd6JnU1ySsD4Tkeg4wMAABz1M"]
[Sat Jul 18 23:17:28.493608 2026] [security2:error] [pid 831031:tid 831239] [client 142.93.64.197:39000] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "50.116.65.227"] [uri "/"] [unique_id "alxd6JnU1ySsD4Tkeg4wOAAAAdw"]
[Sat Jul 18 23:17:28.575561 2026] [security2:error] [pid 831031:tid 831222] [client 142.93.64.197:38846] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "50.116.65.227"] [uri "/"] [unique_id "alxd6JnU1ySsD4Tkeg4wPAAAAcs"]
[Sat Jul 18 23:17:28.602924 2026] [security2:error] [pid 831031:tid 831073] [remote 68.178.160.25:45678] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxd6JnU1ySsD4Tkeg4wPgABwig"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:17:29.223303 2026] [security2:error] [pid 831031:tid 831196] [client 223.185.61.63:14609] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxd6ZnU1ySsD4Tkeg4wVgAAAbE"]
[Sat Jul 18 23:17:29.227973 2026] [security2:error] [pid 831031:tid 831196] [client 223.185.61.63:14609] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxd6ZnU1ySsD4Tkeg4wVgAAAbE"]
[Sat Jul 18 23:17:29.315825 2026] [security2:error] [pid 831031:tid 831235] [client 57.141.18.106:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxd6ZnU1ySsD4Tkeg4wVAAAAdg"]
[Sat Jul 18 23:17:29.822873 2026] [security2:error] [pid 831031:tid 831204] [client 148.251.121.91:54964] ModSecurity: Warning. Matched phrase "DomainStatsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "ccsdifference.com"] [uri "/robots.txt"] [unique_id "alxd6ZnU1ySsD4Tkeg4weQAAAbk"]
[Sat Jul 18 23:17:29.984468 2026] [security2:error] [pid 831031:tid 831066] [remote 8.217.108.67:48296] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxd6ZnU1ySsD4Tkeg4wgAAB1SE"]
[Sat Jul 18 23:17:30.135637 2026] [security2:error] [pid 831031:tid 831220] [client 148.251.121.91:54996] ModSecurity: Warning. Matched phrase "DomainStatsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "ccsdifference.com"] [uri "/"] [unique_id "alxd6pnU1ySsD4Tkeg4wigAAAck"]
[Sat Jul 18 23:17:30.241968 2026] [security2:error] [pid 831031:tid 831059] [remote 20.153.140.50:50562] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxd6pnU1ySsD4Tkeg4wjwACARo"]
[Sat Jul 18 23:17:30.364392 2026] [security2:error] [pid 831031:tid 831166] [client 65.111.28.26:20373] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 26.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxd6pnU1ySsD4Tkeg4wkQAAAZM"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:17:30.383945 2026] [security2:error] [pid 831031:tid 831160] [remote 8.217.108.67:48296] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxd6pnU1ySsD4Tkeg4wlAABnX8"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:17:30.695973 2026] [security2:error] [pid 831031:tid 831141] [remote 20.153.140.50:50562] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxd6pnU1ySsD4Tkeg4wogAB22w"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:17:30.752025 2026] [security2:error] [pid 830701:tid 830867] [client 27.34.68.67:25980] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxd6su1nEoSSDHiOXbGiQAAAS4"]
[Sat Jul 18 23:17:30.752133 2026] [security2:error] [pid 830701:tid 830867] [client 27.34.68.67:25980] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxd6su1nEoSSDHiOXbGiQAAAS4"]
[Sat Jul 18 23:17:31.695329 2026] [security2:error] [pid 830701:tid 830899] [client 119.154.81.234:52955] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxd68u1nEoSSDHiOXbGoAAAAU4"]
[Sat Jul 18 23:17:31.695421 2026] [security2:error] [pid 830701:tid 830899] [client 119.154.81.234:52955] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxd68u1nEoSSDHiOXbGoAAAAU4"]
[Sat Jul 18 23:17:31.754413 2026] [security2:error] [pid 831031:tid 831250] [client 190.245.146.99:50194] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxd65nU1ySsD4Tkeg4w0AAAAec"]
[Sat Jul 18 23:17:31.754551 2026] [security2:error] [pid 831031:tid 831250] [client 190.245.146.99:50194] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxd65nU1ySsD4Tkeg4w0AAAAec"]
[Sat Jul 18 23:17:32.001724 2026] [security2:error] [pid 830701:tid 830906] [client 65.0.26.70:25540] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.26.0.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cryptomeaning.com"] [uri "/xmlrpc.php"] [unique_id "alxd68u1nEoSSDHiOXbGsAAAAVU"]
[Sat Jul 18 23:17:32.001880 2026] [security2:error] [pid 830701:tid 830906] [client 65.0.26.70:25540] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cryptomeaning.com"] [uri "/xmlrpc.php"] [unique_id "alxd68u1nEoSSDHiOXbGsAAAAVU"]
[Sat Jul 18 23:17:32.053042 2026] [security2:error] [pid 831031:tid 831267] [client 171.4.232.110:62572] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxd7JnU1ySsD4Tkeg4w3QAAAfg"]
[Sat Jul 18 23:17:32.053140 2026] [security2:error] [pid 831031:tid 831267] [client 171.4.232.110:62572] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxd7JnU1ySsD4Tkeg4w3QAAAfg"]
[Sat Jul 18 23:17:32.093695 2026] [security2:error] [pid 831031:tid 831094] [remote 31.42.184.154:40118] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxd7JnU1ySsD4Tkeg4w4gACCj0"]
[Sat Jul 18 23:17:32.093880 2026] [security2:error] [pid 831031:tid 831285] [client 31.42.184.154:40118] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxd7JnU1ySsD4Tkeg4w4gACCj0"]
[Sat Jul 18 23:17:32.292415 2026] [security2:error] [pid 831031:tid 831281] [client 5.161.215.244:4488] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "windowtx.com"] [uri "/index.php"] [unique_id "alxd65nU1ySsD4Tkeg4w0gAAAgY"], referer: https://windowtx.com
[Sat Jul 18 23:17:32.754928 2026] [proxy:error] [pid 830701:tid 830846] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:17:32.754989 2026] [proxy_http:error] [pid 830701:tid 830846] [client 192.176.127.46:20123] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:17:32.755492 2026] [proxy:error] [pid 830701:tid 830846] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:17:32.755519 2026] [proxy_http:error] [pid 830701:tid 830846] [client 192.176.127.46:20123] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:17:33.580557 2026] [security2:error] [pid 831031:tid 831195] [client 223.178.210.203:26246] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxd7ZnU1ySsD4Tkeg4xGwAAAbA"]
[Sat Jul 18 23:17:33.580688 2026] [security2:error] [pid 831031:tid 831195] [client 223.178.210.203:26246] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxd7ZnU1ySsD4Tkeg4xGwAAAbA"]
[Sat Jul 18 23:17:33.838779 2026] [security2:error] [pid 831031:tid 831242] [client 103.48.44.9:62742] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxd7ZnU1ySsD4Tkeg4xKAAAAd8"]
[Sat Jul 18 23:17:33.838926 2026] [security2:error] [pid 831031:tid 831242] [client 103.48.44.9:62742] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxd7ZnU1ySsD4Tkeg4xKAAAAd8"]
[Sat Jul 18 23:17:33.864276 2026] [security2:error] [pid 831031:tid 831052] [remote 188.138.102.156:45860] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/wp-login.php"] [unique_id "alxd7ZnU1ySsD4Tkeg4xKQAB-RM"]
[Sat Jul 18 23:17:34.068524 2026] [security2:error] [pid 831031:tid 831132] [remote 188.138.102.156:45860] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/wp-login.php"] [unique_id "alxd7pnU1ySsD4Tkeg4xMQABtmM"], referer: https://adultdaycarereno.com/wp-login.php
[Sat Jul 18 23:17:34.359326 2026] [security2:error] [pid 831031:tid 831172] [client 51.195.248.115:44252] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "autodiscover.ncr.brn.mybluehost.me"] [uri "/.env"] [unique_id "alxd7pnU1ySsD4Tkeg4xQAAAAZk"]
[Sat Jul 18 23:17:34.429406 2026] [security2:error] [pid 830701:tid 830929] [client 15.237.217.26:44672] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 26.217.237.15.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxd7su1nEoSSDHiOXbG5gAAAWw"]
[Sat Jul 18 23:17:34.584197 2026] [security2:error] [pid 831031:tid 831269] [client 113.160.97.242:63696] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxd7pnU1ySsD4Tkeg4xSgAAAfo"]
[Sat Jul 18 23:17:34.686572 2026] [security2:error] [pid 831031:tid 831150] [remote 157.66.47.83:33220] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxd7pnU1ySsD4Tkeg4xTgABznU"]
[Sat Jul 18 23:17:34.774885 2026] [security2:error] [pid 831031:tid 831122] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxd7pnU1ySsD4Tkeg4xVQABuVk"]
[Sat Jul 18 23:17:34.775083 2026] [security2:error] [pid 831031:tid 831204] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxd7pnU1ySsD4Tkeg4xVQABuVk"]
[Sat Jul 18 23:17:35.119342 2026] [security2:error] [pid 831031:tid 831129] [remote 157.66.47.83:33220] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxd75nU1ySsD4Tkeg4xZQACDGA"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:17:35.490228 2026] [security2:error] [pid 831031:tid 831227] [client 74.208.214.194:33672] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxd75nU1ySsD4Tkeg4xdgAAAdA"]
[Sat Jul 18 23:17:35.832850 2026] [proxy:error] [pid 830701:tid 830948] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:17:35.832929 2026] [proxy_http:error] [pid 830701:tid 830948] [client 193.47.62.168:38684] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:17:35.833366 2026] [proxy:error] [pid 830701:tid 830948] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:17:35.833398 2026] [proxy_http:error] [pid 830701:tid 830948] [client 193.47.62.168:38684] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:17:35.967505 2026] [security2:error] [pid 831031:tid 831172] [client 65.111.28.106:44821] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxd75nU1ySsD4Tkeg4xigAAAZk"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:17:36.020269 2026] [security2:error] [pid 831031:tid 831231] [client 223.228.182.224:52526] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxd8JnU1ySsD4Tkeg4xjwAAAdQ"]
[Sat Jul 18 23:17:36.020394 2026] [security2:error] [pid 831031:tid 831231] [client 223.228.182.224:52526] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxd8JnU1ySsD4Tkeg4xjwAAAdQ"]
[Sat Jul 18 23:17:36.219128 2026] [security2:error] [pid 830701:tid 830958] [client 13.38.58.119:20542] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.58.38.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxd8Mu1nEoSSDHiOXbHAgAAAYk"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:17:36.499325 2026] [security2:error] [pid 831031:tid 831219] [client 148.251.121.91:33030] ModSecurity: Warning. Matched phrase "DomainStatsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "ccsdifference.com"] [uri "/index.php"] [unique_id "alxd8JnU1ySsD4Tkeg4xmwAAAcg"]
[Sat Jul 18 23:17:36.505452 2026] [security2:error] [pid 831031:tid 831175] [client 211.159.151.27:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxd8JnU1ySsD4Tkeg4xowABnAM"], referer: https://www.aleishapenny.ca/listing/page/1269?paged=1&view=grid&posts_per_page=24
[Sat Jul 18 23:17:36.808565 2026] [security2:error] [pid 831031:tid 831071] [remote 31.42.184.154:40126] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxd8JnU1ySsD4Tkeg4xwgAB7yY"]
[Sat Jul 18 23:17:37.052123 2026] [security2:error] [pid 831031:tid 831068] [remote 31.42.184.154:40126] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxd8ZnU1ySsD4Tkeg4xywACAyM"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:17:37.167789 2026] [security2:error] [pid 831031:tid 831038] [remote 4.205.168.44:39958] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxd8ZnU1ySsD4Tkeg4xzgABzgU"]
[Sat Jul 18 23:17:37.257826 2026] [security2:error] [pid 830701:tid 830939] [client 124.29.207.185:57320] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxd8cu1nEoSSDHiOXbHFAAAAXY"]
[Sat Jul 18 23:17:37.258198 2026] [security2:error] [pid 830701:tid 830939] [client 124.29.207.185:57320] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxd8cu1nEoSSDHiOXbHFAAAAXY"]
[Sat Jul 18 23:17:37.333979 2026] [security2:error] [pid 831031:tid 831133] [remote 4.205.168.44:39958] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxd8ZnU1ySsD4Tkeg4x1AABtmQ"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:17:37.432289 2026] [security2:error] [pid 830701:tid 830911] [client 148.251.121.91:33224] ModSecurity: Warning. Matched phrase "DomainStatsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "ccsdifference.com"] [uri "/index.php"] [unique_id "alxd8cu1nEoSSDHiOXbHFgAAAVo"]
[Sat Jul 18 23:17:37.432321 2026] [security2:error] [pid 830701:tid 830911] [client 148.251.121.91:33224] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "ccsdifference.com"] [uri "/index.php"] [unique_id "alxd8cu1nEoSSDHiOXbHFgAAAVo"]
[Sat Jul 18 23:17:37.509827 2026] [security2:error] [pid 831031:tid 831228] [client 63.179.105.113:15546] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.105.179.63.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxd8ZnU1ySsD4Tkeg4x2AAAAdE"]
[Sat Jul 18 23:17:37.509930 2026] [security2:error] [pid 831031:tid 831228] [client 63.179.105.113:15546] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxd8ZnU1ySsD4Tkeg4x2AAAAdE"]
[Sat Jul 18 23:17:37.662334 2026] [security2:error] [pid 831031:tid 831175] [client 74.208.214.194:33676] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxd8ZnU1ySsD4Tkeg4x5QAAAZw"]
[Sat Jul 18 23:17:38.219765 2026] [security2:error] [pid 830701:tid 830918] [client 148.251.121.91:33370] ModSecurity: Warning. Matched phrase "DomainStatsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "ccsdifference.com"] [uri "/index.php"] [unique_id "alxd8su1nEoSSDHiOXbHJQAAAWE"]
[Sat Jul 18 23:17:38.385223 2026] [security2:error] [pid 831031:tid 831235] [client 45.3.45.91:64913] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "155"] [id "900406"] [msg "wp-login POST logging"] [data "200"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxd8pnU1ySsD4Tkeg4x-gAAAdg"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:17:39.163305 2026] [security2:error] [pid 830701:tid 830831] [client 72.220.34.188:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "tacticaltreeoperations.com"] [uri "/index.php"] [unique_id "alxd8su1nEoSSDHiOXbHNQAAAQo"]
[Sat Jul 18 23:17:39.236336 2026] [security2:error] [pid 831031:tid 831084] [remote 98.156.100.191:50502] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 191.100.156.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "worbals.com"] [uri "/wp-login.php"] [unique_id "alxd85nU1ySsD4Tkeg4yKAAB6TM"]
[Sat Jul 18 23:17:39.301787 2026] [security2:error] [pid 830701:tid 830736] [remote 97.74.93.24:54918] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxd88u1nEoSSDHiOXbHPwABPiI"]
[Sat Jul 18 23:17:39.342077 2026] [security2:error] [pid 830701:tid 830740] [remote 117.0.21.154:39922] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "website-e36532c6.faadenergy.com"] [uri "/wp-login.php"] [unique_id "alxd88u1nEoSSDHiOXbHQgABEyY"]
[Sat Jul 18 23:17:39.733550 2026] [security2:error] [pid 830701:tid 830776] [remote 97.74.93.24:54918] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxd88u1nEoSSDHiOXbHRgABJUo"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:17:39.768142 2026] [security2:error] [pid 831031:tid 831169] [client 45.3.45.127:29933] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 127.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxd85nU1ySsD4Tkeg4ySQAAAZY"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:17:39.800213 2026] [security2:error] [pid 830701:tid 830958] [client 223.185.61.63:10416] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxd88u1nEoSSDHiOXbHSAAAAYk"]
[Sat Jul 18 23:17:39.800332 2026] [security2:error] [pid 830701:tid 830958] [client 223.185.61.63:10416] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxd88u1nEoSSDHiOXbHSAAAAYk"]
[Sat Jul 18 23:17:39.828583 2026] [proxy:error] [pid 831031:tid 831185] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:17:39.828664 2026] [proxy_http:error] [pid 831031:tid 831185] [client 193.47.62.168:38702] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:17:39.829560 2026] [proxy:error] [pid 831031:tid 831185] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:17:39.829607 2026] [proxy_http:error] [pid 831031:tid 831185] [client 193.47.62.168:38702] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:17:39.867043 2026] [security2:error] [pid 831031:tid 831234] [client 74.7.227.179:45836] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxd85nU1ySsD4Tkeg4yRgAB11c"], referer: https://tejasenvironmental.com/p=871701
[Sat Jul 18 23:17:40.001358 2026] [security2:error] [pid 831031:tid 831165] [client 40.77.167.159:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.savilerowtravel.com"] [uri "/index.php"] [unique_id "alxd85nU1ySsD4Tkeg4yTAAAAZI"]
[Sat Jul 18 23:17:40.291992 2026] [security2:error] [pid 831031:tid 831282] [client 72.220.34.188:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tacticaltreeoperations.com"] [uri "/index.php"] [unique_id "alxd85nU1ySsD4Tkeg4yWAAAAgc"]
[Sat Jul 18 23:17:40.412941 2026] [security2:error] [pid 831031:tid 831143] [remote 46.101.194.217:57400] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 217.194.101.46.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.factsandminds.com"] [uri "/wp-login.php"] [unique_id "alxd9JnU1ySsD4Tkeg4ybAAByG4"]
[Sat Jul 18 23:17:40.657040 2026] [security2:error] [pid 831031:tid 831093] [remote 46.101.194.217:57400] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 217.194.101.46.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.factsandminds.com"] [uri "/wp-login.php"] [unique_id "alxd9JnU1ySsD4Tkeg4yegABtjw"], referer: https://mail.factsandminds.com/wp-login.php
[Sat Jul 18 23:17:41.137269 2026] [security2:error] [pid 830701:tid 830936] [client 72.220.34.188:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "tacticaltreeoperations.com"] [uri "/index.php"] [unique_id "alxd9Mu1nEoSSDHiOXbHVwAAAXM"]
[Sat Jul 18 23:17:41.144793 2026] [security2:error] [pid 831031:tid 831198] [client 157.90.156.63:62952] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "mtlegnews.gov"] [uri "/index.php"] [unique_id "alxd9JnU1ySsD4Tkeg4yhgAAAbM"], referer: https://mtlegnews.gov/
[Sat Jul 18 23:17:41.338047 2026] [security2:error] [pid 830701:tid 830836] [client 27.34.68.67:10079] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxd9cu1nEoSSDHiOXbHZwAAAQ8"]
[Sat Jul 18 23:17:41.338145 2026] [security2:error] [pid 830701:tid 830836] [client 27.34.68.67:10079] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxd9cu1nEoSSDHiOXbHZwAAAQ8"]
[Sat Jul 18 23:17:42.202055 2026] [security2:error] [pid 831031:tid 831281] [client 190.245.146.99:50704] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxd9pnU1ySsD4Tkeg4yxAAAAgY"]
[Sat Jul 18 23:17:42.207458 2026] [security2:error] [pid 831031:tid 831281] [client 190.245.146.99:50704] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxd9pnU1ySsD4Tkeg4yxAAAAgY"]
[Sat Jul 18 23:17:42.287161 2026] [security2:error] [pid 831031:tid 831171] [client 119.154.81.234:53390] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxd9pnU1ySsD4Tkeg4yxwAAAZg"]
[Sat Jul 18 23:17:42.287275 2026] [security2:error] [pid 831031:tid 831171] [client 119.154.81.234:53390] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxd9pnU1ySsD4Tkeg4yxwAAAZg"]
[Sat Jul 18 23:17:42.304677 2026] [security2:error] [pid 830701:tid 830916] [client 72.220.34.188:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tacticaltreeoperations.com"] [uri "/index.php"] [unique_id "alxd9cu1nEoSSDHiOXbHeAAAAV8"]
[Sat Jul 18 23:17:42.574992 2026] [security2:error] [pid 831031:tid 831276] [client 171.4.232.110:63064] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxd9pnU1ySsD4Tkeg4y3wAAAgE"]
[Sat Jul 18 23:17:42.575199 2026] [security2:error] [pid 831031:tid 831276] [client 171.4.232.110:63064] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxd9pnU1ySsD4Tkeg4y3wAAAgE"]
[Sat Jul 18 23:17:42.802191 2026] [security2:error] [pid 830701:tid 830880] [client 72.220.34.188:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tacticaltreeoperations.com"] [uri "/index.php"] [unique_id "alxd9su1nEoSSDHiOXbHiQAAATs"]
[Sat Jul 18 23:17:43.061079 2026] [security2:error] [pid 831031:tid 831055] [remote 68.178.160.25:42416] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "website-e4de5cd0.epu.kzx.mybluehost.me"] [uri "/wp/wp-login.php"] [unique_id "alxd95nU1ySsD4Tkeg4y8gABxBY"]
[Sat Jul 18 23:17:43.255672 2026] [security2:error] [pid 830701:tid 830914] [client 179.124.138.158:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.maxenengineering.com"] [uri "/maxenengineering/index.php"] [unique_id "alxd9cu1nEoSSDHiOXbHZgAAAV0"]
[Sat Jul 18 23:17:43.494526 2026] [security2:error] [pid 831031:tid 831069] [remote 68.178.160.25:42416] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "website-e4de5cd0.epu.kzx.mybluehost.me"] [uri "/wp/wp-login.php"] [unique_id "alxd95nU1ySsD4Tkeg4zDAACAyQ"], referer: https://website-e4de5cd0.epu.kzx.mybluehost.me/wp/wp-login.php
[Sat Jul 18 23:17:43.633387 2026] [security2:error] [pid 830701:tid 830793] [remote 97.74.93.24:40500] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/wp-login.php"] [unique_id "alxd98u1nEoSSDHiOXbHmAABdls"]
[Sat Jul 18 23:17:43.804427 2026] [security2:error] [pid 831031:tid 831205] [client 57.141.18.96:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxd95nU1ySsD4Tkeg4zFgAAAbo"]
[Sat Jul 18 23:17:44.044484 2026] [security2:error] [pid 830701:tid 830782] [remote 97.74.93.24:40500] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/wp-login.php"] [unique_id "alxd-Mu1nEoSSDHiOXbHoQABVFA"], referer: https://securingmemories.com/wp-login.php
[Sat Jul 18 23:17:44.154869 2026] [security2:error] [pid 831031:tid 831209] [client 223.178.210.203:10314] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxd-JnU1ySsD4Tkeg4zLgAAAb4"]
[Sat Jul 18 23:17:44.154987 2026] [security2:error] [pid 831031:tid 831209] [client 223.178.210.203:10314] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxd-JnU1ySsD4Tkeg4zLgAAAb4"]
[Sat Jul 18 23:17:44.310178 2026] [security2:error] [pid 830701:tid 830895] [client 120.240.178.145:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aosta.nz"] [uri "/index.php"] [unique_id "alxd98u1nEoSSDHiOXbHnAAAAUo"]
[Sat Jul 18 23:17:44.403647 2026] [security2:error] [pid 831031:tid 831220] [client 103.48.44.9:63245] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxd-JnU1ySsD4Tkeg4zOgAAAck"]
[Sat Jul 18 23:17:44.403805 2026] [security2:error] [pid 831031:tid 831220] [client 103.48.44.9:63245] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxd-JnU1ySsD4Tkeg4zOgAAAck"]
[Sat Jul 18 23:17:44.543915 2026] [security2:error] [pid 831031:tid 831263] [client 148.251.121.91:34396] ModSecurity: Warning. Matched phrase "DomainStatsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "www.ccsdifference.com"] [uri "/index.php"] [unique_id "alxd-JnU1ySsD4Tkeg4zNwAAAfQ"]
[Sat Jul 18 23:17:44.549942 2026] [security2:error] [pid 831031:tid 831185] [client 65.111.28.20:12427] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "155"] [id "900406"] [msg "wp-login POST logging"] [data "200"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxd9pnU1ySsD4Tkeg4y2wAAAaY"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:17:45.230510 2026] [security2:error] [pid 831031:tid 831084] [remote 160.30.104.102:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 102.104.30.160.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aleishapenny.ca"] [uri "/xmlrpc.php"] [unique_id "alxd-ZnU1ySsD4Tkeg4zYAABuDM"]
[Sat Jul 18 23:17:45.230790 2026] [security2:error] [pid 831031:tid 831203] [client 160.30.104.102:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aleishapenny.ca"] [uri "/xmlrpc.php"] [unique_id "alxd-ZnU1ySsD4Tkeg4zYAABuDM"]
[Sat Jul 18 23:17:45.371417 2026] [security2:error] [pid 831031:tid 831127] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxd-ZnU1ySsD4Tkeg4zZQABol4"]
[Sat Jul 18 23:17:45.371552 2026] [security2:error] [pid 831031:tid 831181] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxd-ZnU1ySsD4Tkeg4zZQABol4"]
[Sat Jul 18 23:17:45.674060 2026] [security2:error] [pid 830701:tid 830902] [client 148.251.121.91:34512] ModSecurity: Warning. Matched phrase "DomainStatsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "www.ccsdifference.com"] [uri "/index.php"] [unique_id "alxd-cu1nEoSSDHiOXbHrwAAASQ"]
[Sat Jul 18 23:17:46.760132 2026] [security2:error] [pid 831031:tid 831172] [client 223.228.182.224:52541] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxd-pnU1ySsD4Tkeg4zmwAAAZk"]
[Sat Jul 18 23:17:46.760277 2026] [security2:error] [pid 831031:tid 831172] [client 223.228.182.224:52541] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxd-pnU1ySsD4Tkeg4zmwAAAZk"]
[Sat Jul 18 23:17:47.181143 2026] [security2:error] [pid 831031:tid 831194] [client 124.29.246.106:57763] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxd-5nU1ySsD4Tkeg4zqwAAAa8"]
[Sat Jul 18 23:17:47.181237 2026] [security2:error] [pid 831031:tid 831194] [client 124.29.246.106:57763] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxd-5nU1ySsD4Tkeg4zqwAAAa8"]
[Sat Jul 18 23:17:47.442656 2026] [security2:error] [pid 830701:tid 830800] [remote 20.153.140.50:42364] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "civitansuncitiesaz.org"] [uri "/wp-login.php"] [unique_id "alxd-8u1nEoSSDHiOXbH2wABXWI"]
[Sat Jul 18 23:17:47.603895 2026] [security2:error] [pid 831031:tid 831223] [client 4.194.24.143:59735] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/nine2code.php"] [unique_id "alxd-5nU1ySsD4Tkeg4zwgAAAcw"]
[Sat Jul 18 23:17:47.870922 2026] [security2:error] [pid 830701:tid 830816] [remote 20.153.140.50:42364] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "civitansuncitiesaz.org"] [uri "/wp-login.php"] [unique_id "alxd-8u1nEoSSDHiOXbH4QABEXI"], referer: https://civitansuncitiesaz.org/wp-login.php
[Sat Jul 18 23:17:48.453805 2026] [security2:error] [pid 831031:tid 831134] [remote 41.76.213.235:40134] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxd_JnU1ySsD4Tkeg4z6QACAGU"]
[Sat Jul 18 23:17:48.647687 2026] [security2:error] [pid 831031:tid 831228] [client 4.194.24.143:59764] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/num.php"] [unique_id "alxd_JnU1ySsD4Tkeg4z7gAAAdE"]
[Sat Jul 18 23:17:48.975892 2026] [security2:error] [pid 831031:tid 831156] [remote 41.76.213.235:40134] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxd_JnU1ySsD4Tkeg40CgAB9Hs"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:17:49.273553 2026] [security2:error] [pid 830701:tid 830877] [client 4.194.24.143:36252] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/odf7udtspqtpxzyxmw2rccdefault.php"] [unique_id "alxd_cu1nEoSSDHiOXbH8AAAATg"]
[Sat Jul 18 23:17:49.576161 2026] [security2:error] [pid 831031:tid 831055] [remote 8.217.108.67:45576] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxd_ZnU1ySsD4Tkeg40HQAB_hY"]
[Sat Jul 18 23:17:49.576345 2026] [security2:error] [pid 831031:tid 831273] [client 8.217.108.67:45576] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxd_ZnU1ySsD4Tkeg40HQAB_hY"]
[Sat Jul 18 23:17:49.833820 2026] [security2:error] [pid 831031:tid 831287] [client 4.194.24.143:3502] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/option.php"] [unique_id "alxd_ZnU1ySsD4Tkeg40JQAAAgw"]
[Sat Jul 18 23:17:50.375349 2026] [security2:error] [pid 831031:tid 831216] [client 4.194.24.143:36243] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/p.php"] [unique_id "alxd_pnU1ySsD4Tkeg40QAAAAcU"]
[Sat Jul 18 23:17:50.441040 2026] [security2:error] [pid 831031:tid 831217] [client 223.185.61.63:7244] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxd_pnU1ySsD4Tkeg40QwAAAcY"]
[Sat Jul 18 23:17:50.441175 2026] [security2:error] [pid 831031:tid 831217] [client 223.185.61.63:7244] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxd_pnU1ySsD4Tkeg40QwAAAcY"]
[Sat Jul 18 23:17:51.040850 2026] [security2:error] [pid 831031:tid 831258] [client 4.194.24.143:3467] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/past.php"] [unique_id "alxd_5nU1ySsD4Tkeg40ZQAAAe8"]
[Sat Jul 18 23:17:51.615919 2026] [security2:error] [pid 830701:tid 830891] [client 4.194.24.143:59727] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/php.php"] [unique_id "alxd_8u1nEoSSDHiOXbIGwAAAUY"]
[Sat Jul 18 23:17:51.908597 2026] [security2:error] [pid 830701:tid 830884] [client 27.34.68.67:29641] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxd_8u1nEoSSDHiOXbIIAAAAT8"]
[Sat Jul 18 23:17:51.908717 2026] [security2:error] [pid 830701:tid 830884] [client 27.34.68.67:29641] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxd_8u1nEoSSDHiOXbIIAAAAT8"]
[Sat Jul 18 23:17:52.262049 2026] [security2:error] [pid 831031:tid 831083] [remote 87.106.67.224:56316] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.67.106.87.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxeAJnU1ySsD4Tkeg40mgAB5zI"]
[Sat Jul 18 23:17:52.262226 2026] [security2:error] [pid 831031:tid 831250] [client 87.106.67.224:56316] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxeAJnU1ySsD4Tkeg40mgAB5zI"]
[Sat Jul 18 23:17:52.418184 2026] [security2:error] [pid 830701:tid 830838] [client 4.194.24.143:37210] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/php8.php"] [unique_id "alxeAMu1nEoSSDHiOXbIKgAAARE"]
[Sat Jul 18 23:17:52.468073 2026] [security2:error] [pid 831031:tid 831109] [remote 20.75.217.69:1024] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 69.217.75.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxeAJnU1ySsD4Tkeg40pQABuUw"]
[Sat Jul 18 23:17:52.532534 2026] [security2:error] [pid 830701:tid 830904] [client 122.63.145.191:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "aosta.nz"] [uri "/index.php"] [unique_id "alxeAMu1nEoSSDHiOXbIIwAAAVM"], referer: https://aosta.nz/
[Sat Jul 18 23:17:52.678535 2026] [security2:error] [pid 831031:tid 831195] [client 190.245.146.99:51205] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeAJnU1ySsD4Tkeg40rgAAAbA"]
[Sat Jul 18 23:17:52.684685 2026] [security2:error] [pid 831031:tid 831195] [client 190.245.146.99:51205] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeAJnU1ySsD4Tkeg40rgAAAbA"]
[Sat Jul 18 23:17:52.756607 2026] [security2:error] [pid 831031:tid 831100] [remote 20.75.217.69:1024] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 69.217.75.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxeAJnU1ySsD4Tkeg40tAAB0EM"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:17:52.852853 2026] [security2:error] [pid 831031:tid 831210] [client 119.154.81.234:53826] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxeAJnU1ySsD4Tkeg40uQAAAb8"]
[Sat Jul 18 23:17:52.852987 2026] [security2:error] [pid 831031:tid 831210] [client 119.154.81.234:53826] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxeAJnU1ySsD4Tkeg40uQAAAb8"]
[Sat Jul 18 23:17:53.118458 2026] [security2:error] [pid 831031:tid 831278] [client 171.4.232.110:63564] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeAZnU1ySsD4Tkeg40wQAAAgM"]
[Sat Jul 18 23:17:53.118561 2026] [security2:error] [pid 831031:tid 831278] [client 171.4.232.110:63564] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeAZnU1ySsD4Tkeg40wQAAAgM"]
[Sat Jul 18 23:17:53.128549 2026] [security2:error] [pid 830701:tid 830847] [client 4.194.24.143:59740] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/phpinfo.php"] [unique_id "alxeAcu1nEoSSDHiOXbIPgAAARo"]
[Sat Jul 18 23:17:53.900958 2026] [security2:error] [pid 831031:tid 831164] [client 4.194.24.143:59766] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/post.php"] [unique_id "alxeAZnU1ySsD4Tkeg404AAAAZE"]
[Sat Jul 18 23:17:54.326768 2026] [security2:error] [pid 830701:tid 830940] [client 113.166.213.233:42055] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "thewelloiledlife.com"] [uri "/index.php"] [unique_id "alxeAsu1nEoSSDHiOXbIVAAAAXc"], referer: https://thewelloiledlife.com/
[Sat Jul 18 23:17:54.584326 2026] [security2:error] [pid 830701:tid 830880] [client 4.194.24.143:36224] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/public/assets/design_1/css/parts/course_cards/grid_card_1.min.php"] [unique_id "alxeAsu1nEoSSDHiOXbIWQAAATs"]
[Sat Jul 18 23:17:54.745664 2026] [security2:error] [pid 830701:tid 830869] [client 223.178.210.203:8023] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeAsu1nEoSSDHiOXbIYQAAATA"]
[Sat Jul 18 23:17:54.745796 2026] [security2:error] [pid 830701:tid 830869] [client 223.178.210.203:8023] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeAsu1nEoSSDHiOXbIYQAAATA"]
[Sat Jul 18 23:17:54.808762 2026] [security2:error] [pid 831031:tid 831105] [remote 31.42.184.154:59002] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "katsklar.com"] [uri "/wp-login.php"] [unique_id "alxeApnU1ySsD4Tkeg40_QABrEg"]
[Sat Jul 18 23:17:54.908613 2026] [security2:error] [pid 831031:tid 831206] [client 103.48.44.9:63753] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeApnU1ySsD4Tkeg41AAAAAbs"]
[Sat Jul 18 23:17:54.908717 2026] [security2:error] [pid 831031:tid 831206] [client 103.48.44.9:63753] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeApnU1ySsD4Tkeg41AAAAAbs"]
[Sat Jul 18 23:17:55.095462 2026] [security2:error] [pid 831031:tid 831101] [remote 31.42.184.154:59002] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "katsklar.com"] [uri "/wp-login.php"] [unique_id "alxeA5nU1ySsD4Tkeg41DwABokQ"], referer: https://katsklar.com/wp-login.php
[Sat Jul 18 23:17:55.249291 2026] [security2:error] [pid 830701:tid 830937] [client 4.194.24.143:3690] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/public/css.php"] [unique_id "alxeA8u1nEoSSDHiOXbIbAAAAXQ"]
[Sat Jul 18 23:17:55.471122 2026] [security2:error] [pid 831031:tid 831256] [client 65.111.28.13:14715] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxeA5nU1ySsD4Tkeg41MwAAAe0"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:17:55.802989 2026] [security2:error] [pid 830701:tid 830843] [client 4.194.24.143:3508] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/r.php"] [unique_id "alxeA8u1nEoSSDHiOXbIegAAARY"]
[Sat Jul 18 23:17:55.952548 2026] [security2:error] [pid 831031:tid 831115] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxeA5nU1ySsD4Tkeg41QgABoFI"]
[Sat Jul 18 23:17:55.952718 2026] [security2:error] [pid 831031:tid 831179] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxeA5nU1ySsD4Tkeg41QgABoFI"]
[Sat Jul 18 23:17:56.058729 2026] [security2:error] [pid 831031:tid 831154] [remote 72.167.132.114:56368] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "taskidsvirginia.com"] [uri "/wp-login.php"] [unique_id "alxeBJnU1ySsD4Tkeg41RwAB13k"]
[Sat Jul 18 23:17:56.287792 2026] [security2:error] [pid 831031:tid 831059] [remote 72.167.132.114:56368] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "taskidsvirginia.com"] [uri "/wp-login.php"] [unique_id "alxeBJnU1ySsD4Tkeg41UQABzBo"], referer: https://taskidsvirginia.com/wp-login.php
[Sat Jul 18 23:17:56.291958 2026] [security2:error] [pid 830701:tid 830825] [remote 91.142.222.105:39066] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxeBMu1nEoSSDHiOXbIhQABOHs"]
[Sat Jul 18 23:17:56.349555 2026] [security2:error] [pid 831031:tid 831245] [client 4.194.24.143:3513] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/radio.php"] [unique_id "alxeBJnU1ySsD4Tkeg41UgAAAeI"]
[Sat Jul 18 23:17:56.507676 2026] [security2:error] [pid 830701:tid 830952] [client 47.130.151.169:34628] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 169.151.130.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxeBMu1nEoSSDHiOXbIhgAAAYM"]
[Sat Jul 18 23:17:56.982487 2026] [security2:error] [pid 831031:tid 831173] [client 4.194.24.143:3668] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/randkeyword.php7"] [unique_id "alxeBJnU1ySsD4Tkeg41cQAAAZo"]
[Sat Jul 18 23:17:57.225226 2026] [security2:error] [pid 831031:tid 831069] [remote 47.253.116.19:34984] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/httpd/modsecurity.d/01_asl_content.conf"] [line "64"] [id "391213"] [msg "Atomicorp.com WAF Rules: Request content type is not allowed by policy"] [data "application/dns-message"] [severity "WARNING"] [hostname "50.116.65.229"] [uri "/dns-query"] [unique_id "alxeBZnU1ySsD4Tkeg41ewACAiQ"]
[Sat Jul 18 23:17:57.476625 2026] [security2:error] [pid 830701:tid 830852] [client 47.130.156.109:57418] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 109.156.130.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxeBcu1nEoSSDHiOXbIlwAAAR8"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:17:57.496492 2026] [security2:error] [pid 831031:tid 831206] [client 223.228.182.224:52543] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxeBZnU1ySsD4Tkeg41jAAAAbs"]
[Sat Jul 18 23:17:57.505920 2026] [security2:error] [pid 831031:tid 831206] [client 223.228.182.224:52543] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxeBZnU1ySsD4Tkeg41jAAAAbs"]
[Sat Jul 18 23:17:57.592633 2026] [security2:error] [pid 831031:tid 831263] [client 4.194.24.143:59717] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/readme.php"] [unique_id "alxeBZnU1ySsD4Tkeg41lwAAAfQ"]
[Sat Jul 18 23:17:58.305497 2026] [security2:error] [pid 831031:tid 831279] [client 4.194.24.143:3652] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/reze.php"] [unique_id "alxeBpnU1ySsD4Tkeg41sgAAAgQ"]
[Sat Jul 18 23:17:58.734341 2026] [security2:error] [pid 830701:tid 830748] [remote 46.101.194.217:47732] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 217.194.101.46.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "timespans.org"] [uri "/wp-login.php"] [unique_id "alxeBsu1nEoSSDHiOXbIsAABHS4"]
[Sat Jul 18 23:17:58.924069 2026] [security2:error] [pid 831031:tid 831184] [client 4.194.24.143:36229] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/rh.php"] [unique_id "alxeBpnU1ySsD4Tkeg41xwAAAaU"]
[Sat Jul 18 23:17:58.935813 2026] [security2:error] [pid 830701:tid 830707] [remote 46.101.194.217:47732] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 217.194.101.46.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "timespans.org"] [uri "/wp-login.php"] [unique_id "alxeBsu1nEoSSDHiOXbItwABbgU"], referer: https://timespans.org/wp-login.php
[Sat Jul 18 23:17:59.058460 2026] [security2:error] [pid 830701:tid 830791] [remote 91.142.222.105:39066] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxeB8u1nEoSSDHiOXbIuAABeFk"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:17:59.591174 2026] [security2:error] [pid 831031:tid 831272] [client 4.194.24.143:37244] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/rip.php"] [unique_id "alxeB5nU1ySsD4Tkeg415gAAAf0"]
[Sat Jul 18 23:18:00.198027 2026] [security2:error] [pid 831031:tid 831204] [client 4.194.24.143:3468] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/root.php"] [unique_id "alxeCJnU1ySsD4Tkeg42AQAAAbk"]
[Sat Jul 18 23:18:00.446240 2026] [security2:error] [pid 831031:tid 831191] [client 45.3.52.95:45773] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.52.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxeCJnU1ySsD4Tkeg42DQAAAaw"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:18:00.642879 2026] [security2:error] [pid 831031:tid 831226] [client 32.193.37.124:63420] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "reosportsboats.com"] [uri "/index.php"] [unique_id "alxeBpnU1ySsD4Tkeg41ygAAAc8"]
[Sat Jul 18 23:18:00.743640 2026] [security2:error] [pid 830701:tid 830913] [client 4.194.24.143:3477] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/s.php"] [unique_id "alxeCMu1nEoSSDHiOXbIyQAAAVw"]
[Sat Jul 18 23:18:01.089455 2026] [security2:error] [pid 830701:tid 830852] [client 223.185.61.63:10058] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeCcu1nEoSSDHiOXbI1AAAAR8"]
[Sat Jul 18 23:18:01.089555 2026] [security2:error] [pid 830701:tid 830852] [client 223.185.61.63:10058] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeCcu1nEoSSDHiOXbI1AAAAR8"]
[Sat Jul 18 23:18:01.368549 2026] [security2:error] [pid 830701:tid 830876] [client 4.194.24.143:37209] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/sang.php"] [unique_id "alxeCcu1nEoSSDHiOXbI2wAAATc"]
[Sat Jul 18 23:18:01.753551 2026] [security2:error] [pid 831031:tid 831215] [client 14.224.227.113:49706] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxeCZnU1ySsD4Tkeg42OgAAAcQ"]
[Sat Jul 18 23:18:02.173080 2026] [security2:error] [pid 830701:tid 830926] [client 4.194.24.143:41350] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/scxy.php"] [unique_id "alxeCsu1nEoSSDHiOXbI6gAAAWk"]
[Sat Jul 18 23:18:02.401828 2026] [security2:error] [pid 831031:tid 831256] [client 27.34.68.67:8217] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxeCpnU1ySsD4Tkeg42TAAAAe0"]
[Sat Jul 18 23:18:02.401921 2026] [security2:error] [pid 831031:tid 831256] [client 27.34.68.67:8217] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxeCpnU1ySsD4Tkeg42TAAAAe0"]
[Sat Jul 18 23:18:02.871168 2026] [security2:error] [pid 831031:tid 831198] [client 4.194.24.143:37238] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/sd.php"] [unique_id "alxeCpnU1ySsD4Tkeg42YAAAAbM"]
[Sat Jul 18 23:18:03.170035 2026] [security2:error] [pid 830701:tid 830856] [client 190.245.146.99:51716] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeC8u1nEoSSDHiOXbJBAAAASM"]
[Sat Jul 18 23:18:03.170208 2026] [security2:error] [pid 830701:tid 830856] [client 190.245.146.99:51716] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeC8u1nEoSSDHiOXbJBAAAASM"]
[Sat Jul 18 23:18:03.445174 2026] [security2:error] [pid 830701:tid 830839] [client 119.154.81.234:54271] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxeC8u1nEoSSDHiOXbJCAAAARI"]
[Sat Jul 18 23:18:03.446985 2026] [security2:error] [pid 830701:tid 830839] [client 119.154.81.234:54271] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxeC8u1nEoSSDHiOXbJCAAAARI"]
[Sat Jul 18 23:18:03.725159 2026] [security2:error] [pid 831031:tid 831195] [client 4.194.24.143:3519] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/sf.php"] [unique_id "alxeC5nU1ySsD4Tkeg42jwAAAbA"]
[Sat Jul 18 23:18:04.015040 2026] [security2:error] [pid 831031:tid 831212] [client 171.4.232.110:64062] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeDJnU1ySsD4Tkeg42mQAAAcE"]
[Sat Jul 18 23:18:04.015162 2026] [security2:error] [pid 831031:tid 831212] [client 171.4.232.110:64062] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeDJnU1ySsD4Tkeg42mQAAAcE"]
[Sat Jul 18 23:18:04.330002 2026] [security2:error] [pid 831031:tid 831209] [client 14.169.248.156:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "tacticaltreeoperations.com"] [uri "/index.php"] [unique_id "alxeDJnU1ySsD4Tkeg42nwAAAb4"]
[Sat Jul 18 23:18:04.493298 2026] [security2:error] [pid 831031:tid 831287] [client 4.194.24.143:37243] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/shell.php"] [unique_id "alxeDJnU1ySsD4Tkeg42sgAAAgw"]
[Sat Jul 18 23:18:05.387598 2026] [security2:error] [pid 831031:tid 831277] [client 103.48.44.9:64263] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeDZnU1ySsD4Tkeg422gAAAgI"]
[Sat Jul 18 23:18:05.387782 2026] [security2:error] [pid 831031:tid 831277] [client 103.48.44.9:64263] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeDZnU1ySsD4Tkeg422gAAAgI"]
[Sat Jul 18 23:18:05.412769 2026] [security2:error] [pid 831031:tid 831170] [client 4.194.24.143:59726] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/sid3.php"] [unique_id "alxeDZnU1ySsD4Tkeg423AAAAZc"]
[Sat Jul 18 23:18:05.472915 2026] [security2:error] [pid 830701:tid 830925] [client 223.178.210.203:9249] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeDcu1nEoSSDHiOXbJMQAAAWg"]
[Sat Jul 18 23:18:05.473037 2026] [security2:error] [pid 830701:tid 830925] [client 223.178.210.203:9249] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeDcu1nEoSSDHiOXbJMQAAAWg"]
[Sat Jul 18 23:18:06.310397 2026] [security2:error] [pid 831031:tid 831262] [client 4.194.24.143:3503] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/simple.php"] [unique_id "alxeDpnU1ySsD4Tkeg43CAAAAfM"]
[Sat Jul 18 23:18:06.471628 2026] [core:error] [pid 831031:tid 831175] [client 185.247.137.131:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:18:06.471647 2026] [core:error] [pid 831031:tid 831175] [client 185.247.137.131:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:18:06.569924 2026] [security2:error] [pid 831031:tid 831122] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxeDpnU1ySsD4Tkeg43EgABylk"]
[Sat Jul 18 23:18:06.570106 2026] [security2:error] [pid 831031:tid 831221] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxeDpnU1ySsD4Tkeg43EgABylk"]
[Sat Jul 18 23:18:07.245181 2026] [security2:error] [pid 831031:tid 831270] [client 4.194.24.143:3480] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/sitemap.php"] [unique_id "alxeD5nU1ySsD4Tkeg43NgAAAfs"]
[Sat Jul 18 23:18:07.247187 2026] [security2:error] [pid 831031:tid 831214] [client 14.169.248.156:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "tacticaltreeoperations.com"] [uri "/index.php"] [unique_id "alxeD5nU1ySsD4Tkeg43LAAAAcM"]
[Sat Jul 18 23:18:08.134211 2026] [security2:error] [pid 830701:tid 830853] [client 124.29.246.106:58665] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxeEMu1nEoSSDHiOXbJWQAAASA"]
[Sat Jul 18 23:18:08.134324 2026] [security2:error] [pid 830701:tid 830853] [client 124.29.246.106:58665] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxeEMu1nEoSSDHiOXbJWQAAASA"]
[Sat Jul 18 23:18:08.187394 2026] [security2:error] [pid 831031:tid 831167] [client 4.194.24.143:38789] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/size.php"] [unique_id "alxeEJnU1ySsD4Tkeg43ZwAAAZQ"]
[Sat Jul 18 23:18:08.501997 2026] [security2:error] [pid 831031:tid 831280] [client 223.228.182.224:60714] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxeEJnU1ySsD4Tkeg43fgAAAgU"]
[Sat Jul 18 23:18:08.502103 2026] [security2:error] [pid 831031:tid 831280] [client 223.228.182.224:60714] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxeEJnU1ySsD4Tkeg43fgAAAgU"]
[Sat Jul 18 23:18:09.111859 2026] [security2:error] [pid 831031:tid 831102] [remote 8.217.108.67:54160] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.yok.mqz.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxeEZnU1ySsD4Tkeg43lQAB3UU"]
[Sat Jul 18 23:18:09.111998 2026] [security2:error] [pid 831031:tid 831240] [client 8.217.108.67:54160] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "mail.yok.mqz.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxeEZnU1ySsD4Tkeg43lQAB3UU"]
[Sat Jul 18 23:18:09.181737 2026] [security2:error] [pid 831031:tid 831285] [client 4.194.24.143:41358] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/sm.php"] [unique_id "alxeEZnU1ySsD4Tkeg43mwAAAgo"]
[Sat Jul 18 23:18:09.253337 2026] [security2:error] [pid 831031:tid 831090] [remote 188.138.102.156:53744] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxeEZnU1ySsD4Tkeg43nAAB_zk"]
[Sat Jul 18 23:18:09.456433 2026] [security2:error] [pid 831031:tid 831084] [remote 188.138.102.156:53744] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxeEZnU1ySsD4Tkeg43qwAB_TM"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:18:09.821095 2026] [security2:error] [pid 831031:tid 831202] [client 4.194.24.143:38788] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/sql.php"] [unique_id "alxeEZnU1ySsD4Tkeg43uAAAAbc"]
[Sat Jul 18 23:18:10.381619 2026] [security2:error] [pid 830701:tid 830911] [client 57.141.18.12:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxeEsu1nEoSSDHiOXbJiwAAAVo"]
[Sat Jul 18 23:18:10.668874 2026] [security2:error] [pid 830701:tid 830836] [client 4.194.24.143:41344] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/ss.php"] [unique_id "alxeEsu1nEoSSDHiOXbJngAAAQ8"]
[Sat Jul 18 23:18:10.738094 2026] [security2:error] [pid 831031:tid 831100] [remote 31.42.184.154:40780] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "fkconstructionfunding.com"] [uri "/wp-login.php"] [unique_id "alxeEpnU1ySsD4Tkeg432AAB9kM"]
[Sat Jul 18 23:18:10.954023 2026] [security2:error] [pid 831031:tid 831099] [remote 31.42.184.154:40780] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "fkconstructionfunding.com"] [uri "/wp-login.php"] [unique_id "alxeEpnU1ySsD4Tkeg434QAB3kI"], referer: https://fkconstructionfunding.com/wp-login.php
[Sat Jul 18 23:18:10.985528 2026] [security2:error] [pid 831031:tid 831096] [remote 113.160.142.119:60846] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxeEpnU1ySsD4Tkeg434gAB2j8"]
[Sat Jul 18 23:18:11.208541 2026] [security2:error] [pid 831031:tid 831180] [client 3.223.181.32:21034] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "tacticaltreeoperations.com"] [uri "/"] [unique_id "alxeE5nU1ySsD4Tkeg436wAAAaE"]
[Sat Jul 18 23:18:11.390705 2026] [security2:error] [pid 830701:tid 830897] [client 4.194.24.143:38841] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/stats.php"] [unique_id "alxeE8u1nEoSSDHiOXbJrQAAAUw"]
[Sat Jul 18 23:18:11.435180 2026] [security2:error] [pid 831031:tid 831231] [client 65.111.28.78:37403] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 78.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxeE5nU1ySsD4Tkeg439AAAAdQ"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:18:11.478806 2026] [security2:error] [pid 831031:tid 831136] [remote 113.160.142.119:60846] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxeE5nU1ySsD4Tkeg43-QABuWc"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:18:11.950123 2026] [security2:error] [pid 831031:tid 831212] [client 223.185.61.63:19174] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeE5nU1ySsD4Tkeg44CwAAAcE"]
[Sat Jul 18 23:18:11.950225 2026] [security2:error] [pid 831031:tid 831212] [client 223.185.61.63:19174] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeE5nU1ySsD4Tkeg44CwAAAcE"]
[Sat Jul 18 23:18:12.071769 2026] [security2:error] [pid 831031:tid 831194] [client 4.194.24.143:31326] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/sump1.php"] [unique_id "alxeFJnU1ySsD4Tkeg44EAAAAa8"]
[Sat Jul 18 23:18:12.443700 2026] [proxy:error] [pid 831031:tid 831270] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:18:12.443813 2026] [proxy_http:error] [pid 831031:tid 831270] [client 193.47.62.168:51300] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:18:12.444694 2026] [proxy:error] [pid 831031:tid 831270] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:18:12.444770 2026] [proxy_http:error] [pid 831031:tid 831270] [client 193.47.62.168:51300] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:18:12.602580 2026] [security2:error] [pid 830701:tid 830778] [remote 31.42.184.154:40782] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "adastra.love"] [uri "/wp-login.php"] [unique_id "alxeFMu1nEoSSDHiOXbJuQABCkw"]
[Sat Jul 18 23:18:12.612861 2026] [security2:error] [pid 831031:tid 831257] [client 4.194.24.143:3515] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/system.php"] [unique_id "alxeFJnU1ySsD4Tkeg44LAAAAe4"]
[Sat Jul 18 23:18:12.820213 2026] [security2:error] [pid 830701:tid 830791] [remote 31.42.184.154:40782] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "adastra.love"] [uri "/wp-login.php"] [unique_id "alxeFMu1nEoSSDHiOXbJvAABeFk"], referer: https://adastra.love/wp-login.php
[Sat Jul 18 23:18:12.923649 2026] [security2:error] [pid 831031:tid 831193] [client 65.111.28.52:35915] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxeFJnU1ySsD4Tkeg44OwAAAa4"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:18:13.034726 2026] [security2:error] [pid 830701:tid 830840] [client 27.34.68.67:26221] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxeFcu1nEoSSDHiOXbJwQAAARM"]
[Sat Jul 18 23:18:13.034858 2026] [security2:error] [pid 830701:tid 830840] [client 27.34.68.67:26221] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxeFcu1nEoSSDHiOXbJwQAAARM"]
[Sat Jul 18 23:18:13.156601 2026] [security2:error] [pid 831031:tid 831223] [client 4.194.24.143:41394] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/system/03n1hob7p03r2npdefault.php"] [unique_id "alxeFZnU1ySsD4Tkeg44SQAAAcw"]
[Sat Jul 18 23:18:13.360458 2026] [security2:error] [pid 830701:tid 830893] [client 45.3.45.164:52869] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxeFcu1nEoSSDHiOXbJxgAAAUg"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:18:13.690318 2026] [security2:error] [pid 831031:tid 831220] [client 190.245.146.99:52224] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeFZnU1ySsD4Tkeg44XgAAAck"]
[Sat Jul 18 23:18:13.690417 2026] [security2:error] [pid 831031:tid 831220] [client 190.245.146.99:52224] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeFZnU1ySsD4Tkeg44XgAAAck"]
[Sat Jul 18 23:18:13.730193 2026] [security2:error] [pid 831031:tid 831284] [client 4.194.24.143:41361] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/system/cj5ha2rah8lyiqqdefault.php"] [unique_id "alxeFZnU1ySsD4Tkeg44YgAAAgk"]
[Sat Jul 18 23:18:13.894181 2026] [security2:error] [pid 830701:tid 830940] [client 50.116.65.227:21246] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "www.sesamegreenbeans.com"] [uri "/wp-content/uploads/2025/01/54257992315_73e60fc469_h.jpg"] [unique_id "alxeFcu1nEoSSDHiOXbJzwAAAXc"]
[Sat Jul 18 23:18:13.910097 2026] [security2:error] [pid 831031:tid 831184] [client 50.116.65.227:43698] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.sesamegreenbeans.com"] [uri "/wp-content/uploads/2025/01/54257992315_73e60fc469_h.jpg"] [unique_id "alxeFZnU1ySsD4Tkeg44cgAAAa4"]
[Sat Jul 18 23:18:13.990883 2026] [security2:error] [pid 831031:tid 831174] [client 57.141.18.70:44980] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "sesamegreenbeans.com"] [uri "/index.php"] [unique_id "alxeE5nU1ySsD4Tkeg44DgABm3o"]
[Sat Jul 18 23:18:14.076003 2026] [security2:error] [pid 831031:tid 831179] [client 34.91.100.7:49152] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "cpanel.amalia-capital.com"] [uri "/"] [unique_id "alxeFpnU1ySsD4Tkeg44ewAAAaA"]
[Sat Jul 18 23:18:14.076106 2026] [security2:error] [pid 831031:tid 831179] [client 34.91.100.7:49152] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "cpanel.amalia-capital.com"] [uri "/"] [unique_id "alxeFpnU1ySsD4Tkeg44ewAAAaA"]
[Sat Jul 18 23:18:14.104139 2026] [security2:error] [pid 831031:tid 831180] [client 119.154.81.234:54711] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxeFpnU1ySsD4Tkeg44fAAAAaE"]
[Sat Jul 18 23:18:14.104267 2026] [security2:error] [pid 831031:tid 831180] [client 119.154.81.234:54711] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxeFpnU1ySsD4Tkeg44fAAAAaE"]
[Sat Jul 18 23:18:14.210285 2026] [security2:error] [pid 830701:tid 830702] [remote 157.66.47.83:59880] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxeFsu1nEoSSDHiOXbJ1QABFAA"]
[Sat Jul 18 23:18:14.210495 2026] [security2:error] [pid 830701:tid 830841] [client 157.66.47.83:59880] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxeFsu1nEoSSDHiOXbJ1QABFAA"]
[Sat Jul 18 23:18:14.565211 2026] [security2:error] [pid 831031:tid 831240] [client 4.194.24.143:38832] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/system_log.php"] [unique_id "alxeFpnU1ySsD4Tkeg44kgAAAd0"]
[Sat Jul 18 23:18:14.786641 2026] [security2:error] [pid 831031:tid 831219] [client 45.3.45.13:58211] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxeFpnU1ySsD4Tkeg44nAAAAcg"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:18:15.120810 2026] [security2:error] [pid 830701:tid 830711] [remote 165.232.173.236:60576] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 236.173.232.165.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "latiendadejorge.com.gt"] [uri "/wp-login.php"] [unique_id "alxeF8u1nEoSSDHiOXbJ2gABegk"]
[Sat Jul 18 23:18:15.316721 2026] [security2:error] [pid 831031:tid 831188] [client 65.111.28.22:61295] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 22.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxeF5nU1ySsD4Tkeg44ugAAAak"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:18:15.428682 2026] [security2:error] [pid 830701:tid 830934] [client 4.194.24.143:3485] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/t.php"] [unique_id "alxeF8u1nEoSSDHiOXbJ5QAAAXE"]
[Sat Jul 18 23:18:15.475545 2026] [security2:error] [pid 831031:tid 831282] [client 54.81.43.75:36588] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.ccsdifference.com"] [uri "/index.php"] [unique_id "alxeF5nU1ySsD4Tkeg44vAAAAgc"]
[Sat Jul 18 23:18:15.491541 2026] [security2:error] [pid 830701:tid 830814] [remote 165.232.173.236:60576] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 236.173.232.165.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "latiendadejorge.com.gt"] [uri "/wp-login.php"] [unique_id "alxeF8u1nEoSSDHiOXbJ5gABJHA"], referer: https://latiendadejorge.com.gt/wp-login.php
[Sat Jul 18 23:18:15.885487 2026] [security2:error] [pid 831031:tid 831186] [client 103.48.44.9:64770] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeF5nU1ySsD4Tkeg440gAAAac"]
[Sat Jul 18 23:18:15.885944 2026] [security2:error] [pid 831031:tid 831186] [client 103.48.44.9:64770] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeF5nU1ySsD4Tkeg440gAAAac"]
[Sat Jul 18 23:18:16.152479 2026] [security2:error] [pid 831031:tid 831226] [client 4.194.24.143:31347] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/term.php"] [unique_id "alxeGJnU1ySsD4Tkeg443QAAAc8"]
[Sat Jul 18 23:18:16.160985 2026] [security2:error] [pid 831031:tid 831185] [client 54.81.43.75:35756] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.ccsdifference.com"] [uri "/index.php"] [unique_id "alxeGJnU1ySsD4Tkeg441wAAAaY"]
[Sat Jul 18 23:18:16.209590 2026] [security2:error] [pid 831031:tid 831109] [remote 31.42.184.154:40786] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "maplerespiteservices.com"] [uri "/wp-login.php"] [unique_id "alxeGJnU1ySsD4Tkeg443wABtUw"]
[Sat Jul 18 23:18:16.252333 2026] [security2:error] [pid 831031:tid 831288] [client 223.178.210.203:32737] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeGJnU1ySsD4Tkeg444gAAAg0"]
[Sat Jul 18 23:18:16.252460 2026] [security2:error] [pid 831031:tid 831288] [client 223.178.210.203:32737] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeGJnU1ySsD4Tkeg444gAAAg0"]
[Sat Jul 18 23:18:16.321162 2026] [security2:error] [pid 831031:tid 831095] [remote 31.42.184.154:36734] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/wp-login.php"] [unique_id "alxeGJnU1ySsD4Tkeg445QACBj4"]
[Sat Jul 18 23:18:16.435869 2026] [security2:error] [pid 831031:tid 831094] [remote 31.42.184.154:40786] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "maplerespiteservices.com"] [uri "/wp-login.php"] [unique_id "alxeGJnU1ySsD4Tkeg447AABlz0"], referer: https://maplerespiteservices.com/wp-login.php
[Sat Jul 18 23:18:16.569000 2026] [security2:error] [pid 831031:tid 831117] [remote 31.42.184.154:36734] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/wp-login.php"] [unique_id "alxeGJnU1ySsD4Tkeg449wAB1VQ"], referer: https://joulecommunications.com/wp-login.php
[Sat Jul 18 23:18:16.713109 2026] [security2:error] [pid 831031:tid 831099] [remote 41.76.213.235:56026] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxeGJnU1ySsD4Tkeg44-AAB0EI"]
[Sat Jul 18 23:18:16.713329 2026] [security2:error] [pid 831031:tid 831227] [client 41.76.213.235:56026] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxeGJnU1ySsD4Tkeg44-AAB0EI"]
[Sat Jul 18 23:18:16.893722 2026] [security2:error] [pid 831031:tid 831194] [client 212.129.77.58:23168] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "hedgerow-crafts.com"] [uri "/index.php"] [unique_id "alxeGJnU1ySsD4Tkeg447QABr04"]
[Sat Jul 18 23:18:16.928961 2026] [security2:error] [pid 831031:tid 831188] [client 4.194.24.143:59748] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/test.php"] [unique_id "alxeGJnU1ySsD4Tkeg45CAAAAak"]
[Sat Jul 18 23:18:16.973905 2026] [security2:error] [pid 831031:tid 831140] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxeGJnU1ySsD4Tkeg45CgAB_Gs"]
[Sat Jul 18 23:18:16.974083 2026] [security2:error] [pid 831031:tid 831271] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxeGJnU1ySsD4Tkeg45CgAB_Gs"]
[Sat Jul 18 23:18:17.799959 2026] [security2:error] [pid 831031:tid 831180] [client 57.141.18.81:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxeGZnU1ySsD4Tkeg45IgAAAaE"]
[Sat Jul 18 23:18:17.956109 2026] [security2:error] [pid 831031:tid 831281] [client 4.194.24.143:31309] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/test1.php"] [unique_id "alxeGZnU1ySsD4Tkeg45MQAAAgY"]
[Sat Jul 18 23:18:18.155513 2026] [security2:error] [pid 830701:tid 830754] [remote 134.209.147.209:50758] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.147.209.134.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxeGsu1nEoSSDHiOXbKBwABSTQ"]
[Sat Jul 18 23:18:18.332604 2026] [security2:error] [pid 831031:tid 831146] [remote 31.42.184.154:40802] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxeGpnU1ySsD4Tkeg45QQABunE"]
[Sat Jul 18 23:18:18.550388 2026] [security2:error] [pid 830701:tid 830813] [remote 134.209.147.209:50758] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.147.209.134.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxeGsu1nEoSSDHiOXbKDQABG28"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:18:18.591096 2026] [security2:error] [pid 831031:tid 831036] [remote 31.42.184.154:40802] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxeGpnU1ySsD4Tkeg45VwACDQM"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:18:18.717825 2026] [security2:error] [pid 831031:tid 831202] [client 4.194.24.143:31348] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/tfm.php"] [unique_id "alxeGpnU1ySsD4Tkeg45WwAAAbc"]
[Sat Jul 18 23:18:19.213484 2026] [security2:error] [pid 831031:tid 831259] [client 65.111.27.92:57891] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.27.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxeG5nU1ySsD4Tkeg45dwAAAfA"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:18:19.352181 2026] [security2:error] [pid 831031:tid 831184] [client 223.228.182.224:46109] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxeG5nU1ySsD4Tkeg45fQAAAaU"]
[Sat Jul 18 23:18:19.352281 2026] [security2:error] [pid 831031:tid 831184] [client 223.228.182.224:46109] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxeG5nU1ySsD4Tkeg45fQAAAaU"]
[Sat Jul 18 23:18:19.396569 2026] [security2:error] [pid 831031:tid 831225] [client 4.194.24.143:38828] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/thebe.php"] [unique_id "alxeG5nU1ySsD4Tkeg45gQAAAc4"]
[Sat Jul 18 23:18:19.627829 2026] [security2:error] [pid 831031:tid 831045] [remote 20.153.140.50:47402] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxeG5nU1ySsD4Tkeg45kQACAAw"]
[Sat Jul 18 23:18:20.138654 2026] [security2:error] [pid 831031:tid 831199] [client 4.194.24.143:37217] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/themes.php"] [unique_id "alxeHJnU1ySsD4Tkeg45uwAAAbQ"]
[Sat Jul 18 23:18:20.449559 2026] [security2:error] [pid 831031:tid 831040] [remote 20.153.140.50:47402] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxeHJnU1ySsD4Tkeg45yAABxwc"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:18:20.452959 2026] [security2:error] [pid 831031:tid 831069] [remote 182.77.62.24:39390] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.62.77.182.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "massagelacey.com"] [uri "/wp-login.php"] [unique_id "alxeHJnU1ySsD4Tkeg45yQAB4yQ"]
[Sat Jul 18 23:18:20.836918 2026] [security2:error] [pid 831031:tid 831128] [remote 185.242.3.189:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 189.3.242.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "tanmiya.me"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "alxeHJnU1ySsD4Tkeg455wABk18"], referer: www.google.com
[Sat Jul 18 23:18:20.871328 2026] [security2:error] [pid 831031:tid 831109] [remote 185.242.3.189:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 189.3.242.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "tanmiya.me"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "alxeHJnU1ySsD4Tkeg457AABm0w"]
[Sat Jul 18 23:18:20.909899 2026] [security2:error] [pid 831031:tid 831094] [remote 185.242.3.189:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 189.3.242.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "tanmiya.me"] [uri "/wp-plain.php"] [unique_id "alxeHJnU1ySsD4Tkeg458gABnj0"], referer: www.google.com
[Sat Jul 18 23:18:20.919099 2026] [security2:error] [pid 831031:tid 831251] [client 65.111.30.27:23035] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.30.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxeHJnU1ySsD4Tkeg457gAAAeg"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:18:21.030062 2026] [security2:error] [pid 831031:tid 831270] [client 4.194.24.143:3484] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/tiny.php"] [unique_id "alxeHZnU1ySsD4Tkeg45_wAAAfs"]
[Sat Jul 18 23:18:21.050735 2026] [security2:error] [pid 831031:tid 831106] [remote 182.77.62.24:39390] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.62.77.182.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "massagelacey.com"] [uri "/wp-login.php"] [unique_id "alxeHZnU1ySsD4Tkeg46AgAB0kk"], referer: https://massagelacey.com/wp-login.php
[Sat Jul 18 23:18:21.098115 2026] [security2:error] [pid 831031:tid 831093] [remote 185.242.3.189:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 189.3.242.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "tanmiya.me"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "alxeHZnU1ySsD4Tkeg46CAABtTw"], referer: www.google.com
[Sat Jul 18 23:18:21.153410 2026] [security2:error] [pid 831031:tid 831041] [remote 185.242.3.189:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 189.3.242.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "tanmiya.me"] [uri "/lnuepvep.php"] [unique_id "alxeHZnU1ySsD4Tkeg46CgAB-Qg"], referer: www.google.com
[Sat Jul 18 23:18:21.694252 2026] [security2:error] [pid 831031:tid 831078] [remote 8.217.108.67:16006] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.upf.ztf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxeHZnU1ySsD4Tkeg46IAACCy0"]
[Sat Jul 18 23:18:21.968871 2026] [security2:error] [pid 830701:tid 830955] [client 4.194.24.143:41398] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/tmp/byp.php"] [unique_id "alxeHcu1nEoSSDHiOXbKOgAAAYY"]
[Sat Jul 18 23:18:22.079102 2026] [security2:error] [pid 831031:tid 831138] [remote 8.217.108.67:16006] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.upf.ztf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxeHpnU1ySsD4Tkeg46NAABuGk"], referer: https://mail.upf.ztf.mybluehost.me/wp-login.php
[Sat Jul 18 23:18:22.419932 2026] [security2:error] [pid 830701:tid 830864] [client 223.185.61.63:27421] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeHsu1nEoSSDHiOXbKQAAAASs"]
[Sat Jul 18 23:18:22.420031 2026] [security2:error] [pid 830701:tid 830864] [client 223.185.61.63:27421] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeHsu1nEoSSDHiOXbKQAAAASs"]
[Sat Jul 18 23:18:23.136703 2026] [security2:error] [pid 831031:tid 831035] [remote 185.242.3.189:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 189.3.242.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "tanmiya.me"] [uri "/wp-content/plugins/apikey/apikey.php"] [unique_id "alxeH5nU1ySsD4Tkeg46YwABlgI"]
[Sat Jul 18 23:18:23.317458 2026] [security2:error] [pid 831031:tid 831076] [remote 185.242.3.189:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 189.3.242.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "tanmiya.me"] [uri "/plugins/content/apismtp/apismtp.php"] [unique_id "alxeH5nU1ySsD4Tkeg46bwAByys"]
[Sat Jul 18 23:18:23.511212 2026] [security2:error] [pid 831031:tid 831045] [remote 185.242.3.189:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 189.3.242.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "tanmiya.me"] [uri "/wp-content/plugins/apikey/apikey.php.suspected"] [unique_id "alxeH5nU1ySsD4Tkeg46dwAB1gw"]
[Sat Jul 18 23:18:23.555180 2026] [security2:error] [pid 831031:tid 831283] [client 27.34.68.67:20273] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxeH5nU1ySsD4Tkeg46eQAAAgg"]
[Sat Jul 18 23:18:23.555283 2026] [security2:error] [pid 831031:tid 831283] [client 27.34.68.67:20273] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxeH5nU1ySsD4Tkeg46eQAAAgg"]
[Sat Jul 18 23:18:23.812599 2026] [security2:error] [pid 830701:tid 830954] [client 50.116.65.227:39682] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Jin-Wee-Feature-Image.jpg"] [unique_id "alxeH8u1nEoSSDHiOXbKYQAAAYU"]
[Sat Jul 18 23:18:23.823038 2026] [security2:error] [pid 830701:tid 830882] [client 50.116.65.227:59700] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Jin-Wee-Feature-Image.jpg"] [unique_id "alxeH8u1nEoSSDHiOXbKYwAAAWE"]
[Sat Jul 18 23:18:24.025396 2026] [security2:error] [pid 830701:tid 830773] [remote 185.242.3.189:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 189.3.242.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "tanmiya.me"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "alxeIMu1nEoSSDHiOXbKZgABJEc"]
[Sat Jul 18 23:18:24.246506 2026] [security2:error] [pid 830701:tid 830951] [client 190.245.146.99:52733] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeIMu1nEoSSDHiOXbKbQAAAYI"]
[Sat Jul 18 23:18:24.246700 2026] [security2:error] [pid 830701:tid 830951] [client 190.245.146.99:52733] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeIMu1nEoSSDHiOXbKbQAAAYI"]
[Sat Jul 18 23:18:24.309410 2026] [security2:error] [pid 830701:tid 830720] [remote 141.94.161.61:36500] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.161.94.141.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "scott-assist.com"] [uri "/wp-login.php"] [unique_id "alxeIMu1nEoSSDHiOXbKbwABOBI"]
[Sat Jul 18 23:18:24.396068 2026] [security2:error] [pid 831031:tid 831098] [remote 31.42.184.154:56724] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nextlevelpressurewashing.com"] [uri "/wp-login.php"] [unique_id "alxeIJnU1ySsD4Tkeg46rwABkEE"]
[Sat Jul 18 23:18:24.457107 2026] [security2:error] [pid 830701:tid 830897] [client 65.0.26.70:58426] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.26.0.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxeIMu1nEoSSDHiOXbKeQAAAUw"]
[Sat Jul 18 23:18:24.507909 2026] [security2:error] [pid 830701:tid 830731] [remote 141.94.161.61:36500] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.161.94.141.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "scott-assist.com"] [uri "/wp-login.php"] [unique_id "alxeIMu1nEoSSDHiOXbKegABDB0"], referer: https://scott-assist.com/wp-login.php
[Sat Jul 18 23:18:24.621853 2026] [security2:error] [pid 831031:tid 831120] [remote 31.42.184.154:56724] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nextlevelpressurewashing.com"] [uri "/wp-login.php"] [unique_id "alxeIJnU1ySsD4Tkeg46tQAB1lc"], referer: https://nextlevelpressurewashing.com/wp-login.php
[Sat Jul 18 23:18:24.695243 2026] [security2:error] [pid 830701:tid 830859] [client 119.154.81.234:55151] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxeIMu1nEoSSDHiOXbKfAAAASY"]
[Sat Jul 18 23:18:24.695415 2026] [security2:error] [pid 830701:tid 830859] [client 119.154.81.234:55151] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxeIMu1nEoSSDHiOXbKfAAAASY"]
[Sat Jul 18 23:18:24.989889 2026] [security2:error] [pid 830701:tid 830868] [client 171.4.232.110:40237] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeIMu1nEoSSDHiOXbKhwAAAS8"]
[Sat Jul 18 23:18:24.990004 2026] [security2:error] [pid 830701:tid 830868] [client 171.4.232.110:40237] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeIMu1nEoSSDHiOXbKhwAAAS8"]
[Sat Jul 18 23:18:25.512062 2026] [ssl:error] [pid 830701:tid 830860] [client 104.48.69.105:32868] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname blog.danwolfe.us provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:18:25.672346 2026] [security2:error] [pid 831031:tid 831255] [client 3.108.60.216:42478] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxeIZnU1ySsD4Tkeg461AAAAew"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:18:25.690757 2026] [security2:error] [pid 830701:tid 830875] [client 65.111.28.44:64977] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxeIcu1nEoSSDHiOXbKlwAAATY"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:18:26.410530 2026] [security2:error] [pid 831031:tid 831168] [client 103.48.44.9:65279] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeIpnU1ySsD4Tkeg46-wAAAZU"]
[Sat Jul 18 23:18:26.410610 2026] [security2:error] [pid 831031:tid 831168] [client 103.48.44.9:65279] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeIpnU1ySsD4Tkeg46-wAAAZU"]
[Sat Jul 18 23:18:26.686833 2026] [security2:error] [pid 831031:tid 831036] [remote 216.73.217.174:54294] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.217.73.216.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "thechancersband.com"] [uri "/xmlrpc.php"] [unique_id "alxeIpnU1ySsD4Tkeg47BAACBgM"]
[Sat Jul 18 23:18:26.703348 2026] [security2:error] [pid 830701:tid 830889] [client 223.178.210.203:4314] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeIsu1nEoSSDHiOXbKqgAAAUQ"]
[Sat Jul 18 23:18:26.703460 2026] [security2:error] [pid 830701:tid 830889] [client 223.178.210.203:4314] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeIsu1nEoSSDHiOXbKqgAAAUQ"]
[Sat Jul 18 23:18:27.413341 2026] [security2:error] [pid 831031:tid 831196] [client 74.208.214.194:42354] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxeI5nU1ySsD4Tkeg47IgAAAbE"]
[Sat Jul 18 23:18:27.566459 2026] [security2:error] [pid 830701:tid 830798] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxeI8u1nEoSSDHiOXbKvgABJWA"]
[Sat Jul 18 23:18:27.566567 2026] [security2:error] [pid 830701:tid 830858] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxeI8u1nEoSSDHiOXbKvgABJWA"]
[Sat Jul 18 23:18:28.120815 2026] [security2:error] [pid 830701:tid 830834] [client 200.8.34.40:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "tacticaltreeoperations.com"] [uri "/index.php"] [unique_id "alxeI8u1nEoSSDHiOXbKxAAAAQ0"]
[Sat Jul 18 23:18:28.414533 2026] [security2:error] [pid 831031:tid 831143] [remote 65.60.38.74:47112] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.38.60.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "civitansuncitiesaz.org"] [uri "/wp-login.php"] [unique_id "alxeJJnU1ySsD4Tkeg47TAACC24"]
[Sat Jul 18 23:18:28.604421 2026] [security2:error] [pid 831031:tid 831081] [remote 65.60.38.74:47112] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.38.60.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "civitansuncitiesaz.org"] [uri "/wp-login.php"] [unique_id "alxeJJnU1ySsD4Tkeg47XQAB4jA"], referer: https://civitansuncitiesaz.org/wp-login.php
[Sat Jul 18 23:18:29.416943 2026] [ssl:error] [pid 831031:tid 831259] [client 104.48.69.105:35448] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname www.bandsir.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:18:29.977139 2026] [security2:error] [pid 831031:tid 831262] [client 223.228.182.224:51365] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxeJZnU1ySsD4Tkeg47kwAAAfM"]
[Sat Jul 18 23:18:29.977272 2026] [security2:error] [pid 831031:tid 831262] [client 223.228.182.224:51365] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxeJZnU1ySsD4Tkeg47kwAAAfM"]
[Sat Jul 18 23:18:30.083114 2026] [security2:error] [pid 830701:tid 830903] [client 124.29.207.185:59570] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxeJsu1nEoSSDHiOXbK4gAAAVI"]
[Sat Jul 18 23:18:30.083222 2026] [security2:error] [pid 830701:tid 830903] [client 124.29.207.185:59570] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxeJsu1nEoSSDHiOXbK4gAAAVI"]
[Sat Jul 18 23:18:30.635721 2026] [security2:error] [pid 831031:tid 831084] [remote 72.167.132.114:55074] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxeJpnU1ySsD4Tkeg47twAByTM"]
[Sat Jul 18 23:18:30.635848 2026] [security2:error] [pid 831031:tid 831220] [client 72.167.132.114:55074] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxeJpnU1ySsD4Tkeg47twAByTM"]
[Sat Jul 18 23:18:31.188771 2026] [security2:error] [pid 831031:tid 831183] [client 57.141.18.18:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "bandsir.com"] [uri "/index.php"] [unique_id "alxeJpnU1ySsD4Tkeg47xwAAAaQ"]
[Sat Jul 18 23:18:31.215757 2026] [security2:error] [pid 830701:tid 830835] [client 74.208.214.194:42362] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxeJ8u1nEoSSDHiOXbK7AAAAQ4"]
[Sat Jul 18 23:18:31.277493 2026] [security2:error] [pid 831031:tid 831175] [client 62.150.67.110:53862] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "ali-alghanim.net"] [uri "/index.php"] [unique_id "alxeJpnU1ySsD4Tkeg47ywAAAZw"]
[Sat Jul 18 23:18:31.662913 2026] [proxy:error] [pid 831031:tid 831168] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:18:31.662946 2026] [proxy_http:error] [pid 831031:tid 831168] [client 212.56.54.149:60835] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:18:31.663337 2026] [proxy:error] [pid 831031:tid 831168] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:18:31.663357 2026] [proxy_http:error] [pid 831031:tid 831168] [client 212.56.54.149:60835] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:18:32.093225 2026] [security2:error] [pid 831031:tid 831129] [remote 152.228.213.32:43960] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxeKJnU1ySsD4Tkeg479QAB5GA"]
[Sat Jul 18 23:18:32.272880 2026] [security2:error] [pid 831031:tid 831051] [remote 152.228.213.32:43960] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxeKJnU1ySsD4Tkeg47_gABrBI"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:18:32.291106 2026] [security2:error] [pid 830701:tid 830897] [client 217.181.91.199:27609] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.91.181.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxeKMu1nEoSSDHiOXbK_wAAAUw"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:18:32.795907 2026] [security2:error] [pid 830701:tid 830868] [client 34.91.100.7:49153] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "backend.safe-systems.net"] [uri "/"] [unique_id "alxeKMu1nEoSSDHiOXbLDAAAAS8"]
[Sat Jul 18 23:18:32.795979 2026] [security2:error] [pid 830701:tid 830868] [client 34.91.100.7:49153] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "backend.safe-systems.net"] [uri "/"] [unique_id "alxeKMu1nEoSSDHiOXbLDAAAAS8"]
[Sat Jul 18 23:18:32.922699 2026] [security2:error] [pid 830701:tid 830848] [client 65.111.30.95:48715] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.30.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxeKMu1nEoSSDHiOXbLEgAAARs"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:18:33.025401 2026] [security2:error] [pid 831031:tid 831182] [client 223.185.61.63:12327] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeKZnU1ySsD4Tkeg48HAAAAaM"]
[Sat Jul 18 23:18:33.025517 2026] [security2:error] [pid 831031:tid 831182] [client 223.185.61.63:12327] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeKZnU1ySsD4Tkeg48HAAAAaM"]
[Sat Jul 18 23:18:33.559202 2026] [security2:error] [pid 831031:tid 831203] [client 151.123.177.234:24587] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.177.123.151.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxeKZnU1ySsD4Tkeg48MAAAAbg"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:18:34.139662 2026] [security2:error] [pid 830701:tid 830917] [client 27.34.68.67:7669] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxeKsu1nEoSSDHiOXbLIwAAAWA"]
[Sat Jul 18 23:18:34.139783 2026] [security2:error] [pid 830701:tid 830917] [client 27.34.68.67:7669] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxeKsu1nEoSSDHiOXbLIwAAAWA"]
[Sat Jul 18 23:18:34.180828 2026] [security2:error] [pid 831031:tid 831242] [client 65.111.28.127:22261] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 127.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxeKpnU1ySsD4Tkeg48TgAAAd8"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:18:34.779321 2026] [security2:error] [pid 831031:tid 831170] [client 190.245.146.99:53247] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeKpnU1ySsD4Tkeg48bAAAAZc"]
[Sat Jul 18 23:18:34.785325 2026] [security2:error] [pid 831031:tid 831170] [client 190.245.146.99:53247] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeKpnU1ySsD4Tkeg48bAAAAZc"]
[Sat Jul 18 23:18:34.814466 2026] [security2:error] [pid 831031:tid 831076] [remote 20.153.140.50:54506] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxeKpnU1ySsD4Tkeg48bQAB9Cs"]
[Sat Jul 18 23:18:34.814690 2026] [security2:error] [pid 831031:tid 831263] [client 20.153.140.50:54506] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxeKpnU1ySsD4Tkeg48bQAB9Cs"]
[Sat Jul 18 23:18:34.970788 2026] [security2:error] [pid 831031:tid 831145] [remote 8.217.108.67:36454] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxeKpnU1ySsD4Tkeg48egAB1HA"]
[Sat Jul 18 23:18:34.979984 2026] [ssl:error] [pid 831031:tid 831222] [client 104.48.69.105:35454] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname www.icemarc.org provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:18:35.014634 2026] [security2:error] [pid 831031:tid 831135] [remote 31.42.184.154:41610] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxeK5nU1ySsD4Tkeg48fAACC2Y"]
[Sat Jul 18 23:18:35.014797 2026] [security2:error] [pid 831031:tid 831286] [client 31.42.184.154:41610] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxeK5nU1ySsD4Tkeg48fAACC2Y"]
[Sat Jul 18 23:18:35.122230 2026] [security2:error] [pid 831031:tid 831196] [client 35.204.135.22:32768] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "webmail.cjh.tmu.mybluehost.me"] [uri "/"] [unique_id "alxeK5nU1ySsD4Tkeg48fwAAAbE"]
[Sat Jul 18 23:18:35.122327 2026] [security2:error] [pid 831031:tid 831196] [client 35.204.135.22:32768] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "webmail.cjh.tmu.mybluehost.me"] [uri "/"] [unique_id "alxeK5nU1ySsD4Tkeg48fwAAAbE"]
[Sat Jul 18 23:18:35.200827 2026] [security2:error] [pid 831031:tid 831217] [client 119.154.81.234:55579] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxeK5nU1ySsD4Tkeg48ggAAAcY"]
[Sat Jul 18 23:18:35.200905 2026] [security2:error] [pid 831031:tid 831217] [client 119.154.81.234:55579] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxeK5nU1ySsD4Tkeg48ggAAAcY"]
[Sat Jul 18 23:18:35.372158 2026] [security2:error] [pid 831031:tid 831050] [remote 8.217.108.67:36454] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxeK5nU1ySsD4Tkeg48iQAB_BE"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:18:35.544812 2026] [security2:error] [pid 831031:tid 831153] [remote 82.165.88.213:33550] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 213.88.165.82.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.qix.pfz.mybluehost.me"] [uri "/wp/xmlrpc.php"] [unique_id "alxeK5nU1ySsD4Tkeg48kAAB2Xg"]
[Sat Jul 18 23:18:35.545073 2026] [security2:error] [pid 831031:tid 831236] [client 82.165.88.213:33550] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "mail.qix.pfz.mybluehost.me"] [uri "/wp/xmlrpc.php"] [unique_id "alxeK5nU1ySsD4Tkeg48kAAB2Xg"]
[Sat Jul 18 23:18:35.588368 2026] [security2:error] [pid 831031:tid 831208] [client 171.4.232.110:49158] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeK5nU1ySsD4Tkeg48lgAAAb0"]
[Sat Jul 18 23:18:35.588473 2026] [security2:error] [pid 831031:tid 831208] [client 171.4.232.110:49158] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeK5nU1ySsD4Tkeg48lgAAAb0"]
[Sat Jul 18 23:18:35.742538 2026] [security2:error] [pid 830701:tid 830822] [remote 217.182.128.41:38540] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.128.182.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxeK8u1nEoSSDHiOXbLOAABiXg"]
[Sat Jul 18 23:18:35.948155 2026] [security2:error] [pid 830701:tid 830738] [remote 217.182.128.41:38540] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.128.182.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxeK8u1nEoSSDHiOXbLQQABQSQ"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:18:36.480470 2026] [security2:error] [pid 830701:tid 830847] [client 4.194.24.143:18479] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/nine2code.php"] [unique_id "alxeLMu1nEoSSDHiOXbLUQAAARo"]
[Sat Jul 18 23:18:37.013591 2026] [security2:error] [pid 830701:tid 830764] [remote 188.138.102.156:59414] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxeLcu1nEoSSDHiOXbLXAABDz4"]
[Sat Jul 18 23:18:37.041785 2026] [security2:error] [pid 831031:tid 831165] [client 103.48.44.9:49409] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeLZnU1ySsD4Tkeg48xwAAAZI"]
[Sat Jul 18 23:18:37.041916 2026] [security2:error] [pid 831031:tid 831165] [client 103.48.44.9:49409] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeLZnU1ySsD4Tkeg48xwAAAZI"]
[Sat Jul 18 23:18:37.051560 2026] [security2:error] [pid 831031:tid 831169] [client 4.194.24.143:18453] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/num.php"] [unique_id "alxeLZnU1ySsD4Tkeg48yAAAAZY"]
[Sat Jul 18 23:18:37.225376 2026] [security2:error] [pid 830701:tid 830712] [remote 188.138.102.156:59414] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxeLcu1nEoSSDHiOXbLXQABRAo"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:18:37.258232 2026] [security2:error] [pid 831031:tid 831166] [client 223.178.210.203:15023] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeLZnU1ySsD4Tkeg48zgAAAZM"]
[Sat Jul 18 23:18:37.258352 2026] [security2:error] [pid 831031:tid 831166] [client 223.178.210.203:15023] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeLZnU1ySsD4Tkeg48zgAAAZM"]
[Sat Jul 18 23:18:37.378154 2026] [security2:error] [pid 831031:tid 831218] [client 69.158.20.247:53904] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.adultdaycarereno.com"] [uri "/index.php"] [unique_id "alxeLZnU1ySsD4Tkeg480QABx1g"], referer: https://www.adultdaycarereno.com/wp-content/themes/moretolifeadhc/css/generalize.min.css
[Sat Jul 18 23:18:37.605258 2026] [security2:error] [pid 831031:tid 831189] [client 4.194.24.143:59673] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/odf7udtspqtpxzyxmw2rccdefault.php"] [unique_id "alxeLZnU1ySsD4Tkeg487AAAAao"]
[Sat Jul 18 23:18:37.895085 2026] [security2:error] [pid 831031:tid 831270] [client 69.158.20.247:53904] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.adultdaycarereno.com"] [uri "/index.php"] [unique_id "alxeLZnU1ySsD4Tkeg489QAB-yA"], referer: https://www.adultdaycarereno.com/adult-day-care-center-when-and-how-to-select-an-adult-day-center
[Sat Jul 18 23:18:38.001485 2026] [security2:error] [pid 831031:tid 831078] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxeLZnU1ySsD4Tkeg49AwABsS0"]
[Sat Jul 18 23:18:38.001638 2026] [security2:error] [pid 831031:tid 831196] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxeLZnU1ySsD4Tkeg49AwABsS0"]
[Sat Jul 18 23:18:38.147802 2026] [security2:error] [pid 830701:tid 830831] [client 4.194.24.143:19452] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/option.php"] [unique_id "alxeLsu1nEoSSDHiOXbLcQAAAQo"]
[Sat Jul 18 23:18:38.734547 2026] [security2:error] [pid 830701:tid 830938] [client 4.194.24.143:19444] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/p.php"] [unique_id "alxeLsu1nEoSSDHiOXbLjQAAAXU"]
[Sat Jul 18 23:18:39.292142 2026] [security2:error] [pid 830701:tid 830927] [client 4.194.24.143:19142] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/past.php"] [unique_id "alxeL8u1nEoSSDHiOXbLqgAAAWo"]
[Sat Jul 18 23:18:39.489826 2026] [security2:error] [pid 830701:tid 830846] [client 57.141.18.2:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxeL8u1nEoSSDHiOXbLqwAAARk"]
[Sat Jul 18 23:18:39.664883 2026] [security2:error] [pid 830701:tid 830803] [remote 188.138.102.156:39194] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.shantimethod.com"] [uri "/wp-login.php"] [unique_id "alxeL8u1nEoSSDHiOXbLxwABR2U"]
[Sat Jul 18 23:18:39.863795 2026] [security2:error] [pid 830701:tid 830875] [client 4.194.24.143:19321] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/php.php"] [unique_id "alxeL8u1nEoSSDHiOXbLzAAAATY"]
[Sat Jul 18 23:18:39.917691 2026] [security2:error] [pid 830701:tid 830704] [remote 188.138.102.156:39194] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.shantimethod.com"] [uri "/wp-login.php"] [unique_id "alxeL8u1nEoSSDHiOXbLzwABXgI"], referer: https://mail.shantimethod.com/wp-login.php
[Sat Jul 18 23:18:40.153945 2026] [security2:error] [pid 830701:tid 830938] [client 124.29.246.106:59692] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxeMMu1nEoSSDHiOXbL5QAAAXU"]
[Sat Jul 18 23:18:40.154092 2026] [security2:error] [pid 830701:tid 830938] [client 124.29.246.106:59692] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxeMMu1nEoSSDHiOXbL5QAAAXU"]
[Sat Jul 18 23:18:40.311124 2026] [security2:error] [pid 830701:tid 830833] [client 45.61.185.216:64503] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.185.61.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/wp-login.php"] [unique_id "alxeMMu1nEoSSDHiOXbL6gAAAQw"]
[Sat Jul 18 23:18:40.444185 2026] [security2:error] [pid 830701:tid 830919] [client 4.194.24.143:41422] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/php8.php"] [unique_id "alxeMMu1nEoSSDHiOXbL8QAAAWI"]
[Sat Jul 18 23:18:40.880790 2026] [security2:error] [pid 830701:tid 830852] [client 223.228.182.224:43211] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxeMMu1nEoSSDHiOXbMCQAAAR8"]
[Sat Jul 18 23:18:40.885765 2026] [security2:error] [pid 830701:tid 830852] [client 223.228.182.224:43211] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxeMMu1nEoSSDHiOXbMCQAAAR8"]
[Sat Jul 18 23:18:41.045589 2026] [security2:error] [pid 830701:tid 830847] [client 4.194.24.143:41449] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/phpinfo.php"] [unique_id "alxeMcu1nEoSSDHiOXbMEwAAARo"]
[Sat Jul 18 23:18:41.075397 2026] [security2:error] [pid 830701:tid 830754] [remote 199.189.225.167:41893] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.225.189.199.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "deltat24.com"] [uri "/wp-login.php"] [unique_id "alxeMcu1nEoSSDHiOXbMFAABXjQ"]
[Sat Jul 18 23:18:41.264876 2026] [security2:error] [pid 830701:tid 830813] [remote 199.189.225.167:41893] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.225.189.199.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "deltat24.com"] [uri "/wp-login.php"] [unique_id "alxeMcu1nEoSSDHiOXbMIAABOG8"], referer: https://deltat24.com/wp-login.php
[Sat Jul 18 23:18:41.712808 2026] [security2:error] [pid 830701:tid 830908] [client 181.28.129.92:45892] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.keywayconstructionclt.com"] [uri "/index.php"] [unique_id "alxeMMu1nEoSSDHiOXbL8AAAAVc"]
[Sat Jul 18 23:18:42.502029 2026] [security2:error] [pid 830701:tid 830944] [client 152.58.31.118:65260] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.guidehunting.com"] [uri "/index.php"] [unique_id "alxeMsu1nEoSSDHiOXbMWgAAAXs"]
[Sat Jul 18 23:18:43.111539 2026] [security2:error] [pid 830701:tid 830870] [client 4.194.24.143:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "ghivs.com"] [uri "/index.php"] [unique_id "alxeMcu1nEoSSDHiOXbMOQAAATE"]
[Sat Jul 18 23:18:43.296233 2026] [security2:error] [pid 830701:tid 830944] [client 4.194.24.143:19291] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/post.php"] [unique_id "alxeM8u1nEoSSDHiOXbMpAAAAXs"]
[Sat Jul 18 23:18:43.526893 2026] [security2:error] [pid 830701:tid 830921] [client 74.7.227.179:47128] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxeM8u1nEoSSDHiOXbMpwABZE8"], referer: https://tejasenvironmental.com/p=874145
[Sat Jul 18 23:18:43.571632 2026] [security2:error] [pid 830701:tid 830854] [client 223.185.61.63:23306] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeM8u1nEoSSDHiOXbMrwAAASE"]
[Sat Jul 18 23:18:43.571734 2026] [security2:error] [pid 830701:tid 830854] [client 223.185.61.63:23306] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeM8u1nEoSSDHiOXbMrwAAASE"]
[Sat Jul 18 23:18:43.864363 2026] [security2:error] [pid 830701:tid 830928] [client 4.194.24.143:63682] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/public/assets/design_1/css/parts/course_cards/grid_card_1.min.php"] [unique_id "alxeM8u1nEoSSDHiOXbMwwAAAWs"]
[Sat Jul 18 23:18:43.885381 2026] [security2:error] [pid 830701:tid 830906] [client 65.111.26.103:43115] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.26.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxeM8u1nEoSSDHiOXbMwQAAAVU"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:18:44.069608 2026] [security2:error] [pid 830701:tid 830954] [client 152.58.31.118:65260] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.guidehunting.com"] [uri "/index.php"] [unique_id "alxeM8u1nEoSSDHiOXbMwAAAAYU"]
[Sat Jul 18 23:18:44.344716 2026] [security2:error] [pid 830701:tid 830865] [client 57.141.18.52:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxeNMu1nEoSSDHiOXbM0wAAASw"]
[Sat Jul 18 23:18:44.438303 2026] [security2:error] [pid 830701:tid 830851] [client 4.194.24.143:20339] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/public/css.php"] [unique_id "alxeNMu1nEoSSDHiOXbM5AAAAR4"]
[Sat Jul 18 23:18:44.561003 2026] [security2:error] [pid 830701:tid 830796] [remote 163.227.186.27:42778] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxeNMu1nEoSSDHiOXbM7QABMV4"]
[Sat Jul 18 23:18:44.790565 2026] [security2:error] [pid 830701:tid 830947] [client 65.111.28.28:50687] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 28.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxeNMu1nEoSSDHiOXbM_gAAAX4"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:18:44.795305 2026] [security2:error] [pid 830701:tid 830871] [client 27.34.68.67:8241] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxeNMu1nEoSSDHiOXbNAwAAATI"]
[Sat Jul 18 23:18:44.795447 2026] [security2:error] [pid 830701:tid 830871] [client 27.34.68.67:8241] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxeNMu1nEoSSDHiOXbNAwAAATI"]
[Sat Jul 18 23:18:44.876601 2026] [security2:error] [pid 830701:tid 830873] [client 152.58.31.118:65260] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.guidehunting.com"] [uri "/index.php"] [unique_id "alxeNMu1nEoSSDHiOXbM8AAAATQ"]
[Sat Jul 18 23:18:45.025451 2026] [security2:error] [pid 830701:tid 830828] [remote 163.227.186.27:42778] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxeNcu1nEoSSDHiOXbNCwABcH4"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:18:45.032189 2026] [security2:error] [pid 830701:tid 830868] [client 4.194.24.143:19152] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/r.php"] [unique_id "alxeNcu1nEoSSDHiOXbNDAAAAS8"]
[Sat Jul 18 23:18:45.292654 2026] [security2:error] [pid 830701:tid 830847] [client 190.245.146.99:53757] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeNcu1nEoSSDHiOXbNHAAAARo"]
[Sat Jul 18 23:18:45.292783 2026] [security2:error] [pid 830701:tid 830847] [client 190.245.146.99:53757] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeNcu1nEoSSDHiOXbNHAAAARo"]
[Sat Jul 18 23:18:45.351794 2026] [security2:error] [pid 830701:tid 830874] [client 188.3.68.229:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "globalvisionholiday.com"] [uri "/index.php"] [unique_id "alxeMcu1nEoSSDHiOXbMLQABNXE"], referer: https://globalvisionholiday.com
[Sat Jul 18 23:18:45.404144 2026] [security2:error] [pid 830701:tid 830869] [client 45.3.55.168:20375] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 168.55.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxeNcu1nEoSSDHiOXbNJwAAATA"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:18:45.605225 2026] [security2:error] [pid 830701:tid 830936] [client 4.194.24.143:20341] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/radio.php"] [unique_id "alxeNcu1nEoSSDHiOXbNNgAAAXM"]
[Sat Jul 18 23:18:45.703204 2026] [security2:error] [pid 830701:tid 830941] [client 152.58.31.118:65260] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.guidehunting.com"] [uri "/index.php"] [unique_id "alxeNcu1nEoSSDHiOXbNKgAAAXg"]
[Sat Jul 18 23:18:45.984798 2026] [security2:error] [pid 830701:tid 830954] [client 45.3.45.141:31099] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 141.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxeNcu1nEoSSDHiOXbNSwAAAYU"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:18:46.164536 2026] [security2:error] [pid 830701:tid 830955] [client 4.194.24.143:47099] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/randkeyword.php7"] [unique_id "alxeNsu1nEoSSDHiOXbNVQAAAYY"]
[Sat Jul 18 23:18:46.490629 2026] [security2:error] [pid 830701:tid 830857] [client 119.154.81.234:56046] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxeNsu1nEoSSDHiOXbNZAAAASQ"]
[Sat Jul 18 23:18:46.490763 2026] [security2:error] [pid 830701:tid 830857] [client 119.154.81.234:56046] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxeNsu1nEoSSDHiOXbNZAAAASQ"]
[Sat Jul 18 23:18:46.515527 2026] [security2:error] [pid 830701:tid 830902] [client 152.58.31.118:65260] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.guidehunting.com"] [uri "/index.php"] [unique_id "alxeNsu1nEoSSDHiOXbNWgAAAVE"]
[Sat Jul 18 23:18:46.597843 2026] [security2:error] [pid 830701:tid 830870] [client 45.3.40.15:56275] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.40.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxeNsu1nEoSSDHiOXbNZQAAATE"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:18:46.718557 2026] [security2:error] [pid 830701:tid 830900] [client 4.194.24.143:47090] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/readme.php"] [unique_id "alxeNsu1nEoSSDHiOXbNbAAAAU8"]
[Sat Jul 18 23:18:47.243949 2026] [security2:error] [pid 830701:tid 830895] [client 65.111.28.240:11981] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxeN8u1nEoSSDHiOXbNlAAAAUo"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:18:47.269229 2026] [security2:error] [pid 830701:tid 830847] [client 4.194.24.143:28752] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/reze.php"] [unique_id "alxeN8u1nEoSSDHiOXbNmgAAARo"]
[Sat Jul 18 23:18:47.345172 2026] [security2:error] [pid 830701:tid 830878] [client 152.58.31.118:65260] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.guidehunting.com"] [uri "/index.php"] [unique_id "alxeN8u1nEoSSDHiOXbNkgAAATk"]
[Sat Jul 18 23:18:47.462527 2026] [security2:error] [pid 830701:tid 830851] [client 171.4.232.110:40863] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeN8u1nEoSSDHiOXbNqAAAAR4"]
[Sat Jul 18 23:18:47.462652 2026] [security2:error] [pid 830701:tid 830851] [client 171.4.232.110:40863] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeN8u1nEoSSDHiOXbNqAAAAR4"]
[Sat Jul 18 23:18:47.564433 2026] [security2:error] [pid 830701:tid 830867] [client 103.48.44.9:49924] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeN8u1nEoSSDHiOXbNsAAAAS4"]
[Sat Jul 18 23:18:47.564525 2026] [security2:error] [pid 830701:tid 830867] [client 103.48.44.9:49924] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeN8u1nEoSSDHiOXbNsAAAAS4"]
[Sat Jul 18 23:18:47.851351 2026] [security2:error] [pid 830701:tid 830892] [client 4.194.24.143:18466] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/rh.php"] [unique_id "alxeN8u1nEoSSDHiOXbNwAAAAUc"]
[Sat Jul 18 23:18:47.924218 2026] [security2:error] [pid 830701:tid 830936] [client 223.178.210.203:29845] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeN8u1nEoSSDHiOXbNygAAAXM"]
[Sat Jul 18 23:18:47.924333 2026] [security2:error] [pid 830701:tid 830936] [client 223.178.210.203:29845] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeN8u1nEoSSDHiOXbNygAAAXM"]
[Sat Jul 18 23:18:48.146291 2026] [security2:error] [pid 830701:tid 830837] [client 152.58.31.118:65260] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.guidehunting.com"] [uri "/index.php"] [unique_id "alxeN8u1nEoSSDHiOXbNxAAAARA"]
[Sat Jul 18 23:18:48.176208 2026] [security2:error] [pid 830701:tid 830895] [client 65.111.28.67:53411] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxeOMu1nEoSSDHiOXbN2AAAAUo"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:18:48.403815 2026] [security2:error] [pid 830701:tid 830734] [remote 8.217.108.67:39644] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "myspineworld.com"] [uri "/wp-login.php"] [unique_id "alxeOMu1nEoSSDHiOXbN6AABiCA"]
[Sat Jul 18 23:18:48.430083 2026] [security2:error] [pid 830701:tid 830920] [client 4.194.24.143:18755] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/rip.php"] [unique_id "alxeOMu1nEoSSDHiOXbN7AAAAWM"]
[Sat Jul 18 23:18:48.605126 2026] [security2:error] [pid 830701:tid 830803] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxeOMu1nEoSSDHiOXbN9gABFmU"]
[Sat Jul 18 23:18:48.605326 2026] [security2:error] [pid 830701:tid 830843] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxeOMu1nEoSSDHiOXbN9gABFmU"]
[Sat Jul 18 23:18:48.777247 2026] [security2:error] [pid 830701:tid 830799] [remote 8.217.108.67:39644] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "myspineworld.com"] [uri "/wp-login.php"] [unique_id "alxeOMu1nEoSSDHiOXbOBgABJmE"], referer: https://myspineworld.com/wp-login.php
[Sat Jul 18 23:18:48.957138 2026] [security2:error] [pid 830701:tid 830854] [client 51.68.236.59:10311] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "lifetalkswithkay.com"] [uri "/robots.txt"] [unique_id "alxeOMu1nEoSSDHiOXbOGAAAASE"]
[Sat Jul 18 23:18:48.957246 2026] [security2:error] [pid 830701:tid 830854] [client 51.68.236.59:10311] ModSecurity: Warning. Matched phrase "MJ12bot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "lifetalkswithkay.com"] [uri "/robots.txt"] [unique_id "alxeOMu1nEoSSDHiOXbOGAAAASE"]
[Sat Jul 18 23:18:49.007125 2026] [security2:error] [pid 830701:tid 830885] [client 4.194.24.143:47050] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/root.php"] [unique_id "alxeOcu1nEoSSDHiOXbOGQAAAUA"]
[Sat Jul 18 23:18:49.560568 2026] [security2:error] [pid 830701:tid 830941] [client 4.194.24.143:48838] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/s.php"] [unique_id "alxeOcu1nEoSSDHiOXbOOgAAAXg"]
[Sat Jul 18 23:18:49.792079 2026] [security2:error] [pid 830701:tid 830889] [client 54.149.239.117:10130] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.239.149.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxeOcu1nEoSSDHiOXbOSAAAAUQ"]
[Sat Jul 18 23:18:49.939172 2026] [security2:error] [pid 830701:tid 830927] [client 57.141.18.33:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxeOcu1nEoSSDHiOXbOSQAAAWo"]
[Sat Jul 18 23:18:50.115980 2026] [security2:error] [pid 830701:tid 830847] [client 4.194.24.143:19174] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/sang.php"] [unique_id "alxeOsu1nEoSSDHiOXbOYAAAARo"]
[Sat Jul 18 23:18:50.312506 2026] [security2:error] [pid 830701:tid 830930] [client 124.29.207.185:60118] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxeOsu1nEoSSDHiOXbOagAAAW0"]
[Sat Jul 18 23:18:50.312637 2026] [security2:error] [pid 830701:tid 830930] [client 124.29.207.185:60118] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxeOsu1nEoSSDHiOXbOagAAAW0"]
[Sat Jul 18 23:18:50.655939 2026] [security2:error] [pid 830701:tid 830845] [client 4.194.24.143:18446] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/scxy.php"] [unique_id "alxeOsu1nEoSSDHiOXbOeAAAARg"]
[Sat Jul 18 23:18:50.789910 2026] [security2:error] [pid 830701:tid 830873] [client 45.3.45.2:58755] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "155"] [id "900406"] [msg "wp-login POST logging"] [data "200"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxeOsu1nEoSSDHiOXbOcQAAATQ"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:18:50.889296 2026] [core:error] [pid 830701:tid 830948] [client 50.116.65.227:15000] AH00135: Invalid method in request PURGE /.* HTTP/1.1
[Sat Jul 18 23:18:50.899466 2026] [core:error] [pid 830701:tid 830888] [client 50.116.65.227:15012] AH00135: Invalid method in request PURGE /.* HTTP/1.1
[Sat Jul 18 23:18:51.218360 2026] [security2:error] [pid 830701:tid 830937] [client 4.194.24.143:48879] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/sd.php"] [unique_id "alxeO8u1nEoSSDHiOXbOrAAAAXQ"]
[Sat Jul 18 23:18:51.695919 2026] [security2:error] [pid 830701:tid 830846] [client 223.228.182.224:52523] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxeO8u1nEoSSDHiOXbOxAAAARk"]
[Sat Jul 18 23:18:51.696006 2026] [security2:error] [pid 830701:tid 830846] [client 223.228.182.224:52523] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxeO8u1nEoSSDHiOXbOxAAAARk"]
[Sat Jul 18 23:18:51.710085 2026] [security2:error] [pid 830701:tid 830745] [remote 160.187.68.132:37348] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.68.187.160.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxeO8u1nEoSSDHiOXbOwAABWCs"]
[Sat Jul 18 23:18:51.763427 2026] [security2:error] [pid 830701:tid 830855] [client 4.194.24.143:19000] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/sf.php"] [unique_id "alxeO8u1nEoSSDHiOXbOygAAASI"]
[Sat Jul 18 23:18:52.304013 2026] [security2:error] [pid 830701:tid 830937] [client 4.194.24.143:18462] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/shell.php"] [unique_id "alxePMu1nEoSSDHiOXbPCgAAAXQ"]
[Sat Jul 18 23:18:52.376295 2026] [security2:error] [pid 830701:tid 830859] [client 45.3.45.52:20363] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "155"] [id "900406"] [msg "wp-login POST logging"] [data "200"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxePMu1nEoSSDHiOXbPAAAAASY"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:18:52.814384 2026] [security2:error] [pid 830701:tid 830876] [client 52.202.182.148:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxePMu1nEoSSDHiOXbPHwABN2c"]
[Sat Jul 18 23:18:53.054240 2026] [security2:error] [pid 830701:tid 830885] [client 4.194.24.143:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "ghivs.com"] [uri "/index.php"] [unique_id "alxePMu1nEoSSDHiOXbPRAAAAUA"]
[Sat Jul 18 23:18:53.242130 2026] [security2:error] [pid 830701:tid 830849] [client 4.194.24.143:18963] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/sid3.php"] [unique_id "alxePcu1nEoSSDHiOXbPXgAAARw"]
[Sat Jul 18 23:18:53.286539 2026] [security2:error] [pid 830701:tid 830920] [client 54.184.226.94:47248] ModSecurity: Warning. Matched phrase "Sucuri" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "koaconsultants.com"] [uri "/"] [unique_id "alxePcu1nEoSSDHiOXbPYQAAAWM"]
[Sat Jul 18 23:18:53.484789 2026] [security2:error] [pid 830701:tid 830892] [client 62.150.67.110:54746] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "ali-alghanim.net"] [uri "/index.php"] [unique_id "alxePcu1nEoSSDHiOXbPXAAAAUc"]
[Sat Jul 18 23:18:53.796262 2026] [security2:error] [pid 830701:tid 830922] [client 4.194.24.143:18451] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/simple.php"] [unique_id "alxePcu1nEoSSDHiOXbPjQAAAWU"]
[Sat Jul 18 23:18:53.896828 2026] [security2:error] [pid 830701:tid 830844] [client 114.119.143.250:64589] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "backandneckpainrelieflaceychiropractor.com"] [uri "/medical-disclaimer/"] [unique_id "alxePcu1nEoSSDHiOXbPlQAAARc"], referer: http://backandneckpainrelieflaceychiropractor.com/
[Sat Jul 18 23:18:54.036256 2026] [security2:error] [pid 830701:tid 830954] [client 65.111.28.56:18805] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "155"] [id "900406"] [msg "wp-login POST logging"] [data "200"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxePcu1nEoSSDHiOXbPkAAAAYU"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:18:54.224138 2026] [security2:error] [pid 830701:tid 830916] [client 223.185.61.63:20519] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxePsu1nEoSSDHiOXbPoQAAAV8"]
[Sat Jul 18 23:18:54.224273 2026] [security2:error] [pid 830701:tid 830916] [client 223.185.61.63:20519] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxePsu1nEoSSDHiOXbPoQAAAV8"]
[Sat Jul 18 23:18:54.353041 2026] [security2:error] [pid 830701:tid 830926] [client 4.194.24.143:18432] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/sitemap.php"] [unique_id "alxePsu1nEoSSDHiOXbPpwAAAWk"]
[Sat Jul 18 23:18:54.906466 2026] [security2:error] [pid 830701:tid 830912] [client 4.194.24.143:18990] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/size.php"] [unique_id "alxePsu1nEoSSDHiOXbPzQAAAVs"]
[Sat Jul 18 23:18:55.297384 2026] [security2:error] [pid 830701:tid 830918] [client 27.34.68.67:30511] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxeP8u1nEoSSDHiOXbP2QAAAWE"]
[Sat Jul 18 23:18:55.297558 2026] [security2:error] [pid 830701:tid 830918] [client 27.34.68.67:30511] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxeP8u1nEoSSDHiOXbP2QAAAWE"]
[Sat Jul 18 23:18:55.469920 2026] [security2:error] [pid 830701:tid 830877] [client 4.194.24.143:18969] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/sm.php"] [unique_id "alxeP8u1nEoSSDHiOXbP6AAAATg"]
[Sat Jul 18 23:18:55.497950 2026] [security2:error] [pid 830701:tid 830910] [client 65.111.28.188:47769] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 188.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxeP8u1nEoSSDHiOXbP6QAAAVk"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:18:55.683681 2026] [security2:error] [pid 830701:tid 830854] [client 54.184.226.94:0] ModSecurity: Warning. Matched phrase "Sucuri" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "koaconsultants.com"] [uri "/index.php"] [unique_id "alxePcu1nEoSSDHiOXbPeQAAASE"], referer: http://koaconsultants.com/?rnd=1784438333110
[Sat Jul 18 23:18:55.688492 2026] [security2:error] [pid 830701:tid 830869] [client 54.184.226.94:59086] ModSecurity: Warning. Matched phrase "Sucuri" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "koaconsultants.com"] [uri "/"] [unique_id "alxePcu1nEoSSDHiOXbPdwAAATA"], referer: http://koaconsultants.com/?rnd=1784438333110
[Sat Jul 18 23:18:55.880042 2026] [security2:error] [pid 830701:tid 830899] [client 190.245.146.99:54277] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeP8u1nEoSSDHiOXbQAAAAAU4"]
[Sat Jul 18 23:18:55.880169 2026] [security2:error] [pid 830701:tid 830899] [client 190.245.146.99:54277] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeP8u1nEoSSDHiOXbQAAAAAU4"]
[Sat Jul 18 23:18:56.010839 2026] [security2:error] [pid 830701:tid 830893] [client 4.194.24.143:18438] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/sql.php"] [unique_id "alxeQMu1nEoSSDHiOXbQCgAAAUg"]
[Sat Jul 18 23:18:56.563312 2026] [security2:error] [pid 830701:tid 830845] [client 4.194.24.143:27134] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/ss.php"] [unique_id "alxeQMu1nEoSSDHiOXbQMwAAARg"]
[Sat Jul 18 23:18:56.728230 2026] [security2:error] [pid 830701:tid 830864] [client 171.4.232.110:50158] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeQMu1nEoSSDHiOXbQQAAAASs"]
[Sat Jul 18 23:18:56.728332 2026] [security2:error] [pid 830701:tid 830864] [client 171.4.232.110:50158] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeQMu1nEoSSDHiOXbQQAAAASs"]
[Sat Jul 18 23:18:57.042062 2026] [security2:error] [pid 830701:tid 830951] [client 119.154.81.234:56490] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxeQcu1nEoSSDHiOXbQTQAAAYI"]
[Sat Jul 18 23:18:57.042177 2026] [security2:error] [pid 830701:tid 830951] [client 119.154.81.234:56490] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxeQcu1nEoSSDHiOXbQTQAAAYI"]
[Sat Jul 18 23:18:57.105089 2026] [security2:error] [pid 830701:tid 830843] [client 4.194.24.143:27133] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/stats.php"] [unique_id "alxeQcu1nEoSSDHiOXbQUAAAARY"]
[Sat Jul 18 23:18:57.696675 2026] [security2:error] [pid 830701:tid 830918] [client 4.194.24.143:18458] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/sump1.php"] [unique_id "alxeQcu1nEoSSDHiOXbQdwAAAWE"]
[Sat Jul 18 23:18:58.077206 2026] [security2:error] [pid 830701:tid 830949] [client 103.48.44.9:50435] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeQsu1nEoSSDHiOXbQlwAAAYA"]
[Sat Jul 18 23:18:58.077308 2026] [security2:error] [pid 830701:tid 830949] [client 103.48.44.9:50435] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeQsu1nEoSSDHiOXbQlwAAAYA"]
[Sat Jul 18 23:18:58.237561 2026] [security2:error] [pid 830701:tid 830933] [client 4.194.24.143:27085] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/system.php"] [unique_id "alxeQsu1nEoSSDHiOXbQnAAAAXA"]
[Sat Jul 18 23:18:58.327700 2026] [security2:error] [pid 830701:tid 830925] [client 34.34.16.122:49152] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "webdisk.bjw.jsf.mybluehost.me"] [uri "/"] [unique_id "alxeQsu1nEoSSDHiOXbQpwAAAWg"]
[Sat Jul 18 23:18:58.327798 2026] [security2:error] [pid 830701:tid 830925] [client 34.34.16.122:49152] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "webdisk.bjw.jsf.mybluehost.me"] [uri "/"] [unique_id "alxeQsu1nEoSSDHiOXbQpwAAAWg"]
[Sat Jul 18 23:18:58.533010 2026] [security2:error] [pid 830701:tid 830881] [client 223.178.210.203:24282] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 203.210.178.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeQsu1nEoSSDHiOXbQtgAAATw"]
[Sat Jul 18 23:18:58.533121 2026] [security2:error] [pid 830701:tid 830881] [client 223.178.210.203:24282] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeQsu1nEoSSDHiOXbQtgAAATw"]
[Sat Jul 18 23:18:58.624320 2026] [security2:error] [pid 830701:tid 830810] [remote 31.42.184.154:42630] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxeQsu1nEoSSDHiOXbQuQABbWw"]
[Sat Jul 18 23:18:58.796924 2026] [security2:error] [pid 830701:tid 830831] [client 4.194.24.143:18435] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/system/03n1hob7p03r2npdefault.php"] [unique_id "alxeQsu1nEoSSDHiOXbQwgAAAQo"]
[Sat Jul 18 23:18:58.876327 2026] [security2:error] [pid 830701:tid 830710] [remote 31.42.184.154:42630] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxeQsu1nEoSSDHiOXbQxwABXAg"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:18:59.051811 2026] [security2:error] [pid 830701:tid 830785] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxeQ8u1nEoSSDHiOXbQ1QABWVM"]
[Sat Jul 18 23:18:59.051976 2026] [security2:error] [pid 830701:tid 830910] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxeQ8u1nEoSSDHiOXbQ1QABWVM"]
[Sat Jul 18 23:18:59.363773 2026] [security2:error] [pid 830701:tid 830933] [client 4.194.24.143:18441] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/system/cj5ha2rah8lyiqqdefault.php"] [unique_id "alxeQ8u1nEoSSDHiOXbQ4QAAAXA"]
[Sat Jul 18 23:18:59.441811 2026] [security2:error] [pid 830701:tid 830872] [client 69.63.189.26:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.detroitcsc.com"] [uri "/index.php"] [unique_id "alxeQcu1nEoSSDHiOXbQigAAATM"]
[Sat Jul 18 23:18:59.517808 2026] [security2:error] [pid 830701:tid 830853] [client 69.63.189.21:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.detroitcsc.com"] [uri "/index.php"] [unique_id "alxeQ8u1nEoSSDHiOXbQ5gAAASA"]
[Sat Jul 18 23:18:59.903630 2026] [security2:error] [pid 830701:tid 830858] [client 4.194.24.143:18464] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/system_log.php"] [unique_id "alxeQ8u1nEoSSDHiOXbRDAAAASU"]
[Sat Jul 18 23:19:00.453401 2026] [security2:error] [pid 830701:tid 830886] [client 4.194.24.143:63735] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/t.php"] [unique_id "alxeRMu1nEoSSDHiOXbRLAAAAUE"]
[Sat Jul 18 23:19:01.029134 2026] [security2:error] [pid 830701:tid 830847] [client 4.194.24.143:63727] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/term.php"] [unique_id "alxeRcu1nEoSSDHiOXbRTwAAARo"]
[Sat Jul 18 23:19:01.608901 2026] [security2:error] [pid 830701:tid 830913] [client 4.194.24.143:26554] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/test.php"] [unique_id "alxeRcu1nEoSSDHiOXbRawAAAVw"]
[Sat Jul 18 23:19:02.154855 2026] [security2:error] [pid 830701:tid 830836] [client 4.194.24.143:50439] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/test1.php"] [unique_id "alxeRsu1nEoSSDHiOXbRmAAAAQ8"]
[Sat Jul 18 23:19:02.318999 2026] [security2:error] [pid 830701:tid 830773] [remote 31.42.184.154:43408] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxeRsu1nEoSSDHiOXbRowABIkc"]
[Sat Jul 18 23:19:02.319240 2026] [security2:error] [pid 830701:tid 830855] [client 31.42.184.154:43408] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxeRsu1nEoSSDHiOXbRowABIkc"]
[Sat Jul 18 23:19:02.493721 2026] [security2:error] [pid 830701:tid 830933] [client 223.228.182.224:24906] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxeRsu1nEoSSDHiOXbRrAAAAXA"]
[Sat Jul 18 23:19:02.493906 2026] [security2:error] [pid 830701:tid 830933] [client 223.228.182.224:24906] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxeRsu1nEoSSDHiOXbRrAAAAXA"]
[Sat Jul 18 23:19:02.721955 2026] [security2:error] [pid 830701:tid 830844] [client 4.194.24.143:50453] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/tfm.php"] [unique_id "alxeRsu1nEoSSDHiOXbRwAAAARc"]
[Sat Jul 18 23:19:02.866853 2026] [security2:error] [pid 830701:tid 830735] [remote 103.90.234.13:38182] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.234.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxeRsu1nEoSSDHiOXbRyAABbSE"]
[Sat Jul 18 23:19:03.285967 2026] [security2:error] [pid 830701:tid 830838] [client 4.194.24.143:63727] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/thebe.php"] [unique_id "alxeR8u1nEoSSDHiOXbR3wAAARE"]
[Sat Jul 18 23:19:03.829332 2026] [security2:error] [pid 830701:tid 830851] [client 4.194.24.143:18641] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/themes.php"] [unique_id "alxeR8u1nEoSSDHiOXbSAAAAAR4"]
[Sat Jul 18 23:19:03.832050 2026] [security2:error] [pid 830701:tid 830722] [remote 103.90.234.13:38182] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.234.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxeR8u1nEoSSDHiOXbR_gABIRQ"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:19:04.086988 2026] [security2:error] [pid 830701:tid 830917] [client 13.221.201.234:59884] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.201.221.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxeSMu1nEoSSDHiOXbSDAAAAWA"]
[Sat Jul 18 23:19:04.087105 2026] [security2:error] [pid 830701:tid 830917] [client 13.221.201.234:59884] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxeSMu1nEoSSDHiOXbSDAAAAWA"]
[Sat Jul 18 23:19:04.380107 2026] [security2:error] [pid 830701:tid 830845] [client 4.194.24.143:50487] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/tiny.php"] [unique_id "alxeSMu1nEoSSDHiOXbSJwAAARg"]
[Sat Jul 18 23:19:04.506878 2026] [security2:error] [pid 830701:tid 830843] [client 14.224.227.113:54728] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxeSMu1nEoSSDHiOXbSLAAAARY"]
[Sat Jul 18 23:19:04.777231 2026] [security2:error] [pid 830701:tid 830890] [client 223.185.61.63:10205] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeSMu1nEoSSDHiOXbSOwAAAUU"]
[Sat Jul 18 23:19:04.777379 2026] [security2:error] [pid 830701:tid 830890] [client 223.185.61.63:10205] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeSMu1nEoSSDHiOXbSOwAAAUU"]
[Sat Jul 18 23:19:04.933006 2026] [security2:error] [pid 830701:tid 830885] [client 4.194.24.143:63708] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ghivs.com"] [uri "/tmp/byp.php"] [unique_id "alxeSMu1nEoSSDHiOXbSQgAAAUA"]
[Sat Jul 18 23:19:05.004338 2026] [security2:error] [pid 830701:tid 830939] [client 3.108.60.216:15102] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxeScu1nEoSSDHiOXbSTgAAAXY"]
[Sat Jul 18 23:19:05.004421 2026] [security2:error] [pid 830701:tid 830939] [client 3.108.60.216:15102] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxeScu1nEoSSDHiOXbSTgAAAXY"]
[Sat Jul 18 23:19:05.167629 2026] [security2:error] [pid 830701:tid 830941] [client 103.109.44.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "worbals.com"] [uri "/index.php"] [unique_id "alxeRsu1nEoSSDHiOXbRzwAAAXg"]
[Sat Jul 18 23:19:05.622273 2026] [security2:error] [pid 830701:tid 830805] [remote 17.241.219.138:46452] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 138.219.241.17.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxeScu1nEoSSDHiOXbSdAABcGc"], referer: https://mezzacraft.com/test-knitting-normandie-sweater/
[Sat Jul 18 23:19:05.639811 2026] [security2:error] [pid 830701:tid 830855] [client 34.147.22.160:49152] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "webmail.elespecialista.mx"] [uri "/"] [unique_id "alxeScu1nEoSSDHiOXbSdgAAASI"]
[Sat Jul 18 23:19:05.639908 2026] [security2:error] [pid 830701:tid 830855] [client 34.147.22.160:49152] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "webmail.elespecialista.mx"] [uri "/"] [unique_id "alxeScu1nEoSSDHiOXbSdgAAASI"]
[Sat Jul 18 23:19:05.887090 2026] [security2:error] [pid 830701:tid 830865] [client 27.34.68.67:53489] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxeScu1nEoSSDHiOXbSfAAAASw"]
[Sat Jul 18 23:19:05.887260 2026] [security2:error] [pid 830701:tid 830865] [client 27.34.68.67:53489] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxeScu1nEoSSDHiOXbSfAAAASw"]
[Sat Jul 18 23:19:06.380211 2026] [security2:error] [pid 830701:tid 830885] [client 47.128.121.245:62528] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "koaconsultants.com"] [uri "/robots.txt"] [unique_id "alxeSsu1nEoSSDHiOXbSlgAAAUA"]
[Sat Jul 18 23:19:06.416998 2026] [security2:error] [pid 830701:tid 830849] [client 190.245.146.99:54794] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeSsu1nEoSSDHiOXbSmQAAARw"]
[Sat Jul 18 23:19:06.417112 2026] [security2:error] [pid 830701:tid 830849] [client 190.245.146.99:54794] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeSsu1nEoSSDHiOXbSmQAAARw"]
[Sat Jul 18 23:19:07.275202 2026] [security2:error] [pid 830701:tid 830912] [client 171.4.232.110:50648] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeS8u1nEoSSDHiOXbS2gAAAVs"]
[Sat Jul 18 23:19:07.275295 2026] [security2:error] [pid 830701:tid 830912] [client 171.4.232.110:50648] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeS8u1nEoSSDHiOXbS2gAAAVs"]
[Sat Jul 18 23:19:07.278512 2026] [security2:error] [pid 830701:tid 830810] [remote 20.153.140.50:54736] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/wp-login.php"] [unique_id "alxeS8u1nEoSSDHiOXbS2wABKGw"]
[Sat Jul 18 23:19:07.685300 2026] [security2:error] [pid 830701:tid 830765] [remote 20.153.140.50:54736] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/wp-login.php"] [unique_id "alxeS8u1nEoSSDHiOXbS-AABKj8"], referer: https://truthmedicalaesthetics.com/wp-login.php
[Sat Jul 18 23:19:07.811893 2026] [security2:error] [pid 830701:tid 830896] [client 119.154.81.234:56930] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxeS8u1nEoSSDHiOXbS_wAAAUs"]
[Sat Jul 18 23:19:07.812058 2026] [security2:error] [pid 830701:tid 830896] [client 119.154.81.234:56930] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxeS8u1nEoSSDHiOXbS_wAAAUs"]
[Sat Jul 18 23:19:08.523062 2026] [security2:error] [pid 830701:tid 830954] [client 103.48.44.9:50946] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeTMu1nEoSSDHiOXbTMAAAAYU"]
[Sat Jul 18 23:19:08.523165 2026] [security2:error] [pid 830701:tid 830954] [client 103.48.44.9:50946] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeTMu1nEoSSDHiOXbTMAAAAYU"]
[Sat Jul 18 23:19:09.365801 2026] [security2:error] [pid 830701:tid 830749] [remote 72.167.132.114:38390] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxeTcu1nEoSSDHiOXbTYQABJC8"]
[Sat Jul 18 23:19:09.365956 2026] [security2:error] [pid 830701:tid 830857] [client 72.167.132.114:38390] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxeTcu1nEoSSDHiOXbTYQABJC8"]
[Sat Jul 18 23:19:09.628118 2026] [security2:error] [pid 830701:tid 830762] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxeTcu1nEoSSDHiOXbTaQABMjw"]
[Sat Jul 18 23:19:09.628497 2026] [security2:error] [pid 830701:tid 830871] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxeTcu1nEoSSDHiOXbTaQABMjw"]
[Sat Jul 18 23:19:09.632817 2026] [security2:error] [pid 830701:tid 830826] [remote 31.42.184.154:45558] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxeTcu1nEoSSDHiOXbTawABPHw"]
[Sat Jul 18 23:19:09.868065 2026] [security2:error] [pid 830701:tid 830769] [remote 31.42.184.154:45558] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxeTcu1nEoSSDHiOXbTfwABIkM"], referer: https://mezzacraft.com/wp-login.php
[Sat Jul 18 23:19:09.963867 2026] [security2:error] [pid 830701:tid 830719] [remote 84.54.13.3:43822] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 3.13.54.84.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxeTcu1nEoSSDHiOXbThwABUBE"]
[Sat Jul 18 23:19:10.229793 2026] [security2:error] [pid 830701:tid 830718] [remote 84.54.13.3:43822] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 3.13.54.84.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxeTsu1nEoSSDHiOXbTmgABXhA"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:19:10.560912 2026] [security2:error] [pid 830701:tid 830740] [remote 68.178.160.25:38912] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "dlu.cjf.mybluehost.me"] [uri "/blog/xmlrpc.php"] [unique_id "alxeTsu1nEoSSDHiOXbTqQABfSY"]
[Sat Jul 18 23:19:10.561052 2026] [security2:error] [pid 830701:tid 830946] [client 68.178.160.25:38912] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "dlu.cjf.mybluehost.me"] [uri "/blog/xmlrpc.php"] [unique_id "alxeTsu1nEoSSDHiOXbTqQABfSY"]
[Sat Jul 18 23:19:10.806151 2026] [security2:error] [pid 830701:tid 830822] [remote 20.153.140.50:54738] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxeTsu1nEoSSDHiOXbTtgABZ3g"]
[Sat Jul 18 23:19:11.196723 2026] [security2:error] [pid 830701:tid 830841] [client 124.29.207.185:44361] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxeT8u1nEoSSDHiOXbT0AAAARQ"]
[Sat Jul 18 23:19:11.196855 2026] [security2:error] [pid 830701:tid 830841] [client 124.29.207.185:44361] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxeT8u1nEoSSDHiOXbT0AAAARQ"]
[Sat Jul 18 23:19:11.214519 2026] [security2:error] [pid 830701:tid 830787] [remote 20.153.140.50:54738] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxeT8u1nEoSSDHiOXbT0QABSlU"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:19:11.230334 2026] [security2:error] [pid 830701:tid 830957] [client 57.141.18.90:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxeT8u1nEoSSDHiOXbTwwAAAYg"]
[Sat Jul 18 23:19:11.649194 2026] [security2:error] [pid 830701:tid 830788] [remote 31.42.184.154:45572] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "christiancountytrumpet.com"] [uri "/wp-login.php"] [unique_id "alxeT8u1nEoSSDHiOXbT6gABblY"]
[Sat Jul 18 23:19:11.826575 2026] [security2:error] [pid 830701:tid 830770] [remote 152.228.213.32:34278] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.savilerowtravel.com"] [uri "/wp-login.php"] [unique_id "alxeT8u1nEoSSDHiOXbT9gABX0Q"], referer: https://savilerowtravel.co.uk/wp-login.php
[Sat Jul 18 23:19:11.863422 2026] [security2:error] [pid 830701:tid 830765] [remote 173.252.167.180:56054] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 180.167.252.173.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxeT8u1nEoSSDHiOXbT9wABcj8"]
[Sat Jul 18 23:19:11.892301 2026] [security2:error] [pid 830701:tid 830707] [remote 31.42.184.154:45572] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "christiancountytrumpet.com"] [uri "/wp-login.php"] [unique_id "alxeT8u1nEoSSDHiOXbT-QABTAU"], referer: https://christiancountytrumpet.com/wp-login.php
[Sat Jul 18 23:19:12.007659 2026] [security2:error] [pid 830701:tid 830715] [remote 160.187.68.132:52986] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.68.187.160.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "website-3c1c9eb1.nextlvlmarketingco.com"] [uri "/wp-login.php"] [unique_id "alxeT8u1nEoSSDHiOXbUAwABYw0"]
[Sat Jul 18 23:19:12.078318 2026] [security2:error] [pid 830701:tid 830748] [remote 173.252.167.180:56054] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 180.167.252.173.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxeUMu1nEoSSDHiOXbUBgABOy4"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:19:12.152302 2026] [security2:error] [pid 830701:tid 830746] [remote 152.228.213.32:34278] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.savilerowtravel.com"] [uri "/wp-login.php"] [unique_id "alxeUMu1nEoSSDHiOXbUCgABWSw"], referer: https://savilerowtravel.co.uk/wp-login.php
[Sat Jul 18 23:19:12.568128 2026] [security2:error] [pid 830701:tid 830945] [client 74.7.241.133:36458] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "nandansonscharitablefoundation.com"] [uri "/robots.txt"] [unique_id "alxeUMu1nEoSSDHiOXbUHgAAAXw"]
[Sat Jul 18 23:19:12.726414 2026] [security2:error] [pid 830701:tid 830833] [client 74.7.241.133:55454] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "nandansonscharitablefoundation.com"] [uri "/robots.txt"] [unique_id "alxeUMu1nEoSSDHiOXbUJAABDBs"], referer: http://nandansonscharitablefoundation.com/robots.txt
[Sat Jul 18 23:19:12.808253 2026] [security2:error] [pid 830701:tid 830798] [remote 185.22.228.25:59352] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.228.22.185.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.walkingandtalking.net"] [uri "/xmlrpc.php"] [unique_id "alxeUMu1nEoSSDHiOXbUKwABfmA"]
[Sat Jul 18 23:19:12.808487 2026] [security2:error] [pid 830701:tid 830947] [client 185.22.228.25:59352] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "mail.walkingandtalking.net"] [uri "/xmlrpc.php"] [unique_id "alxeUMu1nEoSSDHiOXbUKwABfmA"]
[Sat Jul 18 23:19:13.024899 2026] [security2:error] [pid 830701:tid 830911] [client 54.198.0.135:47110] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.0.198.54.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxeUMu1nEoSSDHiOXbUMwAAAVo"]
[Sat Jul 18 23:19:13.125513 2026] [security2:error] [pid 830701:tid 830724] [remote 160.187.68.132:52986] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.68.187.160.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "website-3c1c9eb1.nextlvlmarketingco.com"] [uri "/wp-login.php"] [unique_id "alxeUcu1nEoSSDHiOXbUPAABiBY"], referer: https://website-3c1c9eb1.nextlvlmarketingco.com/wp-login.php
[Sat Jul 18 23:19:13.388262 2026] [security2:error] [pid 830701:tid 830949] [client 34.207.130.29:37612] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 29.130.207.34.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxeUcu1nEoSSDHiOXbUTQAAAYA"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:19:13.536682 2026] [security2:error] [pid 830701:tid 830920] [client 223.228.182.224:26028] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxeUcu1nEoSSDHiOXbUXgAAAWM"]
[Sat Jul 18 23:19:13.540874 2026] [security2:error] [pid 830701:tid 830920] [client 223.228.182.224:26028] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxeUcu1nEoSSDHiOXbUXgAAAWM"]
[Sat Jul 18 23:19:13.781778 2026] [security2:error] [pid 830701:tid 830860] [client 108.174.8.21:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "paultoursafari.com"] [uri "/index.php"] [unique_id "alxeTsu1nEoSSDHiOXbTrwABJz0"]
[Sat Jul 18 23:19:15.426955 2026] [security2:error] [pid 830701:tid 830848] [client 223.185.61.63:8384] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeU8u1nEoSSDHiOXbUzQAAARs"]
[Sat Jul 18 23:19:15.427090 2026] [security2:error] [pid 830701:tid 830848] [client 223.185.61.63:8384] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeU8u1nEoSSDHiOXbUzQAAARs"]
[Sat Jul 18 23:19:15.773464 2026] [security2:error] [pid 830701:tid 830705] [remote 68.178.160.25:52044] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "blaizeaccountingservices.com"] [uri "/wp-login.php"] [unique_id "alxeU8u1nEoSSDHiOXbU3gABGQM"]
[Sat Jul 18 23:19:16.164840 2026] [security2:error] [pid 830701:tid 830715] [remote 68.178.160.25:52044] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "blaizeaccountingservices.com"] [uri "/wp-login.php"] [unique_id "alxeVMu1nEoSSDHiOXbU-gABFw0"], referer: https://blaizeaccountingservices.com/wp-login.php
[Sat Jul 18 23:19:16.206401 2026] [security2:error] [pid 830701:tid 830842] [client 45.3.45.126:35287] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 126.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxeVMu1nEoSSDHiOXbU_QAAARU"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:19:16.457836 2026] [security2:error] [pid 830701:tid 830940] [client 27.34.68.67:53295] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxeVMu1nEoSSDHiOXbVDwAAAXc"]
[Sat Jul 18 23:19:16.457955 2026] [security2:error] [pid 830701:tid 830940] [client 27.34.68.67:53295] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxeVMu1nEoSSDHiOXbVDwAAAXc"]
[Sat Jul 18 23:19:16.619517 2026] [security2:error] [pid 830701:tid 830849] [client 57.141.18.108:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxeVMu1nEoSSDHiOXbVDAAAARw"]
[Sat Jul 18 23:19:16.978523 2026] [security2:error] [pid 830701:tid 830896] [client 190.245.146.99:55317] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeVMu1nEoSSDHiOXbVNAAAAUs"]
[Sat Jul 18 23:19:16.984411 2026] [security2:error] [pid 830701:tid 830896] [client 190.245.146.99:55317] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeVMu1nEoSSDHiOXbVNAAAAUs"]
[Sat Jul 18 23:19:17.427522 2026] [security2:error] [pid 830701:tid 830949] [client 23.160.60.249:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "tacticaltreeoperations.com"] [uri "/index.php"] [unique_id "alxeVcu1nEoSSDHiOXbVRQAAAYA"]
[Sat Jul 18 23:19:17.788982 2026] [security2:error] [pid 830701:tid 830938] [client 171.4.232.110:51144] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeVcu1nEoSSDHiOXbVYQAAAXU"]
[Sat Jul 18 23:19:17.789184 2026] [security2:error] [pid 830701:tid 830938] [client 171.4.232.110:51144] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeVcu1nEoSSDHiOXbVYQAAAXU"]
[Sat Jul 18 23:19:18.287633 2026] [security2:error] [pid 830701:tid 830930] [client 119.154.81.234:57377] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxeVsu1nEoSSDHiOXbViAAAAW0"]
[Sat Jul 18 23:19:18.288322 2026] [security2:error] [pid 830701:tid 830930] [client 119.154.81.234:57377] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxeVsu1nEoSSDHiOXbViAAAAW0"]
[Sat Jul 18 23:19:19.127408 2026] [security2:error] [pid 830701:tid 830929] [client 103.48.44.9:51466] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeV8u1nEoSSDHiOXbVwwAAAWw"]
[Sat Jul 18 23:19:19.127498 2026] [security2:error] [pid 830701:tid 830929] [client 103.48.44.9:51466] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeV8u1nEoSSDHiOXbVwwAAAWw"]
[Sat Jul 18 23:19:19.811513 2026] [security2:error] [pid 830701:tid 830728] [remote 68.178.160.25:52050] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxeV8u1nEoSSDHiOXbV8gABWRo"]
[Sat Jul 18 23:19:20.224569 2026] [security2:error] [pid 830701:tid 830707] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxeWMu1nEoSSDHiOXbWEgABGQU"]
[Sat Jul 18 23:19:20.224715 2026] [security2:error] [pid 830701:tid 830846] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxeWMu1nEoSSDHiOXbWEgABGQU"]
[Sat Jul 18 23:19:20.257078 2026] [security2:error] [pid 830701:tid 830825] [remote 68.178.160.25:52050] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxeWMu1nEoSSDHiOXbWFQABJHs"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:19:20.579453 2026] [security2:error] [pid 830701:tid 830948] [client 156.248.104.163:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "jenfarley.com"] [uri "/index.php"] [unique_id "alxeV8u1nEoSSDHiOXbV8AAAAX8"]
[Sat Jul 18 23:19:21.335918 2026] [security2:error] [pid 830701:tid 830912] [client 157.20.207.127:49218] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omegacompass.com"] [uri "/index.php"] [unique_id "alxeWMu1nEoSSDHiOXbWCgAAAVs"]
[Sat Jul 18 23:19:21.522793 2026] [security2:error] [pid 830701:tid 830892] [client 5.193.175.36:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "maxcom.net"] [uri "/index.php"] [unique_id "alxeWMu1nEoSSDHiOXbWBAAAAUc"]
[Sat Jul 18 23:19:21.524134 2026] [security2:error] [pid 830701:tid 830956] [client 185.191.171.4:36188] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "marketingonetoone.net"] [uri "/robots.txt"] [unique_id "alxeWcu1nEoSSDHiOXbWVwAAAYc"]
[Sat Jul 18 23:19:21.524254 2026] [security2:error] [pid 830701:tid 830956] [client 185.191.171.4:36188] ModSecurity: Warning. Matched phrase "Semrush" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "marketingonetoone.net"] [uri "/robots.txt"] [unique_id "alxeWcu1nEoSSDHiOXbWVwAAAYc"]
[Sat Jul 18 23:19:21.610649 2026] [security2:error] [pid 830701:tid 830889] [client 57.141.18.83:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxeWcu1nEoSSDHiOXbWUQAAAUQ"]
[Sat Jul 18 23:19:21.635933 2026] [security2:error] [pid 830701:tid 830809] [remote 205.196.217.58:60408] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.217.196.205.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxeWcu1nEoSSDHiOXbWYgABDGs"]
[Sat Jul 18 23:19:21.716827 2026] [security2:error] [pid 830701:tid 830774] [remote 68.178.160.25:52066] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thesoloceos.com"] [uri "/wp-login.php"] [unique_id "alxeWcu1nEoSSDHiOXbWaQABLEg"]
[Sat Jul 18 23:19:21.876309 2026] [security2:error] [pid 830701:tid 830828] [remote 205.196.217.58:60408] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.217.196.205.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxeWcu1nEoSSDHiOXbWbgABdX4"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:19:21.897928 2026] [security2:error] [pid 830701:tid 830878] [client 85.208.96.209:58316] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "marketingonetoone.net"] [uri "/services/field-maintenance/training/"] [unique_id "alxeWcu1nEoSSDHiOXbWcAAAATk"]
[Sat Jul 18 23:19:21.898043 2026] [security2:error] [pid 830701:tid 830878] [client 85.208.96.209:58316] ModSecurity: Warning. Matched phrase "Semrush" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "marketingonetoone.net"] [uri "/services/field-maintenance/training/"] [unique_id "alxeWcu1nEoSSDHiOXbWcAAAATk"]
[Sat Jul 18 23:19:22.144710 2026] [security2:error] [pid 830701:tid 830818] [remote 68.178.160.25:52066] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thesoloceos.com"] [uri "/wp-login.php"] [unique_id "alxeWsu1nEoSSDHiOXbWhgABPHQ"], referer: https://thesoloceos.com/wp-login.php
[Sat Jul 18 23:19:22.270273 2026] [security2:error] [pid 830701:tid 830883] [client 89.167.13.70:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "amalia-capital.com"] [uri "/index.php"] [unique_id "alxeWsu1nEoSSDHiOXbWgwAAAT4"], referer: https://www.google.com/
[Sat Jul 18 23:19:22.287221 2026] [security2:error] [pid 830701:tid 830937] [client 124.29.246.106:48973] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxeWsu1nEoSSDHiOXbWkgAAAXQ"]
[Sat Jul 18 23:19:22.287657 2026] [security2:error] [pid 830701:tid 830937] [client 124.29.246.106:48973] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxeWsu1nEoSSDHiOXbWkgAAAXQ"]
[Sat Jul 18 23:19:22.746127 2026] [security2:error] [pid 830701:tid 830932] [client 89.167.13.70:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "amalia-capital.com"] [uri "/index.php"] [unique_id "alxeWsu1nEoSSDHiOXbWnQAAAW8"], referer: https://www.google.com/
[Sat Jul 18 23:19:23.068248 2026] [security2:error] [pid 830701:tid 830844] [client 89.167.13.70:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "amalia-capital.com"] [uri "/index.php"] [unique_id "alxeWsu1nEoSSDHiOXbWtQAAARc"], referer: https://www.google.com/
[Sat Jul 18 23:19:23.229268 2026] [security2:error] [pid 830701:tid 830853] [client 89.167.13.70:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "amalia-capital.com"] [uri "/index.php"] [unique_id "alxeW8u1nEoSSDHiOXbWvQAAASA"], referer: https://www.google.com/
[Sat Jul 18 23:19:24.286841 2026] [security2:error] [pid 830701:tid 830943] [client 223.228.182.224:52529] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxeXMu1nEoSSDHiOXbXFQAAAXo"]
[Sat Jul 18 23:19:24.286948 2026] [security2:error] [pid 830701:tid 830943] [client 223.228.182.224:52529] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxeXMu1nEoSSDHiOXbXFQAAAXo"]
[Sat Jul 18 23:19:24.379530 2026] [security2:error] [pid 830701:tid 830951] [client 45.3.45.253:32821] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 253.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxeXMu1nEoSSDHiOXbXGwAAAYI"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:19:24.816560 2026] [security2:error] [pid 830701:tid 830941] [client 89.167.13.70:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "amalia-capital.com"] [uri "/index.php"] [unique_id "alxeXMu1nEoSSDHiOXbXKAAAAXg"], referer: https://www.google.com/
[Sat Jul 18 23:19:25.393990 2026] [security2:error] [pid 830701:tid 830835] [client 89.167.13.70:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "amalia-capital.com"] [uri "/index.php"] [unique_id "alxeXcu1nEoSSDHiOXbXTQAAAQ4"], referer: https://www.google.com/
[Sat Jul 18 23:19:25.664778 2026] [security2:error] [pid 830701:tid 830921] [client 57.141.18.35:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxeXcu1nEoSSDHiOXbXZwAAAWQ"]
[Sat Jul 18 23:19:25.836739 2026] [security2:error] [pid 830701:tid 830953] [client 57.141.18.28:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxeXcu1nEoSSDHiOXbXcgAAAYQ"]
[Sat Jul 18 23:19:25.983588 2026] [security2:error] [pid 830701:tid 830866] [client 89.167.13.70:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "amalia-capital.com"] [uri "/index.php"] [unique_id "alxeXcu1nEoSSDHiOXbXfQAAAS0"], referer: https://www.google.com/
[Sat Jul 18 23:19:25.986448 2026] [security2:error] [pid 830701:tid 830946] [client 223.185.61.63:29921] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeXcu1nEoSSDHiOXbXjAAAAX0"]
[Sat Jul 18 23:19:25.986548 2026] [security2:error] [pid 830701:tid 830946] [client 223.185.61.63:29921] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeXcu1nEoSSDHiOXbXjAAAAX0"]
[Sat Jul 18 23:19:26.339832 2026] [security2:error] [pid 830701:tid 830849] [client 89.167.13.70:21487] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.13.167.89.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "amalia-capital.com"] [uri "/contact.php"] [unique_id "alxeXsu1nEoSSDHiOXbXnwAAARw"], referer: https://www.google.com/
[Sat Jul 18 23:19:26.383061 2026] [security2:error] [pid 830701:tid 830903] [client 95.108.213.141:37226] ModSecurity: Access denied with code 429 (phase 2). Pattern match "Mozilla\\\\/5\\\\.0 \\\\(compatible; YandexBot\\\\/3\\\\.0; \\\\+http:\\\\/\\\\/yandex\\\\.com\\\\/bots\\\\)" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/othercrawler.conf"] [line "3"] [id "901008"] [msg "Yandex Crawler 429 ADDED BY MONITORING DO NOT WHITELIST"] [hostname "heroesoftomorrow.us"] [uri "/robots.txt"] [unique_id "alxeXsu1nEoSSDHiOXbXowAAAVI"]
[Sat Jul 18 23:19:26.643180 2026] [security2:error] [pid 830701:tid 830873] [client 89.167.13.70:18864] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.13.167.89.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "amalia-capital.com"] [uri "/contact-us.php"] [unique_id "alxeXsu1nEoSSDHiOXbXtAAAATQ"], referer: https://www.google.com/
[Sat Jul 18 23:19:26.877385 2026] [security2:error] [pid 830701:tid 830832] [client 190.108.79.183:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "gaantuition.co.uk"] [uri "/index.php"] [unique_id "alxeXMu1nEoSSDHiOXbXNwABCwg"]
[Sat Jul 18 23:19:26.923466 2026] [security2:error] [pid 830701:tid 830952] [client 27.34.68.67:31019] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxeXsu1nEoSSDHiOXbXxQAAAYM"]
[Sat Jul 18 23:19:26.923575 2026] [security2:error] [pid 830701:tid 830952] [client 27.34.68.67:31019] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxeXsu1nEoSSDHiOXbXxQAAAYM"]
[Sat Jul 18 23:19:27.223162 2026] [security2:error] [pid 830701:tid 830756] [remote 68.178.160.25:53120] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxeX8u1nEoSSDHiOXbX3QABiDY"]
[Sat Jul 18 23:19:27.512509 2026] [security2:error] [pid 830701:tid 830877] [client 89.167.13.70:61119] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.13.167.89.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "amalia-capital.com"] [uri "/shipping.php"] [unique_id "alxeX8u1nEoSSDHiOXbX8QAAATg"], referer: https://www.google.com/
[Sat Jul 18 23:19:27.517867 2026] [security2:error] [pid 830701:tid 830934] [client 190.245.146.99:55834] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeX8u1nEoSSDHiOXbX8wAAAXE"]
[Sat Jul 18 23:19:27.523458 2026] [security2:error] [pid 830701:tid 830934] [client 190.245.146.99:55834] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeX8u1nEoSSDHiOXbX8wAAAXE"]
[Sat Jul 18 23:19:28.020397 2026] [security2:error] [pid 830701:tid 830918] [client 34.90.238.78:16384] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "autodiscover.twy.mtk.mybluehost.me"] [uri "/"] [unique_id "alxeYMu1nEoSSDHiOXbYFQAAAWE"]
[Sat Jul 18 23:19:28.020507 2026] [security2:error] [pid 830701:tid 830918] [client 34.90.238.78:16384] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "autodiscover.twy.mtk.mybluehost.me"] [uri "/"] [unique_id "alxeYMu1nEoSSDHiOXbYFQAAAWE"]
[Sat Jul 18 23:19:28.060026 2026] [security2:error] [pid 830701:tid 830775] [remote 68.178.160.25:53120] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxeYMu1nEoSSDHiOXbYFgABHEk"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:19:28.299176 2026] [security2:error] [pid 830701:tid 830954] [client 171.4.232.110:42119] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeYMu1nEoSSDHiOXbYJgAAAYU"]
[Sat Jul 18 23:19:28.299294 2026] [security2:error] [pid 830701:tid 830954] [client 171.4.232.110:42119] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeYMu1nEoSSDHiOXbYJgAAAYU"]
[Sat Jul 18 23:19:28.482874 2026] [security2:error] [pid 830701:tid 830875] [client 89.167.13.70:39269] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.13.167.89.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "amalia-capital.com"] [uri "/delivery.php"] [unique_id "alxeYMu1nEoSSDHiOXbYLQAAATY"], referer: https://www.google.com/
[Sat Jul 18 23:19:28.716467 2026] [security2:error] [pid 830701:tid 830889] [client 3.108.60.216:14536] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxeYMu1nEoSSDHiOXbYQwAAAUQ"]
[Sat Jul 18 23:19:28.716557 2026] [security2:error] [pid 830701:tid 830889] [client 3.108.60.216:14536] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxeYMu1nEoSSDHiOXbYQwAAAUQ"]
[Sat Jul 18 23:19:29.205104 2026] [security2:error] [pid 830701:tid 830948] [client 89.167.13.70:42222] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.13.167.89.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "amalia-capital.com"] [uri "/about.php"] [unique_id "alxeYcu1nEoSSDHiOXbYZwAAAX8"], referer: https://www.google.com/
[Sat Jul 18 23:19:29.390446 2026] [security2:error] [pid 830701:tid 830844] [client 119.154.81.234:57815] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxeYcu1nEoSSDHiOXbYcgAAARc"]
[Sat Jul 18 23:19:29.390559 2026] [security2:error] [pid 830701:tid 830844] [client 119.154.81.234:57815] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxeYcu1nEoSSDHiOXbYcgAAARc"]
[Sat Jul 18 23:19:29.553169 2026] [security2:error] [pid 830701:tid 830720] [remote 154.61.75.100:35528] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxeYcu1nEoSSDHiOXbYegABMRI"]
[Sat Jul 18 23:19:29.582681 2026] [security2:error] [pid 830701:tid 830938] [client 74.7.241.143:35624] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "sergioraya.com"] [uri "/robots.txt"] [unique_id "alxeYcu1nEoSSDHiOXbYgQAAAXU"]
[Sat Jul 18 23:19:29.627318 2026] [security2:error] [pid 830701:tid 830868] [client 103.48.44.9:51975] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeYcu1nEoSSDHiOXbYhQAAAS8"]
[Sat Jul 18 23:19:29.627423 2026] [security2:error] [pid 830701:tid 830868] [client 103.48.44.9:51975] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeYcu1nEoSSDHiOXbYhQAAAS8"]
[Sat Jul 18 23:19:29.799779 2026] [security2:error] [pid 830701:tid 830926] [client 66.187.5.104:48906] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "mail.generationloveproject.com"] [uri "/"] [unique_id "alxeYcu1nEoSSDHiOXbYkwAAAWk"]
[Sat Jul 18 23:19:30.021316 2026] [security2:error] [pid 830701:tid 830921] [client 89.167.13.70:44709] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.13.167.89.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "amalia-capital.com"] [uri "/about-us.php"] [unique_id "alxeYsu1nEoSSDHiOXbYnwAAAWQ"], referer: https://www.google.com/
[Sat Jul 18 23:19:30.486508 2026] [security2:error] [pid 830701:tid 830891] [client 34.171.141.44:44540] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "darkknightsolutions.com"] [uri "/wp-json/batch/v1"] [unique_id "alxeYsu1nEoSSDHiOXbY4AAAAUY"]
[Sat Jul 18 23:19:30.555438 2026] [security2:error] [pid 830701:tid 830883] [client 57.141.18.64:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxeYcu1nEoSSDHiOXbYmwAAAT4"]
[Sat Jul 18 23:19:30.672648 2026] [security2:error] [pid 830701:tid 830771] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxeYsu1nEoSSDHiOXbY7gABPUU"]
[Sat Jul 18 23:19:30.672809 2026] [security2:error] [pid 830701:tid 830882] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxeYsu1nEoSSDHiOXbY7gABPUU"]
[Sat Jul 18 23:19:30.675275 2026] [security2:error] [pid 830701:tid 830884] [client 34.171.141.44:44540] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "darkknightsolutions.com"] [uri "/"] [unique_id "alxeYsu1nEoSSDHiOXbY7QAAAT8"]
[Sat Jul 18 23:19:31.074970 2026] [security2:error] [pid 830701:tid 830940] [client 181.46.71.155:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "youpositive.co"] [uri "/index.php"] [unique_id "alxeYcu1nEoSSDHiOXbYjwAAAXc"]
[Sat Jul 18 23:19:31.400440 2026] [security2:error] [pid 830701:tid 830918] [client 34.171.141.44:53554] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "darkknightsolutions.com"] [uri "/wp-json/batch/v1"] [unique_id "alxeY8u1nEoSSDHiOXbZGAAAAWE"]
[Sat Jul 18 23:19:31.596583 2026] [security2:error] [pid 830701:tid 830941] [client 136.243.59.237:33568] ModSecurity: Warning. Matched phrase "DomainStatsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "www.ccsdifference.com"] [uri "/index.php"] [unique_id "alxeY8u1nEoSSDHiOXbZEwAAAXg"]
[Sat Jul 18 23:19:31.870545 2026] [security2:error] [pid 830701:tid 830923] [client 34.171.141.44:53554] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "darkknightsolutions.com"] [uri "/"] [unique_id "alxeY8u1nEoSSDHiOXbZOAAAAWY"]
[Sat Jul 18 23:19:31.891979 2026] [security2:error] [pid 830701:tid 830735] [remote 157.66.47.83:42518] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxeY8u1nEoSSDHiOXbZOQABaSE"]
[Sat Jul 18 23:19:31.982841 2026] [security2:error] [pid 830701:tid 830726] [remote 154.61.75.100:35528] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxeY8u1nEoSSDHiOXbZQQABVRg"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:19:32.297964 2026] [security2:error] [pid 830701:tid 830746] [remote 157.66.47.83:42518] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxeZMu1nEoSSDHiOXbZWgABGSw"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:19:32.327715 2026] [security2:error] [pid 830701:tid 830838] [client 124.29.207.185:61904] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxeZMu1nEoSSDHiOXbZXgAAARE"]
[Sat Jul 18 23:19:32.328431 2026] [security2:error] [pid 830701:tid 830838] [client 124.29.207.185:61904] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxeZMu1nEoSSDHiOXbZXgAAARE"]
[Sat Jul 18 23:19:32.549882 2026] [security2:error] [pid 830701:tid 830704] [remote 128.199.203.39:55098] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 39.203.199.128.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxeZMu1nEoSSDHiOXbZaAABTAI"]
[Sat Jul 18 23:19:32.550034 2026] [security2:error] [pid 830701:tid 830897] [client 128.199.203.39:55098] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxeZMu1nEoSSDHiOXbZaAABTAI"]
[Sat Jul 18 23:19:33.079148 2026] [security2:error] [pid 830701:tid 830884] [client 89.167.13.70:47013] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.13.167.89.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "amalia-capital.com"] [uri "/info.php"] [unique_id "alxeZcu1nEoSSDHiOXbZhQAAAT8"], referer: https://www.google.com/
[Sat Jul 18 23:19:33.389936 2026] [security2:error] [pid 830701:tid 830831] [client 63.179.105.113:0] ModSecurity: Warning. Matched phrase "ADmantX" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "curlsnpearlsss.com"] [uri "/index.php"] [unique_id "alxeZMu1nEoSSDHiOXbZbAAAAQo"]
[Sat Jul 18 23:19:33.422225 2026] [security2:error] [pid 830701:tid 830833] [client 63.179.105.113:57742] ModSecurity: Warning. Matched phrase "ADmantX" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "curlsnpearlsss.com"] [uri "/puerto-rican-meatballs-in-sofrito-sauce-recipe/"] [unique_id "alxeZMu1nEoSSDHiOXbZagAAAQw"]
[Sat Jul 18 23:19:34.201955 2026] [security2:error] [pid 830701:tid 830958] [client 31.171.130.20:65257] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/ms-themes.php"] [unique_id "alxeZsu1nEoSSDHiOXbZ2AAAAYk"]
[Sat Jul 18 23:19:34.264765 2026] [security2:error] [pid 830701:tid 830900] [client 31.171.130.35:53511] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/ms-themes.php"] [unique_id "alxeZsu1nEoSSDHiOXbZ3QAAAU8"]
[Sat Jul 18 23:19:34.269737 2026] [security2:error] [pid 830701:tid 830942] [client 31.171.130.30:65163] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/ms-themes.php"] [unique_id "alxeZsu1nEoSSDHiOXbZ3gAAAXk"]
[Sat Jul 18 23:19:34.456858 2026] [security2:error] [pid 830701:tid 830877] [client 31.171.130.4:31355] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/ms-themes.php"] [unique_id "alxeZsu1nEoSSDHiOXbZ5wAAATg"]
[Sat Jul 18 23:19:34.458389 2026] [security2:error] [pid 830701:tid 830871] [client 31.171.130.25:40491] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/ms-themes.php"] [unique_id "alxeZsu1nEoSSDHiOXbZ6AAAATI"]
[Sat Jul 18 23:19:34.560848 2026] [security2:error] [pid 830701:tid 830852] [client 3.108.60.216:32528] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxeZsu1nEoSSDHiOXbZ7AAAAR8"]
[Sat Jul 18 23:19:34.690250 2026] [security2:error] [pid 830701:tid 830932] [client 74.208.214.194:34484] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxeZsu1nEoSSDHiOXbZ9wAAAW8"]
[Sat Jul 18 23:19:34.721258 2026] [security2:error] [pid 830701:tid 830828] [remote 152.228.213.32:37586] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxeZsu1nEoSSDHiOXbZ-wABTX4"]
[Sat Jul 18 23:19:34.721497 2026] [security2:error] [pid 830701:tid 830898] [client 152.228.213.32:37586] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxeZsu1nEoSSDHiOXbZ-wABTX4"]
[Sat Jul 18 23:19:34.767100 2026] [security2:error] [pid 830701:tid 830941] [client 31.171.130.26:28199] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/ms-themes.php"] [unique_id "alxeZsu1nEoSSDHiOXbZ_gAAAXg"]
[Sat Jul 18 23:19:34.767155 2026] [security2:error] [pid 830701:tid 830952] [client 31.171.130.50:51545] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/ms-themes.php"] [unique_id "alxeZsu1nEoSSDHiOXbZ_wAAAYM"]
[Sat Jul 18 23:19:34.769088 2026] [security2:error] [pid 830701:tid 830947] [client 45.3.45.90:18835] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 90.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxeZsu1nEoSSDHiOXbZ_QAAAX4"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:19:34.977814 2026] [security2:error] [pid 830701:tid 830850] [client 31.171.130.15:41459] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/ms-themes.php"] [unique_id "alxeZsu1nEoSSDHiOXbaDwAAAR0"]
[Sat Jul 18 23:19:35.300255 2026] [security2:error] [pid 830701:tid 830935] [client 31.171.130.40:40891] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/chosen.php"] [unique_id "alxeZ8u1nEoSSDHiOXbaNgAAAXI"]
[Sat Jul 18 23:19:35.355040 2026] [security2:error] [pid 830701:tid 830913] [client 31.171.130.8:30143] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/chosen.php"] [unique_id "alxeZ8u1nEoSSDHiOXbaPQAAAVw"]
[Sat Jul 18 23:19:35.355047 2026] [security2:error] [pid 830701:tid 830866] [client 31.171.130.51:58671] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/chosen.php"] [unique_id "alxeZ8u1nEoSSDHiOXbaPAAAAS0"]
[Sat Jul 18 23:19:35.361532 2026] [security2:error] [pid 830701:tid 830845] [client 31.171.130.39:47547] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/chosen.php"] [unique_id "alxeZ8u1nEoSSDHiOXbaPwAAARg"]
[Sat Jul 18 23:19:35.423378 2026] [security2:error] [pid 830701:tid 830893] [client 31.171.130.37:43401] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/chosen.php"] [unique_id "alxeZ8u1nEoSSDHiOXbaQQAAAUg"]
[Sat Jul 18 23:19:35.429228 2026] [security2:error] [pid 830701:tid 830928] [client 31.171.130.3:24889] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/chosen.php"] [unique_id "alxeZ8u1nEoSSDHiOXbaQgAAAWs"]
[Sat Jul 18 23:19:35.435219 2026] [security2:error] [pid 830701:tid 830782] [remote 202.51.202.242:34734] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 242.202.51.202.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ferrellroofing.com"] [uri "/wp-login.php"] [unique_id "alxeZ8u1nEoSSDHiOXbaQAABNVA"]
[Sat Jul 18 23:19:35.440723 2026] [security2:error] [pid 830701:tid 830932] [client 31.171.130.35:21155] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/chosen.php"] [unique_id "alxeZ8u1nEoSSDHiOXbaQwAAAW8"]
[Sat Jul 18 23:19:35.566576 2026] [security2:error] [pid 830701:tid 830886] [client 65.111.28.215:19543] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 215.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxeZ8u1nEoSSDHiOXbaRwAAAUE"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:19:35.635406 2026] [security2:error] [pid 830701:tid 830857] [client 31.171.130.17:47391] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/chosen.php"] [unique_id "alxeZ8u1nEoSSDHiOXbaVQAAASQ"]
[Sat Jul 18 23:19:35.640933 2026] [security2:error] [pid 830701:tid 830939] [client 65.0.26.70:22834] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.26.0.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxeZ8u1nEoSSDHiOXbaUwAAAXY"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:19:36.082394 2026] [security2:error] [pid 830701:tid 830839] [client 31.171.130.21:37157] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/file.php"] [unique_id "alxeaMu1nEoSSDHiOXbabQAAARI"]
[Sat Jul 18 23:19:36.100678 2026] [security2:error] [pid 830701:tid 830927] [client 31.171.130.12:50399] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/file.php"] [unique_id "alxeaMu1nEoSSDHiOXbabwAAAWo"]
[Sat Jul 18 23:19:36.118867 2026] [security2:error] [pid 830701:tid 830893] [client 31.171.130.21:25023] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/file.php"] [unique_id "alxeaMu1nEoSSDHiOXbacAAAAUg"]
[Sat Jul 18 23:19:36.119571 2026] [security2:error] [pid 830701:tid 830876] [client 31.171.130.7:44041] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/file.php"] [unique_id "alxeaMu1nEoSSDHiOXbacQAAATc"]
[Sat Jul 18 23:19:36.133312 2026] [security2:error] [pid 830701:tid 830928] [client 31.171.130.19:61951] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/file.php"] [unique_id "alxeaMu1nEoSSDHiOXbacgAAAWs"]
[Sat Jul 18 23:19:36.136114 2026] [security2:error] [pid 830701:tid 830874] [client 31.171.130.50:51593] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/file.php"] [unique_id "alxeaMu1nEoSSDHiOXbacwAAATU"]
[Sat Jul 18 23:19:36.163370 2026] [security2:error] [pid 830701:tid 830920] [client 223.228.182.224:51376] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxeaMu1nEoSSDHiOXbadgAAAWM"]
[Sat Jul 18 23:19:36.163492 2026] [security2:error] [pid 830701:tid 830920] [client 223.228.182.224:51376] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxeaMu1nEoSSDHiOXbadgAAAWM"]
[Sat Jul 18 23:19:36.164741 2026] [security2:error] [pid 830701:tid 830895] [client 31.171.130.8:38287] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/file.php"] [unique_id "alxeaMu1nEoSSDHiOXbadwAAAUo"]
[Sat Jul 18 23:19:36.259285 2026] [security2:error] [pid 830701:tid 830890] [client 31.171.130.11:58555] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/file.php"] [unique_id "alxeaMu1nEoSSDHiOXbafwAAAUU"]
[Sat Jul 18 23:19:36.490351 2026] [security2:error] [pid 830701:tid 830923] [client 65.111.30.123:37161] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 123.30.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxeaMu1nEoSSDHiOXbajgAAAWY"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:19:36.590811 2026] [security2:error] [pid 830701:tid 830863] [client 31.171.130.2:21435] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/flower.php"] [unique_id "alxeaMu1nEoSSDHiOXbakwAAASo"]
[Sat Jul 18 23:19:36.601251 2026] [security2:error] [pid 830701:tid 830882] [client 31.171.130.6:45637] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/flower.php"] [unique_id "alxeaMu1nEoSSDHiOXbalAAAAT0"]
[Sat Jul 18 23:19:36.630950 2026] [security2:error] [pid 830701:tid 830867] [client 223.185.61.63:12090] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeaMu1nEoSSDHiOXbamAAAAS4"]
[Sat Jul 18 23:19:36.631037 2026] [security2:error] [pid 830701:tid 830867] [client 223.185.61.63:12090] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeaMu1nEoSSDHiOXbamAAAAS4"]
[Sat Jul 18 23:19:36.659946 2026] [security2:error] [pid 830701:tid 830840] [client 31.171.130.15:58823] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/flower.php"] [unique_id "alxeaMu1nEoSSDHiOXbamgAAARM"]
[Sat Jul 18 23:19:36.697116 2026] [security2:error] [pid 830701:tid 830935] [client 31.171.130.12:59661] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/flower.php"] [unique_id "alxeaMu1nEoSSDHiOXbanQAAAXI"]
[Sat Jul 18 23:19:36.824470 2026] [security2:error] [pid 830701:tid 830856] [client 31.171.130.41:28347] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/flower.php"] [unique_id "alxeaMu1nEoSSDHiOXbapQAAASM"]
[Sat Jul 18 23:19:37.109850 2026] [security2:error] [pid 830701:tid 830939] [client 31.171.130.44:40861] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/gifclass.php"] [unique_id "alxeacu1nEoSSDHiOXbavgAAAXY"]
[Sat Jul 18 23:19:37.121641 2026] [security2:error] [pid 830701:tid 830892] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "alxeacu1nEoSSDHiOXbawAAAAUc"]
[Sat Jul 18 23:19:37.121712 2026] [security2:error] [pid 830701:tid 830892] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "alxeacu1nEoSSDHiOXbawAAAAUc"]
[Sat Jul 18 23:19:37.151322 2026] [security2:error] [pid 830701:tid 830899] [client 31.171.130.7:35827] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/gifclass.php"] [unique_id "alxeacu1nEoSSDHiOXbawQAAAU4"]
[Sat Jul 18 23:19:37.175505 2026] [security2:error] [pid 830701:tid 830850] [client 31.171.130.14:27361] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/gifclass.php"] [unique_id "alxeacu1nEoSSDHiOXbawwAAAR0"]
[Sat Jul 18 23:19:37.190401 2026] [security2:error] [pid 830701:tid 830922] [client 65.111.27.77:41443] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 77.27.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxeacu1nEoSSDHiOXbawgAAAWU"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:19:37.246443 2026] [security2:error] [pid 830701:tid 830914] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/this_is_a_new_hello_world.php"] [unique_id "alxeacu1nEoSSDHiOXbaxwAAAV0"]
[Sat Jul 18 23:19:37.246513 2026] [security2:error] [pid 830701:tid 830914] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/this_is_a_new_hello_world.php"] [unique_id "alxeacu1nEoSSDHiOXbaxwAAAV0"]
[Sat Jul 18 23:19:37.363123 2026] [security2:error] [pid 830701:tid 830919] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/sql.php"] [unique_id "alxeacu1nEoSSDHiOXbaygAAAWI"]
[Sat Jul 18 23:19:37.363197 2026] [security2:error] [pid 830701:tid 830919] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/sql.php"] [unique_id "alxeacu1nEoSSDHiOXbaygAAAWI"]
[Sat Jul 18 23:19:37.377653 2026] [security2:error] [pid 830701:tid 830854] [client 31.171.130.44:61973] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/gifclass.php"] [unique_id "alxeacu1nEoSSDHiOXbazAAAASE"]
[Sat Jul 18 23:19:37.479216 2026] [security2:error] [pid 830701:tid 830917] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/1index.php"] [unique_id "alxeacu1nEoSSDHiOXba0wAAAWA"]
[Sat Jul 18 23:19:37.479299 2026] [security2:error] [pid 830701:tid 830917] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/1index.php"] [unique_id "alxeacu1nEoSSDHiOXba0wAAAWA"]
[Sat Jul 18 23:19:37.573109 2026] [security2:error] [pid 830701:tid 830844] [client 27.34.68.67:3012] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxeacu1nEoSSDHiOXba1QAAARc"]
[Sat Jul 18 23:19:37.573202 2026] [security2:error] [pid 830701:tid 830844] [client 27.34.68.67:3012] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxeacu1nEoSSDHiOXba1QAAARc"]
[Sat Jul 18 23:19:37.594878 2026] [security2:error] [pid 830701:tid 830855] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/reop1.php"] [unique_id "alxeacu1nEoSSDHiOXba1gAAASI"]
[Sat Jul 18 23:19:37.594979 2026] [security2:error] [pid 830701:tid 830855] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/reop1.php"] [unique_id "alxeacu1nEoSSDHiOXba1gAAASI"]
[Sat Jul 18 23:19:37.645900 2026] [security2:error] [pid 830701:tid 830895] [client 31.171.130.12:21807] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/bless.php"] [unique_id "alxeacu1nEoSSDHiOXba2gAAAUo"]
[Sat Jul 18 23:19:37.670595 2026] [security2:error] [pid 830701:tid 830918] [client 31.171.130.48:35029] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/flower.php"] [unique_id "alxeacu1nEoSSDHiOXba3gAAAWE"]
[Sat Jul 18 23:19:37.671151 2026] [security2:error] [pid 830701:tid 830842] [client 31.171.130.46:40771] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/flower.php"] [unique_id "alxeacu1nEoSSDHiOXba3wAAARU"]
[Sat Jul 18 23:19:37.680004 2026] [security2:error] [pid 830701:tid 830889] [client 31.171.130.32:40001] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/bless.php"] [unique_id "alxeacu1nEoSSDHiOXba4QAAAUQ"]
[Sat Jul 18 23:19:37.714699 2026] [security2:error] [pid 830701:tid 830916] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/trusj18.php"] [unique_id "alxeacu1nEoSSDHiOXba5QAAAV8"]
[Sat Jul 18 23:19:37.714804 2026] [security2:error] [pid 830701:tid 830916] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/trusj18.php"] [unique_id "alxeacu1nEoSSDHiOXba5QAAAV8"]
[Sat Jul 18 23:19:37.735253 2026] [security2:error] [pid 830701:tid 830865] [client 31.171.130.23:50417] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/bless.php"] [unique_id "alxeacu1nEoSSDHiOXba6wAAASw"]
[Sat Jul 18 23:19:37.837141 2026] [security2:error] [pid 830701:tid 830893] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/trusj15.php"] [unique_id "alxeacu1nEoSSDHiOXba7QAAAUg"]
[Sat Jul 18 23:19:37.837229 2026] [security2:error] [pid 830701:tid 830893] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/trusj15.php"] [unique_id "alxeacu1nEoSSDHiOXba7QAAAUg"]
[Sat Jul 18 23:19:37.838856 2026] [security2:error] [pid 830701:tid 830890] [client 31.171.130.30:22533] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/flower.php"] [unique_id "alxeacu1nEoSSDHiOXba7gAAAUU"]
[Sat Jul 18 23:19:37.886605 2026] [security2:error] [pid 830701:tid 830848] [client 31.171.130.1:54581] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/bless.php"] [unique_id "alxeacu1nEoSSDHiOXba7wAAARs"]
[Sat Jul 18 23:19:37.952938 2026] [security2:error] [pid 830701:tid 830931] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/rft8.php"] [unique_id "alxeacu1nEoSSDHiOXba8wAAAW4"]
[Sat Jul 18 23:19:37.953029 2026] [security2:error] [pid 830701:tid 830931] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/rft8.php"] [unique_id "alxeacu1nEoSSDHiOXba8wAAAW4"]
[Sat Jul 18 23:19:38.015360 2026] [security2:error] [pid 830701:tid 830835] [client 190.245.146.99:56349] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeasu1nEoSSDHiOXba-gAAAQ4"]
[Sat Jul 18 23:19:38.027900 2026] [security2:error] [pid 830701:tid 830835] [client 190.245.146.99:56349] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeasu1nEoSSDHiOXba-gAAAQ4"]
[Sat Jul 18 23:19:38.068951 2026] [security2:error] [pid 830701:tid 830926] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/ai.php"] [unique_id "alxeasu1nEoSSDHiOXba_gAAAWk"]
[Sat Jul 18 23:19:38.069049 2026] [security2:error] [pid 830701:tid 830926] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/ai.php"] [unique_id "alxeasu1nEoSSDHiOXba_gAAAWk"]
[Sat Jul 18 23:19:38.185624 2026] [security2:error] [pid 830701:tid 830906] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-rdf.php"] [unique_id "alxeasu1nEoSSDHiOXbbBgAAAVU"]
[Sat Jul 18 23:19:38.185735 2026] [security2:error] [pid 830701:tid 830906] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-rdf.php"] [unique_id "alxeasu1nEoSSDHiOXbbBgAAAVU"]
[Sat Jul 18 23:19:38.244167 2026] [security2:error] [pid 830701:tid 830756] [remote 208.109.9.173:33580] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 173.9.109.208.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxeasu1nEoSSDHiOXbbEAABNzY"]
[Sat Jul 18 23:19:38.244329 2026] [security2:error] [pid 830701:tid 830876] [client 208.109.9.173:33580] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxeasu1nEoSSDHiOXbbEAABNzY"]
[Sat Jul 18 23:19:38.278151 2026] [security2:error] [pid 830701:tid 830933] [client 31.171.130.39:43915] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/class-t.api.php"] [unique_id "alxeasu1nEoSSDHiOXbbEgAAAXA"]
[Sat Jul 18 23:19:38.283304 2026] [security2:error] [pid 830701:tid 830905] [client 31.171.130.50:25361] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/gifclass.php"] [unique_id "alxeasu1nEoSSDHiOXbbFQAAAVQ"]
[Sat Jul 18 23:19:38.305016 2026] [security2:error] [pid 830701:tid 830942] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/fx.php"] [unique_id "alxeasu1nEoSSDHiOXbbGQAAAXk"]
[Sat Jul 18 23:19:38.305084 2026] [security2:error] [pid 830701:tid 830942] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/fx.php"] [unique_id "alxeasu1nEoSSDHiOXbbGQAAAXk"]
[Sat Jul 18 23:19:38.405649 2026] [security2:error] [pid 830701:tid 830889] [client 31.171.130.27:59149] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/class-t.api.php"] [unique_id "alxeasu1nEoSSDHiOXbbHAAAAUQ"]
[Sat Jul 18 23:19:38.407203 2026] [security2:error] [pid 830701:tid 830910] [client 31.171.130.5:30551] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/gifclass.php"] [unique_id "alxeasu1nEoSSDHiOXbbHQAAAVk"]
[Sat Jul 18 23:19:38.421244 2026] [security2:error] [pid 830701:tid 830947] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/xxx.php"] [unique_id "alxeasu1nEoSSDHiOXbbHgAAAX4"]
[Sat Jul 18 23:19:38.421323 2026] [security2:error] [pid 830701:tid 830947] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/xxx.php"] [unique_id "alxeasu1nEoSSDHiOXbbHgAAAX4"]
[Sat Jul 18 23:19:38.432611 2026] [security2:error] [pid 830701:tid 830898] [client 31.171.130.37:27025] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/class-t.api.php"] [unique_id "alxeasu1nEoSSDHiOXbbHwAAAU0"]
[Sat Jul 18 23:19:38.459652 2026] [security2:error] [pid 830701:tid 830868] [client 31.171.130.15:54871] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/class-t.api.php"] [unique_id "alxeasu1nEoSSDHiOXbbIgAAAS8"]
[Sat Jul 18 23:19:38.537370 2026] [security2:error] [pid 830701:tid 830881] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/dropdown.php"] [unique_id "alxeasu1nEoSSDHiOXbbJwAAATw"]
[Sat Jul 18 23:19:38.537454 2026] [security2:error] [pid 830701:tid 830881] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/dropdown.php"] [unique_id "alxeasu1nEoSSDHiOXbbJwAAATw"]
[Sat Jul 18 23:19:38.653580 2026] [security2:error] [pid 830701:tid 830951] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/file11.php"] [unique_id "alxeasu1nEoSSDHiOXbbLAAAAYI"]
[Sat Jul 18 23:19:38.653656 2026] [security2:error] [pid 830701:tid 830951] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/file11.php"] [unique_id "alxeasu1nEoSSDHiOXbbLAAAAYI"]
[Sat Jul 18 23:19:38.772054 2026] [security2:error] [pid 830701:tid 830877] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/png.php"] [unique_id "alxeasu1nEoSSDHiOXbbOAAAATg"]
[Sat Jul 18 23:19:38.772144 2026] [security2:error] [pid 830701:tid 830877] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/png.php"] [unique_id "alxeasu1nEoSSDHiOXbbOAAAATg"]
[Sat Jul 18 23:19:38.833010 2026] [security2:error] [pid 830701:tid 830902] [client 31.171.130.22:49309] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/blurbs.php"] [unique_id "alxeasu1nEoSSDHiOXbbPAAAAVE"]
[Sat Jul 18 23:19:38.891065 2026] [security2:error] [pid 830701:tid 830849] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-slss.php"] [unique_id "alxeasu1nEoSSDHiOXbbQAAAARw"]
[Sat Jul 18 23:19:38.891169 2026] [security2:error] [pid 830701:tid 830849] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-slss.php"] [unique_id "alxeasu1nEoSSDHiOXbbQAAAARw"]
[Sat Jul 18 23:19:38.891856 2026] [security2:error] [pid 830701:tid 830958] [client 171.4.232.110:42421] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeasu1nEoSSDHiOXbbPwAAAYk"]
[Sat Jul 18 23:19:38.891965 2026] [security2:error] [pid 830701:tid 830958] [client 171.4.232.110:42421] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeasu1nEoSSDHiOXbbPwAAAYk"]
[Sat Jul 18 23:19:38.910517 2026] [security2:error] [pid 830701:tid 830919] [client 31.171.130.12:24563] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/bless.php"] [unique_id "alxeasu1nEoSSDHiOXbbQQAAAWI"]
[Sat Jul 18 23:19:38.914505 2026] [security2:error] [pid 830701:tid 830882] [client 31.171.130.46:57605] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/bless.php"] [unique_id "alxeasu1nEoSSDHiOXbbQgAAAT0"]
[Sat Jul 18 23:19:38.922971 2026] [security2:error] [pid 830701:tid 830935] [client 31.171.130.45:45343] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/blurbs.php"] [unique_id "alxeasu1nEoSSDHiOXbbQwAAAXI"]
[Sat Jul 18 23:19:38.934865 2026] [security2:error] [pid 830701:tid 830929] [client 31.171.130.43:48803] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/blurbs.php"] [unique_id "alxeasu1nEoSSDHiOXbbRQAAAWw"]
[Sat Jul 18 23:19:38.993356 2026] [security2:error] [pid 830701:tid 830832] [client 31.171.130.12:22159] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/blurbs.php"] [unique_id "alxeasu1nEoSSDHiOXbbSAAAAQs"]
[Sat Jul 18 23:19:39.006781 2026] [security2:error] [pid 830701:tid 830938] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/ah25.php"] [unique_id "alxea8u1nEoSSDHiOXbbSQAAAXU"]
[Sat Jul 18 23:19:39.006867 2026] [security2:error] [pid 830701:tid 830938] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/ah25.php"] [unique_id "alxea8u1nEoSSDHiOXbbSQAAAXU"]
[Sat Jul 18 23:19:39.122919 2026] [security2:error] [pid 830701:tid 830842] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/ccou.php"] [unique_id "alxea8u1nEoSSDHiOXbbUgAAARU"]
[Sat Jul 18 23:19:39.123055 2026] [security2:error] [pid 830701:tid 830842] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/ccou.php"] [unique_id "alxea8u1nEoSSDHiOXbbUgAAARU"]
[Sat Jul 18 23:19:39.170153 2026] [security2:error] [pid 830701:tid 830876] [client 34.91.129.93:24576] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "cpcalendars.thh.mtk.mybluehost.me"] [uri "/"] [unique_id "alxea8u1nEoSSDHiOXbbVgAAATc"]
[Sat Jul 18 23:19:39.170225 2026] [security2:error] [pid 830701:tid 830876] [client 34.91.129.93:24576] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "cpcalendars.thh.mtk.mybluehost.me"] [uri "/"] [unique_id "alxea8u1nEoSSDHiOXbbVgAAATc"]
[Sat Jul 18 23:19:39.241326 2026] [security2:error] [pid 830701:tid 830846] [client 20.63.63.128:0] ModSecurity: Warning. Pattern match "/1\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1543"] [id "900921"] [msg "temporary TUW-72162 logging rule"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/1.php"] [unique_id "alxea8u1nEoSSDHiOXbbWQAAARk"]
[Sat Jul 18 23:19:39.241410 2026] [security2:error] [pid 830701:tid 830846] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/1.php"] [unique_id "alxea8u1nEoSSDHiOXbbWQAAARk"]
[Sat Jul 18 23:19:39.241478 2026] [security2:error] [pid 830701:tid 830846] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/1.php"] [unique_id "alxea8u1nEoSSDHiOXbbWQAAARk"]
[Sat Jul 18 23:19:39.372576 2026] [security2:error] [pid 830701:tid 830890] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/900.php"] [unique_id "alxea8u1nEoSSDHiOXbbXgAAAUU"]
[Sat Jul 18 23:19:39.372661 2026] [security2:error] [pid 830701:tid 830890] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/900.php"] [unique_id "alxea8u1nEoSSDHiOXbbXgAAAUU"]
[Sat Jul 18 23:19:39.428924 2026] [security2:error] [pid 830701:tid 830865] [client 31.171.130.6:59655] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/akcc.php"] [unique_id "alxea8u1nEoSSDHiOXbbYAAAASw"]
[Sat Jul 18 23:19:39.497198 2026] [security2:error] [pid 830701:tid 830939] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/file59.php"] [unique_id "alxea8u1nEoSSDHiOXbbZAAAAXY"]
[Sat Jul 18 23:19:39.497283 2026] [security2:error] [pid 830701:tid 830939] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/file59.php"] [unique_id "alxea8u1nEoSSDHiOXbbZAAAAXY"]
[Sat Jul 18 23:19:39.546625 2026] [security2:error] [pid 830701:tid 830835] [client 31.171.130.39:20713] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/class-t.api.php"] [unique_id "alxea8u1nEoSSDHiOXbbaAAAAQ4"]
[Sat Jul 18 23:19:39.610986 2026] [security2:error] [pid 830701:tid 830858] [client 31.171.130.42:63951] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/akcc.php"] [unique_id "alxea8u1nEoSSDHiOXbbbAAAASU"]
[Sat Jul 18 23:19:39.611206 2026] [security2:error] [pid 830701:tid 830911] [client 31.171.130.9:43433] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/akcc.php"] [unique_id "alxea8u1nEoSSDHiOXbbbQAAAVo"]
[Sat Jul 18 23:19:39.614607 2026] [security2:error] [pid 830701:tid 830867] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/amxloxxr.php"] [unique_id "alxea8u1nEoSSDHiOXbbbgAAAS4"]
[Sat Jul 18 23:19:39.614673 2026] [security2:error] [pid 830701:tid 830867] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/amxloxxr.php"] [unique_id "alxea8u1nEoSSDHiOXbbbgAAAS4"]
[Sat Jul 18 23:19:39.626943 2026] [security2:error] [pid 830701:tid 830853] [client 31.171.130.46:48153] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/class-t.api.php"] [unique_id "alxea8u1nEoSSDHiOXbbbwAAASA"]
[Sat Jul 18 23:19:39.660321 2026] [security2:error] [pid 830701:tid 830958] [client 31.171.130.5:20453] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/gifclass.php"] [unique_id "alxea8u1nEoSSDHiOXbbdwAAAYk"]
[Sat Jul 18 23:19:39.689725 2026] [security2:error] [pid 830701:tid 830929] [client 31.171.130.31:52109] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/akcc.php"] [unique_id "alxea8u1nEoSSDHiOXbbewAAAWw"]
[Sat Jul 18 23:19:39.733250 2026] [security2:error] [pid 830701:tid 830832] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/aboutc.php"] [unique_id "alxea8u1nEoSSDHiOXbbfAAAAQs"]
[Sat Jul 18 23:19:39.733326 2026] [security2:error] [pid 830701:tid 830832] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/aboutc.php"] [unique_id "alxea8u1nEoSSDHiOXbbfAAAAQs"]
[Sat Jul 18 23:19:39.853641 2026] [security2:error] [pid 830701:tid 830889] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/bless18.php"] [unique_id "alxea8u1nEoSSDHiOXbbhQAAAUQ"]
[Sat Jul 18 23:19:39.853729 2026] [security2:error] [pid 830701:tid 830889] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/bless18.php"] [unique_id "alxea8u1nEoSSDHiOXbbhQAAAUQ"]
[Sat Jul 18 23:19:39.936800 2026] [security2:error] [pid 830701:tid 830881] [client 119.154.81.234:58232] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxea8u1nEoSSDHiOXbbiAAAATw"]
[Sat Jul 18 23:19:39.937069 2026] [security2:error] [pid 830701:tid 830881] [client 119.154.81.234:58232] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxea8u1nEoSSDHiOXbbiAAAATw"]
[Sat Jul 18 23:19:39.970117 2026] [security2:error] [pid 830701:tid 830898] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/crgio.php"] [unique_id "alxea8u1nEoSSDHiOXbbiQAAAU0"]
[Sat Jul 18 23:19:39.970256 2026] [security2:error] [pid 830701:tid 830898] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/crgio.php"] [unique_id "alxea8u1nEoSSDHiOXbbiQAAAU0"]
[Sat Jul 18 23:19:40.032406 2026] [security2:error] [pid 830701:tid 830885] [client 31.171.130.25:48059] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/abcd.php"] [unique_id "alxebMu1nEoSSDHiOXbbjQAAAUA"]
[Sat Jul 18 23:19:40.091161 2026] [security2:error] [pid 830701:tid 830846] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-act.php"] [unique_id "alxebMu1nEoSSDHiOXbbjwAAARk"]
[Sat Jul 18 23:19:40.091257 2026] [security2:error] [pid 830701:tid 830846] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-act.php"] [unique_id "alxebMu1nEoSSDHiOXbbjwAAARk"]
[Sat Jul 18 23:19:40.132580 2026] [security2:error] [pid 830701:tid 830926] [client 103.48.44.9:52485] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxebMu1nEoSSDHiOXbbkQAAAWk"]
[Sat Jul 18 23:19:40.132656 2026] [security2:error] [pid 830701:tid 830926] [client 103.48.44.9:52485] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxebMu1nEoSSDHiOXbbkQAAAWk"]
[Sat Jul 18 23:19:40.175811 2026] [security2:error] [pid 830701:tid 830847] [client 31.171.130.37:62897] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/blurbs.php"] [unique_id "alxebMu1nEoSSDHiOXbblQAAARo"]
[Sat Jul 18 23:19:40.207271 2026] [security2:error] [pid 830701:tid 830845] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/new4.php"] [unique_id "alxebMu1nEoSSDHiOXbbmAAAARg"]
[Sat Jul 18 23:19:40.207383 2026] [security2:error] [pid 830701:tid 830845] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/new4.php"] [unique_id "alxebMu1nEoSSDHiOXbbmAAAARg"]
[Sat Jul 18 23:19:40.305533 2026] [security2:error] [pid 830701:tid 830836] [client 31.171.130.52:30471] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/abcd.php"] [unique_id "alxebMu1nEoSSDHiOXbbnQAAAQ8"]
[Sat Jul 18 23:19:40.310855 2026] [security2:error] [pid 830701:tid 830940] [client 31.171.130.2:26969] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/abcd.php"] [unique_id "alxebMu1nEoSSDHiOXbbngAAAXc"]
[Sat Jul 18 23:19:40.329744 2026] [security2:error] [pid 830701:tid 830900] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-the.php"] [unique_id "alxebMu1nEoSSDHiOXbbowAAAU8"]
[Sat Jul 18 23:19:40.329845 2026] [security2:error] [pid 830701:tid 830900] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-the.php"] [unique_id "alxebMu1nEoSSDHiOXbbowAAAU8"]
[Sat Jul 18 23:19:40.337458 2026] [security2:error] [pid 830701:tid 830956] [client 31.171.130.23:30305] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/blurbs.php"] [unique_id "alxebMu1nEoSSDHiOXbbpQAAAYc"]
[Sat Jul 18 23:19:40.340574 2026] [security2:error] [pid 830701:tid 830892] [client 31.171.130.45:48543] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/bless.php"] [unique_id "alxebMu1nEoSSDHiOXbbpwAAAUc"]
[Sat Jul 18 23:19:40.363494 2026] [security2:error] [pid 830701:tid 830858] [client 31.171.130.20:49515] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/abcd.php"] [unique_id "alxebMu1nEoSSDHiOXbbqgAAASU"]
[Sat Jul 18 23:19:40.445900 2026] [security2:error] [pid 830701:tid 830882] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/atkno.php"] [unique_id "alxebMu1nEoSSDHiOXbbrgAAAT0"]
[Sat Jul 18 23:19:40.446006 2026] [security2:error] [pid 830701:tid 830882] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/atkno.php"] [unique_id "alxebMu1nEoSSDHiOXbbrgAAAT0"]
[Sat Jul 18 23:19:40.541950 2026] [security2:error] [pid 830701:tid 830840] [client 31.171.130.10:44273] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/shelp.php"] [unique_id "alxebMu1nEoSSDHiOXbbswAAARM"]
[Sat Jul 18 23:19:40.568433 2026] [security2:error] [pid 830701:tid 830905] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/mass.php"] [unique_id "alxebMu1nEoSSDHiOXbbtAAAAVQ"]
[Sat Jul 18 23:19:40.568524 2026] [security2:error] [pid 830701:tid 830905] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/mass.php"] [unique_id "alxebMu1nEoSSDHiOXbbtAAAAVQ"]
[Sat Jul 18 23:19:40.672491 2026] [security2:error] [pid 830701:tid 830895] [client 31.171.130.27:30753] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/akcc.php"] [unique_id "alxebMu1nEoSSDHiOXbbvgAAAUo"]
[Sat Jul 18 23:19:40.684240 2026] [security2:error] [pid 830701:tid 830866] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wefile.php"] [unique_id "alxebMu1nEoSSDHiOXbbvwAAAS0"]
[Sat Jul 18 23:19:40.684327 2026] [security2:error] [pid 830701:tid 830866] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wefile.php"] [unique_id "alxebMu1nEoSSDHiOXbbvwAAAS0"]
[Sat Jul 18 23:19:40.798926 2026] [security2:error] [pid 830701:tid 830898] [client 31.171.130.15:30055] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/shelp.php"] [unique_id "alxebMu1nEoSSDHiOXbbwQAAAU0"]
[Sat Jul 18 23:19:40.799896 2026] [security2:error] [pid 830701:tid 830860] [client 31.171.130.43:30827] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/shelp.php"] [unique_id "alxebMu1nEoSSDHiOXbbwgAAASc"]
[Sat Jul 18 23:19:40.801210 2026] [security2:error] [pid 830701:tid 830885] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/min.php"] [unique_id "alxebMu1nEoSSDHiOXbbwwAAAUA"]
[Sat Jul 18 23:19:40.801295 2026] [security2:error] [pid 830701:tid 830885] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/min.php"] [unique_id "alxebMu1nEoSSDHiOXbbwwAAAUA"]
[Sat Jul 18 23:19:40.821100 2026] [security2:error] [pid 830701:tid 830916] [client 31.171.130.4:42729] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/akcc.php"] [unique_id "alxebMu1nEoSSDHiOXbbxAAAAV8"]
[Sat Jul 18 23:19:40.830064 2026] [security2:error] [pid 830701:tid 830846] [client 31.171.130.50:57181] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/class-t.api.php"] [unique_id "alxebMu1nEoSSDHiOXbbxQAAARk"]
[Sat Jul 18 23:19:40.887221 2026] [security2:error] [pid 830701:tid 830926] [client 31.171.130.15:44991] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/shelp.php"] [unique_id "alxebMu1nEoSSDHiOXbbyQAAAWk"]
[Sat Jul 18 23:19:40.916922 2026] [security2:error] [pid 830701:tid 830954] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/sid3.php"] [unique_id "alxebMu1nEoSSDHiOXbbzgAAAYU"]
[Sat Jul 18 23:19:40.917005 2026] [security2:error] [pid 830701:tid 830954] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/sid3.php"] [unique_id "alxebMu1nEoSSDHiOXbbzgAAAYU"]
[Sat Jul 18 23:19:41.032897 2026] [security2:error] [pid 830701:tid 830869] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/fileas.php"] [unique_id "alxebcu1nEoSSDHiOXbb3QAAATA"]
[Sat Jul 18 23:19:41.032978 2026] [security2:error] [pid 830701:tid 830869] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/fileas.php"] [unique_id "alxebcu1nEoSSDHiOXbb3QAAATA"]
[Sat Jul 18 23:19:41.103925 2026] [security2:error] [pid 830701:tid 830923] [client 31.171.130.48:22107] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/cord.php"] [unique_id "alxebcu1nEoSSDHiOXbb5AAAAWY"]
[Sat Jul 18 23:19:41.149543 2026] [security2:error] [pid 830701:tid 830873] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/bless24.php"] [unique_id "alxebcu1nEoSSDHiOXbb5wAAATQ"]
[Sat Jul 18 23:19:41.149636 2026] [security2:error] [pid 830701:tid 830873] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/bless24.php"] [unique_id "alxebcu1nEoSSDHiOXbb5wAAATQ"]
[Sat Jul 18 23:19:41.188966 2026] [security2:error] [pid 830701:tid 830704] [remote 102.134.101.35:44652] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 35.101.134.102.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxebcu1nEoSSDHiOXbb6AABEgI"]
[Sat Jul 18 23:19:41.215174 2026] [security2:error] [pid 830701:tid 830877] [client 31.171.130.30:27795] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/abcd.php"] [unique_id "alxebcu1nEoSSDHiOXbb7gAAATg"]
[Sat Jul 18 23:19:41.234563 2026] [security2:error] [pid 830701:tid 830801] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxebcu1nEoSSDHiOXbb7wABiWM"]
[Sat Jul 18 23:19:41.234692 2026] [security2:error] [pid 830701:tid 830958] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxebcu1nEoSSDHiOXbb7wABiWM"]
[Sat Jul 18 23:19:41.265936 2026] [security2:error] [pid 830701:tid 830852] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/fun.php"] [unique_id "alxebcu1nEoSSDHiOXbb8AAAAR8"]
[Sat Jul 18 23:19:41.266044 2026] [security2:error] [pid 830701:tid 830852] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/fun.php"] [unique_id "alxebcu1nEoSSDHiOXbb8AAAAR8"]
[Sat Jul 18 23:19:41.297581 2026] [security2:error] [pid 830701:tid 830841] [client 31.171.130.40:31159] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/cord.php"] [unique_id "alxebcu1nEoSSDHiOXbb8wAAARQ"]
[Sat Jul 18 23:19:41.297689 2026] [security2:error] [pid 830701:tid 830920] [client 31.171.130.21:61817] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/cord.php"] [unique_id "alxebcu1nEoSSDHiOXbb9AAAAWM"]
[Sat Jul 18 23:19:41.322399 2026] [security2:error] [pid 830701:tid 830895] [client 31.171.130.19:29661] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/blurbs.php"] [unique_id "alxebcu1nEoSSDHiOXbb9QAAAUo"]
[Sat Jul 18 23:19:41.381320 2026] [security2:error] [pid 830701:tid 830888] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/drykl.php"] [unique_id "alxebcu1nEoSSDHiOXbb9wAAAUM"]
[Sat Jul 18 23:19:41.381381 2026] [security2:error] [pid 830701:tid 830888] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/drykl.php"] [unique_id "alxebcu1nEoSSDHiOXbb9wAAAUM"]
[Sat Jul 18 23:19:41.398179 2026] [security2:error] [pid 830701:tid 830844] [client 31.171.130.36:56001] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/cord.php"] [unique_id "alxebcu1nEoSSDHiOXbb-QAAARc"]
[Sat Jul 18 23:19:41.499945 2026] [security2:error] [pid 830701:tid 830934] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "alxebcu1nEoSSDHiOXbcBAAAAXE"]
[Sat Jul 18 23:19:41.500025 2026] [security2:error] [pid 830701:tid 830934] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "alxebcu1nEoSSDHiOXbcBAAAAXE"]
[Sat Jul 18 23:19:41.618662 2026] [security2:error] [pid 830701:tid 830867] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/mifta.php"] [unique_id "alxebcu1nEoSSDHiOXbcDQAAAS4"]
[Sat Jul 18 23:19:41.618781 2026] [security2:error] [pid 830701:tid 830867] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/mifta.php"] [unique_id "alxebcu1nEoSSDHiOXbcDQAAAS4"]
[Sat Jul 18 23:19:41.642462 2026] [security2:error] [pid 830701:tid 830724] [remote 102.134.101.35:44652] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 35.101.134.102.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxebcu1nEoSSDHiOXbcDgABJRY"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:19:41.734634 2026] [security2:error] [pid 830701:tid 830930] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/class-t.api.php"] [unique_id "alxebcu1nEoSSDHiOXbcFAAAAW0"]
[Sat Jul 18 23:19:41.734712 2026] [security2:error] [pid 830701:tid 830930] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/class-t.api.php"] [unique_id "alxebcu1nEoSSDHiOXbcFAAAAW0"]
[Sat Jul 18 23:19:41.855815 2026] [security2:error] [pid 830701:tid 830865] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/vgtyu.php"] [unique_id "alxebcu1nEoSSDHiOXbcGgAAASw"]
[Sat Jul 18 23:19:41.855949 2026] [security2:error] [pid 830701:tid 830865] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/vgtyu.php"] [unique_id "alxebcu1nEoSSDHiOXbcGgAAASw"]
[Sat Jul 18 23:19:41.974649 2026] [security2:error] [pid 830701:tid 830905] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/atomlib.php"] [unique_id "alxebcu1nEoSSDHiOXbcHgAAAVQ"]
[Sat Jul 18 23:19:41.974802 2026] [security2:error] [pid 830701:tid 830905] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/atomlib.php"] [unique_id "alxebcu1nEoSSDHiOXbcHgAAAVQ"]
[Sat Jul 18 23:19:42.007813 2026] [security2:error] [pid 830701:tid 830749] [remote 31.42.184.154:60946] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxebsu1nEoSSDHiOXbcIgABEC8"]
[Sat Jul 18 23:19:42.095772 2026] [security2:error] [pid 830701:tid 830892] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-access.php"] [unique_id "alxebsu1nEoSSDHiOXbcKAAAAUc"]
[Sat Jul 18 23:19:42.095903 2026] [security2:error] [pid 830701:tid 830892] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-access.php"] [unique_id "alxebsu1nEoSSDHiOXbcKAAAAUc"]
[Sat Jul 18 23:19:42.215211 2026] [security2:error] [pid 830701:tid 830881] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-update.php"] [unique_id "alxebsu1nEoSSDHiOXbcNAAAATw"]
[Sat Jul 18 23:19:42.215328 2026] [security2:error] [pid 830701:tid 830881] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-update.php"] [unique_id "alxebsu1nEoSSDHiOXbcNAAAATw"]
[Sat Jul 18 23:19:42.239030 2026] [security2:error] [pid 830701:tid 830953] [client 31.171.130.23:20635] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/dex.php"] [unique_id "alxebsu1nEoSSDHiOXbcNQAAAYQ"]
[Sat Jul 18 23:19:42.247686 2026] [security2:error] [pid 830701:tid 830766] [remote 31.42.184.154:60946] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxebsu1nEoSSDHiOXbcNgABX0A"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:19:42.247894 2026] [security2:error] [pid 830701:tid 830876] [client 31.171.130.30:61125] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/shelp.php"] [unique_id "alxebsu1nEoSSDHiOXbcNwAAATc"]
[Sat Jul 18 23:19:42.281942 2026] [security2:error] [pid 830701:tid 830926] [client 31.171.130.36:26733] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/dex.php"] [unique_id "alxebsu1nEoSSDHiOXbcOQAAAWk"]
[Sat Jul 18 23:19:42.291844 2026] [security2:error] [pid 830701:tid 830941] [client 31.171.130.23:34571] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/dex.php"] [unique_id "alxebsu1nEoSSDHiOXbcOwAAAXg"]
[Sat Jul 18 23:19:42.331897 2026] [security2:error] [pid 830701:tid 830917] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/erty.php"] [unique_id "alxebsu1nEoSSDHiOXbcPgAAAWA"]
[Sat Jul 18 23:19:42.331984 2026] [security2:error] [pid 830701:tid 830917] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/erty.php"] [unique_id "alxebsu1nEoSSDHiOXbcPgAAAWA"]
[Sat Jul 18 23:19:42.348585 2026] [security2:error] [pid 830701:tid 830878] [client 31.171.130.10:51727] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/akcc.php"] [unique_id "alxebsu1nEoSSDHiOXbcPwAAATk"]
[Sat Jul 18 23:19:42.394631 2026] [security2:error] [pid 830701:tid 830946] [client 31.171.130.29:20999] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/dex.php"] [unique_id "alxebsu1nEoSSDHiOXbcQgAAAX0"]
[Sat Jul 18 23:19:42.450986 2026] [security2:error] [pid 830701:tid 830872] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "alxebsu1nEoSSDHiOXbcQwAAATM"]
[Sat Jul 18 23:19:42.451097 2026] [security2:error] [pid 830701:tid 830872] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "alxebsu1nEoSSDHiOXbcQwAAATM"]
[Sat Jul 18 23:19:42.455463 2026] [security2:error] [pid 830701:tid 830850] [client 31.171.130.15:49485] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/abcd.php"] [unique_id "alxebsu1nEoSSDHiOXbcRAAAAR0"]
[Sat Jul 18 23:19:42.567950 2026] [security2:error] [pid 830701:tid 830849] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/like.php"] [unique_id "alxebsu1nEoSSDHiOXbcSQAAARw"]
[Sat Jul 18 23:19:42.568046 2026] [security2:error] [pid 830701:tid 830849] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/like.php"] [unique_id "alxebsu1nEoSSDHiOXbcSQAAARw"]
[Sat Jul 18 23:19:42.683643 2026] [security2:error] [pid 830701:tid 830857] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/bless5.php"] [unique_id "alxebsu1nEoSSDHiOXbcVAAAASQ"]
[Sat Jul 18 23:19:42.683768 2026] [security2:error] [pid 830701:tid 830857] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/bless5.php"] [unique_id "alxebsu1nEoSSDHiOXbcVAAAASQ"]
[Sat Jul 18 23:19:42.716778 2026] [security2:error] [pid 830701:tid 830933] [client 31.171.130.26:61811] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxebsu1nEoSSDHiOXbcVQAAAXA"]
[Sat Jul 18 23:19:42.721223 2026] [security2:error] [pid 830701:tid 830837] [client 31.171.130.34:41215] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/cord.php"] [unique_id "alxebsu1nEoSSDHiOXbcVgAAARA"]
[Sat Jul 18 23:19:42.764722 2026] [security2:error] [pid 830701:tid 830942] [client 31.171.130.42:25645] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxebsu1nEoSSDHiOXbcWAAAAXk"]
[Sat Jul 18 23:19:42.785133 2026] [security2:error] [pid 830701:tid 830958] [client 31.171.130.26:55153] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxebsu1nEoSSDHiOXbcWQAAAYk"]
[Sat Jul 18 23:19:42.800735 2026] [security2:error] [pid 830701:tid 830914] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/t.php"] [unique_id "alxebsu1nEoSSDHiOXbcWgAAAV0"]
[Sat Jul 18 23:19:42.800852 2026] [security2:error] [pid 830701:tid 830914] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/t.php"] [unique_id "alxebsu1nEoSSDHiOXbcWgAAAV0"]
[Sat Jul 18 23:19:42.825438 2026] [security2:error] [pid 830701:tid 830839] [client 31.171.130.37:48441] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/abcd.php"] [unique_id "alxebsu1nEoSSDHiOXbcXQAAARI"]
[Sat Jul 18 23:19:42.835608 2026] [security2:error] [pid 830701:tid 830877] [client 35.204.135.22:32769] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "www.thh.mtk.mybluehost.me"] [uri "/"] [unique_id "alxebsu1nEoSSDHiOXbcYgAAATg"]
[Sat Jul 18 23:19:42.835727 2026] [security2:error] [pid 830701:tid 830877] [client 35.204.135.22:32769] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "www.thh.mtk.mybluehost.me"] [uri "/"] [unique_id "alxebsu1nEoSSDHiOXbcYgAAATg"]
[Sat Jul 18 23:19:42.911552 2026] [security2:error] [pid 830701:tid 830953] [client 31.171.130.37:56201] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxebsu1nEoSSDHiOXbcZwAAAYQ"]
[Sat Jul 18 23:19:42.916694 2026] [security2:error] [pid 830701:tid 830916] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/xoot.php"] [unique_id "alxebsu1nEoSSDHiOXbcaAAAAV8"]
[Sat Jul 18 23:19:42.916866 2026] [security2:error] [pid 830701:tid 830916] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/xoot.php"] [unique_id "alxebsu1nEoSSDHiOXbcaAAAAV8"]
[Sat Jul 18 23:19:42.984574 2026] [security2:error] [pid 830701:tid 830864] [client 31.171.130.5:27721] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/shelp.php"] [unique_id "alxebsu1nEoSSDHiOXbcbwAAASs"]
[Sat Jul 18 23:19:43.033647 2026] [security2:error] [pid 830701:tid 830880] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/xqq.php"] [unique_id "alxeb8u1nEoSSDHiOXbccgAAATs"]
[Sat Jul 18 23:19:43.033765 2026] [security2:error] [pid 830701:tid 830880] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/xqq.php"] [unique_id "alxeb8u1nEoSSDHiOXbccgAAATs"]
[Sat Jul 18 23:19:43.149995 2026] [security2:error] [pid 830701:tid 830900] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-load.php"] [unique_id "alxeb8u1nEoSSDHiOXbcfQAAAU8"]
[Sat Jul 18 23:19:43.150084 2026] [security2:error] [pid 830701:tid 830900] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-load.php"] [unique_id "alxeb8u1nEoSSDHiOXbcfQAAAU8"]
[Sat Jul 18 23:19:43.203980 2026] [security2:error] [pid 830701:tid 830911] [client 31.171.130.38:42095] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/dex.php"] [unique_id "alxeb8u1nEoSSDHiOXbcfgAAAVo"]
[Sat Jul 18 23:19:43.207428 2026] [security2:error] [pid 830701:tid 830896] [client 31.171.130.19:62673] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/zwso.php"] [unique_id "alxeb8u1nEoSSDHiOXbcfwAAAUs"]
[Sat Jul 18 23:19:43.249089 2026] [security2:error] [pid 830701:tid 830893] [client 31.171.130.35:24359] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/zwso.php"] [unique_id "alxeb8u1nEoSSDHiOXbchAAAAUg"]
[Sat Jul 18 23:19:43.266169 2026] [security2:error] [pid 830701:tid 830899] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/x.php"] [unique_id "alxeb8u1nEoSSDHiOXbchQAAAU4"]
[Sat Jul 18 23:19:43.266275 2026] [security2:error] [pid 830701:tid 830899] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/x.php"] [unique_id "alxeb8u1nEoSSDHiOXbchQAAAU4"]
[Sat Jul 18 23:19:43.271524 2026] [security2:error] [pid 830701:tid 830906] [client 31.171.130.13:22393] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/zwso.php"] [unique_id "alxeb8u1nEoSSDHiOXbciAAAAVU"]
[Sat Jul 18 23:19:43.285383 2026] [security2:error] [pid 830701:tid 830863] [client 124.29.246.106:62351] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxeb8u1nEoSSDHiOXbcigAAASo"]
[Sat Jul 18 23:19:43.285478 2026] [security2:error] [pid 830701:tid 830863] [client 124.29.246.106:62351] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxeb8u1nEoSSDHiOXbcigAAASo"]
[Sat Jul 18 23:19:43.298159 2026] [security2:error] [pid 830701:tid 830793] [remote 31.42.184.154:60968] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.pfl.ail.mybluehost.me"] [uri "/wp-includes/xmlrpc.php"] [unique_id "alxeb8u1nEoSSDHiOXbcjQABgls"]
[Sat Jul 18 23:19:43.298305 2026] [security2:error] [pid 830701:tid 830951] [client 31.42.184.154:60968] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "mail.pfl.ail.mybluehost.me"] [uri "/wp-includes/xmlrpc.php"] [unique_id "alxeb8u1nEoSSDHiOXbcjQABgls"]
[Sat Jul 18 23:19:43.305453 2026] [security2:error] [pid 830701:tid 830865] [client 31.171.130.1:38577] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/shelp.php"] [unique_id "alxeb8u1nEoSSDHiOXbckAAAASw"]
[Sat Jul 18 23:19:43.382325 2026] [security2:error] [pid 830701:tid 830939] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/i.php"] [unique_id "alxeb8u1nEoSSDHiOXbclAAAAXY"]
[Sat Jul 18 23:19:43.382415 2026] [security2:error] [pid 830701:tid 830939] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/i.php"] [unique_id "alxeb8u1nEoSSDHiOXbclAAAAXY"]
[Sat Jul 18 23:19:43.472448 2026] [security2:error] [pid 830701:tid 830848] [client 31.171.130.28:41903] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/zwso.php"] [unique_id "alxeb8u1nEoSSDHiOXbclwAAARs"]
[Sat Jul 18 23:19:43.498331 2026] [security2:error] [pid 830701:tid 830892] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/ms-edit.php"] [unique_id "alxeb8u1nEoSSDHiOXbcmQAAAUc"]
[Sat Jul 18 23:19:43.498443 2026] [security2:error] [pid 830701:tid 830892] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/ms-edit.php"] [unique_id "alxeb8u1nEoSSDHiOXbcmQAAAUc"]
[Sat Jul 18 23:19:43.614612 2026] [security2:error] [pid 830701:tid 830853] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/v2.php"] [unique_id "alxeb8u1nEoSSDHiOXbcnQAAASA"]
[Sat Jul 18 23:19:43.614733 2026] [security2:error] [pid 830701:tid 830853] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/v2.php"] [unique_id "alxeb8u1nEoSSDHiOXbcnQAAASA"]
[Sat Jul 18 23:19:43.704901 2026] [security2:error] [pid 830701:tid 830890] [client 31.171.130.20:39495] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxeb8u1nEoSSDHiOXbcpgAAAUU"]
[Sat Jul 18 23:19:43.730903 2026] [security2:error] [pid 830701:tid 830872] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/new.php"] [unique_id "alxeb8u1nEoSSDHiOXbcqgAAATM"]
[Sat Jul 18 23:19:43.730984 2026] [security2:error] [pid 830701:tid 830872] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/new.php"] [unique_id "alxeb8u1nEoSSDHiOXbcqgAAATM"]
[Sat Jul 18 23:19:43.747285 2026] [security2:error] [pid 830701:tid 830836] [client 31.171.130.24:30711] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxeb8u1nEoSSDHiOXbcqwAAAQ8"]
[Sat Jul 18 23:19:43.820300 2026] [security2:error] [pid 830701:tid 830928] [client 31.171.130.35:50499] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/cord.php"] [unique_id "alxeb8u1nEoSSDHiOXbcrwAAAWs"]
[Sat Jul 18 23:19:43.847774 2026] [security2:error] [pid 830701:tid 830879] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-admin/network/edit.php"] [unique_id "alxeb8u1nEoSSDHiOXbcsgAAATo"]
[Sat Jul 18 23:19:43.847924 2026] [security2:error] [pid 830701:tid 830879] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-admin/network/edit.php"] [unique_id "alxeb8u1nEoSSDHiOXbcsgAAATo"]
[Sat Jul 18 23:19:43.877465 2026] [security2:error] [pid 830701:tid 830764] [remote 154.61.75.100:45428] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxeb8u1nEoSSDHiOXbctAABFz4"]
[Sat Jul 18 23:19:43.890310 2026] [security2:error] [pid 830701:tid 830930] [client 116.179.32.107:54078] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.vfcthomasville.org"] [uri "/index.php"] [unique_id "alxeb8u1nEoSSDHiOXbcsQABbUc"]
[Sat Jul 18 23:19:43.955687 2026] [security2:error] [pid 830701:tid 830940] [client 31.171.130.26:40239] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxeb8u1nEoSSDHiOXbctgAAAXc"]
[Sat Jul 18 23:19:43.963871 2026] [security2:error] [pid 830701:tid 830899] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/pouhg.php"] [unique_id "alxeb8u1nEoSSDHiOXbctwAAAU4"]
[Sat Jul 18 23:19:43.963997 2026] [security2:error] [pid 830701:tid 830899] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/pouhg.php"] [unique_id "alxeb8u1nEoSSDHiOXbctwAAAU4"]
[Sat Jul 18 23:19:44.027004 2026] [security2:error] [pid 830701:tid 830832] [client 34.91.36.231:24576] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "autodiscover.amalia-capital.com"] [uri "/"] [unique_id "alxecMu1nEoSSDHiOXbcuAAAAQs"]
[Sat Jul 18 23:19:44.027076 2026] [security2:error] [pid 830701:tid 830832] [client 34.91.36.231:24576] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "autodiscover.amalia-capital.com"] [uri "/"] [unique_id "alxecMu1nEoSSDHiOXbcuAAAAQs"]
[Sat Jul 18 23:19:44.080276 2026] [security2:error] [pid 830701:tid 830884] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/cilus.php"] [unique_id "alxecMu1nEoSSDHiOXbcugAAAT8"]
[Sat Jul 18 23:19:44.080344 2026] [security2:error] [pid 830701:tid 830884] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/cilus.php"] [unique_id "alxecMu1nEoSSDHiOXbcugAAAT8"]
[Sat Jul 18 23:19:44.182589 2026] [security2:error] [pid 830701:tid 830895] [client 31.171.130.41:31195] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/zwso.php"] [unique_id "alxecMu1nEoSSDHiOXbcxAAAAUo"]
[Sat Jul 18 23:19:44.196284 2026] [security2:error] [pid 830701:tid 830925] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/file4.php"] [unique_id "alxecMu1nEoSSDHiOXbcxQAAAWg"]
[Sat Jul 18 23:19:44.196373 2026] [security2:error] [pid 830701:tid 830925] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/file4.php"] [unique_id "alxecMu1nEoSSDHiOXbcxQAAAWg"]
[Sat Jul 18 23:19:44.237378 2026] [security2:error] [pid 830701:tid 830870] [client 31.171.130.2:25319] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/bolt.php"] [unique_id "alxecMu1nEoSSDHiOXbcyAAAATE"]
[Sat Jul 18 23:19:44.296738 2026] [security2:error] [pid 830701:tid 830924] [client 31.171.130.11:52395] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/dex.php"] [unique_id "alxecMu1nEoSSDHiOXbcyQAAAWc"]
[Sat Jul 18 23:19:44.312842 2026] [security2:error] [pid 830701:tid 830892] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/samll.php"] [unique_id "alxecMu1nEoSSDHiOXbczQAAAUc"]
[Sat Jul 18 23:19:44.312988 2026] [security2:error] [pid 830701:tid 830892] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/samll.php"] [unique_id "alxecMu1nEoSSDHiOXbczQAAAUc"]
[Sat Jul 18 23:19:44.371166 2026] [security2:error] [pid 830701:tid 830840] [client 31.171.130.10:34625] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/gifclass.php"] [unique_id "alxecMu1nEoSSDHiOXbc0AAAARM"]
[Sat Jul 18 23:19:44.429208 2026] [security2:error] [pid 830701:tid 830876] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/Okxob.php"] [unique_id "alxecMu1nEoSSDHiOXbc1wAAATc"]
[Sat Jul 18 23:19:44.429306 2026] [security2:error] [pid 830701:tid 830876] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/Okxob.php"] [unique_id "alxecMu1nEoSSDHiOXbc1wAAATc"]
[Sat Jul 18 23:19:44.448505 2026] [security2:error] [pid 830701:tid 830941] [client 31.171.130.14:41315] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/bolt.php"] [unique_id "alxecMu1nEoSSDHiOXbc2AAAAXg"]
[Sat Jul 18 23:19:44.511918 2026] [security2:error] [pid 830701:tid 830739] [remote 154.61.75.100:45428] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxecMu1nEoSSDHiOXbc2gABOSU"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:19:44.563190 2026] [security2:error] [pid 830701:tid 830864] [client 31.171.130.16:42351] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/cord.php"] [unique_id "alxecMu1nEoSSDHiOXbc2wAAASs"]
[Sat Jul 18 23:19:44.571319 2026] [security2:error] [pid 830701:tid 830932] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/ok.php"] [unique_id "alxecMu1nEoSSDHiOXbc3QAAAW8"]
[Sat Jul 18 23:19:44.571404 2026] [security2:error] [pid 830701:tid 830932] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/ok.php"] [unique_id "alxecMu1nEoSSDHiOXbc3QAAAW8"]
[Sat Jul 18 23:19:44.672619 2026] [security2:error] [pid 830701:tid 830907] [client 31.171.130.13:29891] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxecMu1nEoSSDHiOXbc5wAAAVY"]
[Sat Jul 18 23:19:44.687784 2026] [security2:error] [pid 830701:tid 830871] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wuasr.php"] [unique_id "alxecMu1nEoSSDHiOXbc7AAAATI"]
[Sat Jul 18 23:19:44.687873 2026] [security2:error] [pid 830701:tid 830871] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wuasr.php"] [unique_id "alxecMu1nEoSSDHiOXbc7AAAATI"]
[Sat Jul 18 23:19:44.717156 2026] [security2:error] [pid 830701:tid 830859] [client 31.171.130.5:20459] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/cjfuns.php"] [unique_id "alxecMu1nEoSSDHiOXbc7wAAASY"]
[Sat Jul 18 23:19:44.773177 2026] [security2:error] [pid 830701:tid 830943] [client 31.171.130.17:61469] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxecMu1nEoSSDHiOXbc9QAAAXo"]
[Sat Jul 18 23:19:44.804169 2026] [security2:error] [pid 830701:tid 830837] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/bless11.php"] [unique_id "alxecMu1nEoSSDHiOXbc-QAAARA"]
[Sat Jul 18 23:19:44.804257 2026] [security2:error] [pid 830701:tid 830837] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/bless11.php"] [unique_id "alxecMu1nEoSSDHiOXbc-QAAARA"]
[Sat Jul 18 23:19:44.837465 2026] [security2:error] [pid 830701:tid 830956] [client 188.39.109.162:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxecMu1nEoSSDHiOXbc7QAAAYc"]
[Sat Jul 18 23:19:44.846055 2026] [security2:error] [pid 830701:tid 830939] [client 31.171.130.15:36395] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxecMu1nEoSSDHiOXbc-wAAAXY"]
[Sat Jul 18 23:19:44.852698 2026] [security2:error] [pid 830701:tid 830895] [client 31.171.130.15:64269] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/bless.php"] [unique_id "alxecMu1nEoSSDHiOXbc_AAAAUo"]
[Sat Jul 18 23:19:44.920222 2026] [security2:error] [pid 830701:tid 830938] [client 31.171.130.46:39793] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/cjfuns.php"] [unique_id "alxecMu1nEoSSDHiOXbdAQAAAXU"]
[Sat Jul 18 23:19:44.920267 2026] [security2:error] [pid 830701:tid 830952] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-block.php"] [unique_id "alxecMu1nEoSSDHiOXbdAgAAAYM"]
[Sat Jul 18 23:19:44.920340 2026] [security2:error] [pid 830701:tid 830952] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-block.php"] [unique_id "alxecMu1nEoSSDHiOXbdAgAAAYM"]
[Sat Jul 18 23:19:45.036384 2026] [security2:error] [pid 830701:tid 830947] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/aevly.php"] [unique_id "alxeccu1nEoSSDHiOXbdBgAAAX4"]
[Sat Jul 18 23:19:45.036485 2026] [security2:error] [pid 830701:tid 830947] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/aevly.php"] [unique_id "alxeccu1nEoSSDHiOXbdBgAAAX4"]
[Sat Jul 18 23:19:45.147553 2026] [security2:error] [pid 830701:tid 830867] [client 31.171.130.23:42953] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/bolt.php"] [unique_id "alxeccu1nEoSSDHiOXbdEwAAAS4"]
[Sat Jul 18 23:19:45.156736 2026] [security2:error] [pid 830701:tid 830836] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/hello.php"] [unique_id "alxeccu1nEoSSDHiOXbdFQAAAQ8"]
[Sat Jul 18 23:19:45.156841 2026] [security2:error] [pid 830701:tid 830836] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/hello.php"] [unique_id "alxeccu1nEoSSDHiOXbdFQAAAQ8"]
[Sat Jul 18 23:19:45.194935 2026] [security2:error] [pid 830701:tid 830883] [client 31.171.130.39:52847] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxeccu1nEoSSDHiOXbdFwAAAT4"]
[Sat Jul 18 23:19:45.254363 2026] [security2:error] [pid 830701:tid 830898] [client 31.171.130.49:29901] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/bolt.php"] [unique_id "alxeccu1nEoSSDHiOXbdHgAAAU0"]
[Sat Jul 18 23:19:45.273270 2026] [security2:error] [pid 830701:tid 830946] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-links-opml.php"] [unique_id "alxeccu1nEoSSDHiOXbdHwAAAX0"]
[Sat Jul 18 23:19:45.273396 2026] [security2:error] [pid 830701:tid 830946] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-links-opml.php"] [unique_id "alxeccu1nEoSSDHiOXbdHwAAAX0"]
[Sat Jul 18 23:19:45.326075 2026] [security2:error] [pid 830701:tid 830905] [client 31.171.130.28:59483] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/bolt.php"] [unique_id "alxeccu1nEoSSDHiOXbdIgAAAVQ"]
[Sat Jul 18 23:19:45.329862 2026] [security2:error] [pid 830701:tid 830852] [client 31.171.130.5:39441] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/class-t.api.php"] [unique_id "alxeccu1nEoSSDHiOXbdIwAAAR8"]
[Sat Jul 18 23:19:45.389989 2026] [security2:error] [pid 830701:tid 830958] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/forbidals.php"] [unique_id "alxeccu1nEoSSDHiOXbdKQAAAYk"]
[Sat Jul 18 23:19:45.390129 2026] [security2:error] [pid 830701:tid 830958] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/forbidals.php"] [unique_id "alxeccu1nEoSSDHiOXbdKQAAAYk"]
[Sat Jul 18 23:19:45.390437 2026] [security2:error] [pid 830701:tid 830899] [client 34.91.129.93:24577] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "webdisk.olearyplumbingllc.com"] [uri "/"] [unique_id "alxeccu1nEoSSDHiOXbdKgAAAU4"]
[Sat Jul 18 23:19:45.390497 2026] [security2:error] [pid 830701:tid 830899] [client 34.91.129.93:24577] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "webdisk.olearyplumbingllc.com"] [uri "/"] [unique_id "alxeccu1nEoSSDHiOXbdKgAAAU4"]
[Sat Jul 18 23:19:45.405712 2026] [security2:error] [pid 830701:tid 830939] [client 31.171.130.15:56103] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxeccu1nEoSSDHiOXbdLAAAAXY"]
[Sat Jul 18 23:19:45.506490 2026] [security2:error] [pid 830701:tid 830936] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/file30.php"] [unique_id "alxeccu1nEoSSDHiOXbdMwAAAXM"]
[Sat Jul 18 23:19:45.506583 2026] [security2:error] [pid 830701:tid 830936] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/file30.php"] [unique_id "alxeccu1nEoSSDHiOXbdMwAAAXM"]
[Sat Jul 18 23:19:45.623227 2026] [security2:error] [pid 830701:tid 830880] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/xda.php"] [unique_id "alxeccu1nEoSSDHiOXbdOAAAATs"]
[Sat Jul 18 23:19:45.623366 2026] [security2:error] [pid 830701:tid 830880] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/xda.php"] [unique_id "alxeccu1nEoSSDHiOXbdOAAAATs"]
[Sat Jul 18 23:19:45.678840 2026] [security2:error] [pid 830701:tid 830838] [client 31.171.130.21:56063] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxeccu1nEoSSDHiOXbdQQAAARE"]
[Sat Jul 18 23:19:45.719954 2026] [security2:error] [pid 830701:tid 830841] [client 31.171.130.9:28465] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/cjfuns.php"] [unique_id "alxeccu1nEoSSDHiOXbdRAAAARQ"]
[Sat Jul 18 23:19:45.740346 2026] [security2:error] [pid 830701:tid 830864] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/z.php"] [unique_id "alxeccu1nEoSSDHiOXbdRgAAASs"]
[Sat Jul 18 23:19:45.740448 2026] [security2:error] [pid 830701:tid 830864] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/z.php"] [unique_id "alxeccu1nEoSSDHiOXbdRgAAASs"]
[Sat Jul 18 23:19:45.742744 2026] [security2:error] [pid 830701:tid 830860] [client 31.171.130.20:45373] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/cjfuns.php"] [unique_id "alxeccu1nEoSSDHiOXbdRwAAASc"]
[Sat Jul 18 23:19:45.789099 2026] [security2:error] [pid 830701:tid 830916] [client 223.228.182.224:51379] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxeccu1nEoSSDHiOXbdSwAAAV8"]
[Sat Jul 18 23:19:45.789243 2026] [security2:error] [pid 830701:tid 830916] [client 223.228.182.224:51379] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxeccu1nEoSSDHiOXbdSwAAAV8"]
[Sat Jul 18 23:19:45.810946 2026] [security2:error] [pid 830701:tid 830891] [client 31.171.130.18:46525] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/cjfuns.php"] [unique_id "alxeccu1nEoSSDHiOXbdTAAAAUY"]
[Sat Jul 18 23:19:45.856887 2026] [security2:error] [pid 830701:tid 830866] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/b.php"] [unique_id "alxeccu1nEoSSDHiOXbdUQAAAS0"]
[Sat Jul 18 23:19:45.856993 2026] [security2:error] [pid 830701:tid 830866] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/b.php"] [unique_id "alxeccu1nEoSSDHiOXbdUQAAAS0"]
[Sat Jul 18 23:19:45.893481 2026] [security2:error] [pid 830701:tid 830861] [client 31.171.130.14:63759] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxeccu1nEoSSDHiOXbdVAAAASg"]
[Sat Jul 18 23:19:45.948098 2026] [security2:error] [pid 830701:tid 830893] [client 31.171.130.4:43997] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxeccu1nEoSSDHiOXbdVgAAAUg"]
[Sat Jul 18 23:19:45.975949 2026] [security2:error] [pid 830701:tid 830856] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/edit.php"] [unique_id "alxeccu1nEoSSDHiOXbdWAAAASM"]
[Sat Jul 18 23:19:45.976060 2026] [security2:error] [pid 830701:tid 830856] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/edit.php"] [unique_id "alxeccu1nEoSSDHiOXbdWAAAASM"]
[Sat Jul 18 23:19:46.099494 2026] [security2:error] [pid 830701:tid 830869] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/app.php"] [unique_id "alxecsu1nEoSSDHiOXbdXQAAATA"]
[Sat Jul 18 23:19:46.099603 2026] [security2:error] [pid 830701:tid 830869] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/app.php"] [unique_id "alxecsu1nEoSSDHiOXbdXQAAATA"]
[Sat Jul 18 23:19:46.164999 2026] [security2:error] [pid 830701:tid 830849] [client 31.171.130.43:25691] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/dex.php"] [unique_id "alxecsu1nEoSSDHiOXbdYgAAARw"]
[Sat Jul 18 23:19:46.207521 2026] [security2:error] [pid 830701:tid 830888] [client 31.171.130.25:61019] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxecsu1nEoSSDHiOXbdagAAAUM"]
[Sat Jul 18 23:19:46.215483 2026] [security2:error] [pid 830701:tid 830948] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-png.php"] [unique_id "alxecsu1nEoSSDHiOXbdawAAAX8"]
[Sat Jul 18 23:19:46.215560 2026] [security2:error] [pid 830701:tid 830948] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-png.php"] [unique_id "alxecsu1nEoSSDHiOXbdawAAAX8"]
[Sat Jul 18 23:19:46.216888 2026] [security2:error] [pid 830701:tid 830839] [client 31.171.130.7:35083] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxecsu1nEoSSDHiOXbdbAAAARI"]
[Sat Jul 18 23:19:46.350113 2026] [security2:error] [pid 830701:tid 830951] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/lib.php"] [unique_id "alxecsu1nEoSSDHiOXbdcwAAAYI"]
[Sat Jul 18 23:19:46.350277 2026] [security2:error] [pid 830701:tid 830951] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/lib.php"] [unique_id "alxecsu1nEoSSDHiOXbdcwAAAYI"]
[Sat Jul 18 23:19:46.381852 2026] [security2:error] [pid 830701:tid 830923] [client 31.171.130.34:31135] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/wp-content/index.php"] [unique_id "alxecsu1nEoSSDHiOXbddAAAAWY"]
[Sat Jul 18 23:19:46.440952 2026] [security2:error] [pid 830701:tid 830932] [client 31.171.130.16:47793] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/zwso.php"] [unique_id "alxecsu1nEoSSDHiOXbddwAAAW8"]
[Sat Jul 18 23:19:46.466827 2026] [security2:error] [pid 830701:tid 830845] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/sys.php"] [unique_id "alxecsu1nEoSSDHiOXbdegAAARg"]
[Sat Jul 18 23:19:46.466948 2026] [security2:error] [pid 830701:tid 830845] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/sys.php"] [unique_id "alxecsu1nEoSSDHiOXbdegAAARg"]
[Sat Jul 18 23:19:46.596996 2026] [security2:error] [pid 830701:tid 830844] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/la.php"] [unique_id "alxecsu1nEoSSDHiOXbdfQAAARc"]
[Sat Jul 18 23:19:46.597091 2026] [security2:error] [pid 830701:tid 830844] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/la.php"] [unique_id "alxecsu1nEoSSDHiOXbdfQAAARc"]
[Sat Jul 18 23:19:46.703115 2026] [security2:error] [pid 830701:tid 830893] [client 31.171.130.36:37197] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxecsu1nEoSSDHiOXbdhgAAAUg"]
[Sat Jul 18 23:19:46.719255 2026] [security2:error] [pid 830701:tid 830903] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/tires.php"] [unique_id "alxecsu1nEoSSDHiOXbdigAAAVI"]
[Sat Jul 18 23:19:46.719350 2026] [security2:error] [pid 830701:tid 830903] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/tires.php"] [unique_id "alxecsu1nEoSSDHiOXbdigAAAVI"]
[Sat Jul 18 23:19:46.737595 2026] [security2:error] [pid 830701:tid 830837] [client 31.171.130.45:31247] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxecsu1nEoSSDHiOXbdjAAAARA"]
[Sat Jul 18 23:19:46.838651 2026] [security2:error] [pid 830701:tid 830942] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/lv.php"] [unique_id "alxecsu1nEoSSDHiOXbdlAAAAXk"]
[Sat Jul 18 23:19:46.838741 2026] [security2:error] [pid 830701:tid 830942] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/lv.php"] [unique_id "alxecsu1nEoSSDHiOXbdlAAAAXk"]
[Sat Jul 18 23:19:46.842858 2026] [security2:error] [pid 830701:tid 830902] [client 31.171.130.35:21715] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/blurbs.php"] [unique_id "alxecsu1nEoSSDHiOXbdlQAAAVE"]
[Sat Jul 18 23:19:46.957143 2026] [security2:error] [pid 830701:tid 830848] [client 31.171.130.9:39939] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxecsu1nEoSSDHiOXbdoAAAARs"]
[Sat Jul 18 23:19:46.962061 2026] [security2:error] [pid 830701:tid 830957] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/myfile.php"] [unique_id "alxecsu1nEoSSDHiOXbdogAAAYg"]
[Sat Jul 18 23:19:46.962145 2026] [security2:error] [pid 830701:tid 830957] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/myfile.php"] [unique_id "alxecsu1nEoSSDHiOXbdogAAAYg"]
[Sat Jul 18 23:19:46.999172 2026] [security2:error] [pid 830701:tid 830876] [client 74.7.227.179:51612] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxecsu1nEoSSDHiOXbdlwABN2c"], referer: https://tejasenvironmental.com/p=3047900
[Sat Jul 18 23:19:47.008258 2026] [security2:error] [pid 830701:tid 830884] [client 45.3.45.140:33599] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 140.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxecsu1nEoSSDHiOXbdpQAAAT8"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:19:47.080276 2026] [security2:error] [pid 830701:tid 830932] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/06.php"] [unique_id "alxec8u1nEoSSDHiOXbdpwAAAW8"]
[Sat Jul 18 23:19:47.080410 2026] [security2:error] [pid 830701:tid 830932] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/06.php"] [unique_id "alxec8u1nEoSSDHiOXbdpwAAAW8"]
[Sat Jul 18 23:19:47.185828 2026] [security2:error] [pid 830701:tid 830907] [client 223.185.61.63:16770] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxec8u1nEoSSDHiOXbdrgAAAVY"]
[Sat Jul 18 23:19:47.185952 2026] [security2:error] [pid 830701:tid 830907] [client 223.185.61.63:16770] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxec8u1nEoSSDHiOXbdrgAAAVY"]
[Sat Jul 18 23:19:47.193920 2026] [security2:error] [pid 830701:tid 830941] [client 31.171.130.52:49829] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/wp-content/index.php"] [unique_id "alxec8u1nEoSSDHiOXbdrwAAAXg"]
[Sat Jul 18 23:19:47.200269 2026] [security2:error] [pid 830701:tid 830926] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/fs.php"] [unique_id "alxec8u1nEoSSDHiOXbdsAAAAWk"]
[Sat Jul 18 23:19:47.200357 2026] [security2:error] [pid 830701:tid 830926] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/fs.php"] [unique_id "alxec8u1nEoSSDHiOXbdsAAAAWk"]
[Sat Jul 18 23:19:47.300220 2026] [security2:error] [pid 830701:tid 830925] [client 31.171.130.29:54095] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/wp-content/index.php"] [unique_id "alxec8u1nEoSSDHiOXbdugAAAWg"]
[Sat Jul 18 23:19:47.321073 2026] [security2:error] [pid 830701:tid 830868] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/asasx.php"] [unique_id "alxec8u1nEoSSDHiOXbdvQAAAS8"]
[Sat Jul 18 23:19:47.321154 2026] [security2:error] [pid 830701:tid 830868] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/asasx.php"] [unique_id "alxec8u1nEoSSDHiOXbdvQAAAS8"]
[Sat Jul 18 23:19:47.429359 2026] [security2:error] [pid 830701:tid 830861] [client 31.171.130.1:58269] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxec8u1nEoSSDHiOXbdwgAAASg"]
[Sat Jul 18 23:19:47.437586 2026] [security2:error] [pid 830701:tid 830903] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "alxec8u1nEoSSDHiOXbdxQAAAVI"]
[Sat Jul 18 23:19:47.437694 2026] [security2:error] [pid 830701:tid 830903] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "alxec8u1nEoSSDHiOXbdxQAAAVI"]
[Sat Jul 18 23:19:47.553373 2026] [security2:error] [pid 830701:tid 830953] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-good.php"] [unique_id "alxec8u1nEoSSDHiOXbdzQAAAYQ"]
[Sat Jul 18 23:19:47.553471 2026] [security2:error] [pid 830701:tid 830953] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-good.php"] [unique_id "alxec8u1nEoSSDHiOXbdzQAAAYQ"]
[Sat Jul 18 23:19:47.566946 2026] [security2:error] [pid 830701:tid 830852] [client 31.171.130.1:38135] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/bolt.php"] [unique_id "alxec8u1nEoSSDHiOXbd0QAAAR8"]
[Sat Jul 18 23:19:47.666556 2026] [security2:error] [pid 830701:tid 830928] [client 31.171.130.43:35335] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxec8u1nEoSSDHiOXbd1AAAAWs"]
[Sat Jul 18 23:19:47.669708 2026] [security2:error] [pid 830701:tid 830888] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/scxy.php"] [unique_id "alxec8u1nEoSSDHiOXbd1QAAAUM"]
[Sat Jul 18 23:19:47.669834 2026] [security2:error] [pid 830701:tid 830888] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/scxy.php"] [unique_id "alxec8u1nEoSSDHiOXbd1QAAAUM"]
[Sat Jul 18 23:19:47.680193 2026] [security2:error] [pid 830701:tid 830899] [client 31.171.130.48:42285] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/ioxi-o.php"] [unique_id "alxec8u1nEoSSDHiOXbd1gAAAU4"]
[Sat Jul 18 23:19:47.788590 2026] [security2:error] [pid 830701:tid 830919] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wmore1.php"] [unique_id "alxec8u1nEoSSDHiOXbd4gAAAWI"]
[Sat Jul 18 23:19:47.788674 2026] [security2:error] [pid 830701:tid 830919] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wmore1.php"] [unique_id "alxec8u1nEoSSDHiOXbd4gAAAWI"]
[Sat Jul 18 23:19:47.906706 2026] [security2:error] [pid 830701:tid 830892] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/like.php"] [unique_id "alxec8u1nEoSSDHiOXbd5wAAAUc"]
[Sat Jul 18 23:19:47.906870 2026] [security2:error] [pid 830701:tid 830892] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/like.php"] [unique_id "alxec8u1nEoSSDHiOXbd5wAAAUc"]
[Sat Jul 18 23:19:47.974125 2026] [security2:error] [pid 830701:tid 830931] [client 31.171.130.44:33529] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/ioxi-o.php"] [unique_id "alxec8u1nEoSSDHiOXbd6wAAAW4"]
[Sat Jul 18 23:19:47.974461 2026] [security2:error] [pid 830701:tid 830872] [client 31.171.130.16:21295] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxec8u1nEoSSDHiOXbd7AAAATM"]
[Sat Jul 18 23:19:48.022236 2026] [security2:error] [pid 830701:tid 830891] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/x.php"] [unique_id "alxedMu1nEoSSDHiOXbd8QAAAUY"]
[Sat Jul 18 23:19:48.022339 2026] [security2:error] [pid 830701:tid 830891] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/x.php"] [unique_id "alxedMu1nEoSSDHiOXbd8QAAAUY"]
[Sat Jul 18 23:19:48.128510 2026] [security2:error] [pid 830701:tid 830885] [client 27.34.68.67:38104] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxedMu1nEoSSDHiOXbd9wAAAUA"]
[Sat Jul 18 23:19:48.128617 2026] [security2:error] [pid 830701:tid 830885] [client 27.34.68.67:38104] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxedMu1nEoSSDHiOXbd9wAAAUA"]
[Sat Jul 18 23:19:48.138476 2026] [security2:error] [pid 830701:tid 830865] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/xa.php"] [unique_id "alxedMu1nEoSSDHiOXbd-AAAASw"]
[Sat Jul 18 23:19:48.138564 2026] [security2:error] [pid 830701:tid 830865] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/xa.php"] [unique_id "alxedMu1nEoSSDHiOXbd-AAAASw"]
[Sat Jul 18 23:19:48.153535 2026] [security2:error] [pid 830701:tid 830834] [client 31.171.130.44:65533] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/zwso.php"] [unique_id "alxedMu1nEoSSDHiOXbd-gAAAQ0"]
[Sat Jul 18 23:19:48.162142 2026] [security2:error] [pid 830701:tid 830953] [client 31.171.130.42:41593] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/insc.php"] [unique_id "alxedMu1nEoSSDHiOXbd-wAAAYQ"]
[Sat Jul 18 23:19:48.254712 2026] [security2:error] [pid 830701:tid 830850] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/kolda.php"] [unique_id "alxedMu1nEoSSDHiOXbeAQAAAR0"]
[Sat Jul 18 23:19:48.254820 2026] [security2:error] [pid 830701:tid 830850] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/kolda.php"] [unique_id "alxedMu1nEoSSDHiOXbeAQAAAR0"]
[Sat Jul 18 23:19:48.268314 2026] [security2:error] [pid 830701:tid 830738] [remote 5.182.209.54:47916] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.209.182.5.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxedMu1nEoSSDHiOXbeAgABECQ"]
[Sat Jul 18 23:19:48.370972 2026] [security2:error] [pid 830701:tid 830884] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-aothait.php"] [unique_id "alxedMu1nEoSSDHiOXbeEgAAAT8"]
[Sat Jul 18 23:19:48.371078 2026] [security2:error] [pid 830701:tid 830884] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-aothait.php"] [unique_id "alxedMu1nEoSSDHiOXbeEgAAAT8"]
[Sat Jul 18 23:19:48.446439 2026] [security2:error] [pid 830701:tid 830767] [remote 5.182.209.54:47916] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.209.182.5.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxedMu1nEoSSDHiOXbeGAABQUE"], referer: https://mezzacraft.com/wp-login.php
[Sat Jul 18 23:19:48.452918 2026] [security2:error] [pid 830701:tid 830867] [client 31.171.130.17:40291] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/akcc.php"] [unique_id "alxedMu1nEoSSDHiOXbeGgAAAS4"]
[Sat Jul 18 23:19:48.452947 2026] [security2:error] [pid 830701:tid 830892] [client 31.171.130.42:30067] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/wp-content/index.php"] [unique_id "alxedMu1nEoSSDHiOXbeGQAAAUc"]
[Sat Jul 18 23:19:48.454276 2026] [security2:error] [pid 830701:tid 830916] [client 31.171.130.44:29255] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/wp-content/index.php"] [unique_id "alxedMu1nEoSSDHiOXbeGwAAAV8"]
[Sat Jul 18 23:19:48.465513 2026] [security2:error] [pid 830701:tid 830935] [client 31.171.130.12:59601] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/insc.php"] [unique_id "alxedMu1nEoSSDHiOXbeHAAAAXI"]
[Sat Jul 18 23:19:48.486968 2026] [security2:error] [pid 830701:tid 830924] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/ftde.php"] [unique_id "alxedMu1nEoSSDHiOXbeHQAAAWc"]
[Sat Jul 18 23:19:48.487048 2026] [security2:error] [pid 830701:tid 830924] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/ftde.php"] [unique_id "alxedMu1nEoSSDHiOXbeHQAAAWc"]
[Sat Jul 18 23:19:48.492911 2026] [security2:error] [pid 830701:tid 830871] [client 190.245.146.99:56868] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxedMu1nEoSSDHiOXbeHgAAATI"]
[Sat Jul 18 23:19:48.492988 2026] [security2:error] [pid 830701:tid 830871] [client 190.245.146.99:56868] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxedMu1nEoSSDHiOXbeHgAAATI"]
[Sat Jul 18 23:19:48.603715 2026] [security2:error] [pid 830701:tid 830903] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/vx.php"] [unique_id "alxedMu1nEoSSDHiOXbeJwAAAVI"]
[Sat Jul 18 23:19:48.603859 2026] [security2:error] [pid 830701:tid 830903] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/vx.php"] [unique_id "alxedMu1nEoSSDHiOXbeJwAAAVI"]
[Sat Jul 18 23:19:48.634948 2026] [security2:error] [pid 830701:tid 830875] [client 31.171.130.20:22377] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxedMu1nEoSSDHiOXbeKQAAATY"]
[Sat Jul 18 23:19:48.648655 2026] [security2:error] [pid 830701:tid 830848] [client 31.171.130.28:46671] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/classwithtostring.php"] [unique_id "alxedMu1nEoSSDHiOXbeKgAAARs"]
[Sat Jul 18 23:19:48.722013 2026] [security2:error] [pid 830701:tid 830942] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/a5.php"] [unique_id "alxedMu1nEoSSDHiOXbeLAAAAXk"]
[Sat Jul 18 23:19:48.722127 2026] [security2:error] [pid 830701:tid 830942] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/a5.php"] [unique_id "alxedMu1nEoSSDHiOXbeLAAAAXk"]
[Sat Jul 18 23:19:48.838462 2026] [security2:error] [pid 830701:tid 830851] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-sing.php"] [unique_id "alxedMu1nEoSSDHiOXbeMwAAAR4"]
[Sat Jul 18 23:19:48.838563 2026] [security2:error] [pid 830701:tid 830851] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-sing.php"] [unique_id "alxedMu1nEoSSDHiOXbeMwAAAR4"]
[Sat Jul 18 23:19:48.955900 2026] [security2:error] [pid 830701:tid 830948] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/database.php"] [unique_id "alxedMu1nEoSSDHiOXbePAAAAX8"]
[Sat Jul 18 23:19:48.956008 2026] [security2:error] [pid 830701:tid 830948] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/database.php"] [unique_id "alxedMu1nEoSSDHiOXbePAAAAX8"]
[Sat Jul 18 23:19:48.964775 2026] [security2:error] [pid 830701:tid 830919] [client 31.171.130.21:20999] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/ioxi-o.php"] [unique_id "alxedMu1nEoSSDHiOXbeQAAAAWI"]
[Sat Jul 18 23:19:49.072671 2026] [security2:error] [pid 830701:tid 830899] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/explorer/index_.php"] [unique_id "alxedcu1nEoSSDHiOXbeSgAAAU4"]
[Sat Jul 18 23:19:49.072809 2026] [security2:error] [pid 830701:tid 830899] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/explorer/index_.php"] [unique_id "alxedcu1nEoSSDHiOXbeSgAAAU4"]
[Sat Jul 18 23:19:49.169583 2026] [security2:error] [pid 830701:tid 830836] [client 31.171.130.24:26805] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/ioxi-o.php"] [unique_id "alxedcu1nEoSSDHiOXbeTwAAAQ8"]
[Sat Jul 18 23:19:49.175322 2026] [security2:error] [pid 830701:tid 830935] [client 31.171.130.43:22891] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/abcd.php"] [unique_id "alxedcu1nEoSSDHiOXbeUAAAAXI"]
[Sat Jul 18 23:19:49.189160 2026] [security2:error] [pid 830701:tid 830946] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-at.php"] [unique_id "alxedcu1nEoSSDHiOXbeUQAAAX0"]
[Sat Jul 18 23:19:49.189276 2026] [security2:error] [pid 830701:tid 830946] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-at.php"] [unique_id "alxedcu1nEoSSDHiOXbeUQAAAX0"]
[Sat Jul 18 23:19:49.207384 2026] [security2:error] [pid 830701:tid 830925] [client 31.171.130.32:43055] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/cjfuns.php"] [unique_id "alxedcu1nEoSSDHiOXbeUgAAAWg"]
[Sat Jul 18 23:19:49.212711 2026] [security2:error] [pid 830701:tid 830930] [client 31.171.130.47:36071] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/ioxi-o.php"] [unique_id "alxedcu1nEoSSDHiOXbeUwAAAW0"]
[Sat Jul 18 23:19:49.215324 2026] [security2:error] [pid 830701:tid 830860] [client 31.171.130.31:27635] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/classwithtostring.php"] [unique_id "alxedcu1nEoSSDHiOXbeVAAAASc"]
[Sat Jul 18 23:19:49.269343 2026] [security2:error] [pid 830701:tid 830937] [client 31.171.130.48:45703] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/bolt.php"] [unique_id "alxedcu1nEoSSDHiOXbeWQAAAXQ"]
[Sat Jul 18 23:19:49.303174 2026] [security2:error] [pid 830701:tid 830876] [client 65.111.28.165:15583] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "155"] [id "900406"] [msg "wp-login POST logging"] [data "200"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxedcu1nEoSSDHiOXbeSAAAATc"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:19:49.305192 2026] [security2:error] [pid 830701:tid 830870] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-wz.php"] [unique_id "alxedcu1nEoSSDHiOXbeXAAAATE"]
[Sat Jul 18 23:19:49.305275 2026] [security2:error] [pid 830701:tid 830870] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-wz.php"] [unique_id "alxedcu1nEoSSDHiOXbeXAAAATE"]
[Sat Jul 18 23:19:49.422310 2026] [security2:error] [pid 830701:tid 830873] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-ver.php"] [unique_id "alxedcu1nEoSSDHiOXbeZwAAATQ"]
[Sat Jul 18 23:19:49.422438 2026] [security2:error] [pid 830701:tid 830873] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-ver.php"] [unique_id "alxedcu1nEoSSDHiOXbeZwAAATQ"]
[Sat Jul 18 23:19:49.503600 2026] [security2:error] [pid 830701:tid 830906] [client 171.4.232.110:42723] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxedcu1nEoSSDHiOXbeagAAAVU"]
[Sat Jul 18 23:19:49.503719 2026] [security2:error] [pid 830701:tid 830906] [client 171.4.232.110:42723] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxedcu1nEoSSDHiOXbeagAAAVU"]
[Sat Jul 18 23:19:49.541365 2026] [security2:error] [pid 830701:tid 830864] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp5.php"] [unique_id "alxedcu1nEoSSDHiOXbebQAAASs"]
[Sat Jul 18 23:19:49.541509 2026] [security2:error] [pid 830701:tid 830864] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp5.php"] [unique_id "alxedcu1nEoSSDHiOXbebQAAASs"]
[Sat Jul 18 23:19:49.542275 2026] [security2:error] [pid 830701:tid 830958] [client 34.91.213.89:49152] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "www.walkingandtalking.net"] [uri "/"] [unique_id "alxedcu1nEoSSDHiOXbebgAAAYk"]
[Sat Jul 18 23:19:49.542347 2026] [security2:error] [pid 830701:tid 830958] [client 34.91.213.89:49152] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "www.walkingandtalking.net"] [uri "/"] [unique_id "alxedcu1nEoSSDHiOXbebgAAAYk"]
[Sat Jul 18 23:19:49.600816 2026] [security2:error] [pid 830701:tid 830895] [client 31.171.130.9:20745] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/insc.php"] [unique_id "alxedcu1nEoSSDHiOXbecwAAAUo"]
[Sat Jul 18 23:19:49.668441 2026] [security2:error] [pid 830701:tid 830838] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-pp.php"] [unique_id "alxedcu1nEoSSDHiOXbedwAAARE"]
[Sat Jul 18 23:19:49.668539 2026] [security2:error] [pid 830701:tid 830838] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-pp.php"] [unique_id "alxedcu1nEoSSDHiOXbedwAAARE"]
[Sat Jul 18 23:19:49.683354 2026] [security2:error] [pid 830701:tid 830841] [client 74.208.214.194:41730] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxedcu1nEoSSDHiOXbeeAAAARQ"]
[Sat Jul 18 23:19:49.784920 2026] [security2:error] [pid 830701:tid 830860] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/w3lls.php"] [unique_id "alxedcu1nEoSSDHiOXbefwAAASc"]
[Sat Jul 18 23:19:49.785094 2026] [security2:error] [pid 830701:tid 830860] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/w3lls.php"] [unique_id "alxedcu1nEoSSDHiOXbefwAAASc"]
[Sat Jul 18 23:19:49.890899 2026] [security2:error] [pid 830701:tid 830952] [client 105.163.0.149:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.maxenengineering.com"] [uri "/maxenengineering/index.php"] [unique_id "alxedMu1nEoSSDHiOXbd8gAAAYM"]
[Sat Jul 18 23:19:49.908740 2026] [security2:error] [pid 830701:tid 830848] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/sbhu.php"] [unique_id "alxedcu1nEoSSDHiOXbeiAAAARs"]
[Sat Jul 18 23:19:49.908836 2026] [security2:error] [pid 830701:tid 830848] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/sbhu.php"] [unique_id "alxedcu1nEoSSDHiOXbeiAAAARs"]
[Sat Jul 18 23:19:49.986139 2026] [security2:error] [pid 830701:tid 830922] [client 31.171.130.49:61577] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/insc.php"] [unique_id "alxedcu1nEoSSDHiOXbejQAAAWU"]
[Sat Jul 18 23:19:49.986673 2026] [security2:error] [pid 830701:tid 830903] [client 31.171.130.4:20885] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/shelp.php"] [unique_id "alxedcu1nEoSSDHiOXbejgAAAVI"]
[Sat Jul 18 23:19:50.030351 2026] [security2:error] [pid 830701:tid 830873] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-content/uploads/admin.php"] [unique_id "alxedsu1nEoSSDHiOXbekAAAATQ"]
[Sat Jul 18 23:19:50.030453 2026] [security2:error] [pid 830701:tid 830873] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-content/uploads/admin.php"] [unique_id "alxedsu1nEoSSDHiOXbekAAAATQ"]
[Sat Jul 18 23:19:50.055127 2026] [security2:error] [pid 830701:tid 830957] [client 31.171.130.2:59567] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/txets.php"] [unique_id "alxedsu1nEoSSDHiOXbekgAAAYg"]
[Sat Jul 18 23:19:50.066618 2026] [security2:error] [pid 830701:tid 830855] [client 31.171.130.1:57943] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/cjfuns.php"] [unique_id "alxedsu1nEoSSDHiOXbelAAAASI"]
[Sat Jul 18 23:19:50.068898 2026] [security2:error] [pid 830701:tid 830882] [client 31.171.130.32:54469] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxedsu1nEoSSDHiOXbelQAAAT0"]
[Sat Jul 18 23:19:50.079714 2026] [security2:error] [pid 830701:tid 830912] [client 142.93.64.197:50244] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "50.116.64.44"] [uri "/"] [unique_id "alxedsu1nEoSSDHiOXbelgAAAVs"]
[Sat Jul 18 23:19:50.116743 2026] [security2:error] [pid 830701:tid 830948] [client 31.171.130.44:56457] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/insc.php"] [unique_id "alxedsu1nEoSSDHiOXbemQAAAX8"]
[Sat Jul 18 23:19:50.118802 2026] [security2:error] [pid 830701:tid 830853] [client 34.91.229.116:4096] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "autodiscover.elespecialista.mx"] [uri "/"] [unique_id "alxedsu1nEoSSDHiOXbemgAAASA"]
[Sat Jul 18 23:19:50.118860 2026] [security2:error] [pid 830701:tid 830853] [client 34.91.229.116:4096] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "autodiscover.elespecialista.mx"] [uri "/"] [unique_id "alxedsu1nEoSSDHiOXbemgAAASA"]
[Sat Jul 18 23:19:50.138393 2026] [security2:error] [pid 830701:tid 830869] [client 142.93.64.197:60066] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "50.116.64.44"] [uri "/"] [unique_id "alxedsu1nEoSSDHiOXbenQAAATA"]
[Sat Jul 18 23:19:50.145269 2026] [security2:error] [pid 830701:tid 830895] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/favicon.php"] [unique_id "alxedsu1nEoSSDHiOXbengAAAUo"]
[Sat Jul 18 23:19:50.145337 2026] [security2:error] [pid 830701:tid 830895] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/favicon.php"] [unique_id "alxedsu1nEoSSDHiOXbengAAAUo"]
[Sat Jul 18 23:19:50.187794 2026] [security2:error] [pid 830701:tid 830857] [client 82.135.202.97:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "innovativecleaningsvs.com"] [uri "/index.php"] [unique_id "alxedMu1nEoSSDHiOXbeBwABJFw"]
[Sat Jul 18 23:19:50.261572 2026] [security2:error] [pid 830701:tid 830926] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/txets.php"] [unique_id "alxedsu1nEoSSDHiOXbepAAAAWk"]
[Sat Jul 18 23:19:50.261697 2026] [security2:error] [pid 830701:tid 830926] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/txets.php"] [unique_id "alxedsu1nEoSSDHiOXbepAAAAWk"]
[Sat Jul 18 23:19:50.378118 2026] [security2:error] [pid 830701:tid 830844] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-su.php"] [unique_id "alxedsu1nEoSSDHiOXberwAAARc"]
[Sat Jul 18 23:19:50.378225 2026] [security2:error] [pid 830701:tid 830844] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-su.php"] [unique_id "alxedsu1nEoSSDHiOXberwAAARc"]
[Sat Jul 18 23:19:50.414301 2026] [security2:error] [pid 830701:tid 830902] [client 31.171.130.32:28127] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/txets.php"] [unique_id "alxedsu1nEoSSDHiOXbesgAAAVE"]
[Sat Jul 18 23:19:50.426468 2026] [security2:error] [pid 830701:tid 830936] [client 177.106.9.129:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "worbals.com"] [uri "/index.php"] [unique_id "alxedsu1nEoSSDHiOXbeoAAAAXM"]
[Sat Jul 18 23:19:50.476934 2026] [security2:error] [pid 830701:tid 830891] [client 31.171.130.42:32351] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/classwithtostring.php"] [unique_id "alxedsu1nEoSSDHiOXbeuAAAAUY"]
[Sat Jul 18 23:19:50.477080 2026] [security2:error] [pid 830701:tid 830865] [client 31.171.130.42:51583] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/cord.php"] [unique_id "alxedsu1nEoSSDHiOXbetwAAASw"]
[Sat Jul 18 23:19:50.494066 2026] [security2:error] [pid 830701:tid 830875] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/ff.php"] [unique_id "alxedsu1nEoSSDHiOXbeugAAATY"]
[Sat Jul 18 23:19:50.494162 2026] [security2:error] [pid 830701:tid 830875] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/ff.php"] [unique_id "alxedsu1nEoSSDHiOXbeugAAATY"]
[Sat Jul 18 23:19:50.550003 2026] [security2:error] [pid 830701:tid 830905] [client 31.171.130.8:48437] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxedsu1nEoSSDHiOXbevQAAAVQ"]
[Sat Jul 18 23:19:50.590860 2026] [security2:error] [pid 830701:tid 830906] [client 103.48.44.9:52993] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxedsu1nEoSSDHiOXbewAAAAVU"]
[Sat Jul 18 23:19:50.590969 2026] [security2:error] [pid 830701:tid 830906] [client 103.48.44.9:52993] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxedsu1nEoSSDHiOXbewAAAAVU"]
[Sat Jul 18 23:19:50.592970 2026] [security2:error] [pid 830701:tid 830884] [client 31.171.130.48:40125] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxedsu1nEoSSDHiOXbewQAAAT8"]
[Sat Jul 18 23:19:50.596480 2026] [security2:error] [pid 830701:tid 830922] [client 31.171.130.49:34747] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxedsu1nEoSSDHiOXbewgAAAWU"]
[Sat Jul 18 23:19:50.610490 2026] [security2:error] [pid 830701:tid 830883] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/reze.php"] [unique_id "alxedsu1nEoSSDHiOXbexAAAAT4"]
[Sat Jul 18 23:19:50.610596 2026] [security2:error] [pid 830701:tid 830883] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/reze.php"] [unique_id "alxedsu1nEoSSDHiOXbexAAAAT4"]
[Sat Jul 18 23:19:50.612672 2026] [security2:error] [pid 830701:tid 830859] [client 31.171.130.32:38679] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/classwithtostring.php"] [unique_id "alxedsu1nEoSSDHiOXbexQAAASY"]
[Sat Jul 18 23:19:50.669818 2026] [security2:error] [pid 830701:tid 830762] [remote 68.178.160.25:49468] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "goyalsatyam.com"] [uri "/wp-login.php"] [unique_id "alxedsu1nEoSSDHiOXbexgABJTw"]
[Sat Jul 18 23:19:50.727361 2026] [security2:error] [pid 830701:tid 830948] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/666.php"] [unique_id "alxedsu1nEoSSDHiOXbezAAAAX8"]
[Sat Jul 18 23:19:50.727477 2026] [security2:error] [pid 830701:tid 830948] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/666.php"] [unique_id "alxedsu1nEoSSDHiOXbezAAAAX8"]
[Sat Jul 18 23:19:50.843045 2026] [security2:error] [pid 830701:tid 830941] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wehrman.php"] [unique_id "alxedsu1nEoSSDHiOXbe1wAAAXg"]
[Sat Jul 18 23:19:50.843141 2026] [security2:error] [pid 830701:tid 830941] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wehrman.php"] [unique_id "alxedsu1nEoSSDHiOXbe1wAAAXg"]
[Sat Jul 18 23:19:50.895037 2026] [security2:error] [pid 830701:tid 830836] [client 119.154.81.234:58668] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxedsu1nEoSSDHiOXbe3QAAAQ8"]
[Sat Jul 18 23:19:50.895134 2026] [security2:error] [pid 830701:tid 830836] [client 119.154.81.234:58668] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxedsu1nEoSSDHiOXbe3QAAAQ8"]
[Sat Jul 18 23:19:50.907401 2026] [security2:error] [pid 830701:tid 830886] [client 31.171.130.3:39965] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxedsu1nEoSSDHiOXbe3wAAAUE"]
[Sat Jul 18 23:19:50.959475 2026] [security2:error] [pid 830701:tid 830921] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-conflg.php"] [unique_id "alxedsu1nEoSSDHiOXbe4gAAAWQ"]
[Sat Jul 18 23:19:50.959613 2026] [security2:error] [pid 830701:tid 830921] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-conflg.php"] [unique_id "alxedsu1nEoSSDHiOXbe4gAAAWQ"]
[Sat Jul 18 23:19:51.015857 2026] [security2:error] [pid 830701:tid 830879] [client 31.171.130.20:57811] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/dex.php"] [unique_id "alxed8u1nEoSSDHiOXbe5wAAATo"]
[Sat Jul 18 23:19:51.068365 2026] [security2:error] [pid 830701:tid 830865] [client 31.171.130.45:59447] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/wp-admin/txets.php"] [unique_id "alxed8u1nEoSSDHiOXbe6QAAASw"]
[Sat Jul 18 23:19:51.080874 2026] [security2:error] [pid 830701:tid 830834] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/ff1.php"] [unique_id "alxed8u1nEoSSDHiOXbe6gAAAQ0"]
[Sat Jul 18 23:19:51.080968 2026] [security2:error] [pid 830701:tid 830834] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/ff1.php"] [unique_id "alxed8u1nEoSSDHiOXbe6gAAAQ0"]
[Sat Jul 18 23:19:51.084181 2026] [security2:error] [pid 830701:tid 830875] [client 31.171.130.30:57375] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxed8u1nEoSSDHiOXbe6wAAATY"]
[Sat Jul 18 23:19:51.111994 2026] [security2:error] [pid 830701:tid 830937] [client 31.171.130.20:32479] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/wp-content/index.php"] [unique_id "alxed8u1nEoSSDHiOXbe7gAAAXQ"]
[Sat Jul 18 23:19:51.131583 2026] [security2:error] [pid 830701:tid 830954] [client 31.171.130.19:41737] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/txets.php"] [unique_id "alxed8u1nEoSSDHiOXbe8AAAAYU"]
[Sat Jul 18 23:19:51.196960 2026] [security2:error] [pid 830701:tid 830883] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/fff.php"] [unique_id "alxed8u1nEoSSDHiOXbe9AAAAT4"]
[Sat Jul 18 23:19:51.197061 2026] [security2:error] [pid 830701:tid 830883] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/fff.php"] [unique_id "alxed8u1nEoSSDHiOXbe9AAAAT4"]
[Sat Jul 18 23:19:51.243911 2026] [security2:error] [pid 830701:tid 830838] [client 45.3.45.236:20363] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 236.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxed8u1nEoSSDHiOXbe9gAAARE"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:19:51.249254 2026] [security2:error] [pid 830701:tid 830942] [client 31.171.130.4:23337] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/classwithtostring.php"] [unique_id "alxed8u1nEoSSDHiOXbe-QAAAXk"]
[Sat Jul 18 23:19:51.319060 2026] [security2:error] [pid 830701:tid 830895] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/amax.php"] [unique_id "alxed8u1nEoSSDHiOXbe_gAAAUo"]
[Sat Jul 18 23:19:51.319191 2026] [security2:error] [pid 830701:tid 830895] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/amax.php"] [unique_id "alxed8u1nEoSSDHiOXbe_gAAAUo"]
[Sat Jul 18 23:19:51.426467 2026] [security2:error] [pid 830701:tid 830888] [client 31.171.130.52:60527] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/wp-admin/txets.php"] [unique_id "alxed8u1nEoSSDHiOXbfBAAAAUM"]
[Sat Jul 18 23:19:51.439844 2026] [security2:error] [pid 830701:tid 830832] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-firewall.php"] [unique_id "alxed8u1nEoSSDHiOXbfBQAAAQs"]
[Sat Jul 18 23:19:51.439933 2026] [security2:error] [pid 830701:tid 830832] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-firewall.php"] [unique_id "alxed8u1nEoSSDHiOXbfBQAAAQs"]
[Sat Jul 18 23:19:51.549431 2026] [security2:error] [pid 830701:tid 830946] [client 31.171.130.32:42677] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/wp-includes/txets.php"] [unique_id "alxed8u1nEoSSDHiOXbfCwAAAX0"]
[Sat Jul 18 23:19:51.555403 2026] [security2:error] [pid 830701:tid 830886] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/appt.php"] [unique_id "alxed8u1nEoSSDHiOXbfDAAAAUE"]
[Sat Jul 18 23:19:51.555472 2026] [security2:error] [pid 830701:tid 830886] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/appt.php"] [unique_id "alxed8u1nEoSSDHiOXbfDAAAAUE"]
[Sat Jul 18 23:19:51.571743 2026] [security2:error] [pid 830701:tid 830902] [client 31.171.130.43:26281] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxed8u1nEoSSDHiOXbfDQAAAVE"]
[Sat Jul 18 23:19:51.603162 2026] [security2:error] [pid 830701:tid 830868] [client 31.171.130.37:44935] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/wp-content/index.php"] [unique_id "alxed8u1nEoSSDHiOXbfDgAAAS8"]
[Sat Jul 18 23:19:51.603165 2026] [security2:error] [pid 830701:tid 830918] [client 31.171.130.7:57843] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/ioxi-o.php"] [unique_id "alxed8u1nEoSSDHiOXbfDwAAAWE"]
[Sat Jul 18 23:19:51.642781 2026] [security2:error] [pid 830701:tid 830754] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxed8u1nEoSSDHiOXbfEgABajQ"]
[Sat Jul 18 23:19:51.642979 2026] [security2:error] [pid 830701:tid 830927] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxed8u1nEoSSDHiOXbfEgABajQ"]
[Sat Jul 18 23:19:51.689360 2026] [security2:error] [pid 830701:tid 830936] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-thi.php"] [unique_id "alxed8u1nEoSSDHiOXbfFQAAAXM"]
[Sat Jul 18 23:19:51.689422 2026] [security2:error] [pid 830701:tid 830936] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-thi.php"] [unique_id "alxed8u1nEoSSDHiOXbfFQAAAXM"]
[Sat Jul 18 23:19:51.722296 2026] [security2:error] [pid 830701:tid 830939] [client 31.171.130.40:25087] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/txets.php"] [unique_id "alxed8u1nEoSSDHiOXbfGQAAAXY"]
[Sat Jul 18 23:19:51.808665 2026] [security2:error] [pid 830701:tid 830914] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/jj.php"] [unique_id "alxed8u1nEoSSDHiOXbfHgAAAV0"]
[Sat Jul 18 23:19:51.808797 2026] [security2:error] [pid 830701:tid 830914] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/jj.php"] [unique_id "alxed8u1nEoSSDHiOXbfHgAAAV0"]
[Sat Jul 18 23:19:51.926281 2026] [security2:error] [pid 830701:tid 830871] [client 31.171.130.27:20227] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/wp-includes/txets.php"] [unique_id "alxed8u1nEoSSDHiOXbfIgAAATI"]
[Sat Jul 18 23:19:51.938739 2026] [security2:error] [pid 830701:tid 830892] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/333.php"] [unique_id "alxed8u1nEoSSDHiOXbfIwAAAUc"]
[Sat Jul 18 23:19:51.938815 2026] [security2:error] [pid 830701:tid 830892] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/333.php"] [unique_id "alxed8u1nEoSSDHiOXbfIwAAAUc"]
[Sat Jul 18 23:19:52.038493 2026] [security2:error] [pid 830701:tid 830895] [client 31.171.130.27:26663] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/goods.php"] [unique_id "alxeeMu1nEoSSDHiOXbfLAAAAUo"]
[Sat Jul 18 23:19:52.056279 2026] [security2:error] [pid 830701:tid 830869] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/albin.php"] [unique_id "alxeeMu1nEoSSDHiOXbfLwAAATA"]
[Sat Jul 18 23:19:52.056346 2026] [security2:error] [pid 830701:tid 830869] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/albin.php"] [unique_id "alxeeMu1nEoSSDHiOXbfLwAAATA"]
[Sat Jul 18 23:19:52.073891 2026] [security2:error] [pid 830701:tid 830948] [client 31.171.130.45:52417] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/txets.php"] [unique_id "alxeeMu1nEoSSDHiOXbfMQAAAX8"]
[Sat Jul 18 23:19:52.074617 2026] [security2:error] [pid 830701:tid 830912] [client 31.171.130.44:57609] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/zwso.php"] [unique_id "alxeeMu1nEoSSDHiOXbfMgAAAVs"]
[Sat Jul 18 23:19:52.103658 2026] [security2:error] [pid 830701:tid 830953] [client 31.171.130.49:24487] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/ioxi-o.php"] [unique_id "alxeeMu1nEoSSDHiOXbfMwAAAYQ"]
[Sat Jul 18 23:19:52.141181 2026] [security2:error] [pid 830701:tid 830717] [remote 68.178.160.25:49468] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "goyalsatyam.com"] [uri "/wp-login.php"] [unique_id "alxeeMu1nEoSSDHiOXbfNAABJg8"], referer: https://goyalsatyam.com/wp-login.php
[Sat Jul 18 23:19:52.171924 2026] [security2:error] [pid 830701:tid 830893] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/66.php"] [unique_id "alxeeMu1nEoSSDHiOXbfOQAAAUg"]
[Sat Jul 18 23:19:52.172009 2026] [security2:error] [pid 830701:tid 830893] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/66.php"] [unique_id "alxeeMu1nEoSSDHiOXbfOQAAAUg"]
[Sat Jul 18 23:19:52.216390 2026] [security2:error] [pid 830701:tid 830804] [remote 157.66.47.83:59954] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.narv.co"] [uri "/wp-login.php"] [unique_id "alxeeMu1nEoSSDHiOXbfPQABcmY"]
[Sat Jul 18 23:19:52.218998 2026] [security2:error] [pid 830701:tid 830849] [client 34.91.36.231:24577] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "cpcontacts.cjh.tmu.mybluehost.me"] [uri "/"] [unique_id "alxeeMu1nEoSSDHiOXbfPgAAARw"]
[Sat Jul 18 23:19:52.219066 2026] [security2:error] [pid 830701:tid 830849] [client 34.91.36.231:24577] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "cpcontacts.cjh.tmu.mybluehost.me"] [uri "/"] [unique_id "alxeeMu1nEoSSDHiOXbfPgAAARw"]
[Sat Jul 18 23:19:52.242349 2026] [security2:error] [pid 830701:tid 830819] [remote 31.42.184.154:59402] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "walkingandtalking.net"] [uri "/wp-login.php"] [unique_id "alxeeMu1nEoSSDHiOXbfPwABiHU"]
[Sat Jul 18 23:19:52.277188 2026] [security2:error] [pid 830701:tid 830836] [client 31.171.130.38:42357] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxeeMu1nEoSSDHiOXbfQwAAAQ8"]
[Sat Jul 18 23:19:52.288108 2026] [security2:error] [pid 830701:tid 830870] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/motu.php"] [unique_id "alxeeMu1nEoSSDHiOXbfRAAAATE"]
[Sat Jul 18 23:19:52.288227 2026] [security2:error] [pid 830701:tid 830870] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/motu.php"] [unique_id "alxeeMu1nEoSSDHiOXbfRAAAATE"]
[Sat Jul 18 23:19:52.330062 2026] [security2:error] [pid 830701:tid 830730] [remote 154.61.75.100:43154] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "emsbodystorm.com"] [uri "/wp-login.php"] [unique_id "alxeeMu1nEoSSDHiOXbfSQABEBw"]
[Sat Jul 18 23:19:52.404355 2026] [security2:error] [pid 830701:tid 830937] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/kj.php"] [unique_id "alxeeMu1nEoSSDHiOXbfTwAAAXQ"]
[Sat Jul 18 23:19:52.404427 2026] [security2:error] [pid 830701:tid 830937] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/kj.php"] [unique_id "alxeeMu1nEoSSDHiOXbfTwAAAXQ"]
[Sat Jul 18 23:19:52.433389 2026] [security2:error] [pid 830701:tid 830834] [client 31.171.130.22:52595] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/goods.php"] [unique_id "alxeeMu1nEoSSDHiOXbfUQAAAQ0"]
[Sat Jul 18 23:19:52.467970 2026] [security2:error] [pid 830701:tid 830793] [remote 31.42.184.154:59402] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "walkingandtalking.net"] [uri "/wp-login.php"] [unique_id "alxeeMu1nEoSSDHiOXbfUgABKFs"], referer: https://walkingandtalking.net/wp-login.php
[Sat Jul 18 23:19:52.520064 2026] [security2:error] [pid 830701:tid 830906] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp4.php"] [unique_id "alxeeMu1nEoSSDHiOXbfVQAAAVU"]
[Sat Jul 18 23:19:52.520187 2026] [security2:error] [pid 830701:tid 830906] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp4.php"] [unique_id "alxeeMu1nEoSSDHiOXbfVQAAAVU"]
[Sat Jul 18 23:19:52.527188 2026] [security2:error] [pid 830701:tid 830876] [client 52.7.171.101:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxeeMu1nEoSSDHiOXbfTgABNzo"]
[Sat Jul 18 23:19:52.588809 2026] [security2:error] [pid 830701:tid 830942] [client 31.171.130.34:48547] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxeeMu1nEoSSDHiOXbfWwAAAXk"]
[Sat Jul 18 23:19:52.591064 2026] [security2:error] [pid 830701:tid 830851] [client 31.171.130.16:65279] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxeeMu1nEoSSDHiOXbfXAAAAR4"]
[Sat Jul 18 23:19:52.612905 2026] [security2:error] [pid 830701:tid 830850] [client 31.171.130.31:48919] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/insc.php"] [unique_id "alxeeMu1nEoSSDHiOXbfYAAAAR0"]
[Sat Jul 18 23:19:52.621355 2026] [security2:error] [pid 830701:tid 830764] [remote 157.66.47.83:59954] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.narv.co"] [uri "/wp-login.php"] [unique_id "alxeeMu1nEoSSDHiOXbfXgABID4"], referer: https://www.narv.co/wp-login.php
[Sat Jul 18 23:19:52.638344 2026] [security2:error] [pid 830701:tid 830864] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/file61.php"] [unique_id "alxeeMu1nEoSSDHiOXbfYwAAASs"]
[Sat Jul 18 23:19:52.638408 2026] [security2:error] [pid 830701:tid 830864] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/file61.php"] [unique_id "alxeeMu1nEoSSDHiOXbfYwAAASs"]
[Sat Jul 18 23:19:52.652670 2026] [security2:error] [pid 830701:tid 830958] [client 31.171.130.14:51579] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxeeMu1nEoSSDHiOXbfZAAAAYk"]
[Sat Jul 18 23:19:52.756769 2026] [security2:error] [pid 830701:tid 830932] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp.php"] [unique_id "alxeeMu1nEoSSDHiOXbfagAAAW8"]
[Sat Jul 18 23:19:52.756885 2026] [security2:error] [pid 830701:tid 830932] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp.php"] [unique_id "alxeeMu1nEoSSDHiOXbfagAAAW8"]
[Sat Jul 18 23:19:52.768523 2026] [security2:error] [pid 830701:tid 830941] [client 31.171.130.10:45245] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/wp-admin/txets.php"] [unique_id "alxeeMu1nEoSSDHiOXbfbQAAAXg"]
[Sat Jul 18 23:19:52.769065 2026] [security2:error] [pid 830701:tid 830715] [remote 154.61.75.100:43154] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "emsbodystorm.com"] [uri "/wp-login.php"] [unique_id "alxeeMu1nEoSSDHiOXbfbAABaQ0"], referer: https://emsbodystorm.com/wp-login.php
[Sat Jul 18 23:19:52.873570 2026] [security2:error] [pid 830701:tid 830886] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-trackback.php"] [unique_id "alxeeMu1nEoSSDHiOXbfcAAAAUE"]
[Sat Jul 18 23:19:52.873659 2026] [security2:error] [pid 830701:tid 830886] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-trackback.php"] [unique_id "alxeeMu1nEoSSDHiOXbfcAAAAUE"]
[Sat Jul 18 23:19:52.905923 2026] [security2:error] [pid 830701:tid 830905] [client 31.171.130.17:37861] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/wp-editor.php"] [unique_id "alxeeMu1nEoSSDHiOXbfcgAAAVQ"]
[Sat Jul 18 23:19:52.990481 2026] [security2:error] [pid 830701:tid 830918] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/db.php"] [unique_id "alxeeMu1nEoSSDHiOXbfdAAAAWE"]
[Sat Jul 18 23:19:52.990554 2026] [security2:error] [pid 830701:tid 830918] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/db.php"] [unique_id "alxeeMu1nEoSSDHiOXbfdAAAAWE"]
[Sat Jul 18 23:19:53.111173 2026] [security2:error] [pid 830701:tid 830875] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/NewFile.php"] [unique_id "alxeecu1nEoSSDHiOXbfgAAAATY"]
[Sat Jul 18 23:19:53.111264 2026] [security2:error] [pid 830701:tid 830875] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/NewFile.php"] [unique_id "alxeecu1nEoSSDHiOXbfgAAAATY"]
[Sat Jul 18 23:19:53.122635 2026] [security2:error] [pid 830701:tid 830834] [client 31.171.130.1:30369] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/bolt.php"] [unique_id "alxeecu1nEoSSDHiOXbfggAAAQ0"]
[Sat Jul 18 23:19:53.212276 2026] [security2:error] [pid 830701:tid 830838] [client 31.171.130.4:60405] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/classwithtostring.php"] [unique_id "alxeecu1nEoSSDHiOXbfhwAAARE"]
[Sat Jul 18 23:19:53.216993 2026] [security2:error] [pid 830701:tid 830851] [client 31.171.130.8:22291] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/wp-admin/txets.php"] [unique_id "alxeecu1nEoSSDHiOXbfiQAAAR4"]
[Sat Jul 18 23:19:53.227350 2026] [security2:error] [pid 830701:tid 830899] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/xxx.php"] [unique_id "alxeecu1nEoSSDHiOXbfiwAAAU4"]
[Sat Jul 18 23:19:53.227445 2026] [security2:error] [pid 830701:tid 830899] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/xxx.php"] [unique_id "alxeecu1nEoSSDHiOXbfiwAAAU4"]
[Sat Jul 18 23:19:53.227853 2026] [security2:error] [pid 830701:tid 830896] [client 31.171.130.33:20495] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/insc.php"] [unique_id "alxeecu1nEoSSDHiOXbfjAAAAUs"]
[Sat Jul 18 23:19:53.328474 2026] [security2:error] [pid 830701:tid 830923] [client 31.171.130.31:61715] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/wp-admin/txets.php"] [unique_id "alxeecu1nEoSSDHiOXbflQAAAWY"]
[Sat Jul 18 23:19:53.346063 2026] [security2:error] [pid 830701:tid 830872] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/ms.php"] [unique_id "alxeecu1nEoSSDHiOXbflgAAATM"]
[Sat Jul 18 23:19:53.346159 2026] [security2:error] [pid 830701:tid 830872] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/ms.php"] [unique_id "alxeecu1nEoSSDHiOXbflgAAATM"]
[Sat Jul 18 23:19:53.457024 2026] [security2:error] [pid 830701:tid 830772] [remote 31.42.184.154:59408] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "suretybonds-california.com"] [uri "/wp-login.php"] [unique_id "alxeecu1nEoSSDHiOXbfnAABeUY"]
[Sat Jul 18 23:19:53.464393 2026] [security2:error] [pid 830701:tid 830941] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/mini.php"] [unique_id "alxeecu1nEoSSDHiOXbfnQAAAXg"]
[Sat Jul 18 23:19:53.464468 2026] [security2:error] [pid 830701:tid 830941] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/mini.php"] [unique_id "alxeecu1nEoSSDHiOXbfnQAAAXg"]
[Sat Jul 18 23:19:53.539165 2026] [security2:error] [pid 830701:tid 830940] [client 45.3.45.31:9721] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 31.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxeecu1nEoSSDHiOXbfpQAAAXc"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:19:53.552116 2026] [security2:error] [pid 830701:tid 830844] [client 31.171.130.9:36217] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/wp-includes/txets.php"] [unique_id "alxeecu1nEoSSDHiOXbfqAAAARc"]
[Sat Jul 18 23:19:53.580501 2026] [security2:error] [pid 830701:tid 830870] [client 31.171.130.3:28493] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/wp-editor.php"] [unique_id "alxeecu1nEoSSDHiOXbfqwAAATE"]
[Sat Jul 18 23:19:53.580779 2026] [security2:error] [pid 830701:tid 830836] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/first.php"] [unique_id "alxeecu1nEoSSDHiOXbfrQAAAQ8"]
[Sat Jul 18 23:19:53.580884 2026] [security2:error] [pid 830701:tid 830836] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/first.php"] [unique_id "alxeecu1nEoSSDHiOXbfrQAAAQ8"]
[Sat Jul 18 23:19:53.687733 2026] [security2:error] [pid 830701:tid 830735] [remote 31.42.184.154:59408] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "suretybonds-california.com"] [uri "/wp-login.php"] [unique_id "alxeecu1nEoSSDHiOXbftQABdiE"], referer: https://suretybonds-california.com/wp-login.php
[Sat Jul 18 23:19:53.697291 2026] [security2:error] [pid 830701:tid 830852] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/0okj.php"] [unique_id "alxeecu1nEoSSDHiOXbftgAAAR8"]
[Sat Jul 18 23:19:53.697427 2026] [security2:error] [pid 830701:tid 830852] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/0okj.php"] [unique_id "alxeecu1nEoSSDHiOXbftgAAAR8"]
[Sat Jul 18 23:19:53.731517 2026] [security2:error] [pid 830701:tid 830834] [client 31.171.130.51:50433] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/wp-includes/txets.php"] [unique_id "alxeecu1nEoSSDHiOXbfuAAAAQ0"]
[Sat Jul 18 23:19:53.732033 2026] [security2:error] [pid 830701:tid 830954] [client 31.171.130.9:60805] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/classwithtostring.php"] [unique_id "alxeecu1nEoSSDHiOXbfuQAAAYU"]
[Sat Jul 18 23:19:53.740211 2026] [security2:error] [pid 830701:tid 830921] [client 31.171.130.27:45537] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/txets.php"] [unique_id "alxeecu1nEoSSDHiOXbfugAAAWQ"]
[Sat Jul 18 23:19:53.747110 2026] [security2:error] [pid 830701:tid 830879] [client 31.171.130.32:39485] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/lufix.php"] [unique_id "alxeecu1nEoSSDHiOXbfuwAAATo"]
[Sat Jul 18 23:19:53.753634 2026] [security2:error] [pid 830701:tid 830906] [client 31.171.130.23:35889] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/cjfuns.php"] [unique_id "alxeecu1nEoSSDHiOXbfvAAAAVU"]
[Sat Jul 18 23:19:53.813946 2026] [security2:error] [pid 830701:tid 830835] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/grsiuk.php"] [unique_id "alxeecu1nEoSSDHiOXbfwQAAAQ4"]
[Sat Jul 18 23:19:53.814052 2026] [security2:error] [pid 830701:tid 830835] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/grsiuk.php"] [unique_id "alxeecu1nEoSSDHiOXbfwQAAAQ4"]
[Sat Jul 18 23:19:53.936816 2026] [security2:error] [pid 830701:tid 830854] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/shell20211028.php"] [unique_id "alxeecu1nEoSSDHiOXbfxgAAASE"]
[Sat Jul 18 23:19:53.936958 2026] [security2:error] [pid 830701:tid 830854] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/shell20211028.php"] [unique_id "alxeecu1nEoSSDHiOXbfxgAAASE"]
[Sat Jul 18 23:19:54.053365 2026] [security2:error] [pid 830701:tid 830866] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/revealability.php"] [unique_id "alxeesu1nEoSSDHiOXbfygAAAS0"]
[Sat Jul 18 23:19:54.053464 2026] [security2:error] [pid 830701:tid 830866] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/revealability.php"] [unique_id "alxeesu1nEoSSDHiOXbfygAAAS0"]
[Sat Jul 18 23:19:54.067456 2026] [security2:error] [pid 830701:tid 830878] [client 31.171.130.37:47133] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/goods.php"] [unique_id "alxeesu1nEoSSDHiOXbfywAAATk"]
[Sat Jul 18 23:19:54.075610 2026] [security2:error] [pid 830701:tid 830885] [client 31.171.130.11:25257] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/lufix.php"] [unique_id "alxeesu1nEoSSDHiOXbfzAAAAUA"]
[Sat Jul 18 23:19:54.171245 2026] [security2:error] [pid 830701:tid 830957] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/btx25.php"] [unique_id "alxeesu1nEoSSDHiOXbf2AAAAYg"]
[Sat Jul 18 23:19:54.171367 2026] [security2:error] [pid 830701:tid 830957] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/btx25.php"] [unique_id "alxeesu1nEoSSDHiOXbf2AAAAYg"]
[Sat Jul 18 23:19:54.261529 2026] [security2:error] [pid 830701:tid 830928] [client 31.171.130.40:58559] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/goods.php"] [unique_id "alxeesu1nEoSSDHiOXbf3wAAAWs"]
[Sat Jul 18 23:19:54.261706 2026] [security2:error] [pid 830701:tid 830936] [client 31.171.130.3:35043] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxeesu1nEoSSDHiOXbf3gAAAXM"]
[Sat Jul 18 23:19:54.274349 2026] [security2:error] [pid 830701:tid 830860] [client 31.171.130.52:46207] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/txets.php"] [unique_id "alxeesu1nEoSSDHiOXbf4gAAASc"]
[Sat Jul 18 23:19:54.287727 2026] [security2:error] [pid 830701:tid 830881] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/bthil.php"] [unique_id "alxeesu1nEoSSDHiOXbf4wAAATw"]
[Sat Jul 18 23:19:54.287850 2026] [security2:error] [pid 830701:tid 830881] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/bthil.php"] [unique_id "alxeesu1nEoSSDHiOXbf4wAAATw"]
[Sat Jul 18 23:19:54.297786 2026] [security2:error] [pid 830701:tid 830863] [client 31.171.130.46:61625] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxeesu1nEoSSDHiOXbf5gAAASo"]
[Sat Jul 18 23:19:54.332995 2026] [security2:error] [pid 830701:tid 830867] [client 31.171.130.12:56289] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.genspagroup.com"] [uri "/style.php"] [unique_id "alxeesu1nEoSSDHiOXbf6gAAAS4"]
[Sat Jul 18 23:19:54.404854 2026] [security2:error] [pid 830701:tid 830899] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/hplfuns.php"] [unique_id "alxeesu1nEoSSDHiOXbf7AAAAU4"]
[Sat Jul 18 23:19:54.404952 2026] [security2:error] [pid 830701:tid 830899] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/hplfuns.php"] [unique_id "alxeesu1nEoSSDHiOXbf7AAAAU4"]
[Sat Jul 18 23:19:54.521308 2026] [security2:error] [pid 830701:tid 830840] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/error.php"] [unique_id "alxeesu1nEoSSDHiOXbf8QAAARM"]
[Sat Jul 18 23:19:54.521425 2026] [security2:error] [pid 830701:tid 830840] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/error.php"] [unique_id "alxeesu1nEoSSDHiOXbf8QAAARM"]
[Sat Jul 18 23:19:54.563011 2026] [security2:error] [pid 830701:tid 830871] [client 31.171.130.41:41293] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.genspagroup.com"] [uri "/style.php"] [unique_id "alxeesu1nEoSSDHiOXbf9AAAATI"]
[Sat Jul 18 23:19:54.571187 2026] [security2:error] [pid 830701:tid 830841] [client 128.201.41.59:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "healthylifegourmet.org"] [uri "/index.php"] [unique_id "alxeeMu1nEoSSDHiOXbfOwAAARQ"]
[Sat Jul 18 23:19:54.637141 2026] [security2:error] [pid 830701:tid 830901] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/edit.php"] [unique_id "alxeesu1nEoSSDHiOXbf9gAAAVA"]
[Sat Jul 18 23:19:54.637240 2026] [security2:error] [pid 830701:tid 830901] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/edit.php"] [unique_id "alxeesu1nEoSSDHiOXbf9gAAAVA"]
[Sat Jul 18 23:19:54.776664 2026] [security2:error] [pid 830701:tid 830886] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/pass4.php"] [unique_id "alxeesu1nEoSSDHiOXbgAgAAAUE"]
[Sat Jul 18 23:19:54.776766 2026] [security2:error] [pid 830701:tid 830886] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/pass4.php"] [unique_id "alxeesu1nEoSSDHiOXbgAgAAAUE"]
[Sat Jul 18 23:19:54.893215 2026] [security2:error] [pid 830701:tid 830928] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/sadcut1.php"] [unique_id "alxeesu1nEoSSDHiOXbgDgAAAWs"]
[Sat Jul 18 23:19:54.893321 2026] [security2:error] [pid 830701:tid 830928] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/sadcut1.php"] [unique_id "alxeesu1nEoSSDHiOXbgDgAAAWs"]
[Sat Jul 18 23:19:54.915348 2026] [security2:error] [pid 830701:tid 830936] [client 31.171.130.23:60285] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxeesu1nEoSSDHiOXbgEAAAAXM"]
[Sat Jul 18 23:19:54.915494 2026] [security2:error] [pid 830701:tid 830875] [client 31.171.130.2:35945] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxeesu1nEoSSDHiOXbgEQAAATY"]
[Sat Jul 18 23:19:54.918093 2026] [security2:error] [pid 830701:tid 830917] [client 31.171.130.39:31009] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/wp-admin/txets.php"] [unique_id "alxeesu1nEoSSDHiOXbgEgAAAWA"]
[Sat Jul 18 23:19:54.918953 2026] [security2:error] [pid 830701:tid 830834] [client 31.171.130.40:48039] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/wp-includes/txets.php"] [unique_id "alxeesu1nEoSSDHiOXbgFAAAAQ0"]
[Sat Jul 18 23:19:55.009913 2026] [security2:error] [pid 830701:tid 830914] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/bgymj.php"] [unique_id "alxee8u1nEoSSDHiOXbgGAAAAV0"]
[Sat Jul 18 23:19:55.010016 2026] [security2:error] [pid 830701:tid 830914] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/bgymj.php"] [unique_id "alxee8u1nEoSSDHiOXbgGAAAAV0"]
[Sat Jul 18 23:19:55.126310 2026] [security2:error] [pid 830701:tid 830853] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/yas.php"] [unique_id "alxee8u1nEoSSDHiOXbgHwAAASA"]
[Sat Jul 18 23:19:55.126398 2026] [security2:error] [pid 830701:tid 830853] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/yas.php"] [unique_id "alxee8u1nEoSSDHiOXbgHwAAASA"]
[Sat Jul 18 23:19:55.242316 2026] [security2:error] [pid 830701:tid 830869] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/dx.php"] [unique_id "alxee8u1nEoSSDHiOXbgJQAAATA"]
[Sat Jul 18 23:19:55.242402 2026] [security2:error] [pid 830701:tid 830869] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/dx.php"] [unique_id "alxee8u1nEoSSDHiOXbgJQAAATA"]
[Sat Jul 18 23:19:55.366593 2026] [security2:error] [pid 830701:tid 830878] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/yellow.php"] [unique_id "alxee8u1nEoSSDHiOXbgNQAAATk"]
[Sat Jul 18 23:19:55.366680 2026] [security2:error] [pid 830701:tid 830878] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/yellow.php"] [unique_id "alxee8u1nEoSSDHiOXbgNQAAATk"]
[Sat Jul 18 23:19:55.396555 2026] [security2:error] [pid 830701:tid 830953] [client 31.171.130.6:25801] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/wp-content/index.php"] [unique_id "alxee8u1nEoSSDHiOXbgNwAAAYQ"]
[Sat Jul 18 23:19:55.396962 2026] [security2:error] [pid 830701:tid 830836] [client 31.171.130.23:21413] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/goods.php"] [unique_id "alxee8u1nEoSSDHiOXbgOAAAAQ8"]
[Sat Jul 18 23:19:55.482664 2026] [security2:error] [pid 830701:tid 830957] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-der.php"] [unique_id "alxee8u1nEoSSDHiOXbgOgAAAYg"]
[Sat Jul 18 23:19:55.482791 2026] [security2:error] [pid 830701:tid 830957] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/wp-der.php"] [unique_id "alxee8u1nEoSSDHiOXbgOgAAAYg"]
[Sat Jul 18 23:19:55.599191 2026] [security2:error] [pid 830701:tid 830917] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/lala.php"] [unique_id "alxee8u1nEoSSDHiOXbgPwAAAWA"]
[Sat Jul 18 23:19:55.599292 2026] [security2:error] [pid 830701:tid 830917] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/lala.php"] [unique_id "alxee8u1nEoSSDHiOXbgPwAAAWA"]
[Sat Jul 18 23:19:55.698491 2026] [security2:error] [pid 830701:tid 830865] [client 31.171.130.45:27779] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/wp-editor.php"] [unique_id "alxee8u1nEoSSDHiOXbgQgAAASw"]
[Sat Jul 18 23:19:55.715169 2026] [security2:error] [pid 830701:tid 830939] [client 20.63.63.128:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.63.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/aa.php"] [unique_id "alxee8u1nEoSSDHiOXbgQwAAAXY"]
[Sat Jul 18 23:19:55.715274 2026] [security2:error] [pid 830701:tid 830939] [client 20.63.63.128:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcontacts.luxuriaproperties.com"] [uri "/aa.php"] [unique_id "alxee8u1nEoSSDHiOXbgQwAAAXY"]
[Sat Jul 18 23:19:55.776427 2026] [security2:error] [pid 830701:tid 830914] [client 31.171.130.13:62761] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/wp-editor.php"] [unique_id "alxee8u1nEoSSDHiOXbgRwAAAV0"]
[Sat Jul 18 23:19:55.878477 2026] [security2:error] [pid 830701:tid 830882] [client 31.171.130.22:36523] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/wp-editor.php"] [unique_id "alxee8u1nEoSSDHiOXbgUgAAAT0"]
[Sat Jul 18 23:19:55.878782 2026] [security2:error] [pid 830701:tid 830832] [client 31.171.130.38:54635] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/ioxi-o.php"] [unique_id "alxee8u1nEoSSDHiOXbgUwAAAQs"]
[Sat Jul 18 23:19:56.282720 2026] [security2:error] [pid 830701:tid 830878] [client 31.171.130.8:64263] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/lufix.php"] [unique_id "alxefMu1nEoSSDHiOXbgawAAATk"]
[Sat Jul 18 23:19:56.385674 2026] [security2:error] [pid 830701:tid 830893] [client 31.171.130.15:42761] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/lufix.php"] [unique_id "alxefMu1nEoSSDHiOXbgcgAAAUg"]
[Sat Jul 18 23:19:56.404675 2026] [security2:error] [pid 830701:tid 830895] [client 31.171.130.1:64339] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/insc.php"] [unique_id "alxefMu1nEoSSDHiOXbgcwAAAUo"]
[Sat Jul 18 23:19:56.480290 2026] [security2:error] [pid 830701:tid 830834] [client 31.171.130.1:47561] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/wp-admin/txets.php"] [unique_id "alxefMu1nEoSSDHiOXbgfgAAAQ0"]
[Sat Jul 18 23:19:56.564576 2026] [security2:error] [pid 830701:tid 830867] [client 31.171.130.48:37801] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/wp-includes/txets.php"] [unique_id "alxefMu1nEoSSDHiOXbghQAAAS4"]
[Sat Jul 18 23:19:56.640764 2026] [security2:error] [pid 830701:tid 830958] [client 223.228.182.224:53150] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxefMu1nEoSSDHiOXbgigAAAYk"]
[Sat Jul 18 23:19:56.640891 2026] [security2:error] [pid 830701:tid 830958] [client 223.228.182.224:53150] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxefMu1nEoSSDHiOXbgigAAAYk"]
[Sat Jul 18 23:19:56.683862 2026] [security2:error] [pid 830701:tid 830954] [client 104.207.59.118:65345] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.59.207.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxefMu1nEoSSDHiOXbgiwAAAYU"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:19:56.803423 2026] [security2:error] [pid 830701:tid 830904] [client 31.171.130.11:29597] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "genspagroup.com"] [uri "/style.php"] [unique_id "alxefMu1nEoSSDHiOXbglQAAAVM"]
[Sat Jul 18 23:19:56.917314 2026] [security2:error] [pid 830701:tid 830876] [client 31.171.130.2:57147] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/classwithtostring.php"] [unique_id "alxefMu1nEoSSDHiOXbgpAAAATc"]
[Sat Jul 18 23:19:56.985371 2026] [security2:error] [pid 830701:tid 830787] [remote 117.0.21.154:51744] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxefMu1nEoSSDHiOXbgrwABWlU"]
[Sat Jul 18 23:19:56.985547 2026] [security2:error] [pid 830701:tid 830911] [client 117.0.21.154:51744] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxefMu1nEoSSDHiOXbgrwABWlU"]
[Sat Jul 18 23:19:57.008714 2026] [security2:error] [pid 830701:tid 830836] [client 31.171.130.38:29115] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/wp-includes/txets.php"] [unique_id "alxefcu1nEoSSDHiOXbgtAAAAQ8"]
[Sat Jul 18 23:19:57.089817 2026] [security2:error] [pid 830701:tid 830877] [client 31.171.130.43:32773] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/goods.php"] [unique_id "alxefcu1nEoSSDHiOXbguQAAATg"]
[Sat Jul 18 23:19:57.129822 2026] [security2:error] [pid 830701:tid 830822] [remote 142.93.10.93:59960] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 93.10.93.142.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tee.qtw.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxefcu1nEoSSDHiOXbguwABVXg"]
[Sat Jul 18 23:19:57.294531 2026] [security2:error] [pid 830701:tid 830731] [remote 142.93.10.93:59960] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 93.10.93.142.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tee.qtw.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxefcu1nEoSSDHiOXbgxwABaR0"], referer: https://tee.qtw.mybluehost.me/wp-login.php
[Sat Jul 18 23:19:57.297198 2026] [security2:error] [pid 830701:tid 830938] [client 118.148.194.170:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "origine.nz"] [uri "/index.php"] [unique_id "alxefMu1nEoSSDHiOXbgqQABdUc"], referer: https://origine.nz/
[Sat Jul 18 23:19:57.309324 2026] [security2:error] [pid 830701:tid 830922] [client 45.3.45.63:10903] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxefcu1nEoSSDHiOXbgwwAAAWU"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:19:57.350739 2026] [security2:error] [pid 830701:tid 830882] [client 31.171.130.52:53199] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/lufix.php"] [unique_id "alxefcu1nEoSSDHiOXbgzQAAAT0"]
[Sat Jul 18 23:19:57.492613 2026] [security2:error] [pid 830701:tid 830930] [client 31.171.130.41:50965] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/txets.php"] [unique_id "alxefcu1nEoSSDHiOXbg1wAAAW0"]
[Sat Jul 18 23:19:57.564980 2026] [security2:error] [pid 830701:tid 830948] [client 31.171.130.18:59521] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/goods.php"] [unique_id "alxefcu1nEoSSDHiOXbg3AAAAX8"]
[Sat Jul 18 23:19:57.694430 2026] [security2:error] [pid 830701:tid 830886] [client 74.7.230.58:46610] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "sergnotes.com"] [uri "/robots.txt"] [unique_id "alxefcu1nEoSSDHiOXbg3wABQRQ"]
[Sat Jul 18 23:19:57.754526 2026] [security2:error] [pid 830701:tid 830928] [client 223.185.61.63:22780] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxefcu1nEoSSDHiOXbg6wAAAWs"]
[Sat Jul 18 23:19:57.754640 2026] [security2:error] [pid 830701:tid 830928] [client 223.185.61.63:22780] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxefcu1nEoSSDHiOXbg6wAAAWs"]
[Sat Jul 18 23:19:57.942629 2026] [security2:error] [pid 830701:tid 830931] [client 31.171.130.12:50711] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.genspagroup.com"] [uri "/style.php"] [unique_id "alxefcu1nEoSSDHiOXbg8gAAAW4"]
[Sat Jul 18 23:19:57.978555 2026] [security2:error] [pid 830701:tid 830925] [client 31.171.130.51:56529] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxefcu1nEoSSDHiOXbg9QAAAWg"]
[Sat Jul 18 23:19:58.041156 2026] [security2:error] [pid 830701:tid 830867] [client 31.171.130.1:24513] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/wp-editor.php"] [unique_id "alxefsu1nEoSSDHiOXbg-gAAAS4"]
[Sat Jul 18 23:19:58.401913 2026] [security2:error] [pid 830701:tid 830763] [remote 188.138.102.156:33842] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxefsu1nEoSSDHiOXbhDwABiT0"]
[Sat Jul 18 23:19:58.452048 2026] [security2:error] [pid 830701:tid 830885] [client 31.171.130.28:48139] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/wp-admin/txets.php"] [unique_id "alxefsu1nEoSSDHiOXbhEQAAAUA"]
[Sat Jul 18 23:19:58.532469 2026] [security2:error] [pid 830701:tid 830866] [client 31.171.130.9:49989] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/lufix.php"] [unique_id "alxefsu1nEoSSDHiOXbhHgAAAS0"]
[Sat Jul 18 23:19:58.599680 2026] [security2:error] [pid 830701:tid 830817] [remote 188.138.102.156:33842] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxefsu1nEoSSDHiOXbhIwABRnM"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:19:58.619993 2026] [security2:error] [pid 830701:tid 830924] [client 27.34.68.67:52250] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxefsu1nEoSSDHiOXbhJAAAAWc"]
[Sat Jul 18 23:19:58.620139 2026] [security2:error] [pid 830701:tid 830924] [client 27.34.68.67:52250] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxefsu1nEoSSDHiOXbhJAAAAWc"]
[Sat Jul 18 23:19:58.630183 2026] [security2:error] [pid 830701:tid 830929] [client 31.171.130.8:31661] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/wp-editor.php"] [unique_id "alxefsu1nEoSSDHiOXbhJQAAAWw"]
[Sat Jul 18 23:19:58.842721 2026] [security2:error] [pid 830701:tid 830723] [remote 8.217.108.67:34818] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxefsu1nEoSSDHiOXbhKwABehU"]
[Sat Jul 18 23:19:58.914325 2026] [security2:error] [pid 830701:tid 830871] [client 31.171.130.34:23349] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.genspagroup.com"] [uri "/style.php"] [unique_id "alxefsu1nEoSSDHiOXbhMAAAATI"]
[Sat Jul 18 23:19:58.928064 2026] [security2:error] [pid 830701:tid 830938] [client 31.171.130.35:46845] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/wp-includes/txets.php"] [unique_id "alxefsu1nEoSSDHiOXbhMQAAAXU"]
[Sat Jul 18 23:19:58.991461 2026] [security2:error] [pid 830701:tid 830923] [client 190.245.146.99:57387] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxefsu1nEoSSDHiOXbhNwAAAWY"]
[Sat Jul 18 23:19:58.991546 2026] [security2:error] [pid 830701:tid 830923] [client 190.245.146.99:57387] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxefsu1nEoSSDHiOXbhNwAAAWY"]
[Sat Jul 18 23:19:59.034045 2026] [security2:error] [pid 830701:tid 830881] [client 31.171.130.27:29083] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.genspagroup.com"] [uri "/style.php"] [unique_id "alxef8u1nEoSSDHiOXbhOgAAATw"]
[Sat Jul 18 23:19:59.116377 2026] [security2:error] [pid 830701:tid 830914] [client 31.171.130.37:23233] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/lufix.php"] [unique_id "alxef8u1nEoSSDHiOXbhPAAAAV0"]
[Sat Jul 18 23:19:59.436442 2026] [security2:error] [pid 830701:tid 830952] [client 31.171.130.16:34789] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/goods.php"] [unique_id "alxef8u1nEoSSDHiOXbhWwAAAYM"]
[Sat Jul 18 23:19:59.606627 2026] [security2:error] [pid 830701:tid 830834] [client 31.171.130.2:65493] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.genspagroup.com"] [uri "/style.php"] [unique_id "alxef8u1nEoSSDHiOXbhewAAAQ0"]
[Sat Jul 18 23:19:59.963579 2026] [security2:error] [pid 830701:tid 830957] [client 118.179.163.227:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "packerjanitorial.com"] [uri "/index.php"] [unique_id "alxef8u1nEoSSDHiOXbhTAABiDQ"], referer: https://packerjanitorial.com
[Sat Jul 18 23:20:00.029382 2026] [security2:error] [pid 830701:tid 830905] [client 171.4.232.110:53105] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxegMu1nEoSSDHiOXbhswAAAVQ"]
[Sat Jul 18 23:20:00.029514 2026] [security2:error] [pid 830701:tid 830905] [client 171.4.232.110:53105] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxegMu1nEoSSDHiOXbhswAAAVQ"]
[Sat Jul 18 23:20:00.207802 2026] [security2:error] [pid 830701:tid 830722] [remote 123.20.211.178:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxegMu1nEoSSDHiOXbhtAABYxQ"]
[Sat Jul 18 23:20:01.152743 2026] [security2:error] [pid 830701:tid 830886] [client 103.48.44.9:53503] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxegcu1nEoSSDHiOXbiAwAAAUE"]
[Sat Jul 18 23:20:01.152983 2026] [security2:error] [pid 830701:tid 830886] [client 103.48.44.9:53503] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxegcu1nEoSSDHiOXbiAwAAAUE"]
[Sat Jul 18 23:20:01.176850 2026] [security2:error] [pid 830701:tid 830904] [client 31.171.130.22:53005] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/wp-editor.php"] [unique_id "alxegcu1nEoSSDHiOXbiBAAAAVM"]
[Sat Jul 18 23:20:01.442813 2026] [security2:error] [pid 830701:tid 830928] [client 119.154.81.234:59092] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxegcu1nEoSSDHiOXbiDwAAAWs"]
[Sat Jul 18 23:20:01.442916 2026] [security2:error] [pid 830701:tid 830928] [client 119.154.81.234:59092] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxegcu1nEoSSDHiOXbiDwAAAWs"]
[Sat Jul 18 23:20:01.659469 2026] [lsapi:warn] [pid 830701:tid 830919] [client 20.1.128.109:50748] [host oldracelimited.com] Backend log: PHP Warning:  Undefined array key "host" in /home2/oldracel/public_html/oldracelimited/wp-content/plugins/bluehost-wordpress-plugin/inc/YoastAI.php on line 54\n
[Sat Jul 18 23:20:01.662997 2026] [lsapi:warn] [pid 830701:tid 830919] [client 20.1.128.109:50748] [host oldracelimited.com] Backend log: PHP Warning:  Undefined array key "host" in /home2/oldracel/public_html/oldracelimited/wp-content/plugins/bluehost-wordpress-plugin/inc/YoastAI.php on line 54\n
[Sat Jul 18 23:20:02.056035 2026] [security2:error] [pid 830701:tid 830914] [client 31.171.130.40:35933] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/lufix.php"] [unique_id "alxegsu1nEoSSDHiOXbiOQAAAV0"]
[Sat Jul 18 23:20:02.253459 2026] [security2:error] [pid 830701:tid 830743] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxegsu1nEoSSDHiOXbiQwABUSk"]
[Sat Jul 18 23:20:02.253612 2026] [security2:error] [pid 830701:tid 830902] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxegsu1nEoSSDHiOXbiQwABUSk"]
[Sat Jul 18 23:20:02.439491 2026] [security2:error] [pid 830701:tid 830931] [client 57.141.18.102:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "falconarrowshop.com"] [uri "/index.php"] [unique_id "alxegMu1nEoSSDHiOXbhywAAAW4"]
[Sat Jul 18 23:20:02.742542 2026] [security2:error] [pid 830701:tid 830765] [remote 8.217.108.67:34818] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxegsu1nEoSSDHiOXbiaAABWz8"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:20:02.748993 2026] [security2:error] [pid 830701:tid 830907] [client 31.171.130.39:33069] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.genspagroup.com"] [uri "/style.php"] [unique_id "alxegsu1nEoSSDHiOXbiaQAAAVY"]
[Sat Jul 18 23:20:02.893504 2026] [security2:error] [pid 830701:tid 830848] [client 43.163.206.70:49330] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.206.163.43.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lifeisbetterlakeside.com"] [uri "/xmlrpc.php"] [unique_id "alxegsu1nEoSSDHiOXbibgAAARs"]
[Sat Jul 18 23:20:02.910637 2026] [security2:error] [pid 830701:tid 830898] [client 20.1.128.109:50764] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "oldracelimited.com"] [uri "/index.php"] [unique_id "alxegsu1nEoSSDHiOXbiagAAAU0"]
[Sat Jul 18 23:20:03.294044 2026] [security2:error] [pid 830701:tid 830935] [client 57.141.18.56:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxeg8u1nEoSSDHiOXbiggAAAXI"]
[Sat Jul 18 23:20:05.399439 2026] [security2:error] [pid 830701:tid 830943] [client 65.111.28.25:37457] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxehcu1nEoSSDHiOXbjIAAAAXo"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:20:06.174003 2026] [security2:error] [pid 830701:tid 830713] [remote 158.180.33.171:33600] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 171.33.180.158.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxehsu1nEoSSDHiOXbjRAABZAs"]
[Sat Jul 18 23:20:06.174202 2026] [security2:error] [pid 830701:tid 830921] [client 158.180.33.171:33600] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxehsu1nEoSSDHiOXbjRAABZAs"]
[Sat Jul 18 23:20:06.325423 2026] [proxy:error] [pid 830701:tid 830916] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:20:06.325477 2026] [proxy_http:error] [pid 830701:tid 830916] [client 193.47.62.168:35704] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:20:06.325909 2026] [proxy:error] [pid 830701:tid 830916] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:20:06.325934 2026] [proxy_http:error] [pid 830701:tid 830916] [client 193.47.62.168:35704] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:20:06.720938 2026] [security2:error] [pid 830701:tid 830727] [remote 57.141.18.25:44258] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.18.141.57.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/product/3623433"] [unique_id "alxehsu1nEoSSDHiOXbjaAABfBk"]
[Sat Jul 18 23:20:07.172244 2026] [security2:error] [pid 830701:tid 830888] [client 114.119.138.65:58705] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.samdothan.org"] [uri "/wwwthemedicalgroupcouk-772a.pdf"] [unique_id "alxeh8u1nEoSSDHiOXbjfQAAAUM"], referer: http://nekon.jp/dark-eyes/index.php?cmd=backup&action&page=%C3%A3%C2%82%C2%B3%C3%A3%C2%83%C2%A1%C3%A3%C2%83%C2%B3%C3%A3%C2%83%C2%88/FrontPage&age=10
[Sat Jul 18 23:20:07.445483 2026] [security2:error] [pid 830701:tid 830848] [client 223.228.182.224:58525] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxeh8u1nEoSSDHiOXbjiwAAARs"]
[Sat Jul 18 23:20:07.450429 2026] [security2:error] [pid 830701:tid 830848] [client 223.228.182.224:58525] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxeh8u1nEoSSDHiOXbjiwAAARs"]
[Sat Jul 18 23:20:08.441438 2026] [security2:error] [pid 830701:tid 830859] [client 223.185.61.63:23815] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeiMu1nEoSSDHiOXbjxAAAASY"]
[Sat Jul 18 23:20:08.446025 2026] [security2:error] [pid 830701:tid 830859] [client 223.185.61.63:23815] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeiMu1nEoSSDHiOXbjxAAAASY"]
[Sat Jul 18 23:20:08.949336 2026] [security2:error] [pid 830701:tid 830945] [client 74.208.214.194:54752] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxeiMu1nEoSSDHiOXbj3gAAAXw"]
[Sat Jul 18 23:20:09.250539 2026] [security2:error] [pid 830701:tid 830840] [client 27.34.68.67:22369] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxeicu1nEoSSDHiOXbj9AAAARM"]
[Sat Jul 18 23:20:09.250644 2026] [security2:error] [pid 830701:tid 830840] [client 27.34.68.67:22369] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxeicu1nEoSSDHiOXbj9AAAARM"]
[Sat Jul 18 23:20:09.489690 2026] [security2:error] [pid 830701:tid 830860] [client 190.245.146.99:57908] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeicu1nEoSSDHiOXbkAQAAASc"]
[Sat Jul 18 23:20:09.489812 2026] [security2:error] [pid 830701:tid 830860] [client 190.245.146.99:57908] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeicu1nEoSSDHiOXbkAQAAASc"]
[Sat Jul 18 23:20:10.202678 2026] [security2:error] [pid 830701:tid 830943] [client 162.249.167.91:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxeisu1nEoSSDHiOXbkHwABejs"]
[Sat Jul 18 23:20:10.560337 2026] [security2:error] [pid 830701:tid 830898] [client 171.4.232.110:53596] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeisu1nEoSSDHiOXbkPAAAAU0"]
[Sat Jul 18 23:20:10.560442 2026] [security2:error] [pid 830701:tid 830898] [client 171.4.232.110:53596] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeisu1nEoSSDHiOXbkPAAAAU0"]
[Sat Jul 18 23:20:10.607213 2026] [security2:error] [pid 830701:tid 830790] [remote 91.142.222.105:56140] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxeisu1nEoSSDHiOXbkQAABcFg"]
[Sat Jul 18 23:20:10.708934 2026] [security2:error] [pid 830701:tid 830844] [client 114.119.138.220:39969] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.lutheranphilosopher.com"] [uri "/apps/members/membersList%3Bjsessionid=FF95D2E3499BC2951CCAC0D5E4869455"] [unique_id "alxeisu1nEoSSDHiOXbkRgAAARc"], referer: https://www.lutheranphilosopher.com/apps/members/membersList%3Bjsessionid=859BEDDEF206661DCB1E0159BCAF935E?offset=1&q&sort=DISPLAY_NAME&view=list
[Sat Jul 18 23:20:11.152333 2026] [security2:error] [pid 830701:tid 830946] [client 57.141.18.18:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "falconarrowshop.com"] [uri "/index.php"] [unique_id "alxeisu1nEoSSDHiOXbkUwAAAX0"]
[Sat Jul 18 23:20:11.506647 2026] [security2:error] [pid 830701:tid 830945] [client 18.139.208.24:64142] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "cryptomeaning.com"] [uri "/5-popular-crypto-exchanges-every-investor-should-know/"] [unique_id "alxei8u1nEoSSDHiOXbkbgAAAXw"], referer: https://cryptomeaning.com/top-5-cryptocurrency-exchanges-with-the-cheapest-transaction-fees/
[Sat Jul 18 23:20:11.657918 2026] [security2:error] [pid 830701:tid 830831] [client 103.48.44.9:54016] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxei8u1nEoSSDHiOXbkfAAAAQo"]
[Sat Jul 18 23:20:11.658045 2026] [security2:error] [pid 830701:tid 830831] [client 103.48.44.9:54016] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxei8u1nEoSSDHiOXbkfAAAAQo"]
[Sat Jul 18 23:20:11.816282 2026] [security2:error] [pid 830701:tid 830866] [client 114.119.142.140:33047] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.zonemist.com"] [uri "/products/zonemist-generators/"] [unique_id "alxei8u1nEoSSDHiOXbkiAAAAS0"], referer: https://www.zonemist.com/industries
[Sat Jul 18 23:20:11.887869 2026] [security2:error] [pid 830701:tid 830915] [client 114.119.150.190:43023] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "thierry-henry.fr"] [uri "/premier-article-de-blog/amp/"] [unique_id "alxei8u1nEoSSDHiOXbkigAAAV4"], referer: https://thierry-henry.fr/amp/page/34
[Sat Jul 18 23:20:12.039473 2026] [security2:error] [pid 830701:tid 830929] [client 114.119.147.166:40103] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "itekphonerepair.com"] [uri "/"] [unique_id "alxejMu1nEoSSDHiOXbkmgAAAWw"], referer: https://joanne-kelly.com/eue/82ae8ad0a09adcef898191ac8084a3d78bc9868fc08da5e3.html
[Sat Jul 18 23:20:12.066021 2026] [security2:error] [pid 830701:tid 830711] [remote 91.142.222.105:56140] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxejMu1nEoSSDHiOXbknQABVQk"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:20:12.115866 2026] [security2:error] [pid 830701:tid 830944] [client 103.55.145.104:55986] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.145.55.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "vfcthomasville.org"] [uri "/xmlrpc.php"] [unique_id "alxejMu1nEoSSDHiOXbknAAAAXs"]
[Sat Jul 18 23:20:12.115997 2026] [security2:error] [pid 830701:tid 830944] [client 103.55.145.104:55986] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "vfcthomasville.org"] [uri "/xmlrpc.php"] [unique_id "alxejMu1nEoSSDHiOXbknAAAAXs"]
[Sat Jul 18 23:20:12.135529 2026] [security2:error] [pid 830701:tid 830872] [client 114.119.150.209:40475] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "massagelacey.com"] [uri "/category/massage/page/5/"] [unique_id "alxejMu1nEoSSDHiOXbknwAAATM"], referer: https://massagelacey.com/category/massage/page/6/
[Sat Jul 18 23:20:12.163146 2026] [security2:error] [pid 830701:tid 830882] [client 119.154.81.234:59515] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxejMu1nEoSSDHiOXbkogAAAT0"]
[Sat Jul 18 23:20:12.163403 2026] [security2:error] [pid 830701:tid 830882] [client 119.154.81.234:59515] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxejMu1nEoSSDHiOXbkogAAAT0"]
[Sat Jul 18 23:20:12.848190 2026] [security2:error] [pid 830701:tid 830777] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxejMu1nEoSSDHiOXbkxgABWks"]
[Sat Jul 18 23:20:12.848317 2026] [security2:error] [pid 830701:tid 830911] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxejMu1nEoSSDHiOXbkxgABWks"]
[Sat Jul 18 23:20:12.878404 2026] [security2:error] [pid 830701:tid 830905] [client 114.119.158.28:45281] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.savilerowtravel.com"] [uri "/news/savile-row-travel-guide-maldives/"] [unique_id "alxejMu1nEoSSDHiOXbkywAAAVQ"], referer: http://savilerowtravel.com/blog
[Sat Jul 18 23:20:13.113892 2026] [security2:error] [pid 830701:tid 830934] [client 34.147.91.161:8192] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "mail.keyq8.com"] [uri "/"] [unique_id "alxejcu1nEoSSDHiOXbk2QAAAXE"]
[Sat Jul 18 23:20:13.114019 2026] [security2:error] [pid 830701:tid 830934] [client 34.147.91.161:8192] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "mail.keyq8.com"] [uri "/"] [unique_id "alxejcu1nEoSSDHiOXbk2QAAAXE"]
[Sat Jul 18 23:20:13.218931 2026] [security2:error] [pid 830701:tid 830710] [remote 80.243.230.220:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxejcu1nEoSSDHiOXbk2AABEgg"]
[Sat Jul 18 23:20:14.078483 2026] [security2:error] [pid 830701:tid 830776] [remote 154.61.75.100:36154] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxejsu1nEoSSDHiOXblFQABEEo"]
[Sat Jul 18 23:20:14.320494 2026] [security2:error] [pid 830701:tid 830887] [client 124.29.246.106:64075] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxejsu1nEoSSDHiOXblJwAAAUI"]
[Sat Jul 18 23:20:14.320658 2026] [security2:error] [pid 830701:tid 830887] [client 124.29.246.106:64075] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxejsu1nEoSSDHiOXblJwAAAUI"]
[Sat Jul 18 23:20:14.503249 2026] [security2:error] [pid 830701:tid 830793] [remote 154.61.75.100:36154] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxejsu1nEoSSDHiOXblMAABOFs"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:20:15.058908 2026] [security2:error] [pid 830701:tid 830814] [remote 45.157.54.14:11556] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "collectingrealestate.com"] [uri "/xmlrpc.php"] [unique_id "alxej8u1nEoSSDHiOXblSQABfnA"]
[Sat Jul 18 23:20:15.059105 2026] [security2:error] [pid 830701:tid 830947] [client 45.157.54.14:11556] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "collectingrealestate.com"] [uri "/xmlrpc.php"] [unique_id "alxej8u1nEoSSDHiOXblSQABfnA"]
[Sat Jul 18 23:20:15.068499 2026] [security2:error] [pid 830701:tid 830733] [remote 45.157.54.14:11575] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "collectingrealestate.com"] [uri "/xmlrpc.php"] [unique_id "alxej8u1nEoSSDHiOXblTQABKB8"]
[Sat Jul 18 23:20:15.068626 2026] [security2:error] [pid 830701:tid 830861] [client 45.157.54.14:11575] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "collectingrealestate.com"] [uri "/xmlrpc.php"] [unique_id "alxej8u1nEoSSDHiOXblTQABKB8"]
[Sat Jul 18 23:20:15.496633 2026] [security2:error] [pid 830701:tid 830844] [client 114.119.153.215:50777] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.thewelloiledlife.com"] [uri "/sitemap-pt-post-2018-08.html"] [unique_id "alxej8u1nEoSSDHiOXblbAAAARc"], referer: https://www.thewelloiledlife.com/sitemap.html
[Sat Jul 18 23:20:16.341819 2026] [security2:error] [pid 830701:tid 830865] [client 2603:1026:c0a:1428::5:0] ModSecurity: Warning. Matched phrase "Disco" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "404"] [hostname "ali-alghanim.net"] [uri "/index.php"] [unique_id "alxekMu1nEoSSDHiOXbliQABLDM"]
[Sat Jul 18 23:20:16.341842 2026] [security2:error] [pid 830701:tid 830865] [client 2603:1026:c0a:1428::5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "ali-alghanim.net"] [uri "/index.php"] [unique_id "alxekMu1nEoSSDHiOXbliQABLDM"]
[Sat Jul 18 23:20:17.021259 2026] [autoindex:error] [pid 830701:tid 830878] [client 193.183.87.205:58283] AH01276: Cannot serve directory /home1/heidimo2/public_html/website_ba575a2e/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:20:17.029976 2026] [security2:error] [pid 830701:tid 830798] [remote 72.167.132.114:43110] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "jhavoctattoos.com"] [uri "/wp-login.php"] [unique_id "alxekcu1nEoSSDHiOXblugABbGA"]
[Sat Jul 18 23:20:17.268352 2026] [security2:error] [pid 830701:tid 830820] [remote 72.167.132.114:43110] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "jhavoctattoos.com"] [uri "/wp-login.php"] [unique_id "alxekcu1nEoSSDHiOXblxwABG3Y"], referer: https://jhavoctattoos.com/wp-login.php
[Sat Jul 18 23:20:18.258218 2026] [security2:error] [pid 830701:tid 830881] [client 223.228.182.224:60707] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxeksu1nEoSSDHiOXbl-QAAATw"]
[Sat Jul 18 23:20:18.258325 2026] [security2:error] [pid 830701:tid 830881] [client 223.228.182.224:60707] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxeksu1nEoSSDHiOXbl-QAAATw"]
[Sat Jul 18 23:20:18.505489 2026] [security2:error] [pid 830701:tid 830885] [client 114.119.135.120:35801] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.new-menus.com"] [uri "/index.php"] [unique_id "alxeksu1nEoSSDHiOXbmEAAAAUA"], referer: https://www.new-menus.com/index.php?board=14.0%3Bsort%3Dreplies
[Sat Jul 18 23:20:18.632598 2026] [security2:error] [pid 830701:tid 830923] [client 114.119.152.70:43815] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "bruceledewitz.com"] [uri "/looking-forward-to-2022-this-weeks-column-in-the-pa-capital-star/"] [unique_id "alxeksu1nEoSSDHiOXbmFgAAAWY"], referer: https://bruceledewitz.com/blog/
[Sat Jul 18 23:20:19.154881 2026] [security2:error] [pid 830701:tid 830844] [client 223.185.61.63:32522] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxek8u1nEoSSDHiOXbmNwAAARc"]
[Sat Jul 18 23:20:19.154993 2026] [security2:error] [pid 830701:tid 830844] [client 223.185.61.63:32522] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxek8u1nEoSSDHiOXbmNwAAARc"]
[Sat Jul 18 23:20:19.612246 2026] [security2:error] [pid 830701:tid 830906] [client 201.239.115.228:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "packerjanitorial.com"] [uri "/index.php"] [unique_id "alxek8u1nEoSSDHiOXbmOQABVQ8"], referer: https://packerjanitorial.com
[Sat Jul 18 23:20:19.822681 2026] [security2:error] [pid 830701:tid 830899] [client 27.34.68.67:28451] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxek8u1nEoSSDHiOXbmWwAAAU4"]
[Sat Jul 18 23:20:19.822790 2026] [security2:error] [pid 830701:tid 830899] [client 27.34.68.67:28451] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxek8u1nEoSSDHiOXbmWwAAAU4"]
[Sat Jul 18 23:20:19.998847 2026] [security2:error] [pid 830701:tid 830836] [client 190.245.146.99:58427] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxek8u1nEoSSDHiOXbmYwAAAQ8"]
[Sat Jul 18 23:20:19.998943 2026] [security2:error] [pid 830701:tid 830836] [client 190.245.146.99:58427] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxek8u1nEoSSDHiOXbmYwAAAQ8"]
[Sat Jul 18 23:20:20.716225 2026] [security2:error] [pid 830701:tid 830918] [client 99.233.44.156:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxej8u1nEoSSDHiOXblbgABglY"]
[Sat Jul 18 23:20:21.113557 2026] [security2:error] [pid 830701:tid 830899] [client 171.4.232.110:54090] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxelcu1nEoSSDHiOXbmmAAAAU4"]
[Sat Jul 18 23:20:21.113644 2026] [security2:error] [pid 830701:tid 830899] [client 171.4.232.110:54090] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxelcu1nEoSSDHiOXbmmAAAAU4"]
[Sat Jul 18 23:20:21.422430 2026] [security2:error] [pid 830701:tid 830704] [remote 103.133.214.160:57028] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.214.133.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "recruitinginsight.us"] [uri "/wp-login.php"] [unique_id "alxelcu1nEoSSDHiOXbmpAABXwI"]
[Sat Jul 18 23:20:21.575963 2026] [security2:error] [pid 830701:tid 830932] [client 114.119.133.250:48405] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "mourgroup.com"] [uri "/portfolio/thomas-avenue-beach-homes/"] [unique_id "alxelcu1nEoSSDHiOXbmswAAAW8"], referer: https://mourgroup.com/portfolio/lauretta-row-townhomes/
[Sat Jul 18 23:20:21.602176 2026] [proxy:error] [pid 830701:tid 830905] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:20:21.602248 2026] [proxy_http:error] [pid 830701:tid 830905] [client 193.47.62.168:38586] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:20:21.602805 2026] [proxy:error] [pid 830701:tid 830905] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:20:21.602832 2026] [proxy_http:error] [pid 830701:tid 830905] [client 193.47.62.168:38586] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:20:21.611765 2026] [security2:error] [pid 830701:tid 830846] [client 114.119.139.166:23403] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "elementconstruction.co.uk"] [uri "/wp-content/uploads/2023/01/Barnes-05.jpg"] [unique_id "alxelcu1nEoSSDHiOXbmtQAAARk"], referer: https://elementconstruction.co.uk/portfolio/barnes/
[Sat Jul 18 23:20:21.890688 2026] [security2:error] [pid 830701:tid 830774] [remote 103.133.214.160:57028] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.214.133.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "recruitinginsight.us"] [uri "/wp-login.php"] [unique_id "alxelcu1nEoSSDHiOXbmwgABeUg"], referer: https://recruitinginsight.us/wp-login.php
[Sat Jul 18 23:20:22.182476 2026] [security2:error] [pid 830701:tid 830855] [client 103.48.44.9:54526] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxelsu1nEoSSDHiOXbm1QAAASI"]
[Sat Jul 18 23:20:22.182571 2026] [security2:error] [pid 830701:tid 830855] [client 103.48.44.9:54526] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxelsu1nEoSSDHiOXbm1QAAASI"]
[Sat Jul 18 23:20:22.295692 2026] [security2:error] [pid 830701:tid 830924] [client 34.91.229.116:4097] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "cpanel.olearyplumbingllc.com"] [uri "/"] [unique_id "alxelsu1nEoSSDHiOXbm3gAAAWc"]
[Sat Jul 18 23:20:22.295791 2026] [security2:error] [pid 830701:tid 830924] [client 34.91.229.116:4097] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "cpanel.olearyplumbingllc.com"] [uri "/"] [unique_id "alxelsu1nEoSSDHiOXbm3gAAAWc"]
[Sat Jul 18 23:20:22.733361 2026] [security2:error] [pid 830701:tid 830892] [client 114.119.131.245:33157] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.liquidationteam.com"] [uri "/product/mcrmck-red-pepper-crushed"] [unique_id "alxelsu1nEoSSDHiOXbm-gAAAUc"], referer: https://www.liquidationteam.com/product/mcrmck-red-pepper-crushed
[Sat Jul 18 23:20:22.830120 2026] [security2:error] [pid 830701:tid 830843] [client 119.154.81.234:59944] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxelsu1nEoSSDHiOXbm_gAAARY"]
[Sat Jul 18 23:20:22.830209 2026] [security2:error] [pid 830701:tid 830843] [client 119.154.81.234:59944] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxelsu1nEoSSDHiOXbm_gAAARY"]
[Sat Jul 18 23:20:23.261972 2026] [security2:error] [pid 830701:tid 830759] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxel8u1nEoSSDHiOXbnFAABZzk"]
[Sat Jul 18 23:20:23.262093 2026] [security2:error] [pid 830701:tid 830924] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxel8u1nEoSSDHiOXbnFAABZzk"]
[Sat Jul 18 23:20:23.308402 2026] [security2:error] [pid 830701:tid 830841] [client 78.142.18.40:60389] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 40.18.142.78.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mollycahill.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxel8u1nEoSSDHiOXbnFwAAARQ"]
[Sat Jul 18 23:20:23.660847 2026] [security2:error] [pid 830701:tid 830892] [client 85.204.70.112:54720] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "momheadquarters.com"] [uri "/plugins/"] [unique_id "alxel8u1nEoSSDHiOXbnLQAAAUc"]
[Sat Jul 18 23:20:23.725865 2026] [security2:error] [pid 830701:tid 830951] [client 78.142.18.40:58094] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 40.18.142.78.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mollycahill.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxel8u1nEoSSDHiOXbnLgAAAYI"]
[Sat Jul 18 23:20:23.732248 2026] [security2:error] [pid 830701:tid 830844] [client 114.119.144.31:52917] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.cathybuffini.com"] [uri "/sitemap.rss"] [unique_id "alxel8u1nEoSSDHiOXbnLwAAARc"]
[Sat Jul 18 23:20:24.161559 2026] [security2:error] [pid 830701:tid 830876] [client 78.142.18.40:64486] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 40.18.142.78.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mollycahill.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxemMu1nEoSSDHiOXbnTgAAATc"]
[Sat Jul 18 23:20:24.650258 2026] [security2:error] [pid 830701:tid 830867] [client 45.146.54.130:54629] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 130.54.146.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.scoophouse.com"] [uri "/wp-login.php"] [unique_id "alxemMu1nEoSSDHiOXbnZAAAAS4"]
[Sat Jul 18 23:20:24.870444 2026] [security2:error] [pid 830701:tid 830882] [client 114.119.145.183:34707] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "juniper3medical.com"] [uri "/product/oxy508e/"] [unique_id "alxemMu1nEoSSDHiOXbncAAAAT0"], referer: http://juniper3medical.com/product-category/narang-medical-usa/anesthesia/page/3/
[Sat Jul 18 23:20:24.948083 2026] [core:error] [pid 830701:tid 830839] [client 140.248.75.57:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:20:24.948109 2026] [core:error] [pid 830701:tid 830839] [client 140.248.75.57:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:20:24.953551 2026] [core:error] [pid 830701:tid 830901] [client 140.248.75.57:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:20:24.953579 2026] [core:error] [pid 830701:tid 830901] [client 140.248.75.57:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:20:25.297859 2026] [security2:error] [pid 830701:tid 830911] [client 45.3.45.93:35547] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 93.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxemcu1nEoSSDHiOXbnlgAAAVo"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:20:25.355366 2026] [security2:error] [pid 830701:tid 830923] [client 124.29.207.185:64532] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxemcu1nEoSSDHiOXbnmAAAAWY"]
[Sat Jul 18 23:20:25.355463 2026] [security2:error] [pid 830701:tid 830923] [client 124.29.207.185:64532] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxemcu1nEoSSDHiOXbnmAAAAWY"]
[Sat Jul 18 23:20:25.463634 2026] [security2:error] [pid 830701:tid 830861] [client 114.119.133.119:30675] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "fkconstructionfunding.com"] [uri "/"] [unique_id "alxemcu1nEoSSDHiOXbnpAAAASg"], referer: https://fkconstructionfunding.com/
[Sat Jul 18 23:20:25.471256 2026] [security2:error] [pid 830701:tid 830942] [client 78.142.18.40:59793] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 40.18.142.78.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mollycahill.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxemcu1nEoSSDHiOXbnpQAAAXk"]
[Sat Jul 18 23:20:26.309360 2026] [security2:error] [pid 830701:tid 830947] [client 103.178.3.226:46730] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "steadfastwolfproductions.com"] [uri "/wp-comments-post.php"] [unique_id "alxemsu1nEoSSDHiOXbnzQAAAX4"]
[Sat Jul 18 23:20:26.402341 2026] [security2:error] [pid 830701:tid 830947] [client 103.178.3.226:46730] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "403"] [hostname "steadfastwolfproductions.com"] [uri "/wp-comments-post.php"] [unique_id "alxemsu1nEoSSDHiOXbnzQAAAX4"]
[Sat Jul 18 23:20:26.972099 2026] [security2:error] [pid 830701:tid 830821] [remote 154.61.75.100:38230] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxemsu1nEoSSDHiOXbn9wABEnc"]
[Sat Jul 18 23:20:27.383838 2026] [security2:error] [pid 830701:tid 830723] [remote 154.61.75.100:38230] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxem8u1nEoSSDHiOXboDAABERU"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:20:27.703100 2026] [security2:error] [pid 830701:tid 830927] [client 114.119.139.185:44411] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "lifeisbetterlakeside.com"] [uri "/category/homeprojects/gardening/"] [unique_id "alxem8u1nEoSSDHiOXboGwAAAWo"], referer: https://lifeisbetterlakeside.com/lemurs-up-close-and-personal-at-the-alabama-gulf-coast-zoo-part-2/
[Sat Jul 18 23:20:27.736564 2026] [security2:error] [pid 830701:tid 830709] [remote 160.187.68.132:41274] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.68.187.160.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxem8u1nEoSSDHiOXboHAABLQc"]
[Sat Jul 18 23:20:28.003709 2026] [security2:error] [pid 830701:tid 830858] [client 114.119.134.51:51769] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "jenfarley.com"] [uri "/state-animals-usa-map/&sa=U"] [unique_id "alxenMu1nEoSSDHiOXboLAAAASU"], referer: https://anarim.az/img/search.php?newwindow=1&q=national%2Banimals%2Bof%2Bthe%2Busa&sa=X&ved=2ahUKEwifjsfp86j-AhUFp4sKHYFvDjsQ1QJ6BAgGEAI
[Sat Jul 18 23:20:28.799164 2026] [http2:info] [pid 881201:tid 881201] h2_workers: created with min=128 max=192 idle_ms=600000
[Sat Jul 18 23:20:29.215926 2026] [security2:error] [pid 830701:tid 830874] [client 223.228.182.224:52523] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxencu1nEoSSDHiOXboYgAAATU"]
[Sat Jul 18 23:20:29.216022 2026] [security2:error] [pid 830701:tid 830874] [client 223.228.182.224:52523] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxencu1nEoSSDHiOXboYgAAATU"]
[Sat Jul 18 23:20:29.418171 2026] [security2:error] [pid 881201:tid 881223] [remote 14.128.14.9:38754] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.14.128.14.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "str.cly.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxenQWL-zKlchkVWS03BQAABBQ"]
[Sat Jul 18 23:20:29.418390 2026] [security2:error] [pid 881201:tid 881336] [client 14.128.14.9:38754] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "str.cly.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxenQWL-zKlchkVWS03BQAABBQ"]
[Sat Jul 18 23:20:29.810718 2026] [security2:error] [pid 881201:tid 881441] [client 114.119.135.120:56073] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.ferrellroofing.com"] [uri "/products/additional-roofs"] [unique_id "alxenQWL-zKlchkVWS03HQAAAG0"], referer: http://www.ferrellroofing.com/metalworks/
[Sat Jul 18 23:20:29.843996 2026] [security2:error] [pid 881201:tid 881387] [client 223.185.61.63:26842] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxenQWL-zKlchkVWS03IgAAADc"]
[Sat Jul 18 23:20:29.844164 2026] [security2:error] [pid 881201:tid 881387] [client 223.185.61.63:26842] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxenQWL-zKlchkVWS03IgAAADc"]
[Sat Jul 18 23:20:30.125396 2026] [security2:error] [pid 881201:tid 881245] [remote 154.61.75.100:38032] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "worbals.com"] [uri "/wp-login.php"] [unique_id "alxengWL-zKlchkVWS03MgAAaCo"]
[Sat Jul 18 23:20:30.492919 2026] [security2:error] [pid 881201:tid 881449] [client 27.34.68.67:26714] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxengWL-zKlchkVWS03TQAAAHU"]
[Sat Jul 18 23:20:30.493087 2026] [security2:error] [pid 881201:tid 881449] [client 27.34.68.67:26714] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxengWL-zKlchkVWS03TQAAAHU"]
[Sat Jul 18 23:20:30.534889 2026] [security2:error] [pid 881201:tid 881364] [client 190.245.146.99:58948] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxengWL-zKlchkVWS03UwAAACA"]
[Sat Jul 18 23:20:30.540829 2026] [security2:error] [pid 881201:tid 881364] [client 190.245.146.99:58948] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxengWL-zKlchkVWS03UwAAACA"]
[Sat Jul 18 23:20:30.554408 2026] [security2:error] [pid 881201:tid 881258] [remote 154.61.75.100:38032] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "worbals.com"] [uri "/wp-login.php"] [unique_id "alxengWL-zKlchkVWS03VAAAUTc"], referer: https://worbals.com/wp-login.php
[Sat Jul 18 23:20:31.735542 2026] [security2:error] [pid 881201:tid 881395] [client 171.4.232.110:54584] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxenwWL-zKlchkVWS03mgAAAD8"]
[Sat Jul 18 23:20:31.735645 2026] [security2:error] [pid 881201:tid 881395] [client 171.4.232.110:54584] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxenwWL-zKlchkVWS03mgAAAD8"]
[Sat Jul 18 23:20:32.165144 2026] [security2:error] [pid 881201:tid 881455] [client 4.194.24.143:18603] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/nine2code.php"] [unique_id "alxeoAWL-zKlchkVWS03swAAAHs"]
[Sat Jul 18 23:20:32.707580 2026] [security2:error] [pid 881201:tid 881451] [client 103.48.44.9:55035] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeoAWL-zKlchkVWS03xwAAAHc"]
[Sat Jul 18 23:20:32.707735 2026] [security2:error] [pid 881201:tid 881451] [client 103.48.44.9:55035] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeoAWL-zKlchkVWS03xwAAAHc"]
[Sat Jul 18 23:20:32.737859 2026] [security2:error] [pid 881201:tid 881413] [client 4.194.24.143:28774] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/num.php"] [unique_id "alxeoAWL-zKlchkVWS03ygAAAFE"]
[Sat Jul 18 23:20:32.746039 2026] [security2:error] [pid 881201:tid 881422] [client 114.119.147.6:26447] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.safe-systems.net"] [uri "/nextbit.mx/portafolio/aviato"] [unique_id "alxeoAWL-zKlchkVWS03zAAAAFo"], referer: https://nextbit.mx/
[Sat Jul 18 23:20:32.855586 2026] [security2:error] [pid 881201:tid 881367] [client 114.119.135.66:47351] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "mezzacraft.com"] [uri "/mini-crochet-pumpkins-free-pattern/amp"] [unique_id "alxeoAWL-zKlchkVWS031wAAACM"], referer: https://mezzacraft.com/mini-crochet-pumpkins-free-pattern/amp
[Sat Jul 18 23:20:33.151795 2026] [lsapi:error] [pid 831031:tid 831289] [client 66.228.34.49:35918] [host youpositive.co] Error receiving response: ReceiveResponse: receive pkg hdr failed: ReceivePkgHdr: nothing to read from backend (LVE ID 1067; user ID 1067), check http://docs.cloudlinux.com/mod_lsapi_troubleshooting.html
[Sat Jul 18 23:20:33.179329 2026] [security2:error] [pid 881201:tid 881359] [client 66.228.34.49:0] ModSecurity: Warning. Matched phrase "Sucuri" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "404"] [hostname "youpositive.co"] [uri "/cgi-sys/404.html"] [unique_id "alxeoQWL-zKlchkVWS036wAAABs"]
[Sat Jul 18 23:20:33.181738 2026] [security2:error] [pid 831031:tid 831289] [client 66.228.34.49:35918] ModSecurity: Warning. Matched phrase "Sucuri" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "404"] [hostname "youpositive.co"] [uri "/cgi-sys/503.html"] [unique_id "alxddJnU1ySsD4Tkeg4aOwAAAg4"]
[Sat Jul 18 23:20:33.326538 2026] [security2:error] [pid 881201:tid 881335] [client 4.194.24.143:20026] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/odf7udtspqtpxzyxmw2rccdefault.php"] [unique_id "alxeoQWL-zKlchkVWS039gAAAAM"]
[Sat Jul 18 23:20:33.380776 2026] [security2:error] [pid 881201:tid 881389] [client 119.154.81.234:60382] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxeoQWL-zKlchkVWS03_QAAADk"]
[Sat Jul 18 23:20:33.380901 2026] [security2:error] [pid 881201:tid 881389] [client 119.154.81.234:60382] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxeoQWL-zKlchkVWS03_QAAADk"]
[Sat Jul 18 23:20:33.605371 2026] [security2:error] [pid 881201:tid 881255] [remote 160.187.68.132:58508] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.68.187.160.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxeoQWL-zKlchkVWS04MgAATjQ"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:20:33.657785 2026] [security2:error] [pid 881201:tid 881258] [remote 154.61.75.100:38044] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxeoQWL-zKlchkVWS04PQAAMjc"]
[Sat Jul 18 23:20:33.800535 2026] [security2:error] [pid 881201:tid 881353] [client 45.3.45.103:16743] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxeoQWL-zKlchkVWS04RgAAABU"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:20:33.811435 2026] [security2:error] [pid 881201:tid 881444] [client 114.119.138.172:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxeoQWL-zKlchkVWS04QQAAAHA"], referer: https://omenana.com/2019/10/27/above-the-beach-vk-thipa?share=email
[Sat Jul 18 23:20:33.891507 2026] [security2:error] [pid 881201:tid 881272] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxeoQWL-zKlchkVWS04UQAAaUU"]
[Sat Jul 18 23:20:33.891620 2026] [security2:error] [pid 881201:tid 881437] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxeoQWL-zKlchkVWS04UQAAaUU"]
[Sat Jul 18 23:20:33.924489 2026] [security2:error] [pid 881201:tid 881392] [client 4.194.24.143:18562] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/option.php"] [unique_id "alxeoQWL-zKlchkVWS04VgAAADw"]
[Sat Jul 18 23:20:34.110041 2026] [security2:error] [pid 881201:tid 881281] [remote 154.61.75.100:38044] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxeogWL-zKlchkVWS04YwAAfE4"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:20:34.516999 2026] [security2:error] [pid 881201:tid 881413] [client 4.194.24.143:19987] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/p.php"] [unique_id "alxeogWL-zKlchkVWS04fAAAAFE"]
[Sat Jul 18 23:20:34.542891 2026] [security2:error] [pid 881201:tid 881390] [client 23.160.60.202:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "thelastgamestandingexp.com"] [uri "/index.php"] [unique_id "alxeoAWL-zKlchkVWS032AAAADo"]
[Sat Jul 18 23:20:34.671645 2026] [security2:error] [pid 881201:tid 881300] [remote 154.61.75.100:38052] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "colt-in.com"] [uri "/wp-login.php"] [unique_id "alxeogWL-zKlchkVWS04hAAATWE"]
[Sat Jul 18 23:20:35.056904 2026] [security2:error] [pid 881201:tid 881357] [client 4.194.24.143:18647] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/past.php"] [unique_id "alxeowWL-zKlchkVWS04nwAAABk"]
[Sat Jul 18 23:20:35.104112 2026] [security2:error] [pid 881201:tid 881342] [client 195.63.31.160:10549] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.31.63.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxeowWL-zKlchkVWS04oAAAAAo"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:20:35.108884 2026] [security2:error] [pid 881201:tid 881367] [client 47.128.41.58:21554] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "samdothan.org"] [uri "/robots.txt"] [unique_id "alxeowWL-zKlchkVWS04pQAAACM"]
[Sat Jul 18 23:20:35.111386 2026] [security2:error] [pid 881201:tid 881310] [remote 154.61.75.100:38052] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "colt-in.com"] [uri "/wp-login.php"] [unique_id "alxeowWL-zKlchkVWS04owAAX2s"], referer: https://colt-in.com/wp-login.php
[Sat Jul 18 23:20:35.278729 2026] [security2:error] [pid 881201:tid 881378] [client 65.111.28.194:64745] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxeowWL-zKlchkVWS04swAAAC4"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:20:35.623433 2026] [security2:error] [pid 881201:tid 881371] [client 4.194.24.143:19979] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/php.php"] [unique_id "alxeowWL-zKlchkVWS04ywAAACc"]
[Sat Jul 18 23:20:36.139250 2026] [security2:error] [pid 881201:tid 881358] [client 74.208.214.194:52160] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxepAWL-zKlchkVWS047gAAABo"]
[Sat Jul 18 23:20:36.140274 2026] [security2:error] [pid 881201:tid 881230] [remote 57.141.18.4:36088] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 4.18.141.57.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/product/5417502"] [unique_id "alxepAWL-zKlchkVWS047QAATRs"]
[Sat Jul 18 23:20:36.206046 2026] [security2:error] [pid 881201:tid 881353] [client 4.194.24.143:19995] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/php8.php"] [unique_id "alxepAWL-zKlchkVWS049QAAABU"]
[Sat Jul 18 23:20:36.254268 2026] [security2:error] [pid 881201:tid 881233] [remote 72.167.132.114:58554] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxepAWL-zKlchkVWS04-AAAZh4"]
[Sat Jul 18 23:20:36.287964 2026] [security2:error] [pid 881201:tid 881429] [client 14.191.250.179:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mtlegnews.gov"] [uri "/index.php"] [unique_id "alxepAWL-zKlchkVWS046AAAAGE"]
[Sat Jul 18 23:20:36.561508 2026] [security2:error] [pid 881201:tid 881396] [client 124.29.246.106:64982] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxepAWL-zKlchkVWS05DQAAAEA"]
[Sat Jul 18 23:20:36.561618 2026] [security2:error] [pid 881201:tid 881396] [client 124.29.246.106:64982] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxepAWL-zKlchkVWS05DQAAAEA"]
[Sat Jul 18 23:20:36.567195 2026] [security2:error] [pid 881201:tid 881244] [remote 72.167.132.114:58554] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxepAWL-zKlchkVWS05DAAAVyk"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:20:36.725476 2026] [security2:error] [pid 881201:tid 881375] [client 65.111.28.22:29543] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 22.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxepAWL-zKlchkVWS05EgAAACs"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:20:36.772429 2026] [security2:error] [pid 881201:tid 881450] [client 4.194.24.143:20023] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/phpinfo.php"] [unique_id "alxepAWL-zKlchkVWS05GQAAAHY"]
[Sat Jul 18 23:20:37.488145 2026] [security2:error] [pid 881201:tid 881412] [client 82.135.202.97:46326] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.keywayconstructionclt.com"] [uri "/index.php"] [unique_id "alxepQWL-zKlchkVWS05QQAAAFA"]
[Sat Jul 18 23:20:37.499086 2026] [security2:error] [pid 881201:tid 881394] [client 4.194.24.143:28763] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/post.php"] [unique_id "alxepQWL-zKlchkVWS05RwAAAD4"]
[Sat Jul 18 23:20:38.063595 2026] [security2:error] [pid 881201:tid 881454] [client 4.194.24.143:19976] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/public/assets/design_1/css/parts/course_cards/grid_card_1.min.php"] [unique_id "alxepgWL-zKlchkVWS05aAAAAHo"]
[Sat Jul 18 23:20:38.225308 2026] [security2:error] [pid 881201:tid 881442] [client 114.119.132.163:24717] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "timespans.org"] [uri "/wp-content/uploads/a8edcc33-b9d1-4652-bad7-bde1f004da68-800x280.jpg"] [unique_id "alxepgWL-zKlchkVWS05cgAAAG4"], referer: https://timespans.org/new-timespans-2020-videos
[Sat Jul 18 23:20:38.575299 2026] [security2:error] [pid 881201:tid 881391] [client 114.119.132.10:57263] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "sustaintheart.com"] [uri "/watercolor-brush-pens-review/"] [unique_id "alxepgWL-zKlchkVWS05iwAAADs"], referer: https://sustaintheart.com/watercolor-brush-pens-review/
[Sat Jul 18 23:20:38.618441 2026] [security2:error] [pid 881201:tid 881383] [client 4.194.24.143:25572] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/public/css.php"] [unique_id "alxepgWL-zKlchkVWS05jwAAADM"]
[Sat Jul 18 23:20:38.684235 2026] [security2:error] [pid 881201:tid 881287] [remote 157.66.47.83:40424] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxepgWL-zKlchkVWS05kgAAWFQ"]
[Sat Jul 18 23:20:39.130734 2026] [security2:error] [pid 881201:tid 881296] [remote 157.66.47.83:40424] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxepwWL-zKlchkVWS05qAAAEV0"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:20:39.166944 2026] [security2:error] [pid 881201:tid 881378] [client 4.194.24.143:28788] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/r.php"] [unique_id "alxepwWL-zKlchkVWS05qwAAAC4"]
[Sat Jul 18 23:20:39.374827 2026] [security2:error] [pid 881201:tid 881406] [client 114.119.130.221:28813] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "locketsandcharms.com"] [uri "/heart-lockets-by-origami-owl/amp"] [unique_id "alxepwWL-zKlchkVWS05tgAAAEo"], referer: https://locketsandcharms.com/heart-lockets-by-origami-owl/amp
[Sat Jul 18 23:20:39.381103 2026] [security2:error] [pid 881201:tid 881303] [remote 163.227.186.27:55440] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "arunavabanerjee.com"] [uri "/wp-login.php"] [unique_id "alxepwWL-zKlchkVWS05twAACWQ"]
[Sat Jul 18 23:20:39.736622 2026] [security2:error] [pid 881201:tid 881306] [remote 124.156.212.23:43246] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 23.212.156.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "website-5ab144f7.uritems.net"] [uri "/wp-login.php"] [unique_id "alxepwWL-zKlchkVWS05yQAABGc"]
[Sat Jul 18 23:20:39.763142 2026] [security2:error] [pid 881201:tid 881416] [client 4.194.24.143:28737] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/radio.php"] [unique_id "alxepwWL-zKlchkVWS05ywAAAFQ"]
[Sat Jul 18 23:20:39.879735 2026] [security2:error] [pid 881201:tid 881321] [remote 163.227.186.27:55440] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "arunavabanerjee.com"] [uri "/wp-login.php"] [unique_id "alxepwWL-zKlchkVWS051wAAFnY"], referer: https://arunavabanerjee.com/wp-login.php
[Sat Jul 18 23:20:39.939367 2026] [security2:error] [pid 881201:tid 881367] [client 223.228.182.224:27065] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxepwWL-zKlchkVWS052QAAACM"]
[Sat Jul 18 23:20:39.939473 2026] [security2:error] [pid 881201:tid 881367] [client 223.228.182.224:27065] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxepwWL-zKlchkVWS052QAAACM"]
[Sat Jul 18 23:20:39.987943 2026] [security2:error] [pid 881201:tid 881446] [client 57.141.18.68:35140] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "gertoger.org"] [uri "/index.php"] [unique_id "alxepgWL-zKlchkVWS05hgAAclI"]
[Sat Jul 18 23:20:40.132959 2026] [security2:error] [pid 881201:tid 881203] [remote 124.156.212.23:43246] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 23.212.156.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "website-5ab144f7.uritems.net"] [uri "/wp-login.php"] [unique_id "alxeqAWL-zKlchkVWS055QAAXwA"], referer: https://website-5ab144f7.uritems.net/wp-login.php
[Sat Jul 18 23:20:40.330208 2026] [security2:error] [pid 881201:tid 881357] [client 4.194.24.143:20016] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/randkeyword.php7"] [unique_id "alxeqAWL-zKlchkVWS057wAAABk"]
[Sat Jul 18 23:20:40.368337 2026] [security2:error] [pid 881201:tid 881359] [client 223.185.61.63:9748] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeqAWL-zKlchkVWS058AAAABs"]
[Sat Jul 18 23:20:40.368491 2026] [security2:error] [pid 881201:tid 881359] [client 223.185.61.63:9748] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeqAWL-zKlchkVWS058AAAABs"]
[Sat Jul 18 23:20:40.872113 2026] [security2:error] [pid 881201:tid 881232] [remote 4.205.168.44:56438] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxeqAWL-zKlchkVWS06BAAAah0"]
[Sat Jul 18 23:20:40.872264 2026] [security2:error] [pid 881201:tid 881438] [client 4.205.168.44:56438] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxeqAWL-zKlchkVWS06BAAAah0"]
[Sat Jul 18 23:20:40.887728 2026] [security2:error] [pid 881201:tid 881395] [client 4.194.24.143:19984] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/readme.php"] [unique_id "alxeqAWL-zKlchkVWS06CAAAAD8"]
[Sat Jul 18 23:20:40.894627 2026] [security2:error] [pid 881201:tid 881370] [client 27.34.68.67:49972] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxeqAWL-zKlchkVWS06CQAAACY"]
[Sat Jul 18 23:20:40.894744 2026] [security2:error] [pid 881201:tid 881370] [client 27.34.68.67:49972] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxeqAWL-zKlchkVWS06CQAAACY"]
[Sat Jul 18 23:20:41.026688 2026] [security2:error] [pid 881201:tid 881380] [client 190.245.146.99:59466] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeqQWL-zKlchkVWS06EgAAADA"]
[Sat Jul 18 23:20:41.026787 2026] [security2:error] [pid 881201:tid 881380] [client 190.245.146.99:59466] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeqQWL-zKlchkVWS06EgAAADA"]
[Sat Jul 18 23:20:41.120504 2026] [security2:error] [pid 881201:tid 881430] [client 114.119.145.216:60591] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "nevelow.com"] [uri "/comment-subscriptions/"] [unique_id "alxeqQWL-zKlchkVWS06HwAAAGI"], referer: https://nevelow.com/they-call-him-flipper/
[Sat Jul 18 23:20:41.432080 2026] [security2:error] [pid 881201:tid 881389] [client 4.194.24.143:28762] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/reze.php"] [unique_id "alxeqQWL-zKlchkVWS06LQAAADk"]
[Sat Jul 18 23:20:41.973384 2026] [security2:error] [pid 881201:tid 881397] [client 4.194.24.143:28796] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/rh.php"] [unique_id "alxeqQWL-zKlchkVWS06RwAAAEE"]
[Sat Jul 18 23:20:42.036451 2026] [security2:error] [pid 881201:tid 881387] [client 18.141.144.104:35042] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "curlsnpearlsss.com"] [uri "/es/easy-baked-codfish-bacalao-al-horno/"] [unique_id "alxeqgWL-zKlchkVWS06TAAAADc"], referer: https://curlsnpearlsss.com/es/blog/
[Sat Jul 18 23:20:42.305510 2026] [security2:error] [pid 881201:tid 881341] [client 114.119.157.189:42675] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.maxenengineering.com"] [uri "/products/cart"] [unique_id "alxeqgWL-zKlchkVWS06XwAAAAk"], referer: https://www.maxenengineering.com/products/cart?remove_item=54fda78aa8a09b4d77b5aaec57b75028
[Sat Jul 18 23:20:42.489122 2026] [security2:error] [pid 881201:tid 881385] [client 114.119.141.206:27351] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "mtlegnews.gov"] [uri "/montana-cities-end-water-restrictions/"] [unique_id "alxeqgWL-zKlchkVWS06YwAAADU"], referer: https://mtlegnews.gov/montana-cities-end-water-restrictions/
[Sat Jul 18 23:20:42.515387 2026] [security2:error] [pid 881201:tid 881394] [client 4.194.24.143:18570] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/rip.php"] [unique_id "alxeqgWL-zKlchkVWS06ZgAAAD4"]
[Sat Jul 18 23:20:42.596830 2026] [security2:error] [pid 881201:tid 881370] [client 171.4.232.110:44295] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeqgWL-zKlchkVWS06cAAAACY"]
[Sat Jul 18 23:20:42.596918 2026] [security2:error] [pid 881201:tid 881370] [client 171.4.232.110:44295] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeqgWL-zKlchkVWS06cAAAACY"]
[Sat Jul 18 23:20:42.841373 2026] [security2:error] [pid 881201:tid 881448] [client 3.108.60.216:19232] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxeqgWL-zKlchkVWS06ggAAAHQ"]
[Sat Jul 18 23:20:42.841442 2026] [security2:error] [pid 881201:tid 881448] [client 3.108.60.216:19232] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxeqgWL-zKlchkVWS06ggAAAHQ"]
[Sat Jul 18 23:20:43.104425 2026] [security2:error] [pid 881201:tid 881356] [client 4.194.24.143:19986] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/root.php"] [unique_id "alxeqwWL-zKlchkVWS06jAAAABg"]
[Sat Jul 18 23:20:43.150947 2026] [security2:error] [pid 881201:tid 881378] [client 114.119.151.103:27527] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "securingmemories.com"] [uri "/index.php/privacy-policy/"] [unique_id "alxeqwWL-zKlchkVWS06kAAAAC4"], referer: https://securingmemories.com/index.php/2021/05/
[Sat Jul 18 23:20:43.300285 2026] [security2:error] [pid 881201:tid 881354] [client 103.48.44.9:55547] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeqwWL-zKlchkVWS06nQAAABY"]
[Sat Jul 18 23:20:43.300386 2026] [security2:error] [pid 881201:tid 881354] [client 103.48.44.9:55547] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeqwWL-zKlchkVWS06nQAAABY"]
[Sat Jul 18 23:20:43.647904 2026] [security2:error] [pid 881201:tid 881351] [client 4.194.24.143:19973] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/s.php"] [unique_id "alxeqwWL-zKlchkVWS06rAAAABM"]
[Sat Jul 18 23:20:43.895798 2026] [security2:error] [pid 881201:tid 881457] [client 119.154.81.234:60829] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxeqwWL-zKlchkVWS06xgAAAH0"]
[Sat Jul 18 23:20:43.895942 2026] [security2:error] [pid 881201:tid 881457] [client 119.154.81.234:60829] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxeqwWL-zKlchkVWS06xgAAAH0"]
[Sat Jul 18 23:20:43.945033 2026] [security2:error] [pid 881201:tid 881346] [client 34.171.141.44:20096] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "dasmarque.com"] [uri "/wp-json/batch/v1"] [unique_id "alxeqwWL-zKlchkVWS06yAAAAA4"]
[Sat Jul 18 23:20:44.223366 2026] [security2:error] [pid 881201:tid 881295] [remote 41.186.86.12:45679] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxerAWL-zKlchkVWS063AAAAlw"]
[Sat Jul 18 23:20:44.231452 2026] [security2:error] [pid 881201:tid 881359] [client 34.171.141.44:20096] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "dasmarque.com"] [uri "/"] [unique_id "alxerAWL-zKlchkVWS064AAAABs"]
[Sat Jul 18 23:20:44.271116 2026] [security2:error] [pid 881201:tid 881400] [client 4.194.24.143:25547] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/sang.php"] [unique_id "alxerAWL-zKlchkVWS064gAAAEQ"]
[Sat Jul 18 23:20:44.314158 2026] [security2:error] [pid 881201:tid 881323] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxerAWL-zKlchkVWS066gAAVXg"]
[Sat Jul 18 23:20:44.314348 2026] [security2:error] [pid 881201:tid 881417] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxerAWL-zKlchkVWS066gAAVXg"]
[Sat Jul 18 23:20:44.710075 2026] [security2:error] [pid 881201:tid 881320] [remote 41.186.86.12:45679] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxerAWL-zKlchkVWS06-gAADHU"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:20:44.822806 2026] [security2:error] [pid 881201:tid 881365] [client 4.194.24.143:20008] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/scxy.php"] [unique_id "alxerAWL-zKlchkVWS07BQAAACE"]
[Sat Jul 18 23:20:44.851614 2026] [security2:error] [pid 881201:tid 881208] [remote 103.75.185.95:58720] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxerAWL-zKlchkVWS07BgAACQU"]
[Sat Jul 18 23:20:44.855033 2026] [security2:error] [pid 881201:tid 881362] [client 114.119.130.248:21149] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.effingweirdmuseums.com"] [uri "/episode-3-the-didusch-center-for-urologic-history"] [unique_id "alxerAWL-zKlchkVWS07CgAAAB4"], referer: http://www.effingweirdmuseums.com/ep-2-the-barbour-county-historical-museum
[Sat Jul 18 23:20:44.965484 2026] [security2:error] [pid 881201:tid 881407] [client 35.92.83.184:56308] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 184.83.92.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cryptomeaning.com"] [uri "/wp-cron.php"] [unique_id "alxerAWL-zKlchkVWS07DwAAAEs"]
[Sat Jul 18 23:20:44.973185 2026] [security2:error] [pid 881201:tid 881430] [client 104.207.49.134:56401] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 134.49.207.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxerAWL-zKlchkVWS07DQAAAGI"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:20:45.009694 2026] [security2:error] [pid 881201:tid 881380] [client 13.232.206.133:42972] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "cryptomeaning.com"] [uri "/wp-login.php"] [unique_id "alxeqwWL-zKlchkVWS06igAAADA"]
[Sat Jul 18 23:20:45.198216 2026] [security2:error] [pid 881201:tid 881453] [client 114.119.141.18:49083] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "blog.danwolfe.us"] [uri "/page/3/"] [unique_id "alxerQWL-zKlchkVWS07FQAAAHk"], referer: https://blog.danwolfe.us/
[Sat Jul 18 23:20:45.364640 2026] [security2:error] [pid 881201:tid 881409] [client 4.194.24.143:28775] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/sd.php"] [unique_id "alxerQWL-zKlchkVWS07IgAAAE0"]
[Sat Jul 18 23:20:45.389814 2026] [security2:error] [pid 881201:tid 881219] [remote 103.75.185.95:58720] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxerQWL-zKlchkVWS07IwAABBA"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:20:45.559465 2026] [security2:error] [pid 881201:tid 881342] [client 45.3.44.100:18333] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.44.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxerQWL-zKlchkVWS07LAAAAAo"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:20:45.907230 2026] [security2:error] [pid 881201:tid 881355] [client 4.194.24.143:20001] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/sf.php"] [unique_id "alxerQWL-zKlchkVWS07RAAAABc"]
[Sat Jul 18 23:20:46.330270 2026] [autoindex:error] [pid 881201:tid 881415] [client 95.181.234.102:59292] AH01276: Cannot serve directory /home3/alpchxmy/public_html/noisenyc/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:20:46.527617 2026] [security2:error] [pid 881201:tid 881442] [client 4.194.24.143:61676] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/shell.php"] [unique_id "alxergWL-zKlchkVWS07bwAAAG4"]
[Sat Jul 18 23:20:46.775639 2026] [security2:error] [pid 881201:tid 881364] [client 114.119.145.140:23307] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "mtredistricting.gov"] [uri "/november-10-2022-meeting-zoom-only/"] [unique_id "alxergWL-zKlchkVWS07dwAAACA"], referer: https://mtredistricting.gov/meeting-info/
[Sat Jul 18 23:20:46.780721 2026] [security2:error] [pid 881201:tid 881427] [client 57.141.18.73:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxergWL-zKlchkVWS07cwAAAF8"]
[Sat Jul 18 23:20:47.044907 2026] [security2:error] [pid 881201:tid 881447] [client 114.119.151.14:59227] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "recruitinginsight.us"] [uri "/2019/11/page/19/"] [unique_id "alxerwWL-zKlchkVWS07iwAAAHM"], referer: https://recruitinginsight.us/2019/11/page/20?et_blog
[Sat Jul 18 23:20:47.186337 2026] [security2:error] [pid 881201:tid 881342] [client 196.202.14.184:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "adambergeron.com"] [uri "/index.php"] [unique_id "alxergWL-zKlchkVWS07YAAAAAo"]
[Sat Jul 18 23:20:47.190769 2026] [security2:error] [pid 881201:tid 881424] [client 196.202.14.184:57973] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "adambergeron.com"] [uri "/11037.php"] [unique_id "alxergWL-zKlchkVWS07WQAAXB8"]
[Sat Jul 18 23:20:47.322219 2026] [security2:error] [pid 881201:tid 881437] [client 4.194.24.143:18598] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/sid3.php"] [unique_id "alxerwWL-zKlchkVWS07mwAAAGk"]
[Sat Jul 18 23:20:47.530467 2026] [security2:error] [pid 881201:tid 881278] [remote 114.119.155.200:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "origine.nz"] [uri "/checkout/"] [unique_id "alxerwWL-zKlchkVWS07sAAAUEs"], referer: https://origine.nz/page-sitemap.xml
[Sat Jul 18 23:20:47.661238 2026] [security2:error] [pid 881201:tid 881340] [client 114.119.135.224:47559] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "daseighty.net"] [uri "/gallery/main.php"] [unique_id "alxerwWL-zKlchkVWS07twAAAAg"], referer: https://forums.vwvortex.com/showthread.php?3217242-the-das-eighty-thread&s=80e1a8c397b2449545c8a7d9e9cd98b9&p=45937035&viewfull=1
[Sat Jul 18 23:20:47.681100 2026] [security2:error] [pid 881201:tid 881407] [client 3.108.60.216:27796] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cryptomeaning.com"] [uri "/wp-login.php"] [unique_id "alxerwWL-zKlchkVWS07uQAAAEs"], referer: https://cryptomeaning.com/wp-login.php
[Sat Jul 18 23:20:47.807111 2026] [security2:error] [pid 881201:tid 881281] [remote 47.128.23.33:12954] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "massagelacey.com"] [uri "/blog/"] [unique_id "alxerwWL-zKlchkVWS07uwAAAk4"]
[Sat Jul 18 23:20:47.872536 2026] [security2:error] [pid 881201:tid 881353] [client 4.194.24.143:28750] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/simple.php"] [unique_id "alxerwWL-zKlchkVWS07vwAAABU"]
[Sat Jul 18 23:20:48.143364 2026] [security2:error] [pid 881201:tid 881355] [client 124.29.207.185:65434] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxesAWL-zKlchkVWS071AAAABc"]
[Sat Jul 18 23:20:48.143505 2026] [security2:error] [pid 881201:tid 881355] [client 124.29.207.185:65434] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxesAWL-zKlchkVWS071AAAABc"]
[Sat Jul 18 23:20:48.262663 2026] [security2:error] [pid 881201:tid 881446] [client 45.3.45.160:12829] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxesAWL-zKlchkVWS071gAAAHI"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:20:48.488380 2026] [security2:error] [pid 881201:tid 881456] [client 4.194.24.143:61654] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/sitemap.php"] [unique_id "alxesAWL-zKlchkVWS075wAAAHw"]
[Sat Jul 18 23:20:48.687368 2026] [security2:error] [pid 881201:tid 881423] [client 57.141.18.72:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxesAWL-zKlchkVWS076QAAAFs"]
[Sat Jul 18 23:20:48.782637 2026] [security2:error] [pid 881201:tid 881441] [client 114.119.144.29:26005] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "ksands.co.uk"] [uri "/terms-conditions"] [unique_id "alxesAWL-zKlchkVWS08BgAAAG0"], referer: https://ksands.co.uk/news/secure-ground-transportation-in-london/
[Sat Jul 18 23:20:49.137219 2026] [security2:error] [pid 881201:tid 881450] [client 4.194.24.143:28746] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/size.php"] [unique_id "alxesQWL-zKlchkVWS08HAAAAHY"]
[Sat Jul 18 23:20:49.550335 2026] [security2:error] [pid 881201:tid 881426] [client 114.119.146.19:44455] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "jndsupport.com"] [uri "/microsoft-and-samsung-team-up-to-boost-phone-security/"] [unique_id "alxesQWL-zKlchkVWS08NwAAAF4"], referer: https://jndsupport.com/tag/cybersecurity/page/2/
[Sat Jul 18 23:20:49.626111 2026] [security2:error] [pid 881201:tid 881230] [remote 152.228.213.32:47856] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxesQWL-zKlchkVWS08PAAADhs"]
[Sat Jul 18 23:20:49.635904 2026] [security2:error] [pid 881201:tid 881224] [remote 157.66.47.83:51206] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxesQWL-zKlchkVWS08PwAAABU"]
[Sat Jul 18 23:20:49.654727 2026] [security2:error] [pid 881201:tid 881342] [client 62.150.67.110:59335] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "ali-alghanim.net"] [uri "/index.php"] [unique_id "alxesQWL-zKlchkVWS08KwAAAAo"]
[Sat Jul 18 23:20:49.705016 2026] [security2:error] [pid 881201:tid 881407] [client 4.194.24.143:28739] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/sm.php"] [unique_id "alxesQWL-zKlchkVWS08RQAAAEs"]
[Sat Jul 18 23:20:49.877403 2026] [security2:error] [pid 881201:tid 881233] [remote 152.228.213.32:47856] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxesQWL-zKlchkVWS08SQAAax4"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:20:50.030354 2026] [security2:error] [pid 881201:tid 881245] [remote 157.66.47.83:51206] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxesgWL-zKlchkVWS08VgAAMCo"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:20:50.242566 2026] [security2:error] [pid 881201:tid 881430] [client 220.181.108.166:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.earle-brown.org"] [uri "/index.php"] [unique_id "alxesgWL-zKlchkVWS08WwAAAGI"]
[Sat Jul 18 23:20:50.258356 2026] [security2:error] [pid 881201:tid 881212] [remote 74.235.96.117:57570] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.235.74.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "rywventures.com"] [uri "/wp-login.php"] [unique_id "alxesgWL-zKlchkVWS08agAAfQk"]
[Sat Jul 18 23:20:50.287917 2026] [security2:error] [pid 881201:tid 881358] [client 4.194.24.143:18586] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/sql.php"] [unique_id "alxesgWL-zKlchkVWS08dQAAABo"]
[Sat Jul 18 23:20:50.426280 2026] [security2:error] [pid 881201:tid 881248] [remote 74.235.96.117:57570] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.235.74.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "rywventures.com"] [uri "/wp-login.php"] [unique_id "alxesgWL-zKlchkVWS08fAAAVS0"], referer: https://rywventures.com/wp-login.php
[Sat Jul 18 23:20:50.859998 2026] [security2:error] [pid 881201:tid 881387] [client 4.194.24.143:25539] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/ss.php"] [unique_id "alxesgWL-zKlchkVWS08jQAAADc"]
[Sat Jul 18 23:20:50.999248 2026] [security2:error] [pid 881201:tid 881359] [client 223.185.61.63:6414] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxesgWL-zKlchkVWS08lwAAABs"]
[Sat Jul 18 23:20:50.999355 2026] [security2:error] [pid 881201:tid 881359] [client 223.185.61.63:6414] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxesgWL-zKlchkVWS08lwAAABs"]
[Sat Jul 18 23:20:51.081734 2026] [security2:error] [pid 881201:tid 881251] [remote 97.74.93.24:58324] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxeswWL-zKlchkVWS08oAAAdDA"]
[Sat Jul 18 23:20:51.104320 2026] [security2:error] [pid 881201:tid 881334] [client 74.7.227.179:57800] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxesgWL-zKlchkVWS08kwAAAgs"], referer: https://tejasenvironmental.com/p=415962
[Sat Jul 18 23:20:51.363717 2026] [security2:error] [pid 881201:tid 881456] [client 52.167.144.213:55564] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.thewelloiledlife.com"] [uri "/index.php"] [unique_id "alxesgWL-zKlchkVWS08XQAAfBk"]
[Sat Jul 18 23:20:51.440357 2026] [security2:error] [pid 881201:tid 881402] [client 4.194.24.143:61638] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/stats.php"] [unique_id "alxeswWL-zKlchkVWS08tQAAAEY"]
[Sat Jul 18 23:20:51.493527 2026] [security2:error] [pid 881201:tid 881269] [remote 97.74.93.24:58324] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxeswWL-zKlchkVWS08uAAAeEI"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:20:51.536127 2026] [security2:error] [pid 881201:tid 881449] [client 190.245.146.99:59983] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeswWL-zKlchkVWS08wwAAAHU"]
[Sat Jul 18 23:20:51.542225 2026] [security2:error] [pid 881201:tid 881449] [client 190.245.146.99:59983] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeswWL-zKlchkVWS08wwAAAHU"]
[Sat Jul 18 23:20:51.546777 2026] [security2:error] [pid 881201:tid 881340] [client 27.34.68.67:12613] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxeswWL-zKlchkVWS08xAAAAAg"]
[Sat Jul 18 23:20:51.546906 2026] [security2:error] [pid 881201:tid 881340] [client 27.34.68.67:12613] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxeswWL-zKlchkVWS08xAAAAAg"]
[Sat Jul 18 23:20:51.649887 2026] [security2:error] [pid 881201:tid 881415] [client 114.119.133.251:28965] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "mollycahill.com"] [uri "/"] [unique_id "alxeswWL-zKlchkVWS08zQAAAFM"], referer: https://mollycahill.com/
[Sat Jul 18 23:20:51.983599 2026] [security2:error] [pid 881201:tid 881408] [client 4.194.24.143:28786] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/sump1.php"] [unique_id "alxeswWL-zKlchkVWS083wAAAEw"]
[Sat Jul 18 23:20:52.416112 2026] [security2:error] [pid 881201:tid 881407] [client 52.167.144.213:55564] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.thewelloiledlife.com"] [uri "/index.php"] [unique_id "alxeswWL-zKlchkVWS083gAAS0Y"]
[Sat Jul 18 23:20:52.556634 2026] [security2:error] [pid 881201:tid 881449] [client 4.194.24.143:61655] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/system.php"] [unique_id "alxetAWL-zKlchkVWS08_wAAAHU"]
[Sat Jul 18 23:20:52.912239 2026] [security2:error] [pid 881201:tid 881353] [client 171.4.232.110:3468] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxetAWL-zKlchkVWS09EQAAABU"]
[Sat Jul 18 23:20:52.912345 2026] [security2:error] [pid 881201:tid 881353] [client 171.4.232.110:3468] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxetAWL-zKlchkVWS09EQAAABU"]
[Sat Jul 18 23:20:52.921032 2026] [security2:error] [pid 881201:tid 881390] [client 119.249.100.173:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.earle-brown.org"] [uri "/index.php"] [unique_id "alxetAWL-zKlchkVWS09DwAAADo"]
[Sat Jul 18 23:20:53.109380 2026] [security2:error] [pid 881201:tid 881373] [client 4.194.24.143:61647] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/system/03n1hob7p03r2npdefault.php"] [unique_id "alxetQWL-zKlchkVWS09IAAAACk"]
[Sat Jul 18 23:20:53.189465 2026] [security2:error] [pid 881201:tid 881374] [client 212.107.27.66:39161] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "160"] [id "900408"] [msg "register POST logging"] [data "302"] [hostname "xp-design.co"] [uri "/wp-login.php"] [unique_id "alxetAWL-zKlchkVWS09FQAAACo"]
[Sat Jul 18 23:20:53.189501 2026] [security2:error] [pid 881201:tid 881374] [client 212.107.27.66:39161] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "xp-design.co"] [uri "/wp-login.php"] [unique_id "alxetAWL-zKlchkVWS09FQAAACo"]
[Sat Jul 18 23:20:53.491439 2026] [security2:error] [pid 881201:tid 881356] [client 114.119.152.47:29837] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.guidehunting.com"] [uri "/"] [unique_id "alxetQWL-zKlchkVWS09NAAAABg"], referer: https://www.guidehunting.com/?s=%E9%A9%AC%E5%B0%BC%E6%8B%89%E6%96%B0%E6%BF%A0%E5%A4%A9%E5%9C%B0-%E3%80%90%E2%9C%94%EF%B8%8F%E6%8E%A8%E8%8D%90AC68%C2%B7CC%E2%9C%94%EF%B8%8F%E3%80%91-%E7%BD%91%E4%B8%8A%E8%A7%A3%E9%99%A4%E7%A6%81%E8%B5%8C%E4%BB%A4-%E9%A9%AC%E5%B0%BC%E6%8B%89%E6%96%B0%E6%BF%A0%E5%A4%A9%E5%9C%B0b722u-%E3%80%90%E2%9C%94%EF%B8%8F%E6%8E%A8%E8%8D%90AC68%C2%B7CC%E2%9C%94%EF%B8%8F%E3%80%91-%E7%BD%91%E4%B8%8A%E8%A7%A3%E9%99%A4%E7%A6%81%E8%B5%8C%E4%BB%A40yg9-%E9%A9%AC%E5%B0%BC%E6%8B%89%E6%96%B0%E6%BF%A0%E5%A4%A9%E5%9C%B07m0pi-%E7%BD%91%E4%B8%8A%E8%A7%A3%E9%99%A4%E7%A6%81%E8%B5%8C%E4%BB%A4pw5v
[Sat Jul 18 23:20:53.654528 2026] [security2:error] [pid 881201:tid 881334] [client 4.194.24.143:20013] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/system/cj5ha2rah8lyiqqdefault.php"] [unique_id "alxetQWL-zKlchkVWS09QQAAAAI"]
[Sat Jul 18 23:20:53.753170 2026] [security2:error] [pid 881201:tid 881445] [client 103.48.44.9:56056] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxetQWL-zKlchkVWS09SQAAAHE"]
[Sat Jul 18 23:20:53.753506 2026] [security2:error] [pid 881201:tid 881445] [client 103.48.44.9:56056] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxetQWL-zKlchkVWS09SQAAAHE"]
[Sat Jul 18 23:20:53.881574 2026] [security2:error] [pid 881201:tid 881379] [client 24.14.32.122:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "lovedbynee.com"] [uri "/index.php"] [unique_id "alxetQWL-zKlchkVWS09OQAAL3I"], referer: https://lovedbynee.com/
[Sat Jul 18 23:20:54.230082 2026] [security2:error] [pid 881201:tid 881374] [client 4.194.24.143:61642] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/system_log.php"] [unique_id "alxetgWL-zKlchkVWS09ZQAAACo"]
[Sat Jul 18 23:20:54.372777 2026] [security2:error] [pid 881201:tid 881431] [client 50.116.65.227:16682] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.fkconstructionfunding.com"] [uri "/wp-content/plugins/contact-form-7/includes/css/styles.css"] [unique_id "alxetgWL-zKlchkVWS09bwAAAGM"]
[Sat Jul 18 23:20:54.382010 2026] [security2:error] [pid 881201:tid 881435] [client 50.116.65.227:16690] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.fkconstructionfunding.com"] [uri "/wp-content/plugins/contact-form-7/includes/css/styles-rtl.css"] [unique_id "alxetgWL-zKlchkVWS09cAAAAGc"]
[Sat Jul 18 23:20:54.469430 2026] [security2:error] [pid 881201:tid 881430] [client 119.154.81.234:61273] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxetgWL-zKlchkVWS09dQAAAGI"]
[Sat Jul 18 23:20:54.469539 2026] [security2:error] [pid 881201:tid 881430] [client 119.154.81.234:61273] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxetgWL-zKlchkVWS09dQAAAGI"]
[Sat Jul 18 23:20:54.771365 2026] [security2:error] [pid 881201:tid 881417] [client 4.194.24.143:18724] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/t.php"] [unique_id "alxetgWL-zKlchkVWS09hQAAAFU"]
[Sat Jul 18 23:20:54.904910 2026] [security2:error] [pid 881201:tid 881215] [remote 94.65.254.144:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.254.65.94.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxetgWL-zKlchkVWS09kQAAaww"]
[Sat Jul 18 23:20:54.905026 2026] [security2:error] [pid 881201:tid 881439] [client 94.65.254.144:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory.com"] [uri "/xmlrpc.php"] [unique_id "alxetgWL-zKlchkVWS09kQAAaww"]
[Sat Jul 18 23:20:55.032007 2026] [security2:error] [pid 881201:tid 881413] [client 180.142.197.174:19042] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.197.142.180.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "christiancountytrumpet.com"] [uri "/wp-comments-post.php"] [unique_id "alxetgWL-zKlchkVWS09lAAAAFE"]
[Sat Jul 18 23:20:55.032127 2026] [security2:error] [pid 881201:tid 881413] [client 180.142.197.174:19042] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "409"] [hostname "christiancountytrumpet.com"] [uri "/wp-comments-post.php"] [unique_id "alxetgWL-zKlchkVWS09lAAAAFE"]
[Sat Jul 18 23:20:55.314290 2026] [security2:error] [pid 881201:tid 881431] [client 4.194.24.143:28793] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/term.php"] [unique_id "alxetwWL-zKlchkVWS09rQAAAGM"]
[Sat Jul 18 23:20:55.417978 2026] [security2:error] [pid 881201:tid 881355] [client 114.119.137.224:36497] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "myhealthspot.org"] [uri "/2025/07/16/kredit-onlajn-na-kartu-otrimati-terminovo-do-3000/"] [unique_id "alxetwWL-zKlchkVWS09tgAAABc"], referer: https://ssinter.co.th/th/banki-nizhina-2025-viddilennja-ta-bankomati-adresa
[Sat Jul 18 23:20:55.494444 2026] [security2:error] [pid 881201:tid 881393] [client 104.207.63.104:25439] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.63.207.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxetwWL-zKlchkVWS09uQAAAD0"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:20:55.600123 2026] [security2:error] [pid 881201:tid 881340] [client 119.249.100.108:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.earle-brown.org"] [uri "/index.php"] [unique_id "alxetwWL-zKlchkVWS09vAAAAAg"]
[Sat Jul 18 23:20:55.858818 2026] [security2:error] [pid 881201:tid 881368] [client 4.194.24.143:28741] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/test.php"] [unique_id "alxetwWL-zKlchkVWS091wAAACQ"]
[Sat Jul 18 23:20:56.205285 2026] [security2:error] [pid 881201:tid 881391] [client 114.119.128.233:43021] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.sarakety.com"] [uri "/ReviewNew.asp"] [unique_id "alxeuAWL-zKlchkVWS095wAAADs"], referer: http://www.sarakety.com/Carlton-06-12-p/812498016292.htm
[Sat Jul 18 23:20:56.291158 2026] [security2:error] [pid 881201:tid 881431] [client 14.240.195.193:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxeuAWL-zKlchkVWS093wAAAGM"]
[Sat Jul 18 23:20:56.405154 2026] [security2:error] [pid 881201:tid 881377] [client 4.194.24.143:18620] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/test1.php"] [unique_id "alxeuAWL-zKlchkVWS099wAAAC0"]
[Sat Jul 18 23:20:56.974933 2026] [security2:error] [pid 881201:tid 881394] [client 4.194.24.143:61692] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/tfm.php"] [unique_id "alxeuAWL-zKlchkVWS0-HwAAAD4"]
[Sat Jul 18 23:20:57.076820 2026] [security2:error] [pid 881201:tid 881429] [client 114.119.147.74:44467] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.lowemissionsasia.org"] [uri "/sites/default/files/pdf_file/Green%20Growth%20UNESCAP_UNEP_ADB.pdf"] [unique_id "alxeuQWL-zKlchkVWS0-JQAAAGE"], referer: http://www.lowemissionsasia.org/resources?qt-resources=1
[Sat Jul 18 23:20:57.167820 2026] [security2:error] [pid 881201:tid 881419] [client 114.119.142.69:40993] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "hedgerow-crafts.com"] [uri "/tommie-hazel-greenwood-chair-handmade-hedgrow-crafts-6/"] [unique_id "alxeuQWL-zKlchkVWS0-KgAAAFc"], referer: https://hedgerow-crafts.com/tommie-hazel-greenwood-chair-handmade-hedgrow-crafts-6/
[Sat Jul 18 23:20:57.546430 2026] [security2:error] [pid 881201:tid 881396] [client 4.194.24.143:60076] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/thebe.php"] [unique_id "alxeuQWL-zKlchkVWS0-RAAAAEA"]
[Sat Jul 18 23:20:57.787894 2026] [security2:error] [pid 881201:tid 881348] [client 114.119.136.150:21735] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.bandsir.com"] [uri "/attargul/joyfulness137780.html"] [unique_id "alxeuQWL-zKlchkVWS0-TgAAABA"], referer: https://www.bandsir.com/attargul/joyfulness137780.html
[Sat Jul 18 23:20:57.793553 2026] [security2:error] [pid 881201:tid 881321] [remote 182.77.62.24:36842] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.62.77.182.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxeuQWL-zKlchkVWS0-TQAAf3Y"]
[Sat Jul 18 23:20:58.108901 2026] [security2:error] [pid 881201:tid 881429] [client 4.194.24.143:61682] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/themes.php"] [unique_id "alxeugWL-zKlchkVWS0-ZQAAAGE"]
[Sat Jul 18 23:20:58.319940 2026] [security2:error] [pid 881201:tid 881319] [remote 182.77.62.24:36842] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.62.77.182.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxeugWL-zKlchkVWS0-bAAAOHQ"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:20:58.649447 2026] [security2:error] [pid 881201:tid 881457] [client 4.194.24.143:61636] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/tiny.php"] [unique_id "alxeugWL-zKlchkVWS0-hAAAAH0"]
[Sat Jul 18 23:20:58.730031 2026] [security2:error] [pid 881201:tid 881352] [client 114.119.137.193:22811] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.secretkeynumerology.com"] [uri "/sixth-sense"] [unique_id "alxeugWL-zKlchkVWS0-iwAAABQ"], referer: https://www.secretkeynumerology.com/sixth-sense?share=pinterest
[Sat Jul 18 23:20:58.767823 2026] [security2:error] [pid 881201:tid 881336] [client 119.249.100.106:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.earle-brown.org"] [uri "/index.php"] [unique_id "alxeugWL-zKlchkVWS0-dgAAAAQ"]
[Sat Jul 18 23:20:59.190326 2026] [security2:error] [pid 881201:tid 881422] [client 4.194.24.143:25542] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "new-menus.com"] [uri "/tmp/byp.php"] [unique_id "alxeuwWL-zKlchkVWS0-pwAAAFo"]
[Sat Jul 18 23:20:59.272026 2026] [security2:error] [pid 881201:tid 881363] [client 114.119.130.61:31365] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.narv.co"] [uri "/contact/"] [unique_id "alxeuwWL-zKlchkVWS0-rQAAAB8"], referer: https://www.narv.co/contact/
[Sat Jul 18 23:20:59.285610 2026] [security2:error] [pid 881201:tid 881459] [client 34.34.16.122:49152] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "autodiscover.besttestedrecipes.com"] [uri "/"] [unique_id "alxeuwWL-zKlchkVWS0-rgAAAH8"]
[Sat Jul 18 23:20:59.285672 2026] [security2:error] [pid 881201:tid 881459] [client 34.34.16.122:49152] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "autodiscover.besttestedrecipes.com"] [uri "/"] [unique_id "alxeuwWL-zKlchkVWS0-rgAAAH8"]
[Sat Jul 18 23:20:59.461841 2026] [security2:error] [pid 881201:tid 881443] [client 194.61.9.164:33679] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "xp-design.co"] [uri "/wp-signup.php"] [unique_id "alxeuwWL-zKlchkVWS0-sAAAAG8"]
[Sat Jul 18 23:21:00.162317 2026] [security2:error] [pid 881201:tid 881266] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "nuflometers.com"] [uri "/.git/config"] [unique_id "alxevAWL-zKlchkVWS0-7gAAez8"]
[Sat Jul 18 23:21:00.196323 2026] [security2:error] [pid 881201:tid 881366] [client 20.242.16.71:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "thescarystory.com"] [uri "/index.php"] [unique_id "alxevAWL-zKlchkVWS0-6wAAACI"]
[Sat Jul 18 23:21:00.385477 2026] [security2:error] [pid 881201:tid 881425] [client 20.242.16.71:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "thescarystory.com"] [uri "/index.php"] [unique_id "alxevAWL-zKlchkVWS0_CAAAAF0"]
[Sat Jul 18 23:21:00.534608 2026] [security2:error] [pid 881201:tid 881264] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "nuflometers.com"] [uri "/graphql"] [unique_id "alxevAWL-zKlchkVWS0_KAAAOT0"]
[Sat Jul 18 23:21:00.613020 2026] [security2:error] [pid 881201:tid 881256] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/api/.env"] [unique_id "alxevAWL-zKlchkVWS0_MgAAejU"]
[Sat Jul 18 23:21:00.618506 2026] [security2:error] [pid 881201:tid 881276] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "nuflometers.com"] [uri "/.env"] [unique_id "alxevAWL-zKlchkVWS0_MwAATUk"]
[Sat Jul 18 23:21:00.618660 2026] [security2:error] [pid 881201:tid 881409] [client 35.198.15.248:33472] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "nuflometers.com"] [uri "/.env"] [unique_id "alxevAWL-zKlchkVWS0_MwAATUk"]
[Sat Jul 18 23:21:00.620417 2026] [security2:error] [pid 881201:tid 881293] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.backup$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1279"] [id "390588"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .backup)"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/.env.backup"] [unique_id "alxevAWL-zKlchkVWS0_NAAATVo"]
[Sat Jul 18 23:21:00.620462 2026] [security2:error] [pid 881201:tid 881286] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.old$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1263"] [id "390583"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .old)"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/.env.old"] [unique_id "alxevAWL-zKlchkVWS0_NwAATVM"]
[Sat Jul 18 23:21:00.670041 2026] [security2:error] [pid 881201:tid 881273] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\.bak|\\\\.bak\\\\.php)$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1260"] [id "390582"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that nclude .bak)"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/.env.bak"] [unique_id "alxevAWL-zKlchkVWS0_QgAATUY"]
[Sat Jul 18 23:21:00.947702 2026] [security2:error] [pid 881201:tid 881289] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "nuflometers.com"] [uri "/api/graphql"] [unique_id "alxevAWL-zKlchkVWS0_WAAAKVY"]
[Sat Jul 18 23:21:00.961097 2026] [security2:error] [pid 881201:tid 881308] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "nuflometers.com"] [uri "/.npmrc"] [unique_id "alxevAWL-zKlchkVWS0_WgAAa2k"]
[Sat Jul 18 23:21:00.961236 2026] [security2:error] [pid 881201:tid 881439] [client 35.198.15.248:33472] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "nuflometers.com"] [uri "/.npmrc"] [unique_id "alxevAWL-zKlchkVWS0_WgAAa2k"]
[Sat Jul 18 23:21:01.026223 2026] [security2:error] [pid 881201:tid 881304] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/backend/.env"] [unique_id "alxevQWL-zKlchkVWS0_YwAAJmU"]
[Sat Jul 18 23:21:01.027640 2026] [security2:error] [pid 881201:tid 881297] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/config/.env"] [unique_id "alxevQWL-zKlchkVWS0_aAAAJl4"]
[Sat Jul 18 23:21:01.202972 2026] [security2:error] [pid 881201:tid 881376] [client 194.61.9.164:52347] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "xp-design.co"] [uri "/wp-login.php"] [unique_id "alxevQWL-zKlchkVWS0_bAAAACw"]
[Sat Jul 18 23:21:01.324488 2026] [security2:error] [pid 881201:tid 881206] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "nuflometers.com"] [uri "/v1/graphql"] [unique_id "alxevQWL-zKlchkVWS0_fwAAagM"]
[Sat Jul 18 23:21:01.454694 2026] [security2:error] [pid 881201:tid 881323] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/.ssh/id_dsa"] [unique_id "alxevQWL-zKlchkVWS0_hAAATXg"]
[Sat Jul 18 23:21:01.464516 2026] [security2:error] [pid 881201:tid 881393] [client 223.185.61.63:23232] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxevQWL-zKlchkVWS0_iAAAAD0"]
[Sat Jul 18 23:21:01.464638 2026] [security2:error] [pid 881201:tid 881393] [client 223.185.61.63:23232] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxevQWL-zKlchkVWS0_iAAAAD0"]
[Sat Jul 18 23:21:01.494108 2026] [security2:error] [pid 881201:tid 881452] [client 16.145.89.170:47840] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 170.89.145.16.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxevQWL-zKlchkVWS0_iwAAAHg"]
[Sat Jul 18 23:21:01.534921 2026] [security2:error] [pid 881201:tid 881328] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "nuflometers.com"] [uri "/.ssh/id_ecdsa"] [unique_id "alxevQWL-zKlchkVWS0_kgAAb30"]
[Sat Jul 18 23:21:01.535255 2026] [security2:error] [pid 881201:tid 881317] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "nuflometers.com"] [uri "/.ssh/id_ed25519"] [unique_id "alxevQWL-zKlchkVWS0_kwAAb3I"]
[Sat Jul 18 23:21:01.537241 2026] [security2:error] [pid 881201:tid 881216] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/.ssh/id_rsa"] [unique_id "alxevQWL-zKlchkVWS0_lQAAbw0"]
[Sat Jul 18 23:21:01.579931 2026] [authz_core:error] [pid 881201:tid 881340] [client 35.198.15.248:0] AH01630: client denied by server configuration: /home1/tgdhcnmy/nuflometers.com/.htpasswd
[Sat Jul 18 23:21:01.676497 2026] [security2:error] [pid 881201:tid 881440] [client 223.228.182.224:27069] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxevQWL-zKlchkVWS0_sQAAAGw"]
[Sat Jul 18 23:21:01.676618 2026] [security2:error] [pid 881201:tid 881440] [client 223.228.182.224:27069] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxevQWL-zKlchkVWS0_sQAAAGw"]
[Sat Jul 18 23:21:01.783516 2026] [security2:error] [pid 881201:tid 881329] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/id_rsa"] [unique_id "alxevQWL-zKlchkVWS0_tgAAB34"]
[Sat Jul 18 23:21:01.904551 2026] [security2:error] [pid 881201:tid 881217] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/id_dsa"] [unique_id "alxevQWL-zKlchkVWS0_wgAAeA4"]
[Sat Jul 18 23:21:01.905761 2026] [security2:error] [pid 881201:tid 881229] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "nuflometers.com"] [uri "/id_ed25519"] [unique_id "alxevQWL-zKlchkVWS0_xQAAeBo"]
[Sat Jul 18 23:21:01.905824 2026] [security2:error] [pid 881201:tid 881452] [client 35.198.15.248:33472] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "nuflometers.com"] [uri "/id_ed25519"] [unique_id "alxevQWL-zKlchkVWS0_xQAAeBo"]
[Sat Jul 18 23:21:01.906633 2026] [security2:error] [pid 881201:tid 881249] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/key.pem"] [unique_id "alxevQWL-zKlchkVWS0_xgAAeC4"]
[Sat Jul 18 23:21:01.906846 2026] [security2:error] [pid 881201:tid 881235] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/privatekey.key"] [unique_id "alxevQWL-zKlchkVWS0_xwAAeCA"]
[Sat Jul 18 23:21:01.939772 2026] [security2:error] [pid 881201:tid 881225] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "nuflometers.com"] [uri "/host.key"] [unique_id "alxevQWL-zKlchkVWS0_0QAAPhY"]
[Sat Jul 18 23:21:01.939917 2026] [security2:error] [pid 881201:tid 881394] [client 35.198.15.248:33472] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "nuflometers.com"] [uri "/host.key"] [unique_id "alxevQWL-zKlchkVWS0_0QAAPhY"]
[Sat Jul 18 23:21:02.030983 2026] [security2:error] [pid 881201:tid 881389] [client 190.245.146.99:60501] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxevgWL-zKlchkVWS0_1gAAADk"]
[Sat Jul 18 23:21:02.031075 2026] [security2:error] [pid 881201:tid 881389] [client 190.245.146.99:60501] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxevgWL-zKlchkVWS0_1gAAADk"]
[Sat Jul 18 23:21:02.054154 2026] [security2:error] [pid 881201:tid 881378] [client 27.34.68.67:35659] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxevgWL-zKlchkVWS0_2gAAAC4"]
[Sat Jul 18 23:21:02.054235 2026] [security2:error] [pid 881201:tid 881378] [client 27.34.68.67:35659] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxevgWL-zKlchkVWS0_2gAAAC4"]
[Sat Jul 18 23:21:02.096781 2026] [security2:error] [pid 881201:tid 881239] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/.openclaw/.env"] [unique_id "alxevgWL-zKlchkVWS0_3QAATCQ"]
[Sat Jul 18 23:21:02.514717 2026] [security2:error] [pid 881201:tid 881234] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "nuflometers.com"] [uri "/.bash_profile"] [unique_id "alxevgWL-zKlchkVWS1ABAAAJR8"]
[Sat Jul 18 23:21:02.515629 2026] [security2:error] [pid 881201:tid 881214] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "nuflometers.com"] [uri "/.claude.json"] [unique_id "alxevgWL-zKlchkVWS1ABQAAJQs"]
[Sat Jul 18 23:21:02.683141 2026] [security2:error] [pid 881201:tid 881250] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-config\\\\.php(?:\\\\W[a-z]*|bak)" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "300"] [id "900256"] [msg "Wp-Config Backup/edit file request"] [hostname "nuflometers.com"] [uri "/wp-config.php.bak"] [unique_id "alxevgWL-zKlchkVWS1AFgAAKi8"]
[Sat Jul 18 23:21:02.683947 2026] [security2:error] [pid 881201:tid 881269] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "nuflometers.com"] [uri "/.profile"] [unique_id "alxevgWL-zKlchkVWS1AFwAATEI"]
[Sat Jul 18 23:21:02.722869 2026] [security2:error] [pid 881201:tid 881278] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-config\\\\.php(?:\\\\W[a-z]*|bak)" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "300"] [id "900256"] [msg "Wp-Config Backup/edit file request"] [hostname "nuflometers.com"] [uri "/wp-config.php.old"] [unique_id "alxevgWL-zKlchkVWS1AHAAAb0s"]
[Sat Jul 18 23:21:02.742317 2026] [security2:error] [pid 881201:tid 881283] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/.hermes/.env"] [unique_id "alxevgWL-zKlchkVWS1AIAAANlA"]
[Sat Jul 18 23:21:02.751459 2026] [security2:error] [pid 881201:tid 881264] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "nuflometers.com"] [uri "/.bashrc"] [unique_id "alxevgWL-zKlchkVWS1AIgAANj0"]
[Sat Jul 18 23:21:02.751611 2026] [security2:error] [pid 881201:tid 881386] [client 35.198.15.248:33472] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "nuflometers.com"] [uri "/.bashrc"] [unique_id "alxevgWL-zKlchkVWS1AIgAANj0"]
[Sat Jul 18 23:21:02.770786 2026] [security2:error] [pid 881201:tid 881274] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/laravel/.env"] [unique_id "alxevgWL-zKlchkVWS1AJAAANkc"]
[Sat Jul 18 23:21:02.815459 2026] [security2:error] [pid 881201:tid 881293] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "nuflometers.com"] [uri "/.env.php.bak"] [unique_id "alxevgWL-zKlchkVWS1AKQAADFo"]
[Sat Jul 18 23:21:02.815624 2026] [security2:error] [pid 881201:tid 881344] [client 35.198.15.248:33472] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "nuflometers.com"] [uri "/.env.php.bak"] [unique_id "alxevgWL-zKlchkVWS1AKQAADFo"]
[Sat Jul 18 23:21:02.827241 2026] [security2:error] [pid 881201:tid 881286] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.15.198.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nuflometers.com"] [uri "/config/.env.php"] [unique_id "alxevgWL-zKlchkVWS1AKgAADFM"]
[Sat Jul 18 23:21:02.949667 2026] [security2:error] [pid 881201:tid 881281] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.15.198.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nuflometers.com"] [uri "/config.php.bak"] [unique_id "alxevgWL-zKlchkVWS1ANgAAOk4"]
[Sat Jul 18 23:21:03.051254 2026] [security2:error] [pid 881201:tid 881287] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.15.198.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nuflometers.com"] [uri "/configuration.php.bak"] [unique_id "alxevwWL-zKlchkVWS1AQAAAPVQ"]
[Sat Jul 18 23:21:03.052016 2026] [security2:error] [pid 881201:tid 881291] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/core/.env"] [unique_id "alxevwWL-zKlchkVWS1AQQAAPVg"]
[Sat Jul 18 23:21:03.052122 2026] [security2:error] [pid 881201:tid 881305] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/web/.env"] [unique_id "alxevwWL-zKlchkVWS1APgAAPWY"]
[Sat Jul 18 23:21:03.052127 2026] [security2:error] [pid 881201:tid 881303] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/public/.env"] [unique_id "alxevwWL-zKlchkVWS1AQwAAPWQ"]
[Sat Jul 18 23:21:03.052392 2026] [security2:error] [pid 881201:tid 881296] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.sw[a-z]$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1275"] [id "390587"] [rev "5"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .sw)"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/.env.swp"] [unique_id "alxevwWL-zKlchkVWS1APwAAPV0"]
[Sat Jul 18 23:21:03.202890 2026] [security2:error] [pid 881201:tid 881431] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxevwWL-zKlchkVWS1APAAAAGM"]
[Sat Jul 18 23:21:03.356498 2026] [security2:error] [pid 881201:tid 881301] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "nuflometers.com"] [uri "/actuator/env"] [unique_id "alxevwWL-zKlchkVWS1AZwAAMmI"]
[Sat Jul 18 23:21:03.362092 2026] [security2:error] [pid 881201:tid 881302] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "web.config"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/web.config"] [unique_id "alxevwWL-zKlchkVWS1AaAAAMmM"]
[Sat Jul 18 23:21:03.391444 2026] [security2:error] [pid 881201:tid 881326] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "nuflometers.com"] [uri "/application.properties"] [unique_id "alxevwWL-zKlchkVWS1AagAAP3s"]
[Sat Jul 18 23:21:03.406515 2026] [security2:error] [pid 881201:tid 881409] [client 171.4.232.110:44903] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxevwWL-zKlchkVWS1AbQAAAE0"]
[Sat Jul 18 23:21:03.406608 2026] [security2:error] [pid 881201:tid 881409] [client 171.4.232.110:44903] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxevwWL-zKlchkVWS1AbQAAAE0"]
[Sat Jul 18 23:21:03.453480 2026] [security2:error] [pid 881201:tid 881325] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "nuflometers.com"] [uri "/appsettings.json"] [unique_id "alxevwWL-zKlchkVWS1AdgAAQ3o"]
[Sat Jul 18 23:21:03.508782 2026] [security2:error] [pid 881201:tid 881319] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "nuflometers.com"] [uri "/.gradle/gradle.properties"] [unique_id "alxevwWL-zKlchkVWS1AfgAANHQ"]
[Sat Jul 18 23:21:03.570236 2026] [security2:error] [pid 881201:tid 881335] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxevwWL-zKlchkVWS1AcgAAAAM"]
[Sat Jul 18 23:21:03.824593 2026] [security2:error] [pid 881201:tid 881238] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "nuflometers.com"] [uri "/.env.test"] [unique_id "alxevwWL-zKlchkVWS1ArwAARCM"]
[Sat Jul 18 23:21:03.824743 2026] [security2:error] [pid 881201:tid 881400] [client 35.198.15.248:33472] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "nuflometers.com"] [uri "/.env.test"] [unique_id "alxevwWL-zKlchkVWS1ArwAARCM"]
[Sat Jul 18 23:21:03.839735 2026] [security2:error] [pid 881201:tid 881429] [client 152.42.242.202:54910] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "lelandumc.org"] [uri "/"] [unique_id "alxevwWL-zKlchkVWS1AtgAAAGE"]
[Sat Jul 18 23:21:03.927706 2026] [security2:error] [pid 881201:tid 881377] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxevwWL-zKlchkVWS1ArgAAAC0"]
[Sat Jul 18 23:21:04.109987 2026] [security2:error] [pid 881201:tid 881455] [client 114.119.128.237:28137] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "bluedoorbar.co.nz"] [uri "/cvw2323r2eew/scaricare/Un%27anima%2Bche%2Bbrucia"] [unique_id "alxewAWL-zKlchkVWS1AvAAAAHs"], referer: http://bluedoorbar.co.nz/cvw2323r2eew/scaricare/Un%27anima%2Bche%2Bbrucia
[Sat Jul 18 23:21:04.233722 2026] [security2:error] [pid 881201:tid 881235] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\.bak|\\\\.bak\\\\.php)$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1260"] [id "390582"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that nclude .bak)"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/.env.production.bak"] [unique_id "alxewAWL-zKlchkVWS1AyQAAISA"]
[Sat Jul 18 23:21:04.320877 2026] [security2:error] [pid 881201:tid 881426] [client 103.48.44.9:56577] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxewAWL-zKlchkVWS1A0gAAAF4"]
[Sat Jul 18 23:21:04.321182 2026] [security2:error] [pid 881201:tid 881426] [client 103.48.44.9:56577] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxewAWL-zKlchkVWS1A0gAAAF4"]
[Sat Jul 18 23:21:04.330383 2026] [security2:error] [pid 881201:tid 881252] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "nuflometers.com"] [uri "/docker/.env"] [unique_id "alxewAWL-zKlchkVWS1A2wAAbTE"]
[Sat Jul 18 23:21:04.330695 2026] [security2:error] [pid 881201:tid 881248] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/production/.env"] [unique_id "alxewAWL-zKlchkVWS1A1wAAbS0"]
[Sat Jul 18 23:21:04.330698 2026] [security2:error] [pid 881201:tid 881210] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/staging/.env"] [unique_id "alxewAWL-zKlchkVWS1A2AAAbQc"]
[Sat Jul 18 23:21:04.330701 2026] [security2:error] [pid 881201:tid 881246] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/dev/.env"] [unique_id "alxewAWL-zKlchkVWS1A1gAAbSs"]
[Sat Jul 18 23:21:04.330703 2026] [security2:error] [pid 881201:tid 881282] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/@fs/.env"] [unique_id "alxewAWL-zKlchkVWS1A1AAAbU8"]
[Sat Jul 18 23:21:04.330785 2026] [security2:error] [pid 881201:tid 881239] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/frontend/.env"] [unique_id "alxewAWL-zKlchkVWS1A2QAAbSQ"]
[Sat Jul 18 23:21:04.330860 2026] [security2:error] [pid 881201:tid 881220] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/app/.env"] [unique_id "alxewAWL-zKlchkVWS1A3AAAbRE"]
[Sat Jul 18 23:21:04.330895 2026] [security2:error] [pid 881201:tid 881213] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/server/.env"] [unique_id "alxewAWL-zKlchkVWS1A2gAAbQo"]
[Sat Jul 18 23:21:04.331030 2026] [security2:error] [pid 881201:tid 881222] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/src/.env"] [unique_id "alxewAWL-zKlchkVWS1A3gAAbRM"]
[Sat Jul 18 23:21:04.331272 2026] [security2:error] [pid 881201:tid 881207] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\.bak|\\\\.bak\\\\.php)$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1260"] [id "390582"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that nclude .bak)"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/.env.prod.bak"] [unique_id "alxewAWL-zKlchkVWS1A3QAAbQQ"]
[Sat Jul 18 23:21:04.559941 2026] [security2:error] [pid 881201:tid 881366] [client 20.242.16.71:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.thescarystory.com"] [uri "/index.php"] [unique_id "alxewAWL-zKlchkVWS1A5AAAACI"]
[Sat Jul 18 23:21:04.781718 2026] [security2:error] [pid 881201:tid 881241] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "nuflometers.com"] [uri "/@fs/proc/self/environ"] [unique_id "alxewAWL-zKlchkVWS1A9wAAYyY"]
[Sat Jul 18 23:21:04.797072 2026] [security2:error] [pid 881201:tid 881266] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "nuflometers.com"] [uri "/sa.json"] [unique_id "alxewAWL-zKlchkVWS1A-gAAGT8"]
[Sat Jul 18 23:21:04.797236 2026] [security2:error] [pid 881201:tid 881357] [client 35.198.15.248:33472] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "nuflometers.com"] [uri "/sa.json"] [unique_id "alxewAWL-zKlchkVWS1A-gAAGT8"]
[Sat Jul 18 23:21:04.991309 2026] [security2:error] [pid 881201:tid 881253] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "nuflometers.com"] [uri "/firebase-admin.json"] [unique_id "alxewAWL-zKlchkVWS1BBgAAdDI"]
[Sat Jul 18 23:21:04.991646 2026] [security2:error] [pid 881201:tid 881288] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "nuflometers.com"] [uri "/@fs/root/.env"] [unique_id "alxewAWL-zKlchkVWS1BCgAAdFU"]
[Sat Jul 18 23:21:04.991806 2026] [security2:error] [pid 881201:tid 881448] [client 35.198.15.248:33472] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "nuflometers.com"] [uri "/@fs/root/.env"] [unique_id "alxewAWL-zKlchkVWS1BCgAAdFU"]
[Sat Jul 18 23:21:04.991885 2026] [security2:error] [pid 881201:tid 881272] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "nuflometers.com"] [uri "/config/firebase-admin.json"] [unique_id "alxewAWL-zKlchkVWS1BDAAAdEU"]
[Sat Jul 18 23:21:04.991974 2026] [security2:error] [pid 881201:tid 881448] [client 35.198.15.248:33472] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "nuflometers.com"] [uri "/config/firebase-admin.json"] [unique_id "alxewAWL-zKlchkVWS1BDAAAdEU"]
[Sat Jul 18 23:21:05.201456 2026] [security2:error] [pid 881201:tid 881270] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "nuflometers.com"] [uri "/config.json"] [unique_id "alxewQWL-zKlchkVWS1BHwAAbUM"]
[Sat Jul 18 23:21:05.201670 2026] [security2:error] [pid 881201:tid 881441] [client 35.198.15.248:33472] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "nuflometers.com"] [uri "/config.json"] [unique_id "alxewQWL-zKlchkVWS1BHwAAbUM"]
[Sat Jul 18 23:21:05.201669 2026] [security2:error] [pid 881201:tid 881209] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "nuflometers.com"] [uri "/rclone.conf"] [unique_id "alxewQWL-zKlchkVWS1BIQAAbQY"]
[Sat Jul 18 23:21:05.329487 2026] [security2:error] [pid 881201:tid 881405] [client 114.119.162.58:42109] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "sanifidensolutions.com"] [uri "/"] [unique_id "alxewQWL-zKlchkVWS1BNgAAAEk"], referer: https://sidhulawyers.com.au/sitemap_quality_80.xml
[Sat Jul 18 23:21:05.410089 2026] [security2:error] [pid 881201:tid 881391] [client 119.154.81.234:61705] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxewQWL-zKlchkVWS1BPQAAADs"]
[Sat Jul 18 23:21:05.410182 2026] [security2:error] [pid 881201:tid 881391] [client 119.154.81.234:61705] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxewQWL-zKlchkVWS1BPQAAADs"]
[Sat Jul 18 23:21:05.460497 2026] [security2:error] [pid 881201:tid 881307] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "nuflometers.com"] [uri "/openapi.json"] [unique_id "alxewQWL-zKlchkVWS1BRAAAEGg"]
[Sat Jul 18 23:21:05.588787 2026] [security2:error] [pid 881201:tid 881275] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "nuflometers.com"] [uri "/api/health"] [unique_id "alxewQWL-zKlchkVWS1BTgAAPkg"]
[Sat Jul 18 23:21:05.588990 2026] [security2:error] [pid 881201:tid 881394] [client 35.198.15.248:33472] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "nuflometers.com"] [uri "/api/health"] [unique_id "alxewQWL-zKlchkVWS1BTgAAPkg"]
[Sat Jul 18 23:21:05.605735 2026] [security2:error] [pid 881201:tid 881395] [client 77.83.1.26:5715] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "160"] [id "900408"] [msg "register POST logging"] [data "404"] [hostname "xp-design.co"] [uri "/index.php"] [unique_id "alxewQWL-zKlchkVWS1BOQAAAD8"]
[Sat Jul 18 23:21:05.605799 2026] [security2:error] [pid 881201:tid 881395] [client 77.83.1.26:5715] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "xp-design.co"] [uri "/index.php"] [unique_id "alxewQWL-zKlchkVWS1BOQAAAD8"]
[Sat Jul 18 23:21:05.821894 2026] [security2:error] [pid 881201:tid 881310] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "nuflometers.com"] [uri "/health"] [unique_id "alxewQWL-zKlchkVWS1BZwAABms"]
[Sat Jul 18 23:21:05.907340 2026] [security2:error] [pid 881201:tid 881231] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "nuflometers.com"] [uri "/swagger.json"] [unique_id "alxewQWL-zKlchkVWS1BegAARhw"]
[Sat Jul 18 23:21:06.143107 2026] [security2:error] [pid 881201:tid 881295] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.15.198.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nuflometers.com"] [uri "/info.php"] [unique_id "alxewgWL-zKlchkVWS1BjwAAH1w"]
[Sat Jul 18 23:21:06.145891 2026] [security2:error] [pid 881201:tid 881205] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.15.198.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nuflometers.com"] [uri "/phpinfo.php"] [unique_id "alxewgWL-zKlchkVWS1BkwAAHwI"]
[Sat Jul 18 23:21:06.145918 2026] [security2:error] [pid 881201:tid 881219] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.15.198.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nuflometers.com"] [uri "/i.php"] [unique_id "alxewgWL-zKlchkVWS1BkgAAHxA"]
[Sat Jul 18 23:21:06.155103 2026] [security2:error] [pid 881201:tid 881230] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "nuflometers.com"] [uri "/test.php"] [unique_id "alxewgWL-zKlchkVWS1BmgAAHxs"]
[Sat Jul 18 23:21:06.280636 2026] [security2:error] [pid 881201:tid 881249] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "nuflometers.com"] [uri "/v1/graphql"] [unique_id "alxewgWL-zKlchkVWS1BqQAANi4"]
[Sat Jul 18 23:21:06.280876 2026] [security2:error] [pid 881201:tid 881386] [client 35.198.15.248:33472] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "nuflometers.com"] [uri "/v1/graphql"] [unique_id "alxewgWL-zKlchkVWS1BqQAANi4"]
[Sat Jul 18 23:21:06.364463 2026] [security2:error] [pid 881201:tid 881246] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.15.198.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nuflometers.com"] [uri "/pi.php"] [unique_id "alxewgWL-zKlchkVWS1BsgAABis"]
[Sat Jul 18 23:21:06.504884 2026] [security2:error] [pid 881201:tid 881444] [client 114.119.130.116:48843] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.jennylouraya.com"] [uri "/author/mrs-sawahm/page/92"] [unique_id "alxewgWL-zKlchkVWS1BuQAAAHA"], referer: https://www.jennylouraya.com/author/mrs-sawahm/page/91
[Sat Jul 18 23:21:06.724461 2026] [security2:error] [pid 881201:tid 881399] [client 114.119.138.77:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "adambergeron.com"] [uri "/index.php"] [unique_id "alxewgWL-zKlchkVWS1BvAAAAEM"], referer: https://adambergeron.com/grantees?region=49&page=1&year=11&topic=123
[Sat Jul 18 23:21:06.956156 2026] [security2:error] [pid 881201:tid 881240] [remote 208.109.9.173:52134] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 173.9.109.208.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxewgWL-zKlchkVWS1B0gAAZyU"]
[Sat Jul 18 23:21:06.956283 2026] [security2:error] [pid 881201:tid 881435] [client 208.109.9.173:52134] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxewgWL-zKlchkVWS1B0gAAZyU"]
[Sat Jul 18 23:21:07.127929 2026] [security2:error] [pid 881201:tid 881214] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.15.198.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nuflometers.com"] [uri "/app_dev.php/_profiler"] [unique_id "alxewwWL-zKlchkVWS1B2wAAGgs"]
[Sat Jul 18 23:21:07.129445 2026] [security2:error] [pid 881201:tid 881234] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.15.198.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nuflometers.com"] [uri "/app_dev.php"] [unique_id "alxewwWL-zKlchkVWS1B3QAAGh8"]
[Sat Jul 18 23:21:07.129884 2026] [security2:error] [pid 881201:tid 881253] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "nuflometers.com"] [uri "/_profiler/open"] [unique_id "alxewwWL-zKlchkVWS1B3wAAGjI"]
[Sat Jul 18 23:21:07.132989 2026] [security2:error] [pid 881201:tid 881227] [remote 35.198.15.248:33472] ModSecurity: Access denied with code 406 (phase 2). Match of "ipMatch 127.0.0.1,::1" against "REMOTE_ADDR" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "724"] [id "340114"] [rev "2"] [msg "Atomicorp.com WAF Rules: Apache admin service access attempt"] [severity "CRITICAL"] [hostname "nuflometers.com"] [uri "/server-info"] [unique_id "alxewwWL-zKlchkVWS1B5AAAGhg"]
[Sat Jul 18 23:21:07.186060 2026] [access_compat:error] [pid 881201:tid 881228] [remote 35.198.15.248:33472] AH01797: client denied by server configuration: proxy:https://127.0.0.1:8443/server-status
[Sat Jul 18 23:21:07.186272 2026] [security2:error] [pid 881201:tid 881355] [client 2a06:98c0:3600::103:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "nicherealestate.co"] [uri "/wp-admin/install.php"] [unique_id "alxewwWL-zKlchkVWS1B9QAAABc"]
[Sat Jul 18 23:21:07.452316 2026] [autoindex:error] [pid 881201:tid 881396] [client 85.204.70.112:53650] AH01276: Cannot serve directory /home1/tgdhcnmy/public_html/website_42eb2532/wp-admin/maint/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:21:07.452844 2026] [security2:error] [pid 881201:tid 881396] [client 85.204.70.112:53650] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "404"] [hostname "website-42eb2532.nextlvlmarketingco.com"] [uri "/cgi-sys/403.html"] [unique_id "alxewwWL-zKlchkVWS1CCQAAAEA"]
[Sat Jul 18 23:21:08.045602 2026] [security2:error] [pid 881201:tid 881340] [client 124.29.207.185:50015] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxexAWL-zKlchkVWS1CPgAAAAg"]
[Sat Jul 18 23:21:08.045711 2026] [security2:error] [pid 881201:tid 881340] [client 124.29.207.185:50015] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxexAWL-zKlchkVWS1CPgAAAAg"]
[Sat Jul 18 23:21:08.076635 2026] [security2:error] [pid 881201:tid 881299] [remote 72.167.132.114:58014] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/wp-login.php"] [unique_id "alxexAWL-zKlchkVWS1CRAAAG2A"]
[Sat Jul 18 23:21:08.719734 2026] [security2:error] [pid 881201:tid 881304] [remote 72.167.132.114:58014] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/wp-login.php"] [unique_id "alxexAWL-zKlchkVWS1CbAAAEWU"], referer: https://ghivs.com/wp-login.php
[Sat Jul 18 23:21:09.330135 2026] [security2:error] [pid 881201:tid 881445] [client 114.119.134.224:28287] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "youpositive.co"] [uri "/ar/ipad_mockup-1-of-3-1-2"] [unique_id "alxexQWL-zKlchkVWS1ClwAAAHE"], referer: https://youpositive.co/ar/see-my-reflection-as-a-king
[Sat Jul 18 23:21:09.530141 2026] [security2:error] [pid 881201:tid 881368] [client 23.160.60.215:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxexQWL-zKlchkVWS1CmwAAACQ"]
[Sat Jul 18 23:21:10.367927 2026] [security2:error] [pid 881201:tid 881395] [client 110.249.202.135:36552] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "lifeisbetterlakeside.com"] [uri "/robots.txt"] [unique_id "alxexgWL-zKlchkVWS1CxQAAAD8"]
[Sat Jul 18 23:21:10.698067 2026] [security2:error] [pid 881201:tid 881339] [client 77.83.1.161:21965] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "160"] [id "900408"] [msg "register POST logging"] [data "404"] [hostname "xp-design.co"] [uri "/index.php"] [unique_id "alxexgWL-zKlchkVWS1CzwAAAAc"]
[Sat Jul 18 23:21:10.698115 2026] [security2:error] [pid 881201:tid 881339] [client 77.83.1.161:21965] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "xp-design.co"] [uri "/index.php"] [unique_id "alxexgWL-zKlchkVWS1CzwAAAAc"]
[Sat Jul 18 23:21:10.968108 2026] [security2:error] [pid 881201:tid 881243] [remote 72.167.132.114:58028] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxexgWL-zKlchkVWS1C8QAAWig"]
[Sat Jul 18 23:21:11.584064 2026] [security2:error] [pid 881201:tid 881291] [remote 72.167.132.114:58028] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxexwWL-zKlchkVWS1DFAAAHFg"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:21:12.088192 2026] [security2:error] [pid 881201:tid 881429] [client 223.185.61.63:26406] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeyAWL-zKlchkVWS1DKwAAAGE"]
[Sat Jul 18 23:21:12.088283 2026] [security2:error] [pid 881201:tid 881429] [client 223.185.61.63:26406] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxeyAWL-zKlchkVWS1DKwAAAGE"]
[Sat Jul 18 23:21:12.274919 2026] [security2:error] [pid 881201:tid 881368] [client 14.224.227.113:51384] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxeyAWL-zKlchkVWS1DNAAAACQ"]
[Sat Jul 18 23:21:12.317113 2026] [security2:error] [pid 881201:tid 881402] [client 14.251.3.155:51385] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxeyAWL-zKlchkVWS1DOgAAAEY"]
[Sat Jul 18 23:21:12.509664 2026] [security2:error] [pid 881201:tid 881447] [client 190.245.146.99:61019] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeyAWL-zKlchkVWS1DRAAAAHM"]
[Sat Jul 18 23:21:12.515816 2026] [security2:error] [pid 881201:tid 881447] [client 190.245.146.99:61019] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxeyAWL-zKlchkVWS1DRAAAAHM"]
[Sat Jul 18 23:21:12.570308 2026] [security2:error] [pid 881201:tid 881369] [client 27.34.68.67:23990] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxeyAWL-zKlchkVWS1DRwAAACU"]
[Sat Jul 18 23:21:12.570408 2026] [security2:error] [pid 881201:tid 881369] [client 27.34.68.67:23990] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxeyAWL-zKlchkVWS1DRwAAACU"]
[Sat Jul 18 23:21:12.631197 2026] [security2:error] [pid 881201:tid 881348] [client 13.223.109.92:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxeyAWL-zKlchkVWS1DQgAAEFI"]
[Sat Jul 18 23:21:13.999667 2026] [security2:error] [pid 830701:tid 830814] [remote 160.187.68.132:45420] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.68.187.160.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxeycu1nEoSSDHiOXboZAABdHA"]
[Sat Jul 18 23:21:14.006916 2026] [security2:error] [pid 881201:tid 881336] [client 171.4.232.110:56613] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeygWL-zKlchkVWS1DjgAAAAQ"]
[Sat Jul 18 23:21:14.007011 2026] [security2:error] [pid 881201:tid 881336] [client 171.4.232.110:56613] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeygWL-zKlchkVWS1DjgAAAAQ"]
[Sat Jul 18 23:21:14.370209 2026] [security2:error] [pid 881201:tid 881368] [client 170.106.150.42:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxeygWL-zKlchkVWS1DowAAJCQ"]
[Sat Jul 18 23:21:14.773378 2026] [security2:error] [pid 881201:tid 881392] [client 103.48.44.9:57235] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeygWL-zKlchkVWS1DxQAAADw"]
[Sat Jul 18 23:21:14.773513 2026] [security2:error] [pid 881201:tid 881392] [client 103.48.44.9:57235] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxeygWL-zKlchkVWS1DxQAAADw"]
[Sat Jul 18 23:21:14.807044 2026] [security2:error] [pid 881201:tid 881391] [client 47.128.123.6:64684] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "ccsdifference.com"] [uri "/robots.txt"] [unique_id "alxeygWL-zKlchkVWS1DygAAADs"]
[Sat Jul 18 23:21:14.910520 2026] [security2:error] [pid 881201:tid 881352] [client 77.83.1.15:47499] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "160"] [id "900408"] [msg "register POST logging"] [data "404"] [hostname "xp-design.co"] [uri "/index.php"] [unique_id "alxeygWL-zKlchkVWS1DtQAAABQ"]
[Sat Jul 18 23:21:14.910573 2026] [security2:error] [pid 881201:tid 881352] [client 77.83.1.15:47499] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "xp-design.co"] [uri "/index.php"] [unique_id "alxeygWL-zKlchkVWS1DtQAAABQ"]
[Sat Jul 18 23:21:15.147620 2026] [security2:error] [pid 881201:tid 881227] [remote 68.178.160.25:59616] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/wp-login.php"] [unique_id "alxeywWL-zKlchkVWS1D1wAAQRg"]
[Sat Jul 18 23:21:15.607612 2026] [security2:error] [pid 881201:tid 881441] [client 223.228.182.224:20128] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxeywWL-zKlchkVWS1D6wAAAG0"]
[Sat Jul 18 23:21:15.612034 2026] [security2:error] [pid 881201:tid 881441] [client 223.228.182.224:20128] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxeywWL-zKlchkVWS1D6wAAAG0"]
[Sat Jul 18 23:21:15.807729 2026] [security2:error] [pid 881201:tid 881451] [client 46.110.96.34:62233] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "wpad.tsctanks.com"] [uri "/wpad.dat"] [unique_id "alxeywWL-zKlchkVWS1D-wAAAHc"]
[Sat Jul 18 23:21:15.984246 2026] [security2:error] [pid 881201:tid 881386] [client 119.154.81.234:62165] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxeywWL-zKlchkVWS1EAwAAADY"]
[Sat Jul 18 23:21:15.984409 2026] [security2:error] [pid 881201:tid 881386] [client 119.154.81.234:62165] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxeywWL-zKlchkVWS1EAwAAADY"]
[Sat Jul 18 23:21:16.059431 2026] [security2:error] [pid 881201:tid 881281] [remote 68.178.160.25:59616] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/wp-login.php"] [unique_id "alxezAWL-zKlchkVWS1EBwAAAE4"], referer: https://muafaces.org/wp-login.php
[Sat Jul 18 23:21:16.294590 2026] [security2:error] [pid 881201:tid 881348] [client 114.119.129.107:61065] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "hoomanr.com"] [uri "/games/breakOut"] [unique_id "alxezAWL-zKlchkVWS1EFgAAABA"], referer: https://hoomanr.com/games/
[Sat Jul 18 23:21:16.628190 2026] [security2:error] [pid 881201:tid 881379] [client 103.129.212.4:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "packerjanitorial.com"] [uri "/index.php"] [unique_id "alxezAWL-zKlchkVWS1ECwAAL1c"], referer: https://packerjanitorial.com
[Sat Jul 18 23:21:16.900458 2026] [security2:error] [pid 881201:tid 881287] [remote 41.76.213.235:43368] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxezAWL-zKlchkVWS1EOAAAfFQ"]
[Sat Jul 18 23:21:17.403038 2026] [security2:error] [pid 881201:tid 881232] [remote 41.76.213.235:43368] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxezQWL-zKlchkVWS1EVgAAHB0"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:21:17.448803 2026] [security2:error] [pid 881201:tid 881325] [remote 97.74.93.24:56734] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.savilerowtravel.com"] [uri "/wp-login.php"] [unique_id "alxezQWL-zKlchkVWS1EWgAAY3o"], referer: https://savilerowtravel.co.uk/wp-login.php
[Sat Jul 18 23:21:17.599177 2026] [security2:error] [pid 881201:tid 881347] [client 114.119.145.47:34849] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.crmpfilms.com"] [uri "/blog/2016/08/27/files/stacks-image-678c607.jpg"] [unique_id "alxezQWL-zKlchkVWS1EYAAAAA8"], referer: https://www.crmpfilms.com/blog/2016/08/27/files/stacks-image-678c607.jpg
[Sat Jul 18 23:21:18.029021 2026] [security2:error] [pid 881201:tid 881413] [client 124.29.246.106:50469] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxezgWL-zKlchkVWS1EdQAAAFE"]
[Sat Jul 18 23:21:18.029106 2026] [security2:error] [pid 881201:tid 881413] [client 124.29.246.106:50469] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxezgWL-zKlchkVWS1EdQAAAFE"]
[Sat Jul 18 23:21:18.218095 2026] [security2:error] [pid 881201:tid 881238] [remote 97.74.93.24:56734] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.savilerowtravel.com"] [uri "/wp-login.php"] [unique_id "alxezgWL-zKlchkVWS1EfwAAQSM"], referer: https://savilerowtravel.co.uk/wp-login.php
[Sat Jul 18 23:21:18.687473 2026] [security2:error] [pid 881201:tid 881338] [client 14.226.241.58:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.maxenengineering.com"] [uri "/maxenengineering/index.php"] [unique_id "alxezgWL-zKlchkVWS1EdgAAAAY"]
[Sat Jul 18 23:21:18.805837 2026] [security2:error] [pid 881201:tid 881249] [remote 152.228.213.32:47912] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxezgWL-zKlchkVWS1EpgAAMi4"]
[Sat Jul 18 23:21:18.931505 2026] [security2:error] [pid 881201:tid 881373] [client 18.195.15.81:34904] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 81.15.195.18.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxezgWL-zKlchkVWS1ErwAAACk"]
[Sat Jul 18 23:21:18.931639 2026] [security2:error] [pid 881201:tid 881373] [client 18.195.15.81:34904] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxezgWL-zKlchkVWS1ErwAAACk"]
[Sat Jul 18 23:21:19.006303 2026] [security2:error] [pid 881201:tid 881255] [remote 152.228.213.32:47912] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxezgWL-zKlchkVWS1EtgAABzQ"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:21:21.152400 2026] [security2:error] [pid 881201:tid 881430] [client 74.208.214.194:39672] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxe0QWL-zKlchkVWS1FLgAAAGI"]
[Sat Jul 18 23:21:21.475094 2026] [security2:error] [pid 881201:tid 881246] [remote 97.74.93.24:43322] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxe0QWL-zKlchkVWS1FZgAADSs"]
[Sat Jul 18 23:21:21.862248 2026] [security2:error] [pid 881201:tid 881221] [remote 97.74.93.24:43322] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxe0QWL-zKlchkVWS1FjAAANRI"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:21:22.532357 2026] [security2:error] [pid 881201:tid 881339] [client 44.206.217.175:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxe0gWL-zKlchkVWS1FxQAAB0Y"]
[Sat Jul 18 23:21:22.715642 2026] [security2:error] [pid 881201:tid 881438] [client 223.185.61.63:32072] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxe0gWL-zKlchkVWS1F7wAAAGo"]
[Sat Jul 18 23:21:22.716644 2026] [security2:error] [pid 881201:tid 881438] [client 223.185.61.63:32072] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxe0gWL-zKlchkVWS1F7wAAAGo"]
[Sat Jul 18 23:21:23.068637 2026] [security2:error] [pid 881201:tid 881394] [client 190.245.146.99:61545] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxe0wWL-zKlchkVWS1GCAAAAD4"]
[Sat Jul 18 23:21:23.068769 2026] [security2:error] [pid 881201:tid 881394] [client 190.245.146.99:61545] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxe0wWL-zKlchkVWS1GCAAAAD4"]
[Sat Jul 18 23:21:23.087341 2026] [security2:error] [pid 881201:tid 881356] [client 57.141.18.43:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxe0gWL-zKlchkVWS1F-QAAABg"]
[Sat Jul 18 23:21:23.143221 2026] [security2:error] [pid 881201:tid 881405] [client 27.34.68.67:21439] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxe0wWL-zKlchkVWS1GEgAAAEk"]
[Sat Jul 18 23:21:23.143320 2026] [security2:error] [pid 881201:tid 881405] [client 27.34.68.67:21439] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxe0wWL-zKlchkVWS1GEgAAAEk"]
[Sat Jul 18 23:21:23.179006 2026] [security2:error] [pid 881201:tid 881322] [remote 31.42.184.154:37776] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mobilesurvsolutions.com"] [uri "/wp-login.php"] [unique_id "alxe0wWL-zKlchkVWS1GFQAAAXc"]
[Sat Jul 18 23:21:23.295772 2026] [security2:error] [pid 881201:tid 881352] [client 223.228.182.224:26044] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxe0wWL-zKlchkVWS1GHgAAABQ"]
[Sat Jul 18 23:21:23.295867 2026] [security2:error] [pid 881201:tid 881352] [client 223.228.182.224:26044] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxe0wWL-zKlchkVWS1GHgAAABQ"]
[Sat Jul 18 23:21:23.428131 2026] [security2:error] [pid 881201:tid 881329] [remote 31.42.184.154:37776] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mobilesurvsolutions.com"] [uri "/wp-login.php"] [unique_id "alxe0wWL-zKlchkVWS1GKAAAQX4"], referer: https://mobilesurvsolutions.com/wp-login.php
[Sat Jul 18 23:21:23.822421 2026] [security2:error] [pid 881201:tid 881417] [client 65.111.28.43:24827] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "155"] [id "900406"] [msg "wp-login POST logging"] [data "200"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxe0wWL-zKlchkVWS1GNAAAAFU"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:21:23.937848 2026] [core:error] [pid 881201:tid 881419] [client 50.116.65.227:15518] AH00135: Invalid method in request PURGE /.* HTTP/1.1
[Sat Jul 18 23:21:23.948848 2026] [core:error] [pid 881201:tid 881351] [client 50.116.65.227:15528] AH00135: Invalid method in request PURGE /.* HTTP/1.1
[Sat Jul 18 23:21:24.631263 2026] [security2:error] [pid 881201:tid 881397] [client 171.4.232.110:57232] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxe1AWL-zKlchkVWS1GfAAAAEE"]
[Sat Jul 18 23:21:24.631408 2026] [security2:error] [pid 881201:tid 881397] [client 171.4.232.110:57232] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxe1AWL-zKlchkVWS1GfAAAAEE"]
[Sat Jul 18 23:21:24.916631 2026] [security2:error] [pid 881201:tid 881417] [client 23.160.60.99:22549] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.ccsdifference.com"] [uri "/index.php"] [unique_id "alxe1AWL-zKlchkVWS1GggAAAFU"]
[Sat Jul 18 23:21:24.975185 2026] [security2:error] [pid 881201:tid 881270] [remote 220.181.108.174:57106] ModSecurity: Access denied with code 406 (phase 2). Match of "beginsWith %{request_headers.host}" against "TX:1" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "504"] [id "340162"] [rev "302"] [msg "Atomicorp.com WAF Rules: Remote File Injection Attack detected (Unauthorized URL detected as argument)"] [data ",TX:1"] [severity "CRITICAL"] [hostname "www.mollycahill.com"] [uri "/"] [unique_id "alxe1AWL-zKlchkVWS1GjgAAMUM"]
[Sat Jul 18 23:21:25.254992 2026] [security2:error] [pid 881201:tid 881257] [remote 31.42.184.154:37792] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxe1QWL-zKlchkVWS1GpgAALTY"]
[Sat Jul 18 23:21:25.499894 2026] [security2:error] [pid 881201:tid 881260] [remote 31.42.184.154:37792] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxe1QWL-zKlchkVWS1GsQAAPjk"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:21:26.141359 2026] [security2:error] [pid 881201:tid 881299] [remote 119.249.100.179:20584] ModSecurity: Access denied with code 406 (phase 2). Match of "beginsWith %{request_headers.host}" against "TX:1" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "504"] [id "340162"] [rev "302"] [msg "Atomicorp.com WAF Rules: Remote File Injection Attack detected (Unauthorized URL detected as argument)"] [data ",TX:1"] [severity "CRITICAL"] [hostname "www.mollycahill.com"] [uri "/"] [unique_id "alxe1gWL-zKlchkVWS1GzQAAcGA"]
[Sat Jul 18 23:21:26.367170 2026] [security2:error] [pid 881201:tid 881376] [client 95.108.213.79:46062] ModSecurity: Access denied with code 429 (phase 2). Pattern match "Mozilla\\\\/5\\\\.0 \\\\(compatible; YandexBot\\\\/3\\\\.0; \\\\+http:\\\\/\\\\/yandex\\\\.com\\\\/bots\\\\)" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/othercrawler.conf"] [line "3"] [id "901008"] [msg "Yandex Crawler 429 ADDED BY MONITORING DO NOT WHITELIST"] [hostname "heroesoftomorrow.us"] [uri "/robots.txt"] [unique_id "alxe1gWL-zKlchkVWS1G4AAAACw"]
[Sat Jul 18 23:21:26.373586 2026] [proxy:error] [pid 881201:tid 881426] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:26.373630 2026] [proxy_http:error] [pid 881201:tid 881426] [client 193.47.62.168:57522] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:26.374375 2026] [proxy:error] [pid 881201:tid 881426] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:26.374416 2026] [proxy_http:error] [pid 881201:tid 881426] [client 193.47.62.168:57522] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:26.484975 2026] [security2:error] [pid 881201:tid 881316] [remote 72.167.132.114:34998] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxe1gWL-zKlchkVWS1G6wAAaXE"]
[Sat Jul 18 23:21:26.889031 2026] [security2:error] [pid 881201:tid 881349] [client 103.48.44.9:58057] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxe1gWL-zKlchkVWS1HBAAAABE"]
[Sat Jul 18 23:21:26.889121 2026] [security2:error] [pid 881201:tid 881349] [client 103.48.44.9:58057] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxe1gWL-zKlchkVWS1HBAAAABE"]
[Sat Jul 18 23:21:27.261804 2026] [security2:error] [pid 881201:tid 881284] [remote 119.249.100.110:5782] ModSecurity: Access denied with code 406 (phase 2). Match of "beginsWith %{request_headers.host}" against "TX:1" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "504"] [id "340162"] [rev "302"] [msg "Atomicorp.com WAF Rules: Remote File Injection Attack detected (Unauthorized URL detected as argument)"] [data ",TX:1"] [severity "CRITICAL"] [hostname "www.mollycahill.com"] [uri "/"] [unique_id "alxe1wWL-zKlchkVWS1HHgAAXFE"]
[Sat Jul 18 23:21:27.956729 2026] [security2:error] [pid 881201:tid 881225] [remote 72.167.132.114:34998] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxe1wWL-zKlchkVWS1HSwAAfRY"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:21:28.132032 2026] [security2:error] [pid 881201:tid 881356] [client 124.29.207.185:50910] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxe2AWL-zKlchkVWS1HWAAAABg"]
[Sat Jul 18 23:21:28.132237 2026] [security2:error] [pid 881201:tid 881356] [client 124.29.207.185:50910] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxe2AWL-zKlchkVWS1HWAAAABg"]
[Sat Jul 18 23:21:28.406908 2026] [security2:error] [pid 881201:tid 881365] [client 136.243.222.140:52622] ModSecurity: Warning. Matched phrase "DomainStatsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "www.ccsdifference.com"] [uri "/index.php"] [unique_id "alxe2AWL-zKlchkVWS1HVgAAACs"]
[Sat Jul 18 23:21:28.550847 2026] [security2:error] [pid 881201:tid 881420] [client 20.220.9.199:10775] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "alxe2AWL-zKlchkVWS1HcgAAAFg"]
[Sat Jul 18 23:21:28.550985 2026] [security2:error] [pid 881201:tid 881420] [client 20.220.9.199:10775] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "alxe2AWL-zKlchkVWS1HcgAAAFg"]
[Sat Jul 18 23:21:28.685769 2026] [security2:error] [pid 881201:tid 881410] [client 20.220.9.199:23090] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/this_is_a_new_hello_world.php"] [unique_id "alxe2AWL-zKlchkVWS1HdgAAAE4"]
[Sat Jul 18 23:21:28.685861 2026] [security2:error] [pid 881201:tid 881410] [client 20.220.9.199:23090] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/this_is_a_new_hello_world.php"] [unique_id "alxe2AWL-zKlchkVWS1HdgAAAE4"]
[Sat Jul 18 23:21:28.798041 2026] [security2:error] [pid 881201:tid 881221] [remote 31.42.184.154:52746] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sergnotes.com"] [uri "/wp-login.php"] [unique_id "alxe2AWL-zKlchkVWS1HfwAANRI"]
[Sat Jul 18 23:21:28.853592 2026] [security2:error] [pid 881201:tid 881432] [client 20.220.9.199:15209] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/x.php"] [unique_id "alxe2AWL-zKlchkVWS1HgQAAAGQ"]
[Sat Jul 18 23:21:28.853670 2026] [security2:error] [pid 881201:tid 881432] [client 20.220.9.199:15209] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/x.php"] [unique_id "alxe2AWL-zKlchkVWS1HgQAAAGQ"]
[Sat Jul 18 23:21:28.985379 2026] [security2:error] [pid 881201:tid 881345] [client 20.220.9.199:33258] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/mgrr.php"] [unique_id "alxe2AWL-zKlchkVWS1HiQAAAA0"]
[Sat Jul 18 23:21:28.985479 2026] [security2:error] [pid 881201:tid 881345] [client 20.220.9.199:33258] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/mgrr.php"] [unique_id "alxe2AWL-zKlchkVWS1HiQAAAA0"]
[Sat Jul 18 23:21:29.023853 2026] [security2:error] [pid 881201:tid 881289] [remote 31.42.184.154:52746] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sergnotes.com"] [uri "/wp-login.php"] [unique_id "alxe2QWL-zKlchkVWS1HkwAADFY"], referer: https://sergnotes.com/wp-login.php
[Sat Jul 18 23:21:29.139448 2026] [security2:error] [pid 881201:tid 881395] [client 20.220.9.199:52506] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/stdin.php"] [unique_id "alxe2QWL-zKlchkVWS1HlwAAAD8"]
[Sat Jul 18 23:21:29.139561 2026] [security2:error] [pid 881201:tid 881395] [client 20.220.9.199:52506] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/stdin.php"] [unique_id "alxe2QWL-zKlchkVWS1HlwAAAD8"]
[Sat Jul 18 23:21:29.152341 2026] [security2:error] [pid 881201:tid 881343] [client 57.141.18.39:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "idigress.agency"] [uri "/index.php"] [unique_id "alxe1wWL-zKlchkVWS1HEQAAAAs"]
[Sat Jul 18 23:21:29.293333 2026] [security2:error] [pid 881201:tid 881360] [client 20.220.9.199:52527] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/BDKR28.php"] [unique_id "alxe2QWL-zKlchkVWS1HnwAAABw"]
[Sat Jul 18 23:21:29.293482 2026] [security2:error] [pid 881201:tid 881360] [client 20.220.9.199:52527] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/BDKR28.php"] [unique_id "alxe2QWL-zKlchkVWS1HnwAAABw"]
[Sat Jul 18 23:21:29.436365 2026] [security2:error] [pid 881201:tid 881332] [client 20.220.9.199:33236] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/001.php"] [unique_id "alxe2QWL-zKlchkVWS1HqQAAAAA"]
[Sat Jul 18 23:21:29.436451 2026] [security2:error] [pid 881201:tid 881332] [client 20.220.9.199:33236] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/001.php"] [unique_id "alxe2QWL-zKlchkVWS1HqQAAAAA"]
[Sat Jul 18 23:21:29.567772 2026] [security2:error] [pid 881201:tid 881396] [client 20.220.9.199:23102] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/dZ3wP5.php"] [unique_id "alxe2QWL-zKlchkVWS1HswAAAEA"]
[Sat Jul 18 23:21:29.567868 2026] [security2:error] [pid 881201:tid 881396] [client 20.220.9.199:23102] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/dZ3wP5.php"] [unique_id "alxe2QWL-zKlchkVWS1HswAAAEA"]
[Sat Jul 18 23:21:29.695265 2026] [security2:error] [pid 881201:tid 881405] [client 20.220.9.199:10757] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/yup.php"] [unique_id "alxe2QWL-zKlchkVWS1HuwAAAEk"]
[Sat Jul 18 23:21:29.695404 2026] [security2:error] [pid 881201:tid 881405] [client 20.220.9.199:10757] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/yup.php"] [unique_id "alxe2QWL-zKlchkVWS1HuwAAAEk"]
[Sat Jul 18 23:21:29.853938 2026] [security2:error] [pid 881201:tid 881342] [client 13.250.107.25:50766] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.107.250.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxe2QWL-zKlchkVWS1HxgAAAAo"]
[Sat Jul 18 23:21:30.060855 2026] [security2:error] [pid 881201:tid 881392] [client 119.154.81.234:62610] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxe2gWL-zKlchkVWS1H1wAAADw"]
[Sat Jul 18 23:21:30.060958 2026] [security2:error] [pid 881201:tid 881392] [client 119.154.81.234:62610] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxe2gWL-zKlchkVWS1H1wAAADw"]
[Sat Jul 18 23:21:30.314523 2026] [security2:error] [pid 881201:tid 881384] [client 20.220.9.199:17881] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/ts.php"] [unique_id "alxe2gWL-zKlchkVWS1H4wAAADQ"]
[Sat Jul 18 23:21:30.314643 2026] [security2:error] [pid 881201:tid 881384] [client 20.220.9.199:17881] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/ts.php"] [unique_id "alxe2gWL-zKlchkVWS1H4wAAADQ"]
[Sat Jul 18 23:21:30.745480 2026] [security2:error] [pid 881201:tid 881422] [client 20.220.9.199:23095] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/X.php"] [unique_id "alxe2gWL-zKlchkVWS1H_wAAAFo"]
[Sat Jul 18 23:21:30.745575 2026] [security2:error] [pid 881201:tid 881422] [client 20.220.9.199:23095] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/X.php"] [unique_id "alxe2gWL-zKlchkVWS1H_wAAAFo"]
[Sat Jul 18 23:21:30.996100 2026] [security2:error] [pid 881201:tid 881404] [client 20.220.9.199:10755] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/1polka.php"] [unique_id "alxe2gWL-zKlchkVWS1IEwAAAEg"]
[Sat Jul 18 23:21:30.996190 2026] [security2:error] [pid 881201:tid 881404] [client 20.220.9.199:10755] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/1polka.php"] [unique_id "alxe2gWL-zKlchkVWS1IEwAAAEg"]
[Sat Jul 18 23:21:31.165450 2026] [security2:error] [pid 881201:tid 881364] [client 20.220.9.199:52520] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/gec.php"] [unique_id "alxe2wWL-zKlchkVWS1IGwAAACA"]
[Sat Jul 18 23:21:31.165550 2026] [security2:error] [pid 881201:tid 881364] [client 20.220.9.199:52520] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/gec.php"] [unique_id "alxe2wWL-zKlchkVWS1IGwAAACA"]
[Sat Jul 18 23:21:31.273529 2026] [security2:error] [pid 881201:tid 881417] [client 208.84.100.74:38426] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "samdothan.org"] [uri "/.env"] [unique_id "alxe2wWL-zKlchkVWS1IJQAAAFU"]
[Sat Jul 18 23:21:31.302955 2026] [security2:error] [pid 881201:tid 881370] [client 20.220.9.199:33274] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/sky.php"] [unique_id "alxe2wWL-zKlchkVWS1IJwAAACY"]
[Sat Jul 18 23:21:31.303082 2026] [security2:error] [pid 881201:tid 881370] [client 20.220.9.199:33274] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/sky.php"] [unique_id "alxe2wWL-zKlchkVWS1IJwAAACY"]
[Sat Jul 18 23:21:31.353450 2026] [security2:error] [pid 881201:tid 881391] [client 208.84.100.74:38486] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "samdothan.org"] [uri "/backend/.env"] [unique_id "alxe2wWL-zKlchkVWS1IOQAAADs"]
[Sat Jul 18 23:21:31.353613 2026] [security2:error] [pid 881201:tid 881405] [client 208.84.100.74:38500] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "samdothan.org"] [uri "/api/.env"] [unique_id "alxe2wWL-zKlchkVWS1IOgAAAEk"]
[Sat Jul 18 23:21:31.359913 2026] [security2:error] [pid 881201:tid 881402] [client 208.84.100.74:38544] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.100.84.208.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-content/plugins/pagelayer/js/givejs.php"] [unique_id "alxe2wWL-zKlchkVWS1ILwAAAEY"]
[Sat Jul 18 23:21:31.418075 2026] [security2:error] [pid 881201:tid 881458] [client 208.84.100.74:38508] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.100.84.208.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-content/plugins/pagelayer/css/givecss.php"] [unique_id "alxe2wWL-zKlchkVWS1ITAAAAH4"]
[Sat Jul 18 23:21:31.441567 2026] [security2:error] [pid 881201:tid 881426] [client 208.84.100.74:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "samdothan.org"] [uri "/index.php"] [unique_id "alxe2wWL-zKlchkVWS1IJgAAAF4"]
[Sat Jul 18 23:21:31.471564 2026] [security2:error] [pid 881201:tid 881403] [client 20.220.9.199:15190] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/fffm.php"] [unique_id "alxe2wWL-zKlchkVWS1IWgAAAEc"]
[Sat Jul 18 23:21:31.471677 2026] [security2:error] [pid 881201:tid 881403] [client 20.220.9.199:15190] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/fffm.php"] [unique_id "alxe2wWL-zKlchkVWS1IWgAAAEc"]
[Sat Jul 18 23:21:31.513520 2026] [security2:error] [pid 881201:tid 881338] [client 208.84.100.74:38532] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "samdothan.org"] [uri "/index.php"] [unique_id "alxe2wWL-zKlchkVWS1IMQAAAAY"]
[Sat Jul 18 23:21:31.551861 2026] [security2:error] [pid 881201:tid 881404] [client 208.84.100.74:38614] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.100.84.208.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "samdothan.org"] [uri "/xmlrpc.php"] [unique_id "alxe2wWL-zKlchkVWS1IXwAAAEg"]
[Sat Jul 18 23:21:31.634884 2026] [security2:error] [pid 881201:tid 881217] [remote 163.227.186.27:40178] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxe2wWL-zKlchkVWS1IcgAALQ4"]
[Sat Jul 18 23:21:31.709812 2026] [security2:error] [pid 881201:tid 881440] [client 20.220.9.199:52491] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/sixxis.php"] [unique_id "alxe2wWL-zKlchkVWS1IegAAAGw"]
[Sat Jul 18 23:21:31.709887 2026] [security2:error] [pid 881201:tid 881440] [client 20.220.9.199:52491] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/sixxis.php"] [unique_id "alxe2wWL-zKlchkVWS1IegAAAGw"]
[Sat Jul 18 23:21:31.867881 2026] [http2:info] [pid 882519:tid 882519] h2_workers: created with min=128 max=192 idle_ms=600000
[Sat Jul 18 23:21:32.054219 2026] [security2:error] [pid 882519:tid 882652] [client 20.220.9.199:23091] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/yj09.php"] [unique_id "alxe3KL84xJUTmx6eO6a-wAAAIg"]
[Sat Jul 18 23:21:32.054355 2026] [security2:error] [pid 882519:tid 882652] [client 20.220.9.199:23091] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/yj09.php"] [unique_id "alxe3KL84xJUTmx6eO6a-wAAAIg"]
[Sat Jul 18 23:21:32.154261 2026] [security2:error] [pid 881201:tid 881282] [remote 163.227.186.27:40178] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxe3AWL-zKlchkVWS1IjAAAck8"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:21:32.172855 2026] [security2:error] [pid 881201:tid 881367] [client 208.84.100.74:38514] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "samdothan.org"] [uri "/index.php"] [unique_id "alxe2wWL-zKlchkVWS1IMgAAACM"]
[Sat Jul 18 23:21:32.211971 2026] [security2:error] [pid 881201:tid 881400] [client 208.84.100.74:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "samdothan.org"] [uri "/index.php"] [unique_id "alxe2wWL-zKlchkVWS1IQAAAAEQ"]
[Sat Jul 18 23:21:32.227247 2026] [security2:error] [pid 881201:tid 881415] [client 208.84.100.74:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "samdothan.org"] [uri "/index.php"] [unique_id "alxe2wWL-zKlchkVWS1IQQAAAFM"]
[Sat Jul 18 23:21:32.276555 2026] [security2:error] [pid 881201:tid 881240] [remote 8.217.108.67:38650] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "dienerranch.com"] [uri "/wp-login.php"] [unique_id "alxe3AWL-zKlchkVWS1IlAAAPiU"]
[Sat Jul 18 23:21:32.303216 2026] [security2:error] [pid 882519:tid 882660] [client 20.220.9.199:52521] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/f900.php"] [unique_id "alxe3KL84xJUTmx6eO6a_wAAAJA"]
[Sat Jul 18 23:21:32.303372 2026] [security2:error] [pid 882519:tid 882660] [client 20.220.9.199:52521] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/f900.php"] [unique_id "alxe3KL84xJUTmx6eO6a_wAAAJA"]
[Sat Jul 18 23:21:32.633305 2026] [security2:error] [pid 882519:tid 882663] [client 45.3.42.229:13607] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 229.42.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxe3KL84xJUTmx6eO6bAgAAAJM"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:21:32.783858 2026] [security2:error] [pid 882519:tid 882677] [client 20.220.9.199:17910] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/ups.php"] [unique_id "alxe3KL84xJUTmx6eO6bBwAAAKE"]
[Sat Jul 18 23:21:32.783987 2026] [security2:error] [pid 882519:tid 882677] [client 20.220.9.199:17910] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/ups.php"] [unique_id "alxe3KL84xJUTmx6eO6bBwAAAKE"]
[Sat Jul 18 23:21:32.784423 2026] [security2:error] [pid 881201:tid 881353] [client 45.3.45.213:37761] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "155"] [id "900406"] [msg "wp-login POST logging"] [data "200"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxe2wWL-zKlchkVWS1IFQAAABU"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:21:32.936731 2026] [security2:error] [pid 881201:tid 881427] [client 20.220.9.199:52485] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/k.php"] [unique_id "alxe3AWL-zKlchkVWS1IrAAAAF8"]
[Sat Jul 18 23:21:32.936884 2026] [security2:error] [pid 881201:tid 881427] [client 20.220.9.199:52485] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/k.php"] [unique_id "alxe3AWL-zKlchkVWS1IrAAAAF8"]
[Sat Jul 18 23:21:33.127480 2026] [security2:error] [pid 881201:tid 881343] [client 208.84.100.74:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "samdothan.org"] [uri "/index.php"] [unique_id "alxe2wWL-zKlchkVWS1IRQAAAAs"]
[Sat Jul 18 23:21:33.139073 2026] [security2:error] [pid 881201:tid 881453] [client 208.84.100.74:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "samdothan.org"] [uri "/index.php"] [unique_id "alxe2wWL-zKlchkVWS1IRgAAAHk"]
[Sat Jul 18 23:21:33.147219 2026] [security2:error] [pid 881201:tid 881335] [client 208.84.100.74:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "samdothan.org"] [uri "/index.php"] [unique_id "alxe2wWL-zKlchkVWS1IUwAAAAM"]
[Sat Jul 18 23:21:33.183253 2026] [security2:error] [pid 881201:tid 881397] [client 208.84.100.74:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "samdothan.org"] [uri "/index.php"] [unique_id "alxe2wWL-zKlchkVWS1IWAAAAEE"]
[Sat Jul 18 23:21:33.198891 2026] [security2:error] [pid 881201:tid 881423] [client 20.220.9.199:10756] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/k2.php"] [unique_id "alxe3QWL-zKlchkVWS1IugAAAFs"]
[Sat Jul 18 23:21:33.199053 2026] [security2:error] [pid 881201:tid 881423] [client 20.220.9.199:10756] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/k2.php"] [unique_id "alxe3QWL-zKlchkVWS1IugAAAFs"]
[Sat Jul 18 23:21:33.485359 2026] [security2:error] [pid 882519:tid 882711] [client 20.220.9.199:15223] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/w.php"] [unique_id "alxe3aL84xJUTmx6eO6bEwAAAMM"]
[Sat Jul 18 23:21:33.485469 2026] [security2:error] [pid 882519:tid 882711] [client 20.220.9.199:15223] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/w.php"] [unique_id "alxe3aL84xJUTmx6eO6bEwAAAMM"]
[Sat Jul 18 23:21:33.545449 2026] [security2:error] [pid 881201:tid 881403] [client 208.84.100.74:38552] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.100.84.208.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-content/plugins/pagelayer/js/givejs.php"] [unique_id "alxe3QWL-zKlchkVWS1I0wAAAEc"]
[Sat Jul 18 23:21:33.545594 2026] [security2:error] [pid 881201:tid 881386] [client 208.84.100.74:38636] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.100.84.208.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-content/plugins/pagelayer/js/givejs.php"] [unique_id "alxe3QWL-zKlchkVWS1IyQAAADY"]
[Sat Jul 18 23:21:33.545612 2026] [security2:error] [pid 881201:tid 881343] [client 208.84.100.74:38604] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.100.84.208.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-content/plugins/pagelayer/js/givejs.php"] [unique_id "alxe3QWL-zKlchkVWS1IzgAAAAs"]
[Sat Jul 18 23:21:33.546151 2026] [security2:error] [pid 881201:tid 881382] [client 208.84.100.74:38518] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.100.84.208.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-content/plugins/pagelayer/js/givejs.php"] [unique_id "alxe3QWL-zKlchkVWS1I2AAAADI"]
[Sat Jul 18 23:21:33.569072 2026] [security2:error] [pid 882519:tid 882702] [client 190.245.146.99:62061] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxe3aL84xJUTmx6eO6bFwAAALo"]
[Sat Jul 18 23:21:33.569208 2026] [security2:error] [pid 882519:tid 882702] [client 190.245.146.99:62061] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxe3aL84xJUTmx6eO6bFwAAALo"]
[Sat Jul 18 23:21:33.588223 2026] [security2:error] [pid 881201:tid 881333] [client 208.84.100.74:38430] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.100.84.208.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-content/plugins/pagelayer/js/givejs.php"] [unique_id "alxe3QWL-zKlchkVWS1I3gAAAAE"]
[Sat Jul 18 23:21:33.588326 2026] [security2:error] [pid 881201:tid 881373] [client 208.84.100.74:38594] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.100.84.208.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-content/plugins/pagelayer/js/givejs.php"] [unique_id "alxe3QWL-zKlchkVWS1I4QAAACk"]
[Sat Jul 18 23:21:33.588424 2026] [security2:error] [pid 881201:tid 881358] [client 208.84.100.74:38622] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.100.84.208.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-content/plugins/pagelayer/js/givejs.php"] [unique_id "alxe3QWL-zKlchkVWS1I6AAAABo"]
[Sat Jul 18 23:21:33.646107 2026] [security2:error] [pid 881201:tid 881415] [client 208.84.100.74:38426] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.100.84.208.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-content/plugins/pagelayer/js/givejs.php"] [unique_id "alxe3QWL-zKlchkVWS1I8wAAAFM"]
[Sat Jul 18 23:21:33.725661 2026] [security2:error] [pid 881201:tid 881367] [client 20.220.9.199:23046] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/fpwch.php"] [unique_id "alxe3QWL-zKlchkVWS1JEQAAACM"]
[Sat Jul 18 23:21:33.725833 2026] [security2:error] [pid 881201:tid 881367] [client 20.220.9.199:23046] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/fpwch.php"] [unique_id "alxe3QWL-zKlchkVWS1JEQAAACM"]
[Sat Jul 18 23:21:34.009012 2026] [security2:error] [pid 881201:tid 881355] [client 20.220.9.199:23043] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/w2025.php"] [unique_id "alxe3gWL-zKlchkVWS1JKQAAABc"]
[Sat Jul 18 23:21:34.009136 2026] [security2:error] [pid 881201:tid 881355] [client 20.220.9.199:23043] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/w2025.php"] [unique_id "alxe3gWL-zKlchkVWS1JKQAAABc"]
[Sat Jul 18 23:21:34.016299 2026] [security2:error] [pid 882519:tid 882705] [client 27.34.68.67:8537] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxe3qL84xJUTmx6eO6bKgAAAL0"]
[Sat Jul 18 23:21:34.016401 2026] [security2:error] [pid 882519:tid 882705] [client 27.34.68.67:8537] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxe3qL84xJUTmx6eO6bKgAAAL0"]
[Sat Jul 18 23:21:34.206949 2026] [security2:error] [pid 881201:tid 881391] [client 18.136.194.202:52054] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 202.194.136.18.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxe3gWL-zKlchkVWS1JMQAAADs"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:21:34.310313 2026] [security2:error] [pid 881201:tid 881388] [client 20.220.9.199:17883] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/scxy.php"] [unique_id "alxe3gWL-zKlchkVWS1JNgAAADg"]
[Sat Jul 18 23:21:34.310389 2026] [security2:error] [pid 881201:tid 881388] [client 20.220.9.199:17883] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/scxy.php"] [unique_id "alxe3gWL-zKlchkVWS1JNgAAADg"]
[Sat Jul 18 23:21:34.471701 2026] [security2:error] [pid 881201:tid 881410] [client 20.220.9.199:15231] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/FWAZ.php"] [unique_id "alxe3gWL-zKlchkVWS1JPAAAAE4"]
[Sat Jul 18 23:21:34.471805 2026] [security2:error] [pid 881201:tid 881410] [client 20.220.9.199:15231] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/FWAZ.php"] [unique_id "alxe3gWL-zKlchkVWS1JPAAAAE4"]
[Sat Jul 18 23:21:34.620597 2026] [security2:error] [pid 882519:tid 882776] [client 20.220.9.199:52516] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/qterm.php"] [unique_id "alxe3qL84xJUTmx6eO6bPAAAAQQ"]
[Sat Jul 18 23:21:34.620724 2026] [security2:error] [pid 882519:tid 882776] [client 20.220.9.199:52516] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/qterm.php"] [unique_id "alxe3qL84xJUTmx6eO6bPAAAAQQ"]
[Sat Jul 18 23:21:34.758190 2026] [security2:error] [pid 881201:tid 881360] [client 20.220.9.199:33235] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/blurbs.php"] [unique_id "alxe3gWL-zKlchkVWS1JUQAAABw"]
[Sat Jul 18 23:21:34.758295 2026] [security2:error] [pid 881201:tid 881360] [client 20.220.9.199:33235] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/blurbs.php"] [unique_id "alxe3gWL-zKlchkVWS1JUQAAABw"]
[Sat Jul 18 23:21:35.009072 2026] [security2:error] [pid 882519:tid 882678] [client 20.220.9.199:15196] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/v543.php"] [unique_id "alxe36L84xJUTmx6eO6bRwAAAKI"]
[Sat Jul 18 23:21:35.009184 2026] [security2:error] [pid 882519:tid 882678] [client 20.220.9.199:15196] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/v543.php"] [unique_id "alxe36L84xJUTmx6eO6bRwAAAKI"]
[Sat Jul 18 23:21:35.152245 2026] [security2:error] [pid 881201:tid 881379] [client 20.220.9.199:10767] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/w3lls.php"] [unique_id "alxe3wWL-zKlchkVWS1JYQAAAC8"]
[Sat Jul 18 23:21:35.152359 2026] [security2:error] [pid 881201:tid 881379] [client 20.220.9.199:10767] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/w3lls.php"] [unique_id "alxe3wWL-zKlchkVWS1JYQAAAC8"]
[Sat Jul 18 23:21:35.218627 2026] [security2:error] [pid 882519:tid 882657] [client 171.4.232.110:57933] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxe36L84xJUTmx6eO6bUgAAAI0"]
[Sat Jul 18 23:21:35.218737 2026] [security2:error] [pid 882519:tid 882657] [client 171.4.232.110:57933] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxe36L84xJUTmx6eO6bUgAAAI0"]
[Sat Jul 18 23:21:35.231905 2026] [security2:error] [pid 881201:tid 881302] [remote 8.217.108.67:38650] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "dienerranch.com"] [uri "/wp-login.php"] [unique_id "alxe3wWL-zKlchkVWS1JZQAADGM"], referer: https://dienerranch.com/wp-login.php
[Sat Jul 18 23:21:35.290946 2026] [security2:error] [pid 882519:tid 882702] [client 20.220.9.199:17919] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp-ws68.php"] [unique_id "alxe36L84xJUTmx6eO6bVwAAALo"]
[Sat Jul 18 23:21:35.291046 2026] [security2:error] [pid 882519:tid 882702] [client 20.220.9.199:17919] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp-ws68.php"] [unique_id "alxe36L84xJUTmx6eO6bVwAAALo"]
[Sat Jul 18 23:21:35.296483 2026] [security2:error] [pid 882519:tid 882533] [remote 31.42.184.154:42642] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "terrapro.marketing"] [uri "/wp-login.php"] [unique_id "alxe36L84xJUTmx6eO6bWAAApg0"]
[Sat Jul 18 23:21:35.373909 2026] [security2:error] [pid 882519:tid 882658] [client 223.185.61.63:18223] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxe36L84xJUTmx6eO6bXAAAAI4"]
[Sat Jul 18 23:21:35.374014 2026] [security2:error] [pid 882519:tid 882658] [client 223.185.61.63:18223] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxe36L84xJUTmx6eO6bXAAAAI4"]
[Sat Jul 18 23:21:35.465394 2026] [security2:error] [pid 881201:tid 881419] [client 20.220.9.199:15224] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/xyn.php"] [unique_id "alxe3wWL-zKlchkVWS1JbgAAAFc"]
[Sat Jul 18 23:21:35.465489 2026] [security2:error] [pid 881201:tid 881419] [client 20.220.9.199:15224] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/xyn.php"] [unique_id "alxe3wWL-zKlchkVWS1JbgAAAFc"]
[Sat Jul 18 23:21:35.531253 2026] [security2:error] [pid 882519:tid 882536] [remote 31.42.184.154:42642] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "terrapro.marketing"] [uri "/wp-login.php"] [unique_id "alxe36L84xJUTmx6eO6baAAA7RA"], referer: https://terrapro.marketing/wp-login.php
[Sat Jul 18 23:21:35.607154 2026] [security2:error] [pid 882519:tid 882770] [client 20.220.9.199:33249] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/green3.php"] [unique_id "alxe36L84xJUTmx6eO6baQAAAP4"]
[Sat Jul 18 23:21:35.607256 2026] [security2:error] [pid 882519:tid 882770] [client 20.220.9.199:33249] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/green3.php"] [unique_id "alxe36L84xJUTmx6eO6baQAAAP4"]
[Sat Jul 18 23:21:35.763449 2026] [security2:error] [pid 881201:tid 881436] [client 20.220.9.199:23093] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/ccc.php"] [unique_id "alxe3wWL-zKlchkVWS1JegAAAGg"]
[Sat Jul 18 23:21:35.763540 2026] [security2:error] [pid 881201:tid 881436] [client 20.220.9.199:23093] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/ccc.php"] [unique_id "alxe3wWL-zKlchkVWS1JegAAAGg"]
[Sat Jul 18 23:21:35.976360 2026] [security2:error] [pid 881201:tid 881418] [client 20.220.9.199:23055] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/get.php"] [unique_id "alxe3wWL-zKlchkVWS1JiwAAAFY"]
[Sat Jul 18 23:21:35.976459 2026] [security2:error] [pid 881201:tid 881418] [client 20.220.9.199:23055] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/get.php"] [unique_id "alxe3wWL-zKlchkVWS1JiwAAAFY"]
[Sat Jul 18 23:21:36.031108 2026] [security2:error] [pid 882519:tid 882714] [client 47.128.16.2:54288] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.oswegooperatheater.com"] [uri "/robots.txt"] [unique_id "alxe4KL84xJUTmx6eO6begAAAMY"]
[Sat Jul 18 23:21:36.266122 2026] [security2:error] [pid 881201:tid 881374] [client 20.220.9.199:52538] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/images.php"] [unique_id "alxe4AWL-zKlchkVWS1JlgAAACo"]
[Sat Jul 18 23:21:36.266283 2026] [security2:error] [pid 881201:tid 881374] [client 20.220.9.199:52538] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/images.php"] [unique_id "alxe4AWL-zKlchkVWS1JlgAAACo"]
[Sat Jul 18 23:21:36.435903 2026] [security2:error] [pid 882519:tid 882760] [client 20.220.9.199:23047] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/alls.php"] [unique_id "alxe4KL84xJUTmx6eO6bhwAAAPQ"]
[Sat Jul 18 23:21:36.436023 2026] [security2:error] [pid 882519:tid 882760] [client 20.220.9.199:23047] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/alls.php"] [unique_id "alxe4KL84xJUTmx6eO6bhwAAAPQ"]
[Sat Jul 18 23:21:36.515082 2026] [security2:error] [pid 882519:tid 882728] [client 74.208.214.194:37530] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxe4KL84xJUTmx6eO6bjQAAANQ"]
[Sat Jul 18 23:21:36.612622 2026] [security2:error] [pid 881201:tid 881354] [client 20.220.9.199:15197] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/coffexium.php"] [unique_id "alxe4AWL-zKlchkVWS1JowAAABY"]
[Sat Jul 18 23:21:36.612744 2026] [security2:error] [pid 881201:tid 881354] [client 20.220.9.199:15197] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/coffexium.php"] [unique_id "alxe4AWL-zKlchkVWS1JowAAABY"]
[Sat Jul 18 23:21:36.782270 2026] [security2:error] [pid 882519:tid 882712] [client 20.220.9.199:17897] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/red.php"] [unique_id "alxe4KL84xJUTmx6eO6blgAAAMQ"]
[Sat Jul 18 23:21:36.782393 2026] [security2:error] [pid 882519:tid 882712] [client 20.220.9.199:17897] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/red.php"] [unique_id "alxe4KL84xJUTmx6eO6blgAAAMQ"]
[Sat Jul 18 23:21:36.880087 2026] [security2:error] [pid 881201:tid 881335] [client 208.84.100.74:38690] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.100.84.208.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-content/plugins/pagelayer/js/givejs.php"] [unique_id "alxe4AWL-zKlchkVWS1JsQAAAAM"]
[Sat Jul 18 23:21:36.920579 2026] [proxy:error] [pid 881201:tid 881408] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:36.920650 2026] [proxy_http:error] [pid 881201:tid 881408] [client 20.220.9.199:17867] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:36.921077 2026] [proxy:error] [pid 881201:tid 881408] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:36.921100 2026] [proxy_http:error] [pid 881201:tid 881408] [client 20.220.9.199:17867] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:36.921186 2026] [security2:error] [pid 881201:tid 881408] [client 20.220.9.199:17867] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxe4AWL-zKlchkVWS1JtQAAAEw"]
[Sat Jul 18 23:21:36.965697 2026] [security2:error] [pid 881201:tid 881419] [client 116.179.33.138:64414] ModSecurity: Access denied with code 406 (phase 2). Match of "beginsWith %{request_headers.host}" against "TX:1" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "504"] [id "340162"] [rev "302"] [msg "Atomicorp.com WAF Rules: Remote File Injection Attack detected (Unauthorized URL detected as argument)"] [data ",TX:1"] [severity "CRITICAL"] [hostname "www.mollycahill.com"] [uri "/"] [unique_id "alxe4AWL-zKlchkVWS1JuAAAAFc"]
[Sat Jul 18 23:21:37.018389 2026] [security2:error] [pid 881201:tid 881338] [client 208.84.100.74:38500] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.100.84.208.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-content/plugins/pagelayer/js/givejs.php"] [unique_id "alxe4QWL-zKlchkVWS1JuwAAAAY"]
[Sat Jul 18 23:21:37.018421 2026] [security2:error] [pid 882519:tid 882764] [client 208.84.100.74:38670] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.100.84.208.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-content/plugins/pagelayer/js/givejs.php"] [unique_id "alxe4aL84xJUTmx6eO6bnwAAAPg"]
[Sat Jul 18 23:21:37.018493 2026] [security2:error] [pid 881201:tid 881368] [client 208.84.100.74:38486] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.100.84.208.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-content/plugins/pagelayer/js/givejs.php"] [unique_id "alxe4QWL-zKlchkVWS1JvQAAACQ"]
[Sat Jul 18 23:21:37.102959 2026] [security2:error] [pid 881201:tid 881401] [client 208.84.100.74:38656] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.100.84.208.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-content/plugins/pagelayer/js/givejs.php"] [unique_id "alxe4QWL-zKlchkVWS1J0AAAAEU"]
[Sat Jul 18 23:21:37.103056 2026] [security2:error] [pid 881201:tid 881416] [client 208.84.100.74:38700] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.100.84.208.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-content/plugins/pagelayer/js/givejs.php"] [unique_id "alxe4QWL-zKlchkVWS1JzQAAAFQ"]
[Sat Jul 18 23:21:37.103299 2026] [security2:error] [pid 881201:tid 881352] [client 208.84.100.74:38566] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.100.84.208.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-content/plugins/pagelayer/js/givejs.php"] [unique_id "alxe4QWL-zKlchkVWS1J1AAAABQ"]
[Sat Jul 18 23:21:37.103354 2026] [security2:error] [pid 881201:tid 881457] [client 208.84.100.74:38470] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.100.84.208.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-content/plugins/pagelayer/js/givejs.php"] [unique_id "alxe4QWL-zKlchkVWS1J0wAAAH0"]
[Sat Jul 18 23:21:37.107199 2026] [security2:error] [pid 881201:tid 881350] [client 20.220.9.199:17872] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp-admin/css/colors/coffee/wp-adochan.php"] [unique_id "alxe4QWL-zKlchkVWS1J1wAAABI"]
[Sat Jul 18 23:21:37.107260 2026] [security2:error] [pid 881201:tid 881350] [client 20.220.9.199:17872] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp-admin/css/colors/coffee/wp-adochan.php"] [unique_id "alxe4QWL-zKlchkVWS1J1wAAABI"]
[Sat Jul 18 23:21:37.155590 2026] [security2:error] [pid 882519:tid 882686] [client 208.84.100.74:38696] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.100.84.208.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-content/plugins/pagelayer/js/givejs.php"] [unique_id "alxe4aL84xJUTmx6eO6bqQAAAKo"]
[Sat Jul 18 23:21:37.155736 2026] [security2:error] [pid 881201:tid 881344] [client 208.84.100.74:38514] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.100.84.208.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-content/plugins/pagelayer/js/givejs.php"] [unique_id "alxe4QWL-zKlchkVWS1J4gAAAAw"]
[Sat Jul 18 23:21:37.218001 2026] [security2:error] [pid 881201:tid 881456] [client 208.84.100.74:38444] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.100.84.208.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-content/plugins/pagelayer/js/givejs.php"] [unique_id "alxe4QWL-zKlchkVWS1J7AAAAHw"]
[Sat Jul 18 23:21:37.238358 2026] [security2:error] [pid 881201:tid 881363] [client 208.84.100.74:38578] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.100.84.208.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-content/plugins/pagelayer/js/givejs.php"] [unique_id "alxe4QWL-zKlchkVWS1J9QAAAB8"]
[Sat Jul 18 23:21:37.255485 2026] [security2:error] [pid 882519:tid 882695] [client 208.84.100.74:38684] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.100.84.208.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-content/plugins/pagelayer/js/givejs.php"] [unique_id "alxe4aL84xJUTmx6eO6bswAAALM"]
[Sat Jul 18 23:21:37.261069 2026] [security2:error] [pid 881201:tid 881389] [client 208.84.100.74:38742] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.100.84.208.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-content/plugins/pagelayer/js/givejs.php"] [unique_id "alxe4QWL-zKlchkVWS1J_AAAADk"]
[Sat Jul 18 23:21:37.261081 2026] [security2:error] [pid 881201:tid 881405] [client 208.84.100.74:38776] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.100.84.208.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-content/plugins/pagelayer/js/givejs.php"] [unique_id "alxe4QWL-zKlchkVWS1J_QAAAEk"]
[Sat Jul 18 23:21:37.469224 2026] [proxy:error] [pid 881201:tid 881421] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:37.469321 2026] [proxy_http:error] [pid 881201:tid 881421] [client 20.220.9.199:17917] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:37.470668 2026] [proxy:error] [pid 881201:tid 881421] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:37.470738 2026] [proxy_http:error] [pid 881201:tid 881421] [client 20.220.9.199:17917] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:37.470891 2026] [security2:error] [pid 881201:tid 881421] [client 20.220.9.199:17917] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxe4QWL-zKlchkVWS1KBQAAAFk"]
[Sat Jul 18 23:21:37.580854 2026] [security2:error] [pid 882519:tid 882747] [client 103.48.44.9:58571] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxe4aL84xJUTmx6eO6bwAAAAOc"]
[Sat Jul 18 23:21:37.580949 2026] [security2:error] [pid 882519:tid 882747] [client 103.48.44.9:58571] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxe4aL84xJUTmx6eO6bwAAAAOc"]
[Sat Jul 18 23:21:37.715838 2026] [security2:error] [pid 882519:tid 882551] [remote 20.153.140.50:34422] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "rpv.ekr.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxe4aL84xJUTmx6eO6byAAA6x8"]
[Sat Jul 18 23:21:37.762880 2026] [security2:error] [pid 882519:tid 882665] [client 223.228.182.224:34380] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxe4aL84xJUTmx6eO6bzAAAAJU"]
[Sat Jul 18 23:21:37.768872 2026] [security2:error] [pid 882519:tid 882743] [client 20.220.9.199:52535] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/footer.php"] [unique_id "alxe4aL84xJUTmx6eO6bzQAAAOM"]
[Sat Jul 18 23:21:37.768979 2026] [security2:error] [pid 882519:tid 882743] [client 20.220.9.199:52535] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/footer.php"] [unique_id "alxe4aL84xJUTmx6eO6bzQAAAOM"]
[Sat Jul 18 23:21:37.855820 2026] [security2:error] [pid 882519:tid 882668] [client 119.154.81.234:63070] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxe4aL84xJUTmx6eO6b1AAAAJg"]
[Sat Jul 18 23:21:37.856089 2026] [security2:error] [pid 882519:tid 882668] [client 119.154.81.234:63070] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxe4aL84xJUTmx6eO6b1AAAAJg"]
[Sat Jul 18 23:21:37.927962 2026] [proxy:error] [pid 881201:tid 881449] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:37.928041 2026] [proxy_http:error] [pid 881201:tid 881449] [client 20.220.9.199:33263] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:37.928610 2026] [proxy:error] [pid 881201:tid 881449] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:37.928638 2026] [proxy_http:error] [pid 881201:tid 881449] [client 20.220.9.199:33263] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:37.928728 2026] [security2:error] [pid 881201:tid 881449] [client 20.220.9.199:33263] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxe4QWL-zKlchkVWS1KFAAAAHU"]
[Sat Jul 18 23:21:38.113925 2026] [security2:error] [pid 882519:tid 882555] [remote 20.153.140.50:34422] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "rpv.ekr.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxe4qL84xJUTmx6eO6b3QAA-CM"], referer: https://rpv.ekr.mybluehost.me/wp-login.php
[Sat Jul 18 23:21:38.126596 2026] [security2:error] [pid 881201:tid 881381] [client 20.220.9.199:33255] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp-content/index.php"] [unique_id "alxe4gWL-zKlchkVWS1KHgAAADE"]
[Sat Jul 18 23:21:38.126701 2026] [security2:error] [pid 881201:tid 881381] [client 20.220.9.199:33255] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp-content/index.php"] [unique_id "alxe4gWL-zKlchkVWS1KHgAAADE"]
[Sat Jul 18 23:21:38.270008 2026] [security2:error] [pid 882519:tid 882685] [client 20.220.9.199:23082] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/admin.php"] [unique_id "alxe4qL84xJUTmx6eO6b4AAAAKk"]
[Sat Jul 18 23:21:38.270120 2026] [security2:error] [pid 882519:tid 882685] [client 20.220.9.199:23082] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/admin.php"] [unique_id "alxe4qL84xJUTmx6eO6b4AAAAKk"]
[Sat Jul 18 23:21:38.400824 2026] [security2:error] [pid 881201:tid 881346] [client 20.220.9.199:23103] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/177.php"] [unique_id "alxe4gWL-zKlchkVWS1KKQAAAA4"]
[Sat Jul 18 23:21:38.400907 2026] [security2:error] [pid 881201:tid 881346] [client 20.220.9.199:23103] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/177.php"] [unique_id "alxe4gWL-zKlchkVWS1KKQAAAA4"]
[Sat Jul 18 23:21:38.418275 2026] [security2:error] [pid 881201:tid 881225] [remote 72.167.132.114:56600] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxe4gWL-zKlchkVWS1KKgAAThY"]
[Sat Jul 18 23:21:38.452614 2026] [security2:error] [pid 882519:tid 882682] [client 40.77.167.40:40754] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "innspace.ca"] [uri "/index.php"] [unique_id "alxe4KL84xJUTmx6eO6biQAAphU"]
[Sat Jul 18 23:21:38.546796 2026] [security2:error] [pid 882519:tid 882679] [client 20.220.9.199:52492] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/199.php"] [unique_id "alxe4qL84xJUTmx6eO6b7QAAAKM"]
[Sat Jul 18 23:21:38.546887 2026] [security2:error] [pid 882519:tid 882679] [client 20.220.9.199:52492] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/199.php"] [unique_id "alxe4qL84xJUTmx6eO6b7QAAAKM"]
[Sat Jul 18 23:21:38.691608 2026] [security2:error] [pid 881201:tid 881258] [remote 113.160.142.119:50216] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "str.cly.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxe4gWL-zKlchkVWS1KOAAAIDc"]
[Sat Jul 18 23:21:38.716972 2026] [security2:error] [pid 881201:tid 881414] [client 20.220.9.199:17900] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/file52.php"] [unique_id "alxe4gWL-zKlchkVWS1KPgAAAFI"]
[Sat Jul 18 23:21:38.717070 2026] [security2:error] [pid 881201:tid 881414] [client 20.220.9.199:17900] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/file52.php"] [unique_id "alxe4gWL-zKlchkVWS1KPgAAAFI"]
[Sat Jul 18 23:21:38.717428 2026] [security2:error] [pid 881201:tid 881238] [remote 72.167.132.114:56600] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxe4gWL-zKlchkVWS1KOgAAASM"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:21:38.799924 2026] [security2:error] [pid 882519:tid 882665] [client 223.228.182.224:34380] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxe4aL84xJUTmx6eO6bzAAAAJU"]
[Sat Jul 18 23:21:38.922144 2026] [security2:error] [pid 881201:tid 881358] [client 20.220.9.199:10777] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/geck.php"] [unique_id "alxe4gWL-zKlchkVWS1KVgAAABo"]
[Sat Jul 18 23:21:38.922287 2026] [security2:error] [pid 881201:tid 881358] [client 20.220.9.199:10777] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/geck.php"] [unique_id "alxe4gWL-zKlchkVWS1KVgAAABo"]
[Sat Jul 18 23:21:39.065260 2026] [security2:error] [pid 882519:tid 882723] [client 20.220.9.199:15216] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/biufile.php"] [unique_id "alxe46L84xJUTmx6eO6b_wAAAM8"]
[Sat Jul 18 23:21:39.065397 2026] [security2:error] [pid 882519:tid 882723] [client 20.220.9.199:15216] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/biufile.php"] [unique_id "alxe46L84xJUTmx6eO6b_wAAAM8"]
[Sat Jul 18 23:21:39.151067 2026] [security2:error] [pid 881201:tid 881365] [client 124.29.246.106:51361] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxe4wWL-zKlchkVWS1KYwAAACE"]
[Sat Jul 18 23:21:39.151190 2026] [security2:error] [pid 881201:tid 881365] [client 124.29.246.106:51361] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxe4wWL-zKlchkVWS1KYwAAACE"]
[Sat Jul 18 23:21:39.210158 2026] [security2:error] [pid 881201:tid 881223] [remote 113.160.142.119:50216] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "str.cly.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxe4wWL-zKlchkVWS1KZAAAERQ"], referer: https://str.cly.mybluehost.me/wp-login.php
[Sat Jul 18 23:21:39.282341 2026] [security2:error] [pid 881201:tid 881236] [remote 194.164.192.228:59518] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 228.192.164.194.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxe4wWL-zKlchkVWS1KZwAAJSE"]
[Sat Jul 18 23:21:39.282542 2026] [security2:error] [pid 881201:tid 881369] [client 194.164.192.228:59518] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxe4wWL-zKlchkVWS1KZwAAJSE"]
[Sat Jul 18 23:21:39.313683 2026] [security2:error] [pid 882519:tid 882729] [client 20.220.9.199:52512] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/mosty.php"] [unique_id "alxe46L84xJUTmx6eO6cAwAAANU"]
[Sat Jul 18 23:21:39.313822 2026] [security2:error] [pid 882519:tid 882729] [client 20.220.9.199:52512] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/mosty.php"] [unique_id "alxe46L84xJUTmx6eO6cAwAAANU"]
[Sat Jul 18 23:21:39.446872 2026] [security2:error] [pid 882519:tid 882658] [client 20.220.9.199:23085] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/dejavu.php"] [unique_id "alxe46L84xJUTmx6eO6cDgAAAI4"]
[Sat Jul 18 23:21:39.447009 2026] [security2:error] [pid 882519:tid 882658] [client 20.220.9.199:23085] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/dejavu.php"] [unique_id "alxe46L84xJUTmx6eO6cDgAAAI4"]
[Sat Jul 18 23:21:39.458661 2026] [security2:error] [pid 882519:tid 882762] [client 40.77.167.40:40754] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "innspace.ca"] [uri "/index.php"] [unique_id "alxe46L84xJUTmx6eO6b_QAA9io"]
[Sat Jul 18 23:21:39.580402 2026] [security2:error] [pid 882519:tid 882667] [client 20.220.9.199:17900] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/aaf.php"] [unique_id "alxe46L84xJUTmx6eO6cEgAAAJc"]
[Sat Jul 18 23:21:39.580529 2026] [security2:error] [pid 882519:tid 882667] [client 20.220.9.199:17900] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/aaf.php"] [unique_id "alxe46L84xJUTmx6eO6cEgAAAJc"]
[Sat Jul 18 23:21:39.750533 2026] [security2:error] [pid 882519:tid 882659] [client 20.220.9.199:17856] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/ha.php"] [unique_id "alxe46L84xJUTmx6eO6cFwAAAI8"]
[Sat Jul 18 23:21:39.750639 2026] [security2:error] [pid 882519:tid 882659] [client 20.220.9.199:17856] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/ha.php"] [unique_id "alxe46L84xJUTmx6eO6cFwAAAI8"]
[Sat Jul 18 23:21:39.880000 2026] [security2:error] [pid 881201:tid 881425] [client 57.141.18.104:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxe4wWL-zKlchkVWS1KdgAAAF0"]
[Sat Jul 18 23:21:40.044191 2026] [security2:error] [pid 882519:tid 882760] [client 20.220.9.199:15173] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/hur.php"] [unique_id "alxe5KL84xJUTmx6eO6cJAAAAPQ"]
[Sat Jul 18 23:21:40.044283 2026] [security2:error] [pid 882519:tid 882760] [client 20.220.9.199:15173] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/hur.php"] [unique_id "alxe5KL84xJUTmx6eO6cJAAAAPQ"]
[Sat Jul 18 23:21:40.197308 2026] [security2:error] [pid 882519:tid 882720] [client 20.220.9.199:13469] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/h02ugyh.php"] [unique_id "alxe5KL84xJUTmx6eO6cMQAAAMw"]
[Sat Jul 18 23:21:40.197383 2026] [security2:error] [pid 882519:tid 882720] [client 20.220.9.199:13469] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/h02ugyh.php"] [unique_id "alxe5KL84xJUTmx6eO6cMQAAAMw"]
[Sat Jul 18 23:21:40.243364 2026] [security2:error] [pid 882519:tid 882573] [remote 188.138.102.156:39208] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxe5KL84xJUTmx6eO6cMgAA5zU"]
[Sat Jul 18 23:21:40.284468 2026] [security2:error] [pid 881201:tid 881442] [client 47.128.23.188:22974] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.myspineworld.com"] [uri "/robots.txt"] [unique_id "alxe5AWL-zKlchkVWS1KigAAAG4"]
[Sat Jul 18 23:21:40.335374 2026] [security2:error] [pid 881201:tid 881344] [client 20.220.9.199:17882] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/155.php"] [unique_id "alxe5AWL-zKlchkVWS1KjAAAAAw"]
[Sat Jul 18 23:21:40.335498 2026] [security2:error] [pid 881201:tid 881344] [client 20.220.9.199:17882] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/155.php"] [unique_id "alxe5AWL-zKlchkVWS1KjAAAAAw"]
[Sat Jul 18 23:21:40.446669 2026] [security2:error] [pid 882519:tid 882575] [remote 188.138.102.156:39208] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxe5KL84xJUTmx6eO6cNQAA9Tc"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:21:40.482841 2026] [security2:error] [pid 881201:tid 881369] [client 20.220.9.199:59349] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/pp.php"] [unique_id "alxe5AWL-zKlchkVWS1KlgAAACU"]
[Sat Jul 18 23:21:40.482941 2026] [security2:error] [pid 881201:tid 881369] [client 20.220.9.199:59349] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/pp.php"] [unique_id "alxe5AWL-zKlchkVWS1KlgAAACU"]
[Sat Jul 18 23:21:40.592241 2026] [security2:error] [pid 881201:tid 881354] [client 65.0.26.70:26970] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.26.0.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxe5AWL-zKlchkVWS1KmwAAABY"]
[Sat Jul 18 23:21:40.631966 2026] [security2:error] [pid 882519:tid 882658] [client 20.220.9.199:17857] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/ops.php"] [unique_id "alxe5KL84xJUTmx6eO6cPgAAAI4"]
[Sat Jul 18 23:21:40.632063 2026] [security2:error] [pid 882519:tid 882658] [client 20.220.9.199:17857] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/ops.php"] [unique_id "alxe5KL84xJUTmx6eO6cPgAAAI4"]
[Sat Jul 18 23:21:40.807617 2026] [security2:error] [pid 881201:tid 881453] [client 20.220.9.199:15221] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/ingfo.php"] [unique_id "alxe5AWL-zKlchkVWS1KoAAAAHk"]
[Sat Jul 18 23:21:40.807716 2026] [security2:error] [pid 881201:tid 881453] [client 20.220.9.199:15221] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/ingfo.php"] [unique_id "alxe5AWL-zKlchkVWS1KoAAAAHk"]
[Sat Jul 18 23:21:40.840600 2026] [security2:error] [pid 881201:tid 881206] [remote 157.66.47.83:42528] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nwcarvingacademy.com"] [uri "/wp-login.php"] [unique_id "alxe5AWL-zKlchkVWS1KoQAAewM"]
[Sat Jul 18 23:21:40.949190 2026] [security2:error] [pid 881201:tid 881360] [client 20.220.9.199:15208] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/error_log.php"] [unique_id "alxe5AWL-zKlchkVWS1KpgAAABw"]
[Sat Jul 18 23:21:40.949271 2026] [security2:error] [pid 881201:tid 881360] [client 20.220.9.199:15208] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/error_log.php"] [unique_id "alxe5AWL-zKlchkVWS1KpgAAABw"]
[Sat Jul 18 23:21:41.048380 2026] [security2:error] [pid 881201:tid 881323] [remote 41.76.213.235:39664] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.idf.ldc.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxe5QWL-zKlchkVWS1KrAAADng"]
[Sat Jul 18 23:21:41.116243 2026] [security2:error] [pid 881201:tid 881368] [client 20.220.9.199:33229] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/test10.php"] [unique_id "alxe5QWL-zKlchkVWS1KrwAAACQ"]
[Sat Jul 18 23:21:41.116341 2026] [security2:error] [pid 881201:tid 881368] [client 20.220.9.199:33229] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/test10.php"] [unique_id "alxe5QWL-zKlchkVWS1KrwAAACQ"]
[Sat Jul 18 23:21:41.270331 2026] [security2:error] [pid 882519:tid 882696] [client 20.220.9.199:33242] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/koala.php"] [unique_id "alxe5aL84xJUTmx6eO6cTQAAALQ"]
[Sat Jul 18 23:21:41.270424 2026] [security2:error] [pid 882519:tid 882696] [client 20.220.9.199:33242] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/koala.php"] [unique_id "alxe5aL84xJUTmx6eO6cTQAAALQ"]
[Sat Jul 18 23:21:41.278465 2026] [security2:error] [pid 882519:tid 882583] [remote 97.74.93.24:60644] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxe5aL84xJUTmx6eO6cTgAA_D8"]
[Sat Jul 18 23:21:41.414354 2026] [security2:error] [pid 882519:tid 882679] [client 20.220.9.199:15219] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/mac.php"] [unique_id "alxe5aL84xJUTmx6eO6cUwAAAKM"]
[Sat Jul 18 23:21:41.414443 2026] [security2:error] [pid 882519:tid 882679] [client 20.220.9.199:15219] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/mac.php"] [unique_id "alxe5aL84xJUTmx6eO6cUwAAAKM"]
[Sat Jul 18 23:21:41.547220 2026] [security2:error] [pid 881201:tid 881312] [remote 41.76.213.235:39664] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.idf.ldc.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxe5QWL-zKlchkVWS1KvwAAR20"], referer: https://mail.idf.ldc.mybluehost.me/wp-login.php
[Sat Jul 18 23:21:41.565452 2026] [security2:error] [pid 881201:tid 881212] [remote 103.152.165.165:9528] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.165.152.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tbd.jxc.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxe5QWL-zKlchkVWS1KwAAANQk"]
[Sat Jul 18 23:21:41.566274 2026] [security2:error] [pid 882519:tid 882741] [client 20.220.9.199:10764] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wefile.php"] [unique_id "alxe5aL84xJUTmx6eO6cVgAAAOE"]
[Sat Jul 18 23:21:41.566376 2026] [security2:error] [pid 882519:tid 882741] [client 20.220.9.199:10764] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wefile.php"] [unique_id "alxe5aL84xJUTmx6eO6cVgAAAOE"]
[Sat Jul 18 23:21:41.572154 2026] [security2:error] [pid 881201:tid 881391] [client 116.179.37.70:37978] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.adultdaycarereno.com"] [uri "/index.php"] [unique_id "alxe5QWL-zKlchkVWS1KvQAAADs"], referer: https://www.adultdaycarereno.com/wp-content/themes/moretolifeadhc/css/generalize.min.css
[Sat Jul 18 23:21:41.719391 2026] [proxy:error] [pid 882519:tid 882747] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:41.719430 2026] [proxy_http:error] [pid 882519:tid 882747] [client 20.220.9.199:59384] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:41.720163 2026] [proxy:error] [pid 882519:tid 882747] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:41.720232 2026] [proxy_http:error] [pid 882519:tid 882747] [client 20.220.9.199:59384] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:41.720335 2026] [security2:error] [pid 882519:tid 882747] [client 20.220.9.199:59384] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxe5aL84xJUTmx6eO6cXAAAAOc"]
[Sat Jul 18 23:21:41.731886 2026] [security2:error] [pid 881201:tid 881249] [remote 157.66.47.83:42528] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nwcarvingacademy.com"] [uri "/wp-login.php"] [unique_id "alxe5QWL-zKlchkVWS1KywAAGi4"], referer: https://nwcarvingacademy.com/wp-login.php
[Sat Jul 18 23:21:41.886508 2026] [security2:error] [pid 882519:tid 882587] [remote 152.228.213.32:32956] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxe5aL84xJUTmx6eO6cYgAAlUM"]
[Sat Jul 18 23:21:41.888290 2026] [proxy:error] [pid 882519:tid 882758] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:41.888366 2026] [proxy_http:error] [pid 882519:tid 882758] [client 20.220.9.199:52540] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:41.889034 2026] [proxy:error] [pid 882519:tid 882758] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:41.889063 2026] [proxy_http:error] [pid 882519:tid 882758] [client 20.220.9.199:52540] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:41.889149 2026] [security2:error] [pid 882519:tid 882758] [client 20.220.9.199:52540] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxe5aL84xJUTmx6eO6cZQAAAPI"]
[Sat Jul 18 23:21:41.976286 2026] [security2:error] [pid 882519:tid 882590] [remote 97.74.93.24:60644] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxe5aL84xJUTmx6eO6cawAAjkY"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:21:42.004638 2026] [security2:error] [pid 881201:tid 881259] [remote 103.152.165.165:9528] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.165.152.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tbd.jxc.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxe5QWL-zKlchkVWS1K1QAAUTg"], referer: https://tbd.jxc.mybluehost.me/wp-login.php
[Sat Jul 18 23:21:42.049522 2026] [security2:error] [pid 881201:tid 881435] [client 20.220.9.199:33257] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/makeasmtp.php"] [unique_id "alxe5gWL-zKlchkVWS1K2QAAAGc"]
[Sat Jul 18 23:21:42.049620 2026] [security2:error] [pid 881201:tid 881435] [client 20.220.9.199:33257] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/makeasmtp.php"] [unique_id "alxe5gWL-zKlchkVWS1K2QAAAGc"]
[Sat Jul 18 23:21:42.082978 2026] [security2:error] [pid 882519:tid 882592] [remote 152.228.213.32:32956] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxe5qL84xJUTmx6eO6ccAAAqkg"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:21:42.166394 2026] [security2:error] [pid 882519:tid 882594] [remote 72.167.132.114:56614] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mobilesurvsolutions.com"] [uri "/wp-login.php"] [unique_id "alxe5qL84xJUTmx6eO6cdgAAuko"]
[Sat Jul 18 23:21:42.200674 2026] [security2:error] [pid 882519:tid 882682] [client 20.220.9.199:15191] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/2P.php"] [unique_id "alxe5qL84xJUTmx6eO6cdwAAAKY"]
[Sat Jul 18 23:21:42.200788 2026] [security2:error] [pid 882519:tid 882682] [client 20.220.9.199:15191] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/2P.php"] [unique_id "alxe5qL84xJUTmx6eO6cdwAAAKY"]
[Sat Jul 18 23:21:42.306681 2026] [security2:error] [pid 882519:tid 882771] [client 57.141.18.53:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxe5qL84xJUTmx6eO6cdAAAAP8"]
[Sat Jul 18 23:21:42.362213 2026] [security2:error] [pid 881201:tid 881347] [client 68.167.134.20:60344] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.sesamegreenbeans.com"] [uri "/index.php"] [unique_id "alxe5AWL-zKlchkVWS1KlQAADx0"]
[Sat Jul 18 23:21:42.412178 2026] [security2:error] [pid 881201:tid 881357] [client 20.220.9.199:33239] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/.well-known/about.php"] [unique_id "alxe5gWL-zKlchkVWS1K4AAAABk"]
[Sat Jul 18 23:21:42.412296 2026] [security2:error] [pid 881201:tid 881357] [client 20.220.9.199:33239] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/.well-known/about.php"] [unique_id "alxe5gWL-zKlchkVWS1K4AAAABk"]
[Sat Jul 18 23:21:42.415230 2026] [security2:error] [pid 882519:tid 882775] [client 13.232.206.133:23654] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "155"] [id "900406"] [msg "wp-login POST logging"] [data "200"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxe5aL84xJUTmx6eO6cWgAAAQM"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:21:42.547738 2026] [security2:error] [pid 881201:tid 881346] [client 20.220.9.199:33222] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "alxe5gWL-zKlchkVWS1K7AAAAA4"]
[Sat Jul 18 23:21:42.547886 2026] [security2:error] [pid 881201:tid 881346] [client 20.220.9.199:33222] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "alxe5gWL-zKlchkVWS1K7AAAAA4"]
[Sat Jul 18 23:21:42.554455 2026] [security2:error] [pid 882519:tid 882725] [client 192.161.168.39:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "tiokubito.cl"] [uri "/index.php"] [unique_id "alxe5qL84xJUTmx6eO6ceQAA0Us"], referer: https://tiokubito.cl/producto/%E3%80%90preventa%E3%80%91hex-collectibles-gaara-vs-kimimaro/
[Sat Jul 18 23:21:42.710502 2026] [security2:error] [pid 882519:tid 882751] [client 20.220.9.199:23053] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/system_log.php"] [unique_id "alxe5qL84xJUTmx6eO6cgwAAAOs"]
[Sat Jul 18 23:21:42.710609 2026] [security2:error] [pid 882519:tid 882751] [client 20.220.9.199:23053] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/system_log.php"] [unique_id "alxe5qL84xJUTmx6eO6cgwAAAOs"]
[Sat Jul 18 23:21:42.859960 2026] [proxy:error] [pid 882519:tid 882747] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:42.860042 2026] [proxy_http:error] [pid 882519:tid 882747] [client 20.220.9.199:52482] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:42.860651 2026] [proxy:error] [pid 882519:tid 882747] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:42.860680 2026] [proxy_http:error] [pid 882519:tid 882747] [client 20.220.9.199:52482] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:42.860804 2026] [security2:error] [pid 882519:tid 882747] [client 20.220.9.199:52482] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxe5qL84xJUTmx6eO6chQAAAOc"]
[Sat Jul 18 23:21:43.022483 2026] [proxy:error] [pid 882519:tid 882744] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:43.022542 2026] [proxy_http:error] [pid 882519:tid 882744] [client 20.220.9.199:33234] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:43.023003 2026] [proxy:error] [pid 882519:tid 882744] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:43.023030 2026] [proxy_http:error] [pid 882519:tid 882744] [client 20.220.9.199:33234] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:43.023102 2026] [security2:error] [pid 882519:tid 882744] [client 20.220.9.199:33234] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxe56L84xJUTmx6eO6chwAAAOQ"]
[Sat Jul 18 23:21:43.154818 2026] [security2:error] [pid 882519:tid 882724] [client 20.220.9.199:33763] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/crgio.php"] [unique_id "alxe56L84xJUTmx6eO6ciwAAANA"]
[Sat Jul 18 23:21:43.154906 2026] [security2:error] [pid 882519:tid 882724] [client 20.220.9.199:33763] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/crgio.php"] [unique_id "alxe56L84xJUTmx6eO6ciwAAANA"]
[Sat Jul 18 23:21:43.314275 2026] [security2:error] [pid 882519:tid 882762] [client 20.220.9.199:13488] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/pucci.php"] [unique_id "alxe56L84xJUTmx6eO6cjQAAAPY"]
[Sat Jul 18 23:21:43.314443 2026] [security2:error] [pid 882519:tid 882762] [client 20.220.9.199:13488] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/pucci.php"] [unique_id "alxe56L84xJUTmx6eO6cjQAAAPY"]
[Sat Jul 18 23:21:43.460191 2026] [proxy:error] [pid 882519:tid 882720] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:43.460270 2026] [proxy_http:error] [pid 882519:tid 882720] [client 20.220.9.199:33245] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:43.460863 2026] [proxy:error] [pid 882519:tid 882720] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:43.460891 2026] [proxy_http:error] [pid 882519:tid 882720] [client 20.220.9.199:33245] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:43.460979 2026] [security2:error] [pid 882519:tid 882720] [client 20.220.9.199:33245] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxe56L84xJUTmx6eO6ckAAAAMw"]
[Sat Jul 18 23:21:43.479118 2026] [security2:error] [pid 882519:tid 882597] [remote 72.167.132.114:56614] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mobilesurvsolutions.com"] [uri "/wp-login.php"] [unique_id "alxe56L84xJUTmx6eO6ckQAAh00"], referer: https://mobilesurvsolutions.com/wp-login.php
[Sat Jul 18 23:21:43.603840 2026] [proxy:error] [pid 881201:tid 881431] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:43.603901 2026] [proxy_http:error] [pid 881201:tid 881431] [client 20.220.9.199:15180] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:43.604329 2026] [proxy:error] [pid 881201:tid 881431] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:43.604354 2026] [proxy_http:error] [pid 881201:tid 881431] [client 20.220.9.199:15180] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:43.604434 2026] [security2:error] [pid 881201:tid 881431] [client 20.220.9.199:15180] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxe5wWL-zKlchkVWS1LEwAAAGM"]
[Sat Jul 18 23:21:43.763906 2026] [security2:error] [pid 882519:tid 882660] [client 20.220.9.199:33219] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp-temp.php"] [unique_id "alxe56L84xJUTmx6eO6cowAAAJA"]
[Sat Jul 18 23:21:43.764029 2026] [security2:error] [pid 882519:tid 882660] [client 20.220.9.199:33219] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp-temp.php"] [unique_id "alxe56L84xJUTmx6eO6cowAAAJA"]
[Sat Jul 18 23:21:43.900171 2026] [security2:error] [pid 881201:tid 881371] [client 20.220.9.199:15189] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp-admin/js/index.php"] [unique_id "alxe5wWL-zKlchkVWS1LIAAAACc"]
[Sat Jul 18 23:21:43.900299 2026] [security2:error] [pid 881201:tid 881371] [client 20.220.9.199:15189] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp-admin/js/index.php"] [unique_id "alxe5wWL-zKlchkVWS1LIAAAACc"]
[Sat Jul 18 23:21:43.925076 2026] [security2:error] [pid 881201:tid 881427] [client 50.116.65.227:30442] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxe5wWL-zKlchkVWS1LIQAAAF8"]
[Sat Jul 18 23:21:43.939837 2026] [security2:error] [pid 882519:tid 882683] [client 50.116.65.227:26524] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxe56L84xJUTmx6eO6cpQAAAKc"]
[Sat Jul 18 23:21:44.039769 2026] [security2:error] [pid 881201:tid 881348] [client 3.108.60.216:11980] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxe6AWL-zKlchkVWS1LJQAAABA"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:21:44.055281 2026] [security2:error] [pid 881201:tid 881404] [client 20.220.9.199:10752] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/puc.php"] [unique_id "alxe6AWL-zKlchkVWS1LJwAAAEg"]
[Sat Jul 18 23:21:44.055363 2026] [security2:error] [pid 881201:tid 881404] [client 20.220.9.199:10752] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/puc.php"] [unique_id "alxe6AWL-zKlchkVWS1LJwAAAEg"]
[Sat Jul 18 23:21:44.062721 2026] [security2:error] [pid 881201:tid 881262] [remote 8.217.108.67:11748] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxe6AWL-zKlchkVWS1LKAAAIjs"]
[Sat Jul 18 23:21:44.062802 2026] [security2:error] [pid 881201:tid 881262] [remote 8.217.108.67:11748] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxe6AWL-zKlchkVWS1LKAAAIjs"]
[Sat Jul 18 23:21:44.062810 2026] [security2:error] [pid 882519:tid 882714] [client 190.245.146.99:62582] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxe6KL84xJUTmx6eO6cqAAAAMY"]
[Sat Jul 18 23:21:44.062890 2026] [security2:error] [pid 882519:tid 882714] [client 190.245.146.99:62582] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxe6KL84xJUTmx6eO6cqAAAAMY"]
[Sat Jul 18 23:21:44.222344 2026] [security2:error] [pid 882519:tid 882725] [client 20.220.9.199:56586] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/dx.php"] [unique_id "alxe6KL84xJUTmx6eO6crQAAANE"]
[Sat Jul 18 23:21:44.222429 2026] [security2:error] [pid 882519:tid 882725] [client 20.220.9.199:56586] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/dx.php"] [unique_id "alxe6KL84xJUTmx6eO6crQAAANE"]
[Sat Jul 18 23:21:44.233593 2026] [security2:error] [pid 882519:tid 882697] [client 223.185.61.63:26441] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxe6KL84xJUTmx6eO6crgAAALU"]
[Sat Jul 18 23:21:44.238123 2026] [security2:error] [pid 882519:tid 882697] [client 223.185.61.63:26441] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxe6KL84xJUTmx6eO6crgAAALU"]
[Sat Jul 18 23:21:44.362883 2026] [proxy:error] [pid 882519:tid 882741] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:44.362984 2026] [proxy_http:error] [pid 882519:tid 882741] [client 20.220.9.199:23045] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:44.364192 2026] [proxy:error] [pid 882519:tid 882741] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:44.364246 2026] [proxy_http:error] [pid 882519:tid 882741] [client 20.220.9.199:23045] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:44.364377 2026] [security2:error] [pid 882519:tid 882741] [client 20.220.9.199:23045] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxe6KL84xJUTmx6eO6cswAAAOE"]
[Sat Jul 18 23:21:44.491316 2026] [security2:error] [pid 882519:tid 882654] [client 27.34.68.67:1503] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxe6KL84xJUTmx6eO6ctAAAAIo"]
[Sat Jul 18 23:21:44.491456 2026] [security2:error] [pid 882519:tid 882654] [client 27.34.68.67:1503] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxe6KL84xJUTmx6eO6ctAAAAIo"]
[Sat Jul 18 23:21:44.530910 2026] [security2:error] [pid 881201:tid 881352] [client 65.0.26.70:26976] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.26.0.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxe6AWL-zKlchkVWS1LOwAAABQ"]
[Sat Jul 18 23:21:44.531002 2026] [security2:error] [pid 881201:tid 881352] [client 65.0.26.70:26976] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxe6AWL-zKlchkVWS1LOwAAABQ"]
[Sat Jul 18 23:21:44.537613 2026] [security2:error] [pid 881201:tid 881432] [client 20.220.9.199:52507] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/bthil.php"] [unique_id "alxe6AWL-zKlchkVWS1LPAAAAGQ"]
[Sat Jul 18 23:21:44.537695 2026] [security2:error] [pid 881201:tid 881432] [client 20.220.9.199:52507] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/bthil.php"] [unique_id "alxe6AWL-zKlchkVWS1LPAAAAGQ"]
[Sat Jul 18 23:21:44.702512 2026] [security2:error] [pid 881201:tid 881351] [client 20.220.9.199:23040] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/7.php"] [unique_id "alxe6AWL-zKlchkVWS1LQAAAABM"]
[Sat Jul 18 23:21:44.702612 2026] [security2:error] [pid 881201:tid 881351] [client 20.220.9.199:23040] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/7.php"] [unique_id "alxe6AWL-zKlchkVWS1LQAAAABM"]
[Sat Jul 18 23:21:44.840624 2026] [security2:error] [pid 881201:tid 881383] [client 20.220.9.199:33271] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/8.php"] [unique_id "alxe6AWL-zKlchkVWS1LSQAAADM"]
[Sat Jul 18 23:21:44.840739 2026] [security2:error] [pid 881201:tid 881383] [client 20.220.9.199:33271] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/8.php"] [unique_id "alxe6AWL-zKlchkVWS1LSQAAADM"]
[Sat Jul 18 23:21:44.967154 2026] [security2:error] [pid 882519:tid 882669] [client 20.220.9.199:33246] ModSecurity: Warning. Pattern match "/1\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1543"] [id "900921"] [msg "temporary TUW-72162 logging rule"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/1.php"] [unique_id "alxe6KL84xJUTmx6eO6cwQAAAJk"]
[Sat Jul 18 23:21:44.967270 2026] [security2:error] [pid 882519:tid 882669] [client 20.220.9.199:33246] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/1.php"] [unique_id "alxe6KL84xJUTmx6eO6cwQAAAJk"]
[Sat Jul 18 23:21:44.967374 2026] [security2:error] [pid 882519:tid 882669] [client 20.220.9.199:33246] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/1.php"] [unique_id "alxe6KL84xJUTmx6eO6cwQAAAJk"]
[Sat Jul 18 23:21:45.133106 2026] [security2:error] [pid 881201:tid 881381] [client 20.220.9.199:15225] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/100.php"] [unique_id "alxe6QWL-zKlchkVWS1LUAAAADE"]
[Sat Jul 18 23:21:45.133181 2026] [security2:error] [pid 881201:tid 881381] [client 20.220.9.199:15225] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/100.php"] [unique_id "alxe6QWL-zKlchkVWS1LUAAAADE"]
[Sat Jul 18 23:21:45.197150 2026] [security2:error] [pid 882519:tid 882766] [client 171.245.26.255:49490] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxe6aL84xJUTmx6eO6czgAAAPo"]
[Sat Jul 18 23:21:45.401236 2026] [security2:error] [pid 882519:tid 882722] [client 20.220.9.199:52488] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/about.php"] [unique_id "alxe6aL84xJUTmx6eO6c0wAAAM4"]
[Sat Jul 18 23:21:45.401346 2026] [security2:error] [pid 882519:tid 882722] [client 20.220.9.199:52488] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/about.php"] [unique_id "alxe6aL84xJUTmx6eO6c0wAAAM4"]
[Sat Jul 18 23:21:45.417871 2026] [security2:error] [pid 882519:tid 882743] [client 57.141.18.90:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxe6aL84xJUTmx6eO6c0AAAAOM"]
[Sat Jul 18 23:21:45.471855 2026] [security2:error] [pid 881201:tid 881402] [client 45.3.45.0:21173] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 0.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxe6QWL-zKlchkVWS1LWwAAAEY"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:21:45.496060 2026] [security2:error] [pid 882519:tid 882653] [client 167.61.202.154:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mtlegnews.gov"] [uri "/index.php"] [unique_id "alxe6aL84xJUTmx6eO6czwAAAIk"]
[Sat Jul 18 23:21:45.677468 2026] [security2:error] [pid 881201:tid 881325] [remote 31.42.184.154:43086] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxe6QWL-zKlchkVWS1LaQAAbHo"]
[Sat Jul 18 23:21:45.696613 2026] [security2:error] [pid 882519:tid 882681] [client 20.220.9.199:52543] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/admin.php"] [unique_id "alxe6aL84xJUTmx6eO6c2QAAAKU"]
[Sat Jul 18 23:21:45.696714 2026] [security2:error] [pid 882519:tid 882681] [client 20.220.9.199:52543] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/admin.php"] [unique_id "alxe6aL84xJUTmx6eO6c2QAAAKU"]
[Sat Jul 18 23:21:45.709542 2026] [security2:error] [pid 881201:tid 881447] [client 171.4.232.110:58494] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxe6QWL-zKlchkVWS1LbgAAAHM"]
[Sat Jul 18 23:21:45.709630 2026] [security2:error] [pid 881201:tid 881447] [client 171.4.232.110:58494] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxe6QWL-zKlchkVWS1LbgAAAHM"]
[Sat Jul 18 23:21:45.744779 2026] [security2:error] [pid 882519:tid 882708] [client 223.228.182.224:53125] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxe6aL84xJUTmx6eO6c3AAAAMA"]
[Sat Jul 18 23:21:45.744881 2026] [security2:error] [pid 882519:tid 882708] [client 223.228.182.224:53125] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxe6aL84xJUTmx6eO6c3AAAAMA"]
[Sat Jul 18 23:21:45.814144 2026] [security2:error] [pid 882519:tid 882615] [remote 68.178.160.25:54158] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxe6aL84xJUTmx6eO6c3QABA18"]
[Sat Jul 18 23:21:45.908647 2026] [security2:error] [pid 881201:tid 881301] [remote 31.42.184.154:43086] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxe6QWL-zKlchkVWS1LdQAACmI"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:21:45.962567 2026] [proxy:error] [pid 882519:tid 882688] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:45.962642 2026] [proxy_http:error] [pid 882519:tid 882688] [client 193.47.62.168:50750] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:45.963207 2026] [proxy:error] [pid 882519:tid 882688] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:45.963236 2026] [proxy_http:error] [pid 882519:tid 882688] [client 193.47.62.168:50750] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:45.966919 2026] [security2:error] [pid 881201:tid 881398] [client 20.220.9.199:33762] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/edit.php"] [unique_id "alxe6QWL-zKlchkVWS1LdgAAAEI"]
[Sat Jul 18 23:21:45.967003 2026] [security2:error] [pid 881201:tid 881398] [client 20.220.9.199:33762] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/edit.php"] [unique_id "alxe6QWL-zKlchkVWS1LdgAAAEI"]
[Sat Jul 18 23:21:46.097466 2026] [security2:error] [pid 881201:tid 881328] [remote 68.178.160.25:54172] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxe6gWL-zKlchkVWS1LgAAAD30"]
[Sat Jul 18 23:21:46.143707 2026] [security2:error] [pid 881201:tid 881333] [client 20.220.9.199:17862] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp-content/admin.php"] [unique_id "alxe6gWL-zKlchkVWS1LhQAAAAE"]
[Sat Jul 18 23:21:46.143881 2026] [security2:error] [pid 881201:tid 881333] [client 20.220.9.199:17862] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp-content/admin.php"] [unique_id "alxe6gWL-zKlchkVWS1LhQAAAAE"]
[Sat Jul 18 23:21:46.290815 2026] [security2:error] [pid 881201:tid 881356] [client 20.220.9.199:56597] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/ss.php"] [unique_id "alxe6gWL-zKlchkVWS1LigAAABg"]
[Sat Jul 18 23:21:46.290901 2026] [security2:error] [pid 881201:tid 881356] [client 20.220.9.199:56597] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/ss.php"] [unique_id "alxe6gWL-zKlchkVWS1LigAAABg"]
[Sat Jul 18 23:21:46.451073 2026] [security2:error] [pid 881201:tid 881317] [remote 217.182.128.41:48320] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.128.182.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "longevityperformanceclinic.com"] [uri "/wp-login.php"] [unique_id "alxe6gWL-zKlchkVWS1LjwAAP3I"]
[Sat Jul 18 23:21:46.462912 2026] [security2:error] [pid 882519:tid 882673] [client 20.220.9.199:33277] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/inputs.php"] [unique_id "alxe6qL84xJUTmx6eO6c9wAAAJ0"]
[Sat Jul 18 23:21:46.463009 2026] [security2:error] [pid 882519:tid 882673] [client 20.220.9.199:33277] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/inputs.php"] [unique_id "alxe6qL84xJUTmx6eO6c9wAAAJ0"]
[Sat Jul 18 23:21:46.610234 2026] [security2:error] [pid 882519:tid 882655] [client 20.220.9.199:33243] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/av.php"] [unique_id "alxe6qL84xJUTmx6eO6c_gAAAIs"]
[Sat Jul 18 23:21:46.610339 2026] [security2:error] [pid 882519:tid 882655] [client 20.220.9.199:33243] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/av.php"] [unique_id "alxe6qL84xJUTmx6eO6c_gAAAIs"]
[Sat Jul 18 23:21:46.671502 2026] [security2:error] [pid 881201:tid 881244] [remote 217.182.128.41:48320] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.128.182.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "longevityperformanceclinic.com"] [uri "/wp-login.php"] [unique_id "alxe6gWL-zKlchkVWS1LlwAAMSk"], referer: https://longevityperformanceclinic.com/wp-login.php
[Sat Jul 18 23:21:46.829678 2026] [security2:error] [pid 882519:tid 882703] [client 20.220.9.199:33251] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/classwithtostring.php"] [unique_id "alxe6qL84xJUTmx6eO6dDAAAALs"]
[Sat Jul 18 23:21:46.829778 2026] [security2:error] [pid 882519:tid 882703] [client 20.220.9.199:33251] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/classwithtostring.php"] [unique_id "alxe6qL84xJUTmx6eO6dDAAAALs"]
[Sat Jul 18 23:21:46.892226 2026] [security2:error] [pid 882519:tid 882740] [client 45.3.45.133:27035] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxe6qL84xJUTmx6eO6dDwAAAOA"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:21:46.969838 2026] [security2:error] [pid 882519:tid 882664] [client 20.220.9.199:52499] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp-content/themes/index.php"] [unique_id "alxe6qL84xJUTmx6eO6dEwAAAJQ"]
[Sat Jul 18 23:21:46.969937 2026] [security2:error] [pid 882519:tid 882664] [client 20.220.9.199:52499] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp-content/themes/index.php"] [unique_id "alxe6qL84xJUTmx6eO6dEwAAAJQ"]
[Sat Jul 18 23:21:47.140583 2026] [security2:error] [pid 882519:tid 882769] [client 103.48.44.9:59086] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxe66L84xJUTmx6eO6dFwAAAP0"]
[Sat Jul 18 23:21:47.179125 2026] [security2:error] [pid 882519:tid 882768] [client 20.220.9.199:33217] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp-blog.php"] [unique_id "alxe66L84xJUTmx6eO6dGQAAAPw"]
[Sat Jul 18 23:21:47.179212 2026] [security2:error] [pid 882519:tid 882768] [client 20.220.9.199:33217] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp-blog.php"] [unique_id "alxe66L84xJUTmx6eO6dGQAAAPw"]
[Sat Jul 18 23:21:47.323166 2026] [proxy:error] [pid 881201:tid 881364] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:47.323244 2026] [proxy_http:error] [pid 881201:tid 881364] [client 20.220.9.199:52515] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:47.323955 2026] [proxy:error] [pid 881201:tid 881364] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:47.323986 2026] [proxy_http:error] [pid 881201:tid 881364] [client 20.220.9.199:52515] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:47.324064 2026] [security2:error] [pid 881201:tid 881364] [client 20.220.9.199:52515] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxe6wWL-zKlchkVWS1LxgAAACA"]
[Sat Jul 18 23:21:47.468608 2026] [security2:error] [pid 881201:tid 881401] [client 20.220.9.199:33275] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp-content/admin.php"] [unique_id "alxe6wWL-zKlchkVWS1LzwAAAEU"]
[Sat Jul 18 23:21:47.468729 2026] [security2:error] [pid 881201:tid 881401] [client 20.220.9.199:33275] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp-content/admin.php"] [unique_id "alxe6wWL-zKlchkVWS1LzwAAAEU"]
[Sat Jul 18 23:21:47.616648 2026] [security2:error] [pid 882519:tid 882748] [client 20.220.9.199:15171] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/adminfuns.php"] [unique_id "alxe66L84xJUTmx6eO6dKAAAAOg"]
[Sat Jul 18 23:21:47.616783 2026] [security2:error] [pid 882519:tid 882748] [client 20.220.9.199:15171] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/adminfuns.php"] [unique_id "alxe66L84xJUTmx6eO6dKAAAAOg"]
[Sat Jul 18 23:21:47.653608 2026] [security2:error] [pid 881201:tid 881389] [client 116.179.37.82:9757] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.37.179.116.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.adultdaycarereno.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxe6wWL-zKlchkVWS1L1gAAADk"], referer: https://www.adultdaycarereno.com/month-for-giving-thanks
[Sat Jul 18 23:21:47.766123 2026] [security2:error] [pid 881201:tid 881383] [client 20.220.9.199:52519] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/goods.php"] [unique_id "alxe6wWL-zKlchkVWS1L4AAAADM"]
[Sat Jul 18 23:21:47.766260 2026] [security2:error] [pid 881201:tid 881383] [client 20.220.9.199:52519] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/goods.php"] [unique_id "alxe6wWL-zKlchkVWS1L4AAAADM"]
[Sat Jul 18 23:21:47.781270 2026] [security2:error] [pid 882519:tid 882631] [remote 41.76.213.235:55188] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.rvprintfactory.com"] [uri "/wp-login.php"] [unique_id "alxe66L84xJUTmx6eO6dKQAA9G8"]
[Sat Jul 18 23:21:47.913208 2026] [security2:error] [pid 882519:tid 882766] [client 20.220.9.199:52486] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/ms-edit.php"] [unique_id "alxe66L84xJUTmx6eO6dKgAAAPo"]
[Sat Jul 18 23:21:47.913345 2026] [security2:error] [pid 882519:tid 882766] [client 20.220.9.199:52486] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/ms-edit.php"] [unique_id "alxe66L84xJUTmx6eO6dKgAAAPo"]
[Sat Jul 18 23:21:48.028923 2026] [security2:error] [pid 882519:tid 882769] [client 103.48.44.9:59086] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxe66L84xJUTmx6eO6dFwAAAP0"]
[Sat Jul 18 23:21:48.061335 2026] [security2:error] [pid 881201:tid 881370] [client 20.220.9.199:23077] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/222.php"] [unique_id "alxe7AWL-zKlchkVWS1L6gAAACY"]
[Sat Jul 18 23:21:48.061430 2026] [security2:error] [pid 881201:tid 881370] [client 20.220.9.199:23077] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/222.php"] [unique_id "alxe7AWL-zKlchkVWS1L6gAAACY"]
[Sat Jul 18 23:21:48.292943 2026] [security2:error] [pid 882519:tid 882711] [client 20.220.9.199:33218] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/cgi-bin/index.php"] [unique_id "alxe7KL84xJUTmx6eO6dNQAAAMM"]
[Sat Jul 18 23:21:48.293044 2026] [security2:error] [pid 882519:tid 882711] [client 20.220.9.199:33218] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/cgi-bin/index.php"] [unique_id "alxe7KL84xJUTmx6eO6dNQAAAMM"]
[Sat Jul 18 23:21:48.295992 2026] [security2:error] [pid 882519:tid 882747] [client 45.3.45.190:45283] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 190.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxe7KL84xJUTmx6eO6dNAAAAOc"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:21:48.378813 2026] [security2:error] [pid 882519:tid 882633] [remote 41.76.213.235:55188] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.rvprintfactory.com"] [uri "/wp-login.php"] [unique_id "alxe7KL84xJUTmx6eO6dNgAA2XE"], referer: https://www.rvprintfactory.com/wp-login.php
[Sat Jul 18 23:21:48.454274 2026] [proxy:error] [pid 882519:tid 882770] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:48.454370 2026] [proxy_http:error] [pid 882519:tid 882770] [client 20.220.9.199:15181] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:48.455464 2026] [proxy:error] [pid 882519:tid 882770] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:48.455530 2026] [proxy_http:error] [pid 882519:tid 882770] [client 20.220.9.199:15181] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:48.455672 2026] [security2:error] [pid 882519:tid 882770] [client 20.220.9.199:15181] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxe7KL84xJUTmx6eO6dOgAAAP4"]
[Sat Jul 18 23:21:48.626314 2026] [security2:error] [pid 882519:tid 882679] [client 20.220.9.199:33276] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/BDKR28WP.php"] [unique_id "alxe7KL84xJUTmx6eO6dRAAAAKM"]
[Sat Jul 18 23:21:48.626406 2026] [security2:error] [pid 882519:tid 882679] [client 20.220.9.199:33276] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/BDKR28WP.php"] [unique_id "alxe7KL84xJUTmx6eO6dRAAAAKM"]
[Sat Jul 18 23:21:48.669706 2026] [security2:error] [pid 882519:tid 882638] [remote 31.42.184.154:43096] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "rrf.lcd.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxe7KL84xJUTmx6eO6dRwAAy3Y"]
[Sat Jul 18 23:21:48.669874 2026] [security2:error] [pid 882519:tid 882719] [client 31.42.184.154:43096] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "rrf.lcd.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxe7KL84xJUTmx6eO6dRwAAy3Y"]
[Sat Jul 18 23:21:48.786844 2026] [proxy:error] [pid 882519:tid 882768] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:48.786917 2026] [proxy_http:error] [pid 882519:tid 882768] [client 20.220.9.199:33261] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:48.787498 2026] [proxy:error] [pid 882519:tid 882768] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:48.787528 2026] [proxy_http:error] [pid 882519:tid 882768] [client 20.220.9.199:33261] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:48.787601 2026] [security2:error] [pid 882519:tid 882768] [client 20.220.9.199:33261] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxe7KL84xJUTmx6eO6dTAAAAPw"]
[Sat Jul 18 23:21:48.925052 2026] [proxy:error] [pid 882519:tid 882687] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:48.925126 2026] [proxy_http:error] [pid 882519:tid 882687] [client 20.220.9.199:15186] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:48.925663 2026] [proxy:error] [pid 882519:tid 882687] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:48.925697 2026] [proxy_http:error] [pid 882519:tid 882687] [client 20.220.9.199:15186] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:48.925786 2026] [security2:error] [pid 882519:tid 882687] [client 20.220.9.199:15186] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxe7KL84xJUTmx6eO6dUgAAAKs"]
[Sat Jul 18 23:21:49.061035 2026] [security2:error] [pid 882519:tid 882774] [client 20.220.9.199:10779] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp.php"] [unique_id "alxe7aL84xJUTmx6eO6dWQAAAQI"]
[Sat Jul 18 23:21:49.061142 2026] [security2:error] [pid 882519:tid 882774] [client 20.220.9.199:10779] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp.php"] [unique_id "alxe7aL84xJUTmx6eO6dWQAAAQI"]
[Sat Jul 18 23:21:49.107913 2026] [security2:error] [pid 881201:tid 881410] [client 124.29.246.106:51810] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxe7QWL-zKlchkVWS1MCwAAAE4"]
[Sat Jul 18 23:21:49.108003 2026] [security2:error] [pid 881201:tid 881410] [client 124.29.246.106:51810] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxe7QWL-zKlchkVWS1MCwAAAE4"]
[Sat Jul 18 23:21:49.115795 2026] [security2:error] [pid 881201:tid 881403] [client 119.154.81.234:63525] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxe7QWL-zKlchkVWS1MDAAAAEc"]
[Sat Jul 18 23:21:49.115859 2026] [security2:error] [pid 881201:tid 881403] [client 119.154.81.234:63525] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxe7QWL-zKlchkVWS1MDAAAAEc"]
[Sat Jul 18 23:21:49.149366 2026] [security2:error] [pid 882519:tid 882641] [remote 68.178.160.25:54158] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxe7aL84xJUTmx6eO6dXAAAkHk"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:21:49.193453 2026] [security2:error] [pid 881201:tid 881398] [client 20.220.9.199:52508] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/abcd.php"] [unique_id "alxe7QWL-zKlchkVWS1MDgAAAEI"]
[Sat Jul 18 23:21:49.193538 2026] [security2:error] [pid 881201:tid 881398] [client 20.220.9.199:52508] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/abcd.php"] [unique_id "alxe7QWL-zKlchkVWS1MDgAAAEI"]
[Sat Jul 18 23:21:49.340102 2026] [security2:error] [pid 881201:tid 881347] [client 20.220.9.199:10796] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/a1.php"] [unique_id "alxe7QWL-zKlchkVWS1MFAAAAA8"]
[Sat Jul 18 23:21:49.340197 2026] [security2:error] [pid 881201:tid 881347] [client 20.220.9.199:10796] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/a1.php"] [unique_id "alxe7QWL-zKlchkVWS1MFAAAAA8"]
[Sat Jul 18 23:21:49.472095 2026] [security2:error] [pid 882519:tid 882747] [client 20.220.9.199:23081] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "alxe7aL84xJUTmx6eO6daQAAAOc"]
[Sat Jul 18 23:21:49.472189 2026] [security2:error] [pid 882519:tid 882747] [client 20.220.9.199:23081] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "alxe7aL84xJUTmx6eO6daQAAAOc"]
[Sat Jul 18 23:21:49.641257 2026] [security2:error] [pid 882519:tid 882685] [client 20.220.9.199:10789] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/cgi-bin/admin.php"] [unique_id "alxe7aL84xJUTmx6eO6dbAAAAKk"]
[Sat Jul 18 23:21:49.641413 2026] [security2:error] [pid 882519:tid 882685] [client 20.220.9.199:10789] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/cgi-bin/admin.php"] [unique_id "alxe7aL84xJUTmx6eO6dbAAAAKk"]
[Sat Jul 18 23:21:49.809299 2026] [security2:error] [pid 881201:tid 881453] [client 20.220.9.199:23067] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/gettest.php"] [unique_id "alxe7QWL-zKlchkVWS1MLAAAAHk"]
[Sat Jul 18 23:21:49.809418 2026] [security2:error] [pid 881201:tid 881453] [client 20.220.9.199:23067] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/gettest.php"] [unique_id "alxe7QWL-zKlchkVWS1MLAAAAHk"]
[Sat Jul 18 23:21:49.938368 2026] [proxy:error] [pid 882519:tid 882698] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:49.938446 2026] [proxy_http:error] [pid 882519:tid 882698] [client 20.220.9.199:52510] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:49.939137 2026] [proxy:error] [pid 882519:tid 882698] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:49.939169 2026] [proxy_http:error] [pid 882519:tid 882698] [client 20.220.9.199:52510] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:49.939273 2026] [security2:error] [pid 882519:tid 882698] [client 20.220.9.199:52510] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxe7aL84xJUTmx6eO6dfQAAALY"]
[Sat Jul 18 23:21:50.166017 2026] [security2:error] [pid 882519:tid 882724] [client 20.220.9.199:23098] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/simple.php"] [unique_id "alxe7qL84xJUTmx6eO6diAAAANA"]
[Sat Jul 18 23:21:50.166121 2026] [security2:error] [pid 882519:tid 882724] [client 20.220.9.199:23098] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/simple.php"] [unique_id "alxe7qL84xJUTmx6eO6diAAAANA"]
[Sat Jul 18 23:21:50.334814 2026] [security2:error] [pid 882519:tid 882660] [client 20.220.9.199:10803] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/xxx.php"] [unique_id "alxe7qL84xJUTmx6eO6dkAAAAJA"]
[Sat Jul 18 23:21:50.334913 2026] [security2:error] [pid 882519:tid 882660] [client 20.220.9.199:10803] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/xxx.php"] [unique_id "alxe7qL84xJUTmx6eO6dkAAAAJA"]
[Sat Jul 18 23:21:50.476148 2026] [security2:error] [pid 882519:tid 882534] [remote 31.42.184.154:34680] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "oohlovely.com"] [uri "/wp-login.php"] [unique_id "alxe7qL84xJUTmx6eO6dlgAAqA4"]
[Sat Jul 18 23:21:50.499812 2026] [security2:error] [pid 882519:tid 882770] [client 20.220.9.199:15226] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/hypo.php"] [unique_id "alxe7qL84xJUTmx6eO6dmgAAAP4"]
[Sat Jul 18 23:21:50.499922 2026] [security2:error] [pid 882519:tid 882770] [client 20.220.9.199:15226] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/hypo.php"] [unique_id "alxe7qL84xJUTmx6eO6dmgAAAP4"]
[Sat Jul 18 23:21:50.633223 2026] [proxy:error] [pid 881201:tid 881427] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:50.633298 2026] [proxy_http:error] [pid 881201:tid 881427] [client 20.220.9.199:52487] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:50.633934 2026] [proxy:error] [pid 881201:tid 881427] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:50.633971 2026] [proxy_http:error] [pid 881201:tid 881427] [client 20.220.9.199:52487] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:50.634059 2026] [security2:error] [pid 881201:tid 881427] [client 20.220.9.199:52487] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxe7gWL-zKlchkVWS1MRgAAAF8"]
[Sat Jul 18 23:21:50.703567 2026] [security2:error] [pid 882519:tid 882531] [remote 31.42.184.154:34680] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "oohlovely.com"] [uri "/wp-login.php"] [unique_id "alxe7qL84xJUTmx6eO6doAAA0gs"], referer: https://oohlovely.com/wp-login.php
[Sat Jul 18 23:21:50.771819 2026] [security2:error] [pid 882519:tid 882730] [client 20.220.9.199:52490] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/chosen.php"] [unique_id "alxe7qL84xJUTmx6eO6dogAAANY"]
[Sat Jul 18 23:21:50.771924 2026] [security2:error] [pid 882519:tid 882730] [client 20.220.9.199:52490] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/chosen.php"] [unique_id "alxe7qL84xJUTmx6eO6dogAAANY"]
[Sat Jul 18 23:21:50.934489 2026] [proxy:error] [pid 882519:tid 882709] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:50.934586 2026] [proxy_http:error] [pid 882519:tid 882709] [client 20.220.9.199:33266] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:50.935687 2026] [proxy:error] [pid 882519:tid 882709] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:50.935725 2026] [proxy_http:error] [pid 882519:tid 882709] [client 20.220.9.199:33266] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:50.935838 2026] [security2:error] [pid 882519:tid 882709] [client 20.220.9.199:33266] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxe7qL84xJUTmx6eO6dpgAAAME"]
[Sat Jul 18 23:21:51.118342 2026] [security2:error] [pid 882519:tid 882689] [client 20.220.9.199:56584] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/als.php"] [unique_id "alxe76L84xJUTmx6eO6dqgAAAK0"]
[Sat Jul 18 23:21:51.118417 2026] [security2:error] [pid 882519:tid 882689] [client 20.220.9.199:56584] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/als.php"] [unique_id "alxe76L84xJUTmx6eO6dqgAAAK0"]
[Sat Jul 18 23:21:51.145281 2026] [security2:error] [pid 882519:tid 882535] [remote 117.0.21.154:44502] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxe76L84xJUTmx6eO6dqwABAA8"]
[Sat Jul 18 23:21:51.248868 2026] [security2:error] [pid 881201:tid 881454] [client 20.220.9.199:23066] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/pol.php"] [unique_id "alxe7wWL-zKlchkVWS1MWAAAAHo"]
[Sat Jul 18 23:21:51.248950 2026] [security2:error] [pid 881201:tid 881454] [client 20.220.9.199:23066] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/pol.php"] [unique_id "alxe7wWL-zKlchkVWS1MWAAAAHo"]
[Sat Jul 18 23:21:51.382391 2026] [security2:error] [pid 882519:tid 882712] [client 20.220.9.199:52493] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/file5.php"] [unique_id "alxe76L84xJUTmx6eO6dugAAAMQ"]
[Sat Jul 18 23:21:51.382496 2026] [security2:error] [pid 882519:tid 882712] [client 20.220.9.199:52493] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/file5.php"] [unique_id "alxe76L84xJUTmx6eO6dugAAAMQ"]
[Sat Jul 18 23:21:51.530372 2026] [security2:error] [pid 882519:tid 882543] [remote 91.142.222.105:53232] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "idigress.studio"] [uri "/wp-login.php"] [unique_id "alxe76L84xJUTmx6eO6dwwAAyxc"]
[Sat Jul 18 23:21:51.532557 2026] [security2:error] [pid 882519:tid 882544] [remote 72.167.132.114:39834] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "vyx.sbv.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxe76L84xJUTmx6eO6dxQAA6xg"]
[Sat Jul 18 23:21:51.532671 2026] [security2:error] [pid 882519:tid 882751] [client 72.167.132.114:39834] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "vyx.sbv.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxe76L84xJUTmx6eO6dxQAA6xg"]
[Sat Jul 18 23:21:51.533505 2026] [security2:error] [pid 882519:tid 882753] [client 20.220.9.199:17874] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/file.php"] [unique_id "alxe76L84xJUTmx6eO6dxgAAAO0"]
[Sat Jul 18 23:21:51.533565 2026] [security2:error] [pid 882519:tid 882753] [client 20.220.9.199:17874] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/file.php"] [unique_id "alxe76L84xJUTmx6eO6dxgAAAO0"]
[Sat Jul 18 23:21:51.603505 2026] [security2:error] [pid 882519:tid 882545] [remote 217.182.128.41:48334] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.128.182.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxe76L84xJUTmx6eO6dyQAA8hk"]
[Sat Jul 18 23:21:51.682656 2026] [security2:error] [pid 882519:tid 882667] [client 20.220.9.199:10762] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/cfile.php"] [unique_id "alxe76L84xJUTmx6eO6dzAAAAJc"]
[Sat Jul 18 23:21:51.682736 2026] [security2:error] [pid 882519:tid 882667] [client 20.220.9.199:10762] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/cfile.php"] [unique_id "alxe76L84xJUTmx6eO6dzAAAAJc"]
[Sat Jul 18 23:21:51.789873 2026] [security2:error] [pid 882519:tid 882548] [remote 117.0.21.154:44502] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxe76L84xJUTmx6eO6d0AAAohw"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:21:51.814956 2026] [security2:error] [pid 882519:tid 882551] [remote 217.182.128.41:48334] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.128.182.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxe76L84xJUTmx6eO6d0wAA5R8"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:21:51.849183 2026] [security2:error] [pid 882519:tid 882681] [client 20.220.9.199:15184] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/admin.php"] [unique_id "alxe76L84xJUTmx6eO6d1QAAAKU"]
[Sat Jul 18 23:21:51.849278 2026] [security2:error] [pid 882519:tid 882681] [client 20.220.9.199:15184] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/admin.php"] [unique_id "alxe76L84xJUTmx6eO6d1QAAAKU"]
[Sat Jul 18 23:21:52.016687 2026] [security2:error] [pid 881201:tid 881413] [client 20.220.9.199:52480] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/aa2.php"] [unique_id "alxe8AWL-zKlchkVWS1McQAAAFE"]
[Sat Jul 18 23:21:52.016798 2026] [security2:error] [pid 881201:tid 881413] [client 20.220.9.199:52480] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/aa2.php"] [unique_id "alxe8AWL-zKlchkVWS1McQAAAFE"]
[Sat Jul 18 23:21:52.191950 2026] [security2:error] [pid 882519:tid 882555] [remote 91.142.222.105:53232] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "idigress.studio"] [uri "/wp-login.php"] [unique_id "alxe8KL84xJUTmx6eO6d4AAAnCM"], referer: https://idigress.studio/wp-login.php
[Sat Jul 18 23:21:52.213277 2026] [security2:error] [pid 881201:tid 881381] [client 20.220.9.199:15174] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/ccou.php"] [unique_id "alxe8AWL-zKlchkVWS1MewAAADE"]
[Sat Jul 18 23:21:52.213372 2026] [security2:error] [pid 881201:tid 881381] [client 20.220.9.199:15174] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/ccou.php"] [unique_id "alxe8AWL-zKlchkVWS1MewAAADE"]
[Sat Jul 18 23:21:52.346345 2026] [security2:error] [pid 881201:tid 881337] [client 20.220.9.199:10753] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/dr.php"] [unique_id "alxe8AWL-zKlchkVWS1MgwAAAAU"]
[Sat Jul 18 23:21:52.346440 2026] [security2:error] [pid 881201:tid 881337] [client 20.220.9.199:10753] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/dr.php"] [unique_id "alxe8AWL-zKlchkVWS1MgwAAAAU"]
[Sat Jul 18 23:21:52.451037 2026] [security2:error] [pid 882519:tid 882746] [client 74.7.227.179:52586] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxe8KL84xJUTmx6eO6d5wAA5hU"], referer: https://tejasenvironmental.com/p=154577
[Sat Jul 18 23:21:52.525997 2026] [security2:error] [pid 882519:tid 882682] [client 20.220.9.199:52537] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/xamp.php"] [unique_id "alxe8KL84xJUTmx6eO6d6wAAAKY"]
[Sat Jul 18 23:21:52.526115 2026] [security2:error] [pid 882519:tid 882682] [client 20.220.9.199:52537] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/xamp.php"] [unique_id "alxe8KL84xJUTmx6eO6d6wAAAKY"]
[Sat Jul 18 23:21:52.658314 2026] [security2:error] [pid 881201:tid 881419] [client 20.220.9.199:23096] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/bless.php"] [unique_id "alxe8AWL-zKlchkVWS1MjgAAAFc"]
[Sat Jul 18 23:21:52.658397 2026] [security2:error] [pid 881201:tid 881419] [client 20.220.9.199:23096] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/bless.php"] [unique_id "alxe8AWL-zKlchkVWS1MjgAAAFc"]
[Sat Jul 18 23:21:52.785143 2026] [security2:error] [pid 881201:tid 881387] [client 20.220.9.199:23069] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/file25.php"] [unique_id "alxe8AWL-zKlchkVWS1MlAAAADc"]
[Sat Jul 18 23:21:52.785228 2026] [security2:error] [pid 881201:tid 881387] [client 20.220.9.199:23069] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/file25.php"] [unique_id "alxe8AWL-zKlchkVWS1MlAAAADc"]
[Sat Jul 18 23:21:52.938315 2026] [security2:error] [pid 882519:tid 882710] [client 20.220.9.199:23058] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/file6.php"] [unique_id "alxe8KL84xJUTmx6eO6d9AAAAMI"]
[Sat Jul 18 23:21:52.938409 2026] [security2:error] [pid 882519:tid 882710] [client 20.220.9.199:23058] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/file6.php"] [unique_id "alxe8KL84xJUTmx6eO6d9AAAAMI"]
[Sat Jul 18 23:21:53.114313 2026] [security2:error] [pid 882519:tid 882698] [client 20.220.9.199:52530] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/a2.php"] [unique_id "alxe8aL84xJUTmx6eO6d9gAAALY"]
[Sat Jul 18 23:21:53.114407 2026] [security2:error] [pid 882519:tid 882698] [client 20.220.9.199:52530] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/a2.php"] [unique_id "alxe8aL84xJUTmx6eO6d9gAAALY"]
[Sat Jul 18 23:21:53.269680 2026] [security2:error] [pid 881201:tid 881352] [client 20.220.9.199:15220] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/file15.php"] [unique_id "alxe8QWL-zKlchkVWS1MpQAAABQ"]
[Sat Jul 18 23:21:53.269794 2026] [security2:error] [pid 881201:tid 881352] [client 20.220.9.199:15220] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/file15.php"] [unique_id "alxe8QWL-zKlchkVWS1MpQAAABQ"]
[Sat Jul 18 23:21:53.330107 2026] [security2:error] [pid 882519:tid 882767] [client 57.141.18.28:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxe8aL84xJUTmx6eO6d-wAAAPs"]
[Sat Jul 18 23:21:53.459207 2026] [security2:error] [pid 881201:tid 881400] [client 20.220.9.199:15205] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/f35.php"] [unique_id "alxe8QWL-zKlchkVWS1MqQAAAEQ"]
[Sat Jul 18 23:21:53.459305 2026] [security2:error] [pid 881201:tid 881400] [client 20.220.9.199:15205] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/f35.php"] [unique_id "alxe8QWL-zKlchkVWS1MqQAAAEQ"]
[Sat Jul 18 23:21:53.588512 2026] [security2:error] [pid 882519:tid 882775] [client 20.220.9.199:52517] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp-load.php"] [unique_id "alxe8aL84xJUTmx6eO6eBAAAAQM"]
[Sat Jul 18 23:21:53.588593 2026] [security2:error] [pid 882519:tid 882775] [client 20.220.9.199:52517] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp-load.php"] [unique_id "alxe8aL84xJUTmx6eO6eBAAAAQM"]
[Sat Jul 18 23:21:53.762623 2026] [security2:error] [pid 881201:tid 881448] [client 20.220.9.199:52489] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/xwpg.php"] [unique_id "alxe8QWL-zKlchkVWS1MuwAAAHQ"]
[Sat Jul 18 23:21:53.762717 2026] [security2:error] [pid 881201:tid 881448] [client 20.220.9.199:52489] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/xwpg.php"] [unique_id "alxe8QWL-zKlchkVWS1MuwAAAHQ"]
[Sat Jul 18 23:21:53.916201 2026] [proxy:error] [pid 881201:tid 881356] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:53.916278 2026] [proxy_http:error] [pid 881201:tid 881356] [client 20.220.9.199:10778] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:53.916766 2026] [proxy:error] [pid 881201:tid 881356] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:53.916802 2026] [proxy_http:error] [pid 881201:tid 881356] [client 20.220.9.199:10778] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:53.916872 2026] [security2:error] [pid 881201:tid 881356] [client 20.220.9.199:10778] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxe8QWL-zKlchkVWS1MwAAAABg"]
[Sat Jul 18 23:21:54.081486 2026] [proxy:error] [pid 881201:tid 881435] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:54.081587 2026] [proxy_http:error] [pid 881201:tid 881435] [client 20.220.9.199:15215] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:54.082724 2026] [proxy:error] [pid 881201:tid 881435] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:21:54.082792 2026] [proxy_http:error] [pid 881201:tid 881435] [client 20.220.9.199:15215] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:21:54.082913 2026] [security2:error] [pid 881201:tid 881435] [client 20.220.9.199:15215] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxe8gWL-zKlchkVWS1MxgAAAGc"]
[Sat Jul 18 23:21:54.210640 2026] [security2:error] [pid 881201:tid 881368] [client 20.220.9.199:23059] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/xstelth.php"] [unique_id "alxe8gWL-zKlchkVWS1MzgAAACQ"]
[Sat Jul 18 23:21:54.210735 2026] [security2:error] [pid 881201:tid 881368] [client 20.220.9.199:23059] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/xstelth.php"] [unique_id "alxe8gWL-zKlchkVWS1MzgAAACQ"]
[Sat Jul 18 23:21:54.270453 2026] [security2:error] [pid 881201:tid 881250] [remote 31.42.184.154:34694] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxe8gWL-zKlchkVWS1M0wAAfS8"]
[Sat Jul 18 23:21:54.365447 2026] [security2:error] [pid 881201:tid 881387] [client 20.220.9.199:15204] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "alxe8gWL-zKlchkVWS1M2AAAADc"]
[Sat Jul 18 23:21:54.365552 2026] [security2:error] [pid 881201:tid 881387] [client 20.220.9.199:15204] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "alxe8gWL-zKlchkVWS1M2AAAADc"]
[Sat Jul 18 23:21:54.501723 2026] [security2:error] [pid 882519:tid 882656] [client 20.220.9.199:52514] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/aaa.php"] [unique_id "alxe8qL84xJUTmx6eO6eIQAAAIw"]
[Sat Jul 18 23:21:54.501842 2026] [security2:error] [pid 882519:tid 882656] [client 20.220.9.199:52514] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/aaa.php"] [unique_id "alxe8qL84xJUTmx6eO6eIQAAAIw"]
[Sat Jul 18 23:21:54.516056 2026] [security2:error] [pid 881201:tid 881260] [remote 31.42.184.154:34694] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxe8gWL-zKlchkVWS1M3gAAdjk"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:21:54.558316 2026] [security2:error] [pid 881201:tid 881455] [client 190.245.146.99:63099] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxe8gWL-zKlchkVWS1M4AAAAHs"]
[Sat Jul 18 23:21:54.558480 2026] [security2:error] [pid 881201:tid 881455] [client 190.245.146.99:63099] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxe8gWL-zKlchkVWS1M4AAAAHs"]
[Sat Jul 18 23:21:54.632186 2026] [security2:error] [pid 882519:tid 882726] [client 20.220.9.199:17914] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/gecko.php"] [unique_id "alxe8qL84xJUTmx6eO6eKgAAANI"]
[Sat Jul 18 23:21:54.632303 2026] [security2:error] [pid 882519:tid 882726] [client 20.220.9.199:17914] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/gecko.php"] [unique_id "alxe8qL84xJUTmx6eO6eKgAAANI"]
[Sat Jul 18 23:21:54.767478 2026] [security2:error] [pid 882519:tid 882670] [client 20.220.9.199:23076] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/sh3ll.php"] [unique_id "alxe8qL84xJUTmx6eO6eLAAAAJo"]
[Sat Jul 18 23:21:54.767664 2026] [security2:error] [pid 882519:tid 882670] [client 20.220.9.199:23076] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/sh3ll.php"] [unique_id "alxe8qL84xJUTmx6eO6eLAAAAJo"]
[Sat Jul 18 23:21:54.796146 2026] [security2:error] [pid 881201:tid 881426] [client 50.116.65.227:42494] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxe8gWL-zKlchkVWS1M7AAAAF4"]
[Sat Jul 18 23:21:54.811074 2026] [security2:error] [pid 882519:tid 882759] [client 50.116.65.227:13460] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxe8qL84xJUTmx6eO6eLQAAAN0"]
[Sat Jul 18 23:21:54.909230 2026] [security2:error] [pid 882519:tid 882695] [client 20.220.9.199:23054] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/pbck.php"] [unique_id "alxe8qL84xJUTmx6eO6eLgAAALM"]
[Sat Jul 18 23:21:54.909335 2026] [security2:error] [pid 882519:tid 882695] [client 20.220.9.199:23054] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/pbck.php"] [unique_id "alxe8qL84xJUTmx6eO6eLgAAALM"]
[Sat Jul 18 23:21:55.106393 2026] [security2:error] [pid 882519:tid 882703] [client 20.220.9.199:17858] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/xiugai.php"] [unique_id "alxe86L84xJUTmx6eO6eNQAAALs"]
[Sat Jul 18 23:21:55.106487 2026] [security2:error] [pid 882519:tid 882703] [client 20.220.9.199:17858] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/xiugai.php"] [unique_id "alxe86L84xJUTmx6eO6eNQAAALs"]
[Sat Jul 18 23:21:55.269083 2026] [security2:error] [pid 882519:tid 882724] [client 20.220.9.199:17895] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/e.php"] [unique_id "alxe86L84xJUTmx6eO6eOwAAANA"]
[Sat Jul 18 23:21:55.269162 2026] [security2:error] [pid 882519:tid 882724] [client 20.220.9.199:17895] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/e.php"] [unique_id "alxe86L84xJUTmx6eO6eOwAAANA"]
[Sat Jul 18 23:21:55.405285 2026] [security2:error] [pid 881201:tid 881448] [client 20.220.9.199:15206] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/ah25.php"] [unique_id "alxe8wWL-zKlchkVWS1M_AAAAHQ"]
[Sat Jul 18 23:21:55.405381 2026] [security2:error] [pid 881201:tid 881448] [client 20.220.9.199:15206] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/ah25.php"] [unique_id "alxe8wWL-zKlchkVWS1M_AAAAHQ"]
[Sat Jul 18 23:21:55.579322 2026] [security2:error] [pid 882519:tid 882668] [client 20.220.9.199:56639] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/do.php"] [unique_id "alxe86L84xJUTmx6eO6eTQAAAJg"]
[Sat Jul 18 23:21:55.579410 2026] [security2:error] [pid 882519:tid 882668] [client 20.220.9.199:56639] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/do.php"] [unique_id "alxe86L84xJUTmx6eO6eTQAAAJg"]
[Sat Jul 18 23:21:55.710984 2026] [security2:error] [pid 882519:tid 882771] [client 20.220.9.199:23068] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/hago.php"] [unique_id "alxe86L84xJUTmx6eO6eVAAAAP8"]
[Sat Jul 18 23:21:55.711106 2026] [security2:error] [pid 882519:tid 882771] [client 20.220.9.199:23068] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/hago.php"] [unique_id "alxe86L84xJUTmx6eO6eVAAAAP8"]
[Sat Jul 18 23:21:55.862249 2026] [security2:error] [pid 881201:tid 881216] [remote 128.199.203.39:54708] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 39.203.199.128.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.upf.ztf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxe8wWL-zKlchkVWS1NCQAAUw0"]
[Sat Jul 18 23:21:55.869168 2026] [security2:error] [pid 881201:tid 881379] [client 20.220.9.199:56614] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/ho.php"] [unique_id "alxe8wWL-zKlchkVWS1NCwAAAC8"]
[Sat Jul 18 23:21:55.869315 2026] [security2:error] [pid 881201:tid 881379] [client 20.220.9.199:56614] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/ho.php"] [unique_id "alxe8wWL-zKlchkVWS1NCwAAAC8"]
[Sat Jul 18 23:21:56.056400 2026] [security2:error] [pid 881201:tid 881451] [client 20.220.9.199:15211] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/bbs.php"] [unique_id "alxe9AWL-zKlchkVWS1NEgAAAHc"]
[Sat Jul 18 23:21:56.056491 2026] [security2:error] [pid 881201:tid 881451] [client 20.220.9.199:15211] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/bbs.php"] [unique_id "alxe9AWL-zKlchkVWS1NEgAAAHc"]
[Sat Jul 18 23:21:56.211360 2026] [security2:error] [pid 881201:tid 881456] [client 20.220.9.199:59366] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/for.php"] [unique_id "alxe9AWL-zKlchkVWS1NFQAAAHw"]
[Sat Jul 18 23:21:56.211623 2026] [security2:error] [pid 881201:tid 881456] [client 20.220.9.199:59366] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/for.php"] [unique_id "alxe9AWL-zKlchkVWS1NFQAAAHw"]
[Sat Jul 18 23:21:56.265640 2026] [security2:error] [pid 882519:tid 882764] [client 171.4.232.110:46387] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxe9KL84xJUTmx6eO6eZQAAAPg"]
[Sat Jul 18 23:21:56.265722 2026] [security2:error] [pid 882519:tid 882764] [client 171.4.232.110:46387] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxe9KL84xJUTmx6eO6eZQAAAPg"]
[Sat Jul 18 23:21:56.289814 2026] [security2:error] [pid 881201:tid 881298] [remote 128.199.203.39:54708] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 39.203.199.128.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.upf.ztf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxe9AWL-zKlchkVWS1NHAAAF18"], referer: https://mail.upf.ztf.mybluehost.me/wp-login.php
[Sat Jul 18 23:21:56.337778 2026] [security2:error] [pid 882519:tid 882673] [client 20.220.9.199:59380] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/ssh3ll.php"] [unique_id "alxe9KL84xJUTmx6eO6eZgAAAJ0"]
[Sat Jul 18 23:21:56.337856 2026] [security2:error] [pid 882519:tid 882673] [client 20.220.9.199:59380] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/ssh3ll.php"] [unique_id "alxe9KL84xJUTmx6eO6eZgAAAJ0"]
[Sat Jul 18 23:21:56.369888 2026] [security2:error] [pid 881201:tid 881203] [remote 68.178.160.25:58400] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxe9AWL-zKlchkVWS1NHgAAWwA"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:21:56.487406 2026] [security2:error] [pid 881201:tid 881347] [client 20.220.9.199:52522] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/adminner.php"] [unique_id "alxe9AWL-zKlchkVWS1NJAAAAA8"]
[Sat Jul 18 23:21:56.487487 2026] [security2:error] [pid 881201:tid 881347] [client 20.220.9.199:52522] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/adminner.php"] [unique_id "alxe9AWL-zKlchkVWS1NJAAAAA8"]
[Sat Jul 18 23:21:56.563396 2026] [security2:error] [pid 882519:tid 882662] [client 223.185.61.63:18001] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxe9KL84xJUTmx6eO6eaQAAAJI"]
[Sat Jul 18 23:21:56.563480 2026] [security2:error] [pid 882519:tid 882662] [client 223.185.61.63:18001] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxe9KL84xJUTmx6eO6eaQAAAJI"]
[Sat Jul 18 23:21:56.650178 2026] [security2:error] [pid 881201:tid 881450] [client 20.220.9.199:23083] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/82.php"] [unique_id "alxe9AWL-zKlchkVWS1NLQAAAHY"]
[Sat Jul 18 23:21:56.650319 2026] [security2:error] [pid 881201:tid 881450] [client 20.220.9.199:23083] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/82.php"] [unique_id "alxe9AWL-zKlchkVWS1NLQAAAHY"]
[Sat Jul 18 23:21:56.793799 2026] [security2:error] [pid 881201:tid 881388] [client 20.220.9.199:13443] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/kir.php"] [unique_id "alxe9AWL-zKlchkVWS1NMwAAADg"]
[Sat Jul 18 23:21:56.793878 2026] [security2:error] [pid 881201:tid 881388] [client 20.220.9.199:13443] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/kir.php"] [unique_id "alxe9AWL-zKlchkVWS1NMwAAADg"]
[Sat Jul 18 23:21:56.922588 2026] [security2:error] [pid 881201:tid 881383] [client 20.220.9.199:15201] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.9.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/ez.php"] [unique_id "alxe9AWL-zKlchkVWS1NNQAAADM"]
[Sat Jul 18 23:21:56.922714 2026] [security2:error] [pid 881201:tid 881383] [client 20.220.9.199:15201] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.jvcmotorsports.com"] [uri "/ez.php"] [unique_id "alxe9AWL-zKlchkVWS1NNQAAADM"]
[Sat Jul 18 23:21:56.988238 2026] [security2:error] [pid 881201:tid 881335] [client 103.48.44.9:59596] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxe9AWL-zKlchkVWS1NOQAAAAM"]
[Sat Jul 18 23:21:56.988330 2026] [security2:error] [pid 881201:tid 881335] [client 103.48.44.9:59596] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxe9AWL-zKlchkVWS1NOQAAAAM"]
[Sat Jul 18 23:21:57.208854 2026] [security2:error] [pid 882519:tid 882671] [client 223.228.182.224:28477] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxe9aL84xJUTmx6eO6ecQAAAJs"]
[Sat Jul 18 23:21:57.208949 2026] [security2:error] [pid 882519:tid 882671] [client 223.228.182.224:28477] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxe9aL84xJUTmx6eO6ecQAAAJs"]
[Sat Jul 18 23:21:57.369990 2026] [security2:error] [pid 882519:tid 882706] [client 27.34.68.67:27700] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxe9aL84xJUTmx6eO6eeAAAAL4"]
[Sat Jul 18 23:21:57.370084 2026] [security2:error] [pid 882519:tid 882706] [client 27.34.68.67:27700] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxe9aL84xJUTmx6eO6eeAAAAL4"]
[Sat Jul 18 23:21:59.069224 2026] [security2:error] [pid 882519:tid 882687] [client 216.244.66.244:57654] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "omenana.com"] [uri "/2021/12/21/the-water-dweller-lazarus-panashe-nyagwambo/"] [unique_id "alxe96L84xJUTmx6eO6eoQAAAKs"]
[Sat Jul 18 23:21:59.069314 2026] [security2:error] [pid 882519:tid 882687] [client 216.244.66.244:57654] ModSecurity: Warning. Matched phrase "Dotbot" at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "omenana.com"] [uri "/2021/12/21/the-water-dweller-lazarus-panashe-nyagwambo/"] [unique_id "alxe96L84xJUTmx6eO6eoQAAAKs"]
[Sat Jul 18 23:22:00.375533 2026] [security2:error] [pid 882519:tid 882776] [client 119.154.81.234:63971] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxe-KL84xJUTmx6eO6evAAAAQQ"]
[Sat Jul 18 23:22:00.375630 2026] [security2:error] [pid 882519:tid 882776] [client 119.154.81.234:63971] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxe-KL84xJUTmx6eO6evAAAAQQ"]
[Sat Jul 18 23:22:01.572839 2026] [security2:error] [pid 881201:tid 881370] [client 57.141.18.45:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxe-QWL-zKlchkVWS1N5AAAACY"]
[Sat Jul 18 23:22:01.880579 2026] [security2:error] [pid 881201:tid 881313] [remote 68.178.160.25:39696] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxe-QWL-zKlchkVWS1N-wAAdG4"]
[Sat Jul 18 23:22:02.048158 2026] [security2:error] [pid 881201:tid 881244] [remote 142.93.10.93:36982] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 93.10.93.142.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mourgroup.com"] [uri "/wp-login.php"] [unique_id "alxe-gWL-zKlchkVWS1OBAAACik"]
[Sat Jul 18 23:22:02.257422 2026] [security2:error] [pid 881201:tid 881213] [remote 142.93.10.93:36982] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 93.10.93.142.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mourgroup.com"] [uri "/wp-login.php"] [unique_id "alxe-gWL-zKlchkVWS1ODAAAeAo"], referer: https://mourgroup.com/wp-login.php
[Sat Jul 18 23:22:02.377386 2026] [security2:error] [pid 881201:tid 881319] [remote 72.167.132.114:34978] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxe-gWL-zKlchkVWS1OEgAAAHQ"]
[Sat Jul 18 23:22:02.389326 2026] [security2:error] [pid 881201:tid 881255] [remote 68.178.160.25:39696] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxe-gWL-zKlchkVWS1OFAAAMzQ"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:22:02.671261 2026] [security2:error] [pid 881201:tid 881214] [remote 72.167.132.114:34978] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxe-gWL-zKlchkVWS1OLQAAbws"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:22:03.126690 2026] [security2:error] [pid 881201:tid 881247] [remote 31.42.184.154:49340] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "rcq.nst.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxe-wWL-zKlchkVWS1OQwAATiw"]
[Sat Jul 18 23:22:03.126953 2026] [security2:error] [pid 881201:tid 881410] [client 31.42.184.154:49340] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "rcq.nst.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxe-wWL-zKlchkVWS1OQwAATiw"]
[Sat Jul 18 23:22:05.036961 2026] [security2:error] [pid 881201:tid 881386] [client 190.245.146.99:63657] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxe_QWL-zKlchkVWS1OmwAAADY"]
[Sat Jul 18 23:22:05.037056 2026] [security2:error] [pid 881201:tid 881386] [client 190.245.146.99:63657] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxe_QWL-zKlchkVWS1OmwAAADY"]
[Sat Jul 18 23:22:05.554490 2026] [security2:error] [pid 882519:tid 882763] [client 27.34.68.67:35339] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxe_aL84xJUTmx6eO6fJgAAAPc"]
[Sat Jul 18 23:22:05.736105 2026] [security2:error] [pid 881201:tid 881310] [remote 193.70.112.205:58174] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 205.112.70.193.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/wp-login.php"] [unique_id "alxe_QWL-zKlchkVWS1OsAAAPWs"]
[Sat Jul 18 23:22:06.435392 2026] [security2:error] [pid 882519:tid 882763] [client 27.34.68.67:35339] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxe_aL84xJUTmx6eO6fJgAAAPc"]
[Sat Jul 18 23:22:06.820307 2026] [security2:error] [pid 881201:tid 881388] [client 171.4.232.110:59504] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxe_gWL-zKlchkVWS1OzAAAADg"]
[Sat Jul 18 23:22:06.820436 2026] [security2:error] [pid 881201:tid 881388] [client 171.4.232.110:59504] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxe_gWL-zKlchkVWS1OzAAAADg"]
[Sat Jul 18 23:22:06.912938 2026] [security2:error] [pid 882519:tid 882726] [client 223.185.61.63:28534] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxe_qL84xJUTmx6eO6fVQAAANI"]
[Sat Jul 18 23:22:06.913048 2026] [security2:error] [pid 882519:tid 882726] [client 223.185.61.63:28534] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxe_qL84xJUTmx6eO6fVQAAANI"]
[Sat Jul 18 23:22:07.041383 2026] [ssl:error] [pid 881201:tid 881409] [client 98.84.1.175:48563] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname webdisk.primests.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:22:07.519418 2026] [security2:error] [pid 882519:tid 882774] [client 103.48.44.9:60110] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxe_6L84xJUTmx6eO6fYgAAAQI"]
[Sat Jul 18 23:22:07.519513 2026] [security2:error] [pid 882519:tid 882774] [client 103.48.44.9:60110] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxe_6L84xJUTmx6eO6fYgAAAQI"]
[Sat Jul 18 23:22:07.981302 2026] [security2:error] [pid 882519:tid 882641] [remote 68.178.160.25:58876] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxe_6L84xJUTmx6eO6feAAAlnk"]
[Sat Jul 18 23:22:08.276658 2026] [security2:error] [pid 881201:tid 881304] [remote 66.33.212.6:44932] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 6.212.33.66.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "kpb.qlr.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfAAWL-zKlchkVWS1O_gAAYmU"]
[Sat Jul 18 23:22:08.459542 2026] [security2:error] [pid 881201:tid 881228] [remote 66.33.212.6:44932] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 6.212.33.66.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "kpb.qlr.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfAAWL-zKlchkVWS1PAwAAQRk"], referer: https://kpb.qlr.mybluehost.me/wp-login.php
[Sat Jul 18 23:22:08.811225 2026] [security2:error] [pid 882519:tid 882758] [client 47.128.97.54:42250] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "abilityplus.org"] [uri "/robots.txt"] [unique_id "alxfAKL84xJUTmx6eO6fkgAAAPI"]
[Sat Jul 18 23:22:08.916464 2026] [security2:error] [pid 882519:tid 882521] [remote 72.167.132.114:33046] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "alrowad-hub.net"] [uri "/wp-login.php"] [unique_id "alxfAKL84xJUTmx6eO6fmAAAigE"]
[Sat Jul 18 23:22:09.732820 2026] [security2:error] [pid 882519:tid 882534] [remote 72.167.132.114:33046] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "alrowad-hub.net"] [uri "/wp-login.php"] [unique_id "alxfAaL84xJUTmx6eO6fuAAAjg4"], referer: https://alrowad-hub.net/wp-login.php
[Sat Jul 18 23:22:10.186024 2026] [security2:error] [pid 881201:tid 881414] [client 124.29.207.185:52747] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxfAgWL-zKlchkVWS1POgAAAFI"]
[Sat Jul 18 23:22:10.186243 2026] [security2:error] [pid 881201:tid 881414] [client 124.29.207.185:52747] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxfAgWL-zKlchkVWS1POgAAAFI"]
[Sat Jul 18 23:22:10.271895 2026] [security2:error] [pid 882519:tid 882744] [client 223.228.182.224:24915] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxfAqL84xJUTmx6eO6fyAAAAOQ"]
[Sat Jul 18 23:22:10.271997 2026] [security2:error] [pid 882519:tid 882744] [client 223.228.182.224:24915] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxfAqL84xJUTmx6eO6fyAAAAOQ"]
[Sat Jul 18 23:22:10.604693 2026] [security2:error] [pid 882519:tid 882531] [remote 97.74.93.24:34940] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfAqL84xJUTmx6eO6f0gAA9gs"]
[Sat Jul 18 23:22:11.054325 2026] [security2:error] [pid 882519:tid 882694] [client 119.154.81.234:64432] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfA6L84xJUTmx6eO6f3wAAALI"]
[Sat Jul 18 23:22:11.054447 2026] [security2:error] [pid 882519:tid 882694] [client 119.154.81.234:64432] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfA6L84xJUTmx6eO6f3wAAALI"]
[Sat Jul 18 23:22:11.328452 2026] [security2:error] [pid 881201:tid 881401] [client 35.84.117.23:60398] ModSecurity: Warning. Matched phrase "Sucuri" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "koaconsultants.com"] [uri "/"] [unique_id "alxfAwWL-zKlchkVWS1PYwAAAEU"]
[Sat Jul 18 23:22:11.752801 2026] [security2:error] [pid 882519:tid 882537] [remote 97.74.93.24:34940] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfA6L84xJUTmx6eO6f7QAA0BE"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:22:12.279865 2026] [security2:error] [pid 881201:tid 881398] [client 57.141.18.17:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "overloadcomedy.com"] [uri "/index.php"] [unique_id "alxfAQWL-zKlchkVWS1PGwAAAEI"]
[Sat Jul 18 23:22:12.767060 2026] [security2:error] [pid 882519:tid 882708] [client 57.141.18.47:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "weifangsmefarm.com"] [uri "/index.php"] [unique_id "alxfAqL84xJUTmx6eO6fzQAAAMA"]
[Sat Jul 18 23:22:13.520289 2026] [security2:error] [pid 882519:tid 882550] [remote 68.178.160.25:39708] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.pju.xqs.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxfBaL84xJUTmx6eO6gGQAA0x4"]
[Sat Jul 18 23:22:13.520449 2026] [security2:error] [pid 882519:tid 882727] [client 68.178.160.25:39708] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "mail.pju.xqs.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxfBaL84xJUTmx6eO6gGQAA0x4"]
[Sat Jul 18 23:22:13.716844 2026] [security2:error] [pid 882519:tid 882687] [client 35.84.117.23:0] ModSecurity: Warning. Matched phrase "Sucuri" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "koaconsultants.com"] [uri "/index.php"] [unique_id "alxfA6L84xJUTmx6eO6f6QAAAKs"]
[Sat Jul 18 23:22:13.814373 2026] [security2:error] [pid 881201:tid 881309] [remote 152.228.213.32:55176] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfBQWL-zKlchkVWS1PsQAAXmo"]
[Sat Jul 18 23:22:13.832282 2026] [security2:error] [pid 881201:tid 881436] [client 35.84.117.23:41962] ModSecurity: Warning. Matched phrase "Sucuri" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "koaconsultants.com"] [uri "/"] [unique_id "alxfAwWL-zKlchkVWS1PcQAAAC0"]
[Sat Jul 18 23:22:13.887144 2026] [security2:error] [pid 882519:tid 882558] [remote 68.178.160.25:58876] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxfBaL84xJUTmx6eO6gIgAAqSY"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:22:13.999660 2026] [security2:error] [pid 881201:tid 881304] [remote 152.228.213.32:55176] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfBQWL-zKlchkVWS1PuwAAZGU"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:22:15.549302 2026] [security2:error] [pid 882519:tid 882656] [client 190.245.146.99:64441] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfB6L84xJUTmx6eO6gTgAAAIw"]
[Sat Jul 18 23:22:15.556020 2026] [security2:error] [pid 882519:tid 882656] [client 190.245.146.99:64441] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfB6L84xJUTmx6eO6gTgAAAIw"]
[Sat Jul 18 23:22:16.812277 2026] [security2:error] [pid 881201:tid 881403] [client 223.185.61.63:32936] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfCAWL-zKlchkVWS1QJgAAAEc"]
[Sat Jul 18 23:22:16.812391 2026] [security2:error] [pid 881201:tid 881403] [client 223.185.61.63:32936] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfCAWL-zKlchkVWS1QJgAAAEc"]
[Sat Jul 18 23:22:16.985296 2026] [security2:error] [pid 881201:tid 881421] [client 27.34.68.67:31717] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfCAWL-zKlchkVWS1QKwAAAFk"]
[Sat Jul 18 23:22:16.985391 2026] [security2:error] [pid 881201:tid 881421] [client 27.34.68.67:31717] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfCAWL-zKlchkVWS1QKwAAAFk"]
[Sat Jul 18 23:22:17.050526 2026] [authz_core:error] [pid 881201:tid 881390] [client 35.84.117.23:0] AH01630: client denied by server configuration: /home4/koaconsu/public_html/wp-content/themes/ohio/index.php
[Sat Jul 18 23:22:17.241184 2026] [security2:error] [pid 881201:tid 881378] [client 35.84.117.23:60864] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "TRACE" at REQUEST_METHOD. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "52"] [id "340002"] [rev "3"] [msg "Atomicorp.com WAF Rules: TRACE/TRACK method denied"] [severity "CRITICAL"] [hostname "koaconsultants.com"] [uri "/"] [unique_id "alxfCQWL-zKlchkVWS1QOgAAAC4"]
[Sat Jul 18 23:22:17.285520 2026] [security2:error] [pid 881201:tid 881420] [client 171.4.232.110:60019] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfCQWL-zKlchkVWS1QPAAAAFg"]
[Sat Jul 18 23:22:17.285684 2026] [security2:error] [pid 881201:tid 881420] [client 171.4.232.110:60019] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfCQWL-zKlchkVWS1QPAAAAFg"]
[Sat Jul 18 23:22:17.617613 2026] [authz_core:error] [pid 882519:tid 882751] [client 35.84.117.23:0] AH01630: client denied by server configuration: /home4/koaconsu/public_html/wp-includes/css/index.php
[Sat Jul 18 23:22:18.133360 2026] [security2:error] [pid 882519:tid 882771] [client 103.48.44.9:60620] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfCqL84xJUTmx6eO6gmAAAAP8"]
[Sat Jul 18 23:22:18.133531 2026] [security2:error] [pid 882519:tid 882771] [client 103.48.44.9:60620] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfCqL84xJUTmx6eO6gmAAAAP8"]
[Sat Jul 18 23:22:18.565895 2026] [security2:error] [pid 881201:tid 881345] [client 65.111.28.27:43619] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "155"] [id "900406"] [msg "wp-login POST logging"] [data "200"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxfCgWL-zKlchkVWS1QXQAAAA0"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:22:18.612383 2026] [security2:error] [pid 881201:tid 881446] [client 223.228.182.224:43211] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxfCgWL-zKlchkVWS1QaQAAAHI"]
[Sat Jul 18 23:22:18.612556 2026] [security2:error] [pid 881201:tid 881446] [client 223.228.182.224:43211] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxfCgWL-zKlchkVWS1QaQAAAHI"]
[Sat Jul 18 23:22:18.962967 2026] [security2:error] [pid 881201:tid 881259] [remote 72.167.132.114:38932] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tadlarsen.com"] [uri "/wp-login.php"] [unique_id "alxfCgWL-zKlchkVWS1QdwAAQjg"]
[Sat Jul 18 23:22:20.255746 2026] [security2:error] [pid 881201:tid 881296] [remote 72.167.132.114:38932] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tadlarsen.com"] [uri "/wp-login.php"] [unique_id "alxfDAWL-zKlchkVWS1QnAAAAl0"], referer: https://tadlarsen.com/wp-login.php
[Sat Jul 18 23:22:20.312295 2026] [security2:error] [pid 881201:tid 881428] [client 66.228.34.49:38432] ModSecurity: Warning. Matched phrase "Sucuri" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "youpositive.co"] [uri "/sucuri-54934b83815411aea28df4191a51388c.php"] [unique_id "alxeogWL-zKlchkVWS04WwAAAGA"]
[Sat Jul 18 23:22:21.117174 2026] [security2:error] [pid 882519:tid 882709] [client 124.29.207.185:53191] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxfDaL84xJUTmx6eO6g_QAAAME"]
[Sat Jul 18 23:22:21.117257 2026] [security2:error] [pid 882519:tid 882709] [client 124.29.207.185:53191] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxfDaL84xJUTmx6eO6g_QAAAME"]
[Sat Jul 18 23:22:21.507257 2026] [security2:error] [pid 881201:tid 881318] [remote 165.232.173.236:48096] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 236.173.232.165.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxfDQWL-zKlchkVWS1QvgAAPHM"]
[Sat Jul 18 23:22:21.936378 2026] [security2:error] [pid 881201:tid 881307] [remote 165.232.173.236:48096] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 236.173.232.165.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxfDQWL-zKlchkVWS1QyQAAemg"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:22:21.997074 2026] [security2:error] [pid 882519:tid 882753] [client 50.116.65.227:37178] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "recruitinginsight.us"] [uri "/wp-cron.php"] [unique_id "alxfDaL84xJUTmx6eO6hEQAAAO0"]
[Sat Jul 18 23:22:22.030106 2026] [security2:error] [pid 881201:tid 881354] [client 195.172.108.88:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.secretkeynumerology.com"] [uri "/index.php"] [unique_id "alxfDQWL-zKlchkVWS1QxQAAABY"]
[Sat Jul 18 23:22:24.279396 2026] [security2:error] [pid 881201:tid 881443] [client 114.119.132.114:57059] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "nandansonscharitablefoundation.com"] [uri "/2019/11"] [unique_id "alxfEAWL-zKlchkVWS1RBgAAAG8"], referer: http://nandansonscharitablefoundation.com/2019/12/23/nandansons-supports-swaminarayan-akshardham-temple
[Sat Jul 18 23:22:24.556188 2026] [security2:error] [pid 881201:tid 881402] [client 31.171.130.33:65355] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/ms-themes.php"] [unique_id "alxfEAWL-zKlchkVWS1REAAAAEY"]
[Sat Jul 18 23:22:24.653488 2026] [security2:error] [pid 882519:tid 882697] [client 119.154.81.234:64888] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfEKL84xJUTmx6eO6haQAAALU"]
[Sat Jul 18 23:22:24.653594 2026] [security2:error] [pid 882519:tid 882697] [client 119.154.81.234:64888] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfEKL84xJUTmx6eO6haQAAALU"]
[Sat Jul 18 23:22:24.826470 2026] [security2:error] [pid 882519:tid 882633] [remote 113.160.142.119:39312] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thestudioatfruitland.com"] [uri "/wp-login.php"] [unique_id "alxfEKL84xJUTmx6eO6hbgAA3XE"]
[Sat Jul 18 23:22:24.865929 2026] [security2:error] [pid 882519:tid 882659] [client 216.73.216.123:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.website-7471409a.uritems.net"] [uri "/index.php"] [unique_id "alxfEKL84xJUTmx6eO6hbQAAAI8"]
[Sat Jul 18 23:22:25.207235 2026] [security2:error] [pid 881201:tid 881210] [remote 68.178.160.25:56336] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/wp-login.php"] [unique_id "alxfEQWL-zKlchkVWS1RIQAAHAc"]
[Sat Jul 18 23:22:25.319764 2026] [security2:error] [pid 882519:tid 882634] [remote 113.160.142.119:39312] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thestudioatfruitland.com"] [uri "/wp-login.php"] [unique_id "alxfEaL84xJUTmx6eO6hgAAA_3I"], referer: https://thestudioatfruitland.com/wp-login.php
[Sat Jul 18 23:22:25.428937 2026] [security2:error] [pid 882519:tid 882676] [client 18.139.208.24:21678] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.208.139.18.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxfEaL84xJUTmx6eO6hhAAAAKA"]
[Sat Jul 18 23:22:25.429143 2026] [security2:error] [pid 882519:tid 882676] [client 18.139.208.24:21678] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxfEaL84xJUTmx6eO6hhAAAAKA"]
[Sat Jul 18 23:22:25.671237 2026] [security2:error] [pid 882519:tid 882746] [client 31.171.130.20:31763] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/chosen.php"] [unique_id "alxfEaL84xJUTmx6eO6hlgAAAOY"]
[Sat Jul 18 23:22:25.763147 2026] [security2:error] [pid 881201:tid 881233] [remote 68.178.160.25:56336] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/wp-login.php"] [unique_id "alxfEQWL-zKlchkVWS1RMAAADh4"], referer: https://royalart-lb.com/wp-login.php
[Sat Jul 18 23:22:26.110626 2026] [security2:error] [pid 882519:tid 882775] [client 190.245.146.99:65076] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfEqL84xJUTmx6eO6hmgAAAQM"]
[Sat Jul 18 23:22:26.117186 2026] [security2:error] [pid 882519:tid 882775] [client 190.245.146.99:65076] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfEqL84xJUTmx6eO6hmgAAAQM"]
[Sat Jul 18 23:22:26.145211 2026] [security2:error] [pid 882519:tid 882645] [remote 68.178.160.25:56326] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "peoplestrategies.us"] [uri "/wp-login.php"] [unique_id "alxfEqL84xJUTmx6eO6hnAAAr30"]
[Sat Jul 18 23:22:26.397962 2026] [security2:error] [pid 882519:tid 882772] [client 223.185.61.63:25708] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfEqL84xJUTmx6eO6hqwAAAQA"]
[Sat Jul 18 23:22:26.398176 2026] [security2:error] [pid 882519:tid 882772] [client 223.185.61.63:25708] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfEqL84xJUTmx6eO6hqwAAAQA"]
[Sat Jul 18 23:22:26.551832 2026] [security2:error] [pid 881201:tid 881351] [client 27.34.68.67:62029] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfEgWL-zKlchkVWS1RSgAAABM"]
[Sat Jul 18 23:22:26.551941 2026] [security2:error] [pid 881201:tid 881351] [client 27.34.68.67:62029] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfEgWL-zKlchkVWS1RSgAAABM"]
[Sat Jul 18 23:22:26.770018 2026] [security2:error] [pid 882519:tid 882520] [remote 31.42.184.154:57034] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "secretkeynumerology.com"] [uri "/wp-login.php"] [unique_id "alxfEqL84xJUTmx6eO6htAAA3AA"]
[Sat Jul 18 23:22:26.990155 2026] [security2:error] [pid 882519:tid 882525] [remote 31.42.184.154:57034] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "secretkeynumerology.com"] [uri "/wp-login.php"] [unique_id "alxfEqL84xJUTmx6eO6htwAA1AU"], referer: https://secretkeynumerology.com/wp-login.php
[Sat Jul 18 23:22:27.420065 2026] [security2:error] [pid 882519:tid 882727] [client 31.171.130.7:59961] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/file.php"] [unique_id "alxfE6L84xJUTmx6eO6h2QAAANM"]
[Sat Jul 18 23:22:27.819541 2026] [security2:error] [pid 881201:tid 881434] [client 171.4.232.110:47345] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfEwWL-zKlchkVWS1RcgAAAGY"]
[Sat Jul 18 23:22:27.819698 2026] [security2:error] [pid 881201:tid 881434] [client 171.4.232.110:47345] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfEwWL-zKlchkVWS1RcgAAAGY"]
[Sat Jul 18 23:22:28.244191 2026] [security2:error] [pid 881201:tid 881375] [client 223.228.182.224:27057] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxfFAWL-zKlchkVWS1RggAAACs"]
[Sat Jul 18 23:22:28.244281 2026] [security2:error] [pid 881201:tid 881375] [client 223.228.182.224:27057] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxfFAWL-zKlchkVWS1RggAAACs"]
[Sat Jul 18 23:22:28.423611 2026] [security2:error] [pid 882519:tid 882757] [client 103.48.44.9:61140] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfFKL84xJUTmx6eO6h-gAAAPE"]
[Sat Jul 18 23:22:28.423712 2026] [security2:error] [pid 882519:tid 882757] [client 103.48.44.9:61140] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfFKL84xJUTmx6eO6h-gAAAPE"]
[Sat Jul 18 23:22:28.461692 2026] [security2:error] [pid 882519:tid 882776] [client 31.171.130.22:54457] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/flower.php"] [unique_id "alxfFKL84xJUTmx6eO6h-wAAAQQ"]
[Sat Jul 18 23:22:28.982119 2026] [security2:error] [pid 882519:tid 882679] [client 31.171.130.1:27963] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/gifclass.php"] [unique_id "alxfFKL84xJUTmx6eO6iCwAAAKM"]
[Sat Jul 18 23:22:29.047158 2026] [core:error] [pid 882519:tid 882748] [client 199.217.98.209:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:22:29.047184 2026] [core:error] [pid 882519:tid 882748] [client 199.217.98.209:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:22:29.476067 2026] [security2:error] [pid 882519:tid 882740] [client 65.111.28.60:60369] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 60.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxfFaL84xJUTmx6eO6iIgAAAOA"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:22:30.371539 2026] [security2:error] [pid 882519:tid 882577] [remote 57.141.18.26:40504] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 26.18.141.57.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/product/4409190"] [unique_id "alxfFqL84xJUTmx6eO6iRAAA3Tk"]
[Sat Jul 18 23:22:31.025289 2026] [security2:error] [pid 881201:tid 881375] [client 106.222.249.209:18976] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfFwWL-zKlchkVWS1R3QAAACs"]
[Sat Jul 18 23:22:31.025490 2026] [security2:error] [pid 881201:tid 881375] [client 106.222.249.209:18976] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfFwWL-zKlchkVWS1R3QAAACs"]
[Sat Jul 18 23:22:31.030785 2026] [security2:error] [pid 882519:tid 882652] [client 31.171.130.2:40813] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/bless.php"] [unique_id "alxfF6L84xJUTmx6eO6iVwAAAIg"]
[Sat Jul 18 23:22:31.126020 2026] [security2:error] [pid 882519:tid 882590] [remote 182.77.62.24:41502] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.62.77.182.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/wp-login.php"] [unique_id "alxfF6L84xJUTmx6eO6iXwAAmkY"]
[Sat Jul 18 23:22:31.160634 2026] [security2:error] [pid 882519:tid 882745] [client 124.29.246.106:53640] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxfF6L84xJUTmx6eO6iYQAAAOU"]
[Sat Jul 18 23:22:31.160808 2026] [security2:error] [pid 882519:tid 882745] [client 124.29.246.106:53640] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxfF6L84xJUTmx6eO6iYQAAAOU"]
[Sat Jul 18 23:22:31.198219 2026] [security2:error] [pid 881201:tid 881432] [client 65.111.28.3:64349] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 3.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxfFwWL-zKlchkVWS1R4gAAAGQ"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:22:31.252887 2026] [security2:error] [pid 881201:tid 881395] [client 119.154.81.234:65338] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfFwWL-zKlchkVWS1R5AAAAD8"]
[Sat Jul 18 23:22:31.253062 2026] [security2:error] [pid 881201:tid 881395] [client 119.154.81.234:65338] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfFwWL-zKlchkVWS1R5AAAAD8"]
[Sat Jul 18 23:22:31.512424 2026] [security2:error] [pid 882519:tid 882592] [remote 8.217.108.67:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/wp-login.php"] [unique_id "alxfF6L84xJUTmx6eO6ibQAA9Eg"]
[Sat Jul 18 23:22:31.526127 2026] [security2:error] [pid 882519:tid 882681] [client 50.116.65.227:46518] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.fkconstructionfunding.com"] [uri "/index.php"] [unique_id "alxfF6L84xJUTmx6eO6iYwAAAKU"]
[Sat Jul 18 23:22:31.667067 2026] [security2:error] [pid 882519:tid 882593] [remote 182.77.62.24:41502] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.62.77.182.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/wp-login.php"] [unique_id "alxfF6L84xJUTmx6eO6icwAAtUk"], referer: https://ghivs.com/wp-login.php
[Sat Jul 18 23:22:31.759742 2026] [security2:error] [pid 882519:tid 882751] [client 50.116.65.227:46532] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.fkconstructionfunding.com"] [uri "/index.php"] [unique_id "alxfF6L84xJUTmx6eO6ibwAAAOs"]
[Sat Jul 18 23:22:31.787707 2026] [security2:error] [pid 881201:tid 881430] [client 31.171.130.48:61975] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/class-t.api.php"] [unique_id "alxfFwWL-zKlchkVWS1R-QAAAGI"]
[Sat Jul 18 23:22:31.837390 2026] [security2:error] [pid 882519:tid 882754] [client 136.0.154.209:35872] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.sesamegreenbeans.com"] [uri "/index.php"] [unique_id "alxfF6L84xJUTmx6eO6icgAA7kQ"]
[Sat Jul 18 23:22:31.839064 2026] [security2:error] [pid 882519:tid 882753] [client 74.208.214.194:59512] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxfF6L84xJUTmx6eO6iewAAAO0"]
[Sat Jul 18 23:22:32.275983 2026] [security2:error] [pid 882519:tid 882666] [client 65.111.28.227:35469] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 227.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxfGKL84xJUTmx6eO6ihgAAAJY"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:22:33.148859 2026] [proxy:error] [pid 882519:tid 882684] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:22:33.148952 2026] [proxy_http:error] [pid 882519:tid 882684] [client 193.47.62.168:34194] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:22:33.149597 2026] [proxy:error] [pid 882519:tid 882684] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:22:33.149636 2026] [proxy_http:error] [pid 882519:tid 882684] [client 193.47.62.168:34194] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:22:33.210762 2026] [security2:error] [pid 882519:tid 882604] [remote 8.217.108.67:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/wp-login.php"] [unique_id "alxfGaL84xJUTmx6eO6imgAA31Q"], referer: https://nzfoodstory.com/wp-login.php
[Sat Jul 18 23:22:33.586173 2026] [security2:error] [pid 882519:tid 882691] [client 65.0.26.70:11200] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.26.0.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxfGaL84xJUTmx6eO6ioAAAAK8"]
[Sat Jul 18 23:22:33.953090 2026] [security2:error] [pid 881201:tid 881360] [client 35.84.117.23:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "koaconsultants.com"] [uri "/index.php"] [unique_id "alxfGQWL-zKlchkVWS1SPAAAABw"], referer: http://sucuri.net
[Sat Jul 18 23:22:34.092026 2026] [proxy:error] [pid 882519:tid 882656] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:22:34.092113 2026] [proxy_http:error] [pid 882519:tid 882656] [client 193.47.62.168:34198] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:22:34.092638 2026] [proxy:error] [pid 882519:tid 882656] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:22:34.092666 2026] [proxy_http:error] [pid 882519:tid 882656] [client 193.47.62.168:34198] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:22:34.143067 2026] [security2:error] [pid 882519:tid 882763] [client 31.171.130.38:41999] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/blurbs.php"] [unique_id "alxfGqL84xJUTmx6eO6isQAAAPc"]
[Sat Jul 18 23:22:34.248172 2026] [security2:error] [pid 881201:tid 881257] [remote 91.142.222.105:46380] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxfGgWL-zKlchkVWS1STAAAYDY"]
[Sat Jul 18 23:22:35.218121 2026] [security2:error] [pid 881201:tid 881449] [client 35.84.117.23:44448] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "koaconsultants.com"] [uri "/index.php"] [unique_id "alxfGgWL-zKlchkVWS1SYQAAAHU"], referer: http://www.google.com/url/?sa=t
[Sat Jul 18 23:22:35.289173 2026] [security2:error] [pid 881201:tid 881316] [remote 91.142.222.105:46380] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxfGwWL-zKlchkVWS1ScQAAP3E"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:22:35.894195 2026] [security2:error] [pid 881201:tid 881440] [client 13.232.206.133:64170] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "155"] [id "900406"] [msg "wp-login POST logging"] [data "200"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxfGwWL-zKlchkVWS1SZwAAAGw"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:22:36.694250 2026] [security2:error] [pid 882519:tid 882742] [client 190.245.146.99:49220] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfHKL84xJUTmx6eO6i8wAAAOI"]
[Sat Jul 18 23:22:36.694398 2026] [security2:error] [pid 882519:tid 882742] [client 190.245.146.99:49220] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfHKL84xJUTmx6eO6i8wAAAOI"]
[Sat Jul 18 23:22:36.772520 2026] [security2:error] [pid 882519:tid 882715] [client 65.111.28.204:45691] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 204.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxfHKL84xJUTmx6eO6i9gAAAMc"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:22:36.997448 2026] [security2:error] [pid 882519:tid 882718] [client 223.185.61.63:24027] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfHKL84xJUTmx6eO6i_wAAAMo"]
[Sat Jul 18 23:22:36.997561 2026] [security2:error] [pid 882519:tid 882718] [client 223.185.61.63:24027] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfHKL84xJUTmx6eO6i_wAAAMo"]
[Sat Jul 18 23:22:37.131158 2026] [security2:error] [pid 882519:tid 882684] [client 27.34.68.67:40102] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfHaL84xJUTmx6eO6jAwAAAKg"]
[Sat Jul 18 23:22:37.131254 2026] [security2:error] [pid 882519:tid 882684] [client 27.34.68.67:40102] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfHaL84xJUTmx6eO6jAwAAAKg"]
[Sat Jul 18 23:22:37.200649 2026] [security2:error] [pid 882519:tid 882624] [remote 72.167.132.114:47844] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nextlevelpressurewashing.com"] [uri "/wp-login.php"] [unique_id "alxfHaL84xJUTmx6eO6jBQAAs2g"]
[Sat Jul 18 23:22:37.366138 2026] [security2:error] [pid 882519:tid 882764] [client 3.149.57.90:3754] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "windowtx.com"] [uri "/index.php"] [unique_id "alxfHKL84xJUTmx6eO6i-QAAAPg"], referer: https://windowtx.com
[Sat Jul 18 23:22:37.446630 2026] [security2:error] [pid 882519:tid 882620] [remote 72.167.132.114:47844] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nextlevelpressurewashing.com"] [uri "/wp-login.php"] [unique_id "alxfHaL84xJUTmx6eO6jCgAA62Q"], referer: https://nextlevelpressurewashing.com/wp-login.php
[Sat Jul 18 23:22:37.731445 2026] [security2:error] [pid 882519:tid 882661] [client 31.171.130.3:46817] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/akcc.php"] [unique_id "alxfHaL84xJUTmx6eO6jEQAAAJE"]
[Sat Jul 18 23:22:38.430736 2026] [security2:error] [pid 882519:tid 882684] [client 50.116.65.227:25038] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxfHqL84xJUTmx6eO6jNwAAAKg"]
[Sat Jul 18 23:22:38.447277 2026] [security2:error] [pid 882519:tid 882708] [client 50.116.65.227:46612] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxfHqL84xJUTmx6eO6jOAAAAMA"]
[Sat Jul 18 23:22:38.472450 2026] [security2:error] [pid 882519:tid 882701] [client 171.4.232.110:61068] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfHqL84xJUTmx6eO6jOwAAALk"]
[Sat Jul 18 23:22:38.472866 2026] [security2:error] [pid 882519:tid 882701] [client 171.4.232.110:61068] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfHqL84xJUTmx6eO6jOwAAALk"]
[Sat Jul 18 23:22:38.954782 2026] [security2:error] [pid 881201:tid 881363] [client 114.119.145.198:59217] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.margaretspeckogawa.com"] [uri "/about-2"] [unique_id "alxfHgWL-zKlchkVWS1S4QAAAB8"], referer: https://www.margaretspeckogawa.com/about
[Sat Jul 18 23:22:39.039179 2026] [security2:error] [pid 882519:tid 882702] [client 223.228.182.224:52523] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxfH6L84xJUTmx6eO6jYgAAALo"]
[Sat Jul 18 23:22:39.039335 2026] [security2:error] [pid 882519:tid 882702] [client 223.228.182.224:52523] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxfH6L84xJUTmx6eO6jYgAAALo"]
[Sat Jul 18 23:22:39.072608 2026] [security2:error] [pid 882519:tid 882717] [client 103.48.44.9:61649] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfH6L84xJUTmx6eO6jZAAAAMk"]
[Sat Jul 18 23:22:39.072790 2026] [security2:error] [pid 882519:tid 882717] [client 103.48.44.9:61649] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfH6L84xJUTmx6eO6jZAAAAMk"]
[Sat Jul 18 23:22:39.143700 2026] [security2:error] [pid 882519:tid 882704] [client 31.171.130.47:42971] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/abcd.php"] [unique_id "alxfH6L84xJUTmx6eO6jbAAAALw"]
[Sat Jul 18 23:22:40.814979 2026] [security2:error] [pid 882519:tid 882616] [remote 68.178.160.25:48882] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "peoplestrategies.us"] [uri "/wp-login.php"] [unique_id "alxfIKL84xJUTmx6eO6j0gAA-mA"], referer: https://peoplestrategies.us/wp-login.php
[Sat Jul 18 23:22:41.147384 2026] [security2:error] [pid 882519:tid 882679] [client 122.2.108.12:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "kingsafety.ca"] [uri "/index.php"] [unique_id "alxfHqL84xJUTmx6eO6jIwAAAKM"]
[Sat Jul 18 23:22:41.416666 2026] [security2:error] [pid 882519:tid 882738] [client 106.222.249.209:1993] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfIaL84xJUTmx6eO6j_wAAAN4"]
[Sat Jul 18 23:22:41.417230 2026] [security2:error] [pid 882519:tid 882738] [client 106.222.249.209:1993] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfIaL84xJUTmx6eO6j_wAAAN4"]
[Sat Jul 18 23:22:41.680511 2026] [security2:error] [pid 881201:tid 881408] [client 119.154.81.234:49396] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfIQWL-zKlchkVWS1TEwAAAEw"]
[Sat Jul 18 23:22:41.680615 2026] [security2:error] [pid 881201:tid 881408] [client 119.154.81.234:49396] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfIQWL-zKlchkVWS1TEwAAAEw"]
[Sat Jul 18 23:22:42.127027 2026] [security2:error] [pid 882519:tid 882759] [client 31.171.130.12:55721] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/shelp.php"] [unique_id "alxfIqL84xJUTmx6eO6kJAAAAPM"]
[Sat Jul 18 23:22:42.142367 2026] [security2:error] [pid 882519:tid 882656] [client 124.29.207.185:54094] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxfIqL84xJUTmx6eO6kJgAAAIw"]
[Sat Jul 18 23:22:42.142464 2026] [security2:error] [pid 882519:tid 882656] [client 124.29.207.185:54094] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxfIqL84xJUTmx6eO6kJgAAAIw"]
[Sat Jul 18 23:22:43.369508 2026] [security2:error] [pid 882519:tid 882552] [remote 182.77.62.24:41778] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.62.77.182.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.walkingandtalking.net"] [uri "/wp-login.php"] [unique_id "alxfI6L84xJUTmx6eO6kTwAAuyA"]
[Sat Jul 18 23:22:43.515216 2026] [security2:error] [pid 881201:tid 881218] [remote 120.72.98.5:17976] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mazzucelli.com"] [uri "/wp-login.php"] [unique_id "alxfIwWL-zKlchkVWS1TNwAAVw8"]
[Sat Jul 18 23:22:43.816537 2026] [security2:error] [pid 882519:tid 882686] [client 74.208.214.194:40012] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxfI6L84xJUTmx6eO6kXQAAAKo"]
[Sat Jul 18 23:22:43.905357 2026] [security2:error] [pid 882519:tid 882563] [remote 182.77.62.24:41778] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.62.77.182.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.walkingandtalking.net"] [uri "/wp-login.php"] [unique_id "alxfI6L84xJUTmx6eO6kYgAAwis"], referer: https://mail.walkingandtalking.net/wp-login.php
[Sat Jul 18 23:22:43.997926 2026] [security2:error] [pid 881201:tid 881275] [remote 120.72.98.5:17976] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mazzucelli.com"] [uri "/wp-login.php"] [unique_id "alxfIwWL-zKlchkVWS1TRAAAFkg"], referer: https://mazzucelli.com/wp-login.php
[Sat Jul 18 23:22:43.999284 2026] [security2:error] [pid 881201:tid 881359] [client 4.194.24.143:23141] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/nine2code.php"] [unique_id "alxfIwWL-zKlchkVWS1TRQAAABs"]
[Sat Jul 18 23:22:44.542058 2026] [security2:error] [pid 882519:tid 882669] [client 4.194.24.143:24861] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/num.php"] [unique_id "alxfJKL84xJUTmx6eO6kfQAAAJk"]
[Sat Jul 18 23:22:45.090107 2026] [security2:error] [pid 881201:tid 881373] [client 4.194.24.143:17448] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/odf7udtspqtpxzyxmw2rccdefault.php"] [unique_id "alxfJQWL-zKlchkVWS1TWgAAACk"]
[Sat Jul 18 23:22:45.684609 2026] [security2:error] [pid 881201:tid 881395] [client 4.194.24.143:17873] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/option.php"] [unique_id "alxfJQWL-zKlchkVWS1TZQAAAD8"]
[Sat Jul 18 23:22:46.208488 2026] [security2:error] [pid 882519:tid 882729] [client 45.3.40.15:23575] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.40.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxfJqL84xJUTmx6eO6kyAAAANU"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:22:46.252649 2026] [security2:error] [pid 882519:tid 882754] [client 4.194.24.143:17884] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/p.php"] [unique_id "alxfJqL84xJUTmx6eO6kzAAAAO4"]
[Sat Jul 18 23:22:46.673110 2026] [security2:error] [pid 881201:tid 881455] [client 3.79.134.69:19656] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "mtlegnews.gov"] [uri "/index.php"] [unique_id "alxfJgWL-zKlchkVWS1TcQAAAHs"], referer: https://mtlegnews.gov/
[Sat Jul 18 23:22:46.815175 2026] [security2:error] [pid 882519:tid 882767] [client 4.194.24.143:17472] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/past.php"] [unique_id "alxfJqL84xJUTmx6eO6k5gAAAPs"]
[Sat Jul 18 23:22:46.822292 2026] [security2:error] [pid 882519:tid 882725] [client 45.3.52.234:32453] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.52.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxfJqL84xJUTmx6eO6k5AAAANE"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:22:46.990575 2026] [security2:error] [pid 882519:tid 882670] [client 31.171.130.34:23485] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/cord.php"] [unique_id "alxfJqL84xJUTmx6eO6k6wAAAJo"]
[Sat Jul 18 23:22:47.212992 2026] [security2:error] [pid 882519:tid 882682] [client 190.245.146.99:49758] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfJ6L84xJUTmx6eO6k9AAAAKY"]
[Sat Jul 18 23:22:47.218906 2026] [security2:error] [pid 882519:tid 882682] [client 190.245.146.99:49758] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfJ6L84xJUTmx6eO6k9AAAAKY"]
[Sat Jul 18 23:22:47.382735 2026] [security2:error] [pid 882519:tid 882737] [client 4.194.24.143:17860] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/php.php"] [unique_id "alxfJ6L84xJUTmx6eO6k_gAAAN0"]
[Sat Jul 18 23:22:47.594176 2026] [security2:error] [pid 881201:tid 881411] [client 223.185.61.63:6062] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfJwWL-zKlchkVWS1TfwAAAE8"]
[Sat Jul 18 23:22:47.594982 2026] [security2:error] [pid 881201:tid 881411] [client 223.185.61.63:6062] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfJwWL-zKlchkVWS1TfwAAAE8"]
[Sat Jul 18 23:22:47.617888 2026] [security2:error] [pid 882519:tid 882629] [remote 72.167.132.114:34050] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "fiq.jjc.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfJ6L84xJUTmx6eO6lAgAArG0"]
[Sat Jul 18 23:22:47.649851 2026] [security2:error] [pid 882519:tid 882754] [client 27.34.68.67:56267] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfJ6L84xJUTmx6eO6lBAAAAO4"]
[Sat Jul 18 23:22:47.649934 2026] [security2:error] [pid 882519:tid 882754] [client 27.34.68.67:56267] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfJ6L84xJUTmx6eO6lBAAAAO4"]
[Sat Jul 18 23:22:47.675803 2026] [security2:error] [pid 881201:tid 881440] [client 65.111.28.209:31827] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxfJwWL-zKlchkVWS1TggAAAGw"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:22:47.979407 2026] [security2:error] [pid 882519:tid 882692] [client 4.194.24.143:24866] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/php8.php"] [unique_id "alxfJ6L84xJUTmx6eO6lEQAAALA"]
[Sat Jul 18 23:22:48.494791 2026] [security2:error] [pid 882519:tid 882533] [remote 72.167.132.114:34050] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "fiq.jjc.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfKKL84xJUTmx6eO6lKQAArg0"], referer: https://fiq.jjc.mybluehost.me/wp-login.php
[Sat Jul 18 23:22:48.557816 2026] [security2:error] [pid 882519:tid 882712] [client 4.194.24.143:43992] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/phpinfo.php"] [unique_id "alxfKKL84xJUTmx6eO6lLwAAAMQ"]
[Sat Jul 18 23:22:48.576705 2026] [security2:error] [pid 882519:tid 882525] [remote 152.228.213.32:49868] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxfKKL84xJUTmx6eO6lMAAAuQU"]
[Sat Jul 18 23:22:48.638766 2026] [security2:error] [pid 882519:tid 882704] [client 66.249.88.42:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "areitoproducciones.com"] [uri "/index.php"] [unique_id "alxfJaL84xJUTmx6eO6klAAAALw"]
[Sat Jul 18 23:22:48.657035 2026] [security2:error] [pid 882519:tid 882713] [client 31.171.130.15:58491] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/dex.php"] [unique_id "alxfKKL84xJUTmx6eO6lMgAAAMU"]
[Sat Jul 18 23:22:48.766939 2026] [security2:error] [pid 882519:tid 882520] [remote 152.228.213.32:49868] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxfKKL84xJUTmx6eO6lNAAApAA"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:22:49.047261 2026] [security2:error] [pid 882519:tid 882710] [client 171.4.232.110:47999] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfKaL84xJUTmx6eO6lPgAAAMI"]
[Sat Jul 18 23:22:49.047383 2026] [security2:error] [pid 882519:tid 882710] [client 171.4.232.110:47999] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfKaL84xJUTmx6eO6lPgAAAMI"]
[Sat Jul 18 23:22:49.081066 2026] [security2:error] [pid 882519:tid 882650] [client 45.3.45.118:16615] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxfKaL84xJUTmx6eO6lPwAAAIY"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:22:49.547142 2026] [security2:error] [pid 882519:tid 882654] [client 103.48.44.9:62136] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfKaL84xJUTmx6eO6lWgAAAIo"]
[Sat Jul 18 23:22:49.547259 2026] [security2:error] [pid 882519:tid 882654] [client 103.48.44.9:62136] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfKaL84xJUTmx6eO6lWgAAAIo"]
[Sat Jul 18 23:22:49.809484 2026] [proxy:error] [pid 882519:tid 882775] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:22:49.809566 2026] [proxy_http:error] [pid 882519:tid 882775] [client 193.47.62.168:35156] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:22:49.810996 2026] [proxy:error] [pid 882519:tid 882775] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:22:49.811047 2026] [proxy_http:error] [pid 882519:tid 882775] [client 193.47.62.168:35156] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:22:50.082228 2026] [security2:error] [pid 882519:tid 882761] [client 223.228.182.224:43207] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxfKqL84xJUTmx6eO6lawAAAPU"]
[Sat Jul 18 23:22:50.082361 2026] [security2:error] [pid 882519:tid 882761] [client 223.228.182.224:43207] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxfKqL84xJUTmx6eO6lawAAAPU"]
[Sat Jul 18 23:22:50.297704 2026] [security2:error] [pid 882519:tid 882650] [client 31.171.130.23:23705] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxfKqL84xJUTmx6eO6leAAAAIY"]
[Sat Jul 18 23:22:50.425053 2026] [security2:error] [pid 882519:tid 882692] [client 4.194.24.143:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "ravmike.com"] [uri "/index.php"] [unique_id "alxfKaL84xJUTmx6eO6lRAAAALA"]
[Sat Jul 18 23:22:50.434807 2026] [security2:error] [pid 882519:tid 882682] [client 45.41.180.97:37780] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.sesamegreenbeans.com"] [uri "/index.php"] [unique_id "alxfKqL84xJUTmx6eO6lcwAApiI"]
[Sat Jul 18 23:22:50.614795 2026] [security2:error] [pid 881201:tid 881448] [client 4.194.24.143:17633] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/post.php"] [unique_id "alxfKgWL-zKlchkVWS1T3QAAAHQ"]
[Sat Jul 18 23:22:51.166811 2026] [security2:error] [pid 881201:tid 881345] [client 4.194.24.143:17886] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/public/assets/design_1/css/parts/course_cards/grid_card_1.min.php"] [unique_id "alxfKwWL-zKlchkVWS1T-AAAAA0"]
[Sat Jul 18 23:22:51.743228 2026] [security2:error] [pid 882519:tid 882745] [client 65.111.28.216:41889] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxfK6L84xJUTmx6eO6lqAAAAOU"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:22:51.748561 2026] [security2:error] [pid 882519:tid 882658] [client 4.194.24.143:44014] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/public/css.php"] [unique_id "alxfK6L84xJUTmx6eO6lqgAAAI4"]
[Sat Jul 18 23:22:51.816135 2026] [security2:error] [pid 881201:tid 881375] [client 31.171.130.44:35203] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/zwso.php"] [unique_id "alxfKwWL-zKlchkVWS1UCQAAACs"]
[Sat Jul 18 23:22:51.985180 2026] [security2:error] [pid 882519:tid 882743] [client 106.222.249.209:22455] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfK6L84xJUTmx6eO6lswAAAOM"]
[Sat Jul 18 23:22:51.985310 2026] [security2:error] [pid 882519:tid 882743] [client 106.222.249.209:22455] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfK6L84xJUTmx6eO6lswAAAOM"]
[Sat Jul 18 23:22:52.176889 2026] [security2:error] [pid 882519:tid 882769] [client 124.29.207.185:54568] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxfLKL84xJUTmx6eO6lvQAAAP0"]
[Sat Jul 18 23:22:52.176977 2026] [security2:error] [pid 882519:tid 882769] [client 124.29.207.185:54568] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxfLKL84xJUTmx6eO6lvQAAAP0"]
[Sat Jul 18 23:22:52.281809 2026] [security2:error] [pid 882519:tid 882655] [client 119.154.81.234:49876] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfLKL84xJUTmx6eO6lwAAAAIs"]
[Sat Jul 18 23:22:52.281914 2026] [security2:error] [pid 882519:tid 882655] [client 119.154.81.234:49876] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfLKL84xJUTmx6eO6lwAAAAIs"]
[Sat Jul 18 23:22:52.307620 2026] [security2:error] [pid 881201:tid 881411] [client 4.194.24.143:17859] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/r.php"] [unique_id "alxfLAWL-zKlchkVWS1UFwAAAE8"]
[Sat Jul 18 23:22:52.879657 2026] [security2:error] [pid 882519:tid 882734] [client 4.194.24.143:17610] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/radio.php"] [unique_id "alxfLKL84xJUTmx6eO6l1QAAANo"]
[Sat Jul 18 23:22:53.355378 2026] [security2:error] [pid 881201:tid 881304] [remote 113.160.142.119:58944] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxfLQWL-zKlchkVWS1UOwAAbmU"]
[Sat Jul 18 23:22:53.355574 2026] [security2:error] [pid 881201:tid 881442] [client 113.160.142.119:58944] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxfLQWL-zKlchkVWS1UOwAAbmU"]
[Sat Jul 18 23:22:53.428677 2026] [security2:error] [pid 881201:tid 881393] [client 4.194.24.143:17443] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/randkeyword.php7"] [unique_id "alxfLQWL-zKlchkVWS1UQAAAAD0"]
[Sat Jul 18 23:22:53.749992 2026] [security2:error] [pid 881201:tid 881396] [client 74.7.227.179:59162] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxfLQWL-zKlchkVWS1USgAAQDM"], referer: https://tejasenvironmental.com/p=2362820
[Sat Jul 18 23:22:53.814514 2026] [security2:error] [pid 882519:tid 882714] [client 57.141.18.38:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxfLaL84xJUTmx6eO6l6gAAAMY"]
[Sat Jul 18 23:22:53.895804 2026] [security2:error] [pid 881201:tid 881335] [client 31.171.130.49:57581] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxfLQWL-zKlchkVWS1UVQAAAAM"]
[Sat Jul 18 23:22:53.973879 2026] [security2:error] [pid 882519:tid 882743] [client 4.194.24.143:17445] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/readme.php"] [unique_id "alxfLaL84xJUTmx6eO6l9wAAAOM"]
[Sat Jul 18 23:22:54.385163 2026] [security2:error] [pid 882519:tid 882723] [client 50.116.65.227:28336] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxfLqL84xJUTmx6eO6mAgAAAM8"]
[Sat Jul 18 23:22:54.400495 2026] [security2:error] [pid 881201:tid 881336] [client 50.116.65.227:37628] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxfLgWL-zKlchkVWS1UbwAAAAQ"]
[Sat Jul 18 23:22:54.582508 2026] [security2:error] [pid 882519:tid 882709] [client 4.194.24.143:17603] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/reze.php"] [unique_id "alxfLqL84xJUTmx6eO6mCgAAAME"]
[Sat Jul 18 23:22:55.175829 2026] [security2:error] [pid 882519:tid 882705] [client 4.194.24.143:17417] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/rh.php"] [unique_id "alxfL6L84xJUTmx6eO6mGgAAAL0"]
[Sat Jul 18 23:22:55.262448 2026] [security2:error] [pid 881201:tid 881435] [client 31.171.130.52:20023] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/bolt.php"] [unique_id "alxfLwWL-zKlchkVWS1UigAAAGc"]
[Sat Jul 18 23:22:55.718140 2026] [security2:error] [pid 882519:tid 882755] [client 4.194.24.143:17463] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/rip.php"] [unique_id "alxfL6L84xJUTmx6eO6mKQAAAO8"]
[Sat Jul 18 23:22:56.007773 2026] [security2:error] [pid 882519:tid 882765] [client 142.147.196.122:20358] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.sesamegreenbeans.com"] [uri "/index.php"] [unique_id "alxfL6L84xJUTmx6eO6mMgAA-XU"]
[Sat Jul 18 23:22:56.277166 2026] [security2:error] [pid 882519:tid 882717] [client 4.194.24.143:24868] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/root.php"] [unique_id "alxfMKL84xJUTmx6eO6mSAAAAMk"]
[Sat Jul 18 23:22:56.455360 2026] [security2:error] [pid 881201:tid 881376] [client 45.3.45.22:61653] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 22.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxfMAWL-zKlchkVWS1UuAAAACw"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:22:56.824177 2026] [security2:error] [pid 882519:tid 882734] [client 4.194.24.143:17439] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/s.php"] [unique_id "alxfMKL84xJUTmx6eO6mWQAAANo"]
[Sat Jul 18 23:22:56.897743 2026] [security2:error] [pid 881201:tid 881369] [client 31.171.130.39:36713] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/cjfuns.php"] [unique_id "alxfMAWL-zKlchkVWS1UyQAAACU"]
[Sat Jul 18 23:22:57.320919 2026] [security2:error] [pid 882519:tid 882687] [client 34.84.236.5:21605] ModSecurity: Access denied with code 406 (phase 1). Pattern match "python-requests|python-urllib" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "1460"] [id "909111"] [msg "Python UA brute"] [hostname "thewelloiledlife.com"] [uri "/wp-content/uploads/cache/2016/08/16-KidScents-Oils/1283432333.jpg"] [unique_id "alxfMaL84xJUTmx6eO6mcgAAAKs"]
[Sat Jul 18 23:22:57.418887 2026] [security2:error] [pid 882519:tid 882668] [client 4.194.24.143:17909] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/sang.php"] [unique_id "alxfMaL84xJUTmx6eO6mdgAAAJg"]
[Sat Jul 18 23:22:57.798483 2026] [security2:error] [pid 881201:tid 881451] [client 190.245.146.99:50291] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfMQWL-zKlchkVWS1U5wAAAHc"]
[Sat Jul 18 23:22:57.804451 2026] [security2:error] [pid 881201:tid 881451] [client 190.245.146.99:50291] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfMQWL-zKlchkVWS1U5wAAAHc"]
[Sat Jul 18 23:22:57.968333 2026] [security2:error] [pid 881201:tid 881415] [client 4.194.24.143:43569] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/scxy.php"] [unique_id "alxfMQWL-zKlchkVWS1U8AAAAFM"]
[Sat Jul 18 23:22:58.019308 2026] [security2:error] [pid 881201:tid 881378] [client 31.171.130.11:42539] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/wp-admin/css/index.php"] [unique_id "alxfMgWL-zKlchkVWS1U8wAAAC4"]
[Sat Jul 18 23:22:58.124828 2026] [security2:error] [pid 881201:tid 881368] [client 223.185.61.63:6266] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfMgWL-zKlchkVWS1U-AAAACQ"]
[Sat Jul 18 23:22:58.125210 2026] [security2:error] [pid 881201:tid 881368] [client 223.185.61.63:6266] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfMgWL-zKlchkVWS1U-AAAACQ"]
[Sat Jul 18 23:22:58.276029 2026] [security2:error] [pid 881201:tid 881340] [client 27.34.68.67:40797] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfMgWL-zKlchkVWS1VAQAAAAg"]
[Sat Jul 18 23:22:58.276598 2026] [security2:error] [pid 881201:tid 881340] [client 27.34.68.67:40797] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfMgWL-zKlchkVWS1VAQAAAAg"]
[Sat Jul 18 23:22:58.352414 2026] [security2:error] [pid 882519:tid 882674] [client 34.73.232.127:48158] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "juniper3medical.com"] [uri "/"] [unique_id "alxfMqL84xJUTmx6eO6mlQAAAJ4"]
[Sat Jul 18 23:22:58.514249 2026] [security2:error] [pid 882519:tid 882741] [client 31.171.130.37:60909] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/wp-content/plugins/index.php"] [unique_id "alxfMqL84xJUTmx6eO6mngAAAOE"]
[Sat Jul 18 23:22:58.527443 2026] [security2:error] [pid 882519:tid 882699] [client 4.194.24.143:61928] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/sd.php"] [unique_id "alxfMqL84xJUTmx6eO6mnwAAALc"]
[Sat Jul 18 23:22:59.007576 2026] [security2:error] [pid 882519:tid 882753] [client 31.171.130.43:30089] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/wp-content/index.php"] [unique_id "alxfM6L84xJUTmx6eO6mrAAAAO0"]
[Sat Jul 18 23:22:59.104492 2026] [security2:error] [pid 881201:tid 881432] [client 4.194.24.143:17916] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/sf.php"] [unique_id "alxfMwWL-zKlchkVWS1VKwAAAGQ"]
[Sat Jul 18 23:22:59.278671 2026] [security2:error] [pid 881201:tid 881365] [client 57.141.18.97:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxfMgWL-zKlchkVWS1VEgAAACE"]
[Sat Jul 18 23:22:59.506557 2026] [security2:error] [pid 882519:tid 882690] [client 31.171.130.12:63953] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/ioxi-o.php"] [unique_id "alxfM6L84xJUTmx6eO6myAAAAK4"]
[Sat Jul 18 23:22:59.592372 2026] [security2:error] [pid 882519:tid 882695] [client 171.4.232.110:62087] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfM6L84xJUTmx6eO6mygAAALM"]
[Sat Jul 18 23:22:59.592524 2026] [security2:error] [pid 882519:tid 882695] [client 171.4.232.110:62087] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfM6L84xJUTmx6eO6mygAAALM"]
[Sat Jul 18 23:22:59.670640 2026] [security2:error] [pid 882519:tid 882729] [client 4.194.24.143:43582] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/shell.php"] [unique_id "alxfM6L84xJUTmx6eO6m0wAAANU"]
[Sat Jul 18 23:23:00.008453 2026] [security2:error] [pid 881201:tid 881366] [client 34.73.232.127:37112] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "juniper3medical.com"] [uri "/wp-json/batch/v1"] [unique_id "alxfNAWL-zKlchkVWS1VSAAAACI"]
[Sat Jul 18 23:23:00.048920 2026] [security2:error] [pid 881201:tid 881411] [client 103.48.44.9:62390] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.44.48.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfNAWL-zKlchkVWS1VSwAAAE8"]
[Sat Jul 18 23:23:00.049054 2026] [security2:error] [pid 881201:tid 881411] [client 103.48.44.9:62390] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfNAWL-zKlchkVWS1VSwAAAE8"]
[Sat Jul 18 23:23:00.066269 2026] [security2:error] [pid 882519:tid 882719] [client 31.171.130.10:21829] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/insc.php"] [unique_id "alxfNKL84xJUTmx6eO6m6QAAAMs"]
[Sat Jul 18 23:23:00.314605 2026] [security2:error] [pid 882519:tid 882701] [client 4.194.24.143:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "ravmike.com"] [uri "/index.php"] [unique_id "alxfNKL84xJUTmx6eO6m7QAAALk"]
[Sat Jul 18 23:23:00.496210 2026] [security2:error] [pid 882519:tid 882736] [client 4.194.24.143:24856] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/sid3.php"] [unique_id "alxfNKL84xJUTmx6eO6m9AAAANw"]
[Sat Jul 18 23:23:00.504441 2026] [security2:error] [pid 881201:tid 881371] [client 34.73.232.127:37112] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "juniper3medical.com"] [uri "/"] [unique_id "alxfNAWL-zKlchkVWS1VXAAAACc"]
[Sat Jul 18 23:23:00.926818 2026] [security2:error] [pid 881201:tid 881447] [client 223.228.182.224:51380] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxfNAWL-zKlchkVWS1VaAAAAHM"]
[Sat Jul 18 23:23:00.926935 2026] [security2:error] [pid 881201:tid 881447] [client 223.228.182.224:51380] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxfNAWL-zKlchkVWS1VaAAAAHM"]
[Sat Jul 18 23:23:01.046936 2026] [security2:error] [pid 881201:tid 881349] [client 4.194.24.143:61892] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/simple.php"] [unique_id "alxfNQWL-zKlchkVWS1VbwAAABE"]
[Sat Jul 18 23:23:01.115732 2026] [security2:error] [pid 882519:tid 882768] [client 31.171.130.47:23031] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/classwithtostring.php"] [unique_id "alxfNaL84xJUTmx6eO6nDAAAAPw"]
[Sat Jul 18 23:23:01.668316 2026] [security2:error] [pid 881201:tid 881413] [client 31.171.130.19:39013] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/txets.php"] [unique_id "alxfNQWL-zKlchkVWS1ViAAAAFE"]
[Sat Jul 18 23:23:01.669289 2026] [security2:error] [pid 882519:tid 882750] [client 4.194.24.143:24864] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/sitemap.php"] [unique_id "alxfNaL84xJUTmx6eO6nHwAAAOo"]
[Sat Jul 18 23:23:02.210721 2026] [security2:error] [pid 881201:tid 881377] [client 31.171.130.13:21907] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/wp-content/themes/txets.php"] [unique_id "alxfNgWL-zKlchkVWS1VngAAAC0"]
[Sat Jul 18 23:23:02.227437 2026] [security2:error] [pid 882519:tid 882666] [client 4.194.24.143:44658] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/size.php"] [unique_id "alxfNqL84xJUTmx6eO6nMQAAAJY"]
[Sat Jul 18 23:23:02.538691 2026] [security2:error] [pid 881201:tid 881374] [client 106.222.249.209:11247] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfNgWL-zKlchkVWS1VrwAAACo"]
[Sat Jul 18 23:23:02.538843 2026] [security2:error] [pid 881201:tid 881374] [client 106.222.249.209:11247] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfNgWL-zKlchkVWS1VrwAAACo"]
[Sat Jul 18 23:23:02.676643 2026] [security2:error] [pid 881201:tid 881370] [client 65.111.28.117:59227] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxfNgWL-zKlchkVWS1VtgAAACY"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:23:02.682740 2026] [security2:error] [pid 881201:tid 881386] [client 3.21.39.251:52660] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/phpinfo.php"] [unique_id "alxfNgWL-zKlchkVWS1VtQAAADY"]
[Sat Jul 18 23:23:02.694860 2026] [security2:error] [pid 882519:tid 882673] [client 31.171.130.12:20087] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/wp-admin/txets.php"] [unique_id "alxfNqL84xJUTmx6eO6nRAAAAJ0"]
[Sat Jul 18 23:23:02.793795 2026] [security2:error] [pid 881201:tid 881397] [client 4.194.24.143:44620] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/sm.php"] [unique_id "alxfNgWL-zKlchkVWS1VvgAAAEE"]
[Sat Jul 18 23:23:02.834066 2026] [security2:error] [pid 881201:tid 881423] [client 3.21.39.251:52664] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/info.php"] [unique_id "alxfNgWL-zKlchkVWS1VvwAAAFs"]
[Sat Jul 18 23:23:02.986157 2026] [security2:error] [pid 882519:tid 882731] [client 3.21.39.251:52676] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/php.php"] [unique_id "alxfNqL84xJUTmx6eO6nUwAAANc"]
[Sat Jul 18 23:23:03.104775 2026] [security2:error] [pid 881201:tid 881402] [client 65.111.28.118:32139] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxfNwWL-zKlchkVWS1VxAAAAEY"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:23:03.138709 2026] [security2:error] [pid 882519:tid 882732] [client 3.21.39.251:52688] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/i.php"] [unique_id "alxfN6L84xJUTmx6eO6nXAAAANg"]
[Sat Jul 18 23:23:03.227702 2026] [security2:error] [pid 881201:tid 881416] [client 119.154.81.234:50572] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfNwWL-zKlchkVWS1VyQAAAFQ"]
[Sat Jul 18 23:23:03.227877 2026] [security2:error] [pid 881201:tid 881416] [client 119.154.81.234:50572] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfNwWL-zKlchkVWS1VyQAAAFQ"]
[Sat Jul 18 23:23:03.245273 2026] [security2:error] [pid 882519:tid 882707] [client 31.171.130.35:37279] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/wp-includes/txets.php"] [unique_id "alxfN6L84xJUTmx6eO6nYgAAAL8"]
[Sat Jul 18 23:23:03.290578 2026] [security2:error] [pid 881201:tid 881373] [client 3.21.39.251:52698] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/pi.php"] [unique_id "alxfNwWL-zKlchkVWS1VywAAACk"]
[Sat Jul 18 23:23:03.345085 2026] [security2:error] [pid 881201:tid 881404] [client 4.194.24.143:43522] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/sql.php"] [unique_id "alxfNwWL-zKlchkVWS1VzAAAAEg"]
[Sat Jul 18 23:23:03.443944 2026] [security2:error] [pid 882519:tid 882727] [client 3.21.39.251:52708] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/pinfo.php"] [unique_id "alxfN6L84xJUTmx6eO6naAAAANM"]
[Sat Jul 18 23:23:03.598850 2026] [security2:error] [pid 881201:tid 881410] [client 3.21.39.251:52724] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/test.php"] [unique_id "alxfNwWL-zKlchkVWS1V0gAAAE4"]
[Sat Jul 18 23:23:03.750914 2026] [security2:error] [pid 882519:tid 882704] [client 31.171.130.45:32449] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/goods.php"] [unique_id "alxfN6L84xJUTmx6eO6ncgAAALw"]
[Sat Jul 18 23:23:03.813533 2026] [security2:error] [pid 881201:tid 881359] [client 3.21.39.251:51134] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/p.php"] [unique_id "alxfNwWL-zKlchkVWS1V3wAAABs"]
[Sat Jul 18 23:23:03.915527 2026] [security2:error] [pid 881201:tid 881405] [client 4.194.24.143:61913] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/ss.php"] [unique_id "alxfNwWL-zKlchkVWS1V4QAAAEk"]
[Sat Jul 18 23:23:03.966718 2026] [security2:error] [pid 881201:tid 881433] [client 3.21.39.251:51136] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/debug.php"] [unique_id "alxfNwWL-zKlchkVWS1V5AAAAGU"]
[Sat Jul 18 23:23:04.118473 2026] [security2:error] [pid 882519:tid 882671] [client 3.21.39.251:51150] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/admin/phpinfo.php"] [unique_id "alxfOKL84xJUTmx6eO6ngQAAAJs"]
[Sat Jul 18 23:23:04.272539 2026] [security2:error] [pid 882519:tid 882683] [client 3.21.39.251:51166] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/test/phpinfo.php"] [unique_id "alxfOKL84xJUTmx6eO6nigAAAKc"]
[Sat Jul 18 23:23:04.313547 2026] [security2:error] [pid 881201:tid 881360] [client 31.171.130.29:45833] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/wp-editor.php"] [unique_id "alxfOAWL-zKlchkVWS1V6QAAABw"]
[Sat Jul 18 23:23:04.428142 2026] [security2:error] [pid 882519:tid 882760] [client 3.21.39.251:51172] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/dev/phpinfo.php"] [unique_id "alxfOKL84xJUTmx6eO6nkQAAAPQ"]
[Sat Jul 18 23:23:04.472080 2026] [security2:error] [pid 882519:tid 882746] [client 4.194.24.143:44006] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/stats.php"] [unique_id "alxfOKL84xJUTmx6eO6nlgAAAOY"]
[Sat Jul 18 23:23:04.584816 2026] [security2:error] [pid 882519:tid 882662] [client 3.21.39.251:51180] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/old/phpinfo.php"] [unique_id "alxfOKL84xJUTmx6eO6nmwAAAJI"]
[Sat Jul 18 23:23:04.737186 2026] [security2:error] [pid 882519:tid 882722] [client 3.21.39.251:51182] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/tmp/phpinfo.php"] [unique_id "alxfOKL84xJUTmx6eO6npAAAAM4"]
[Sat Jul 18 23:23:04.892352 2026] [security2:error] [pid 881201:tid 881397] [client 3.21.39.251:51194] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/public/phpinfo.php"] [unique_id "alxfOAWL-zKlchkVWS1V8AAAAEE"]
[Sat Jul 18 23:23:05.067553 2026] [security2:error] [pid 881201:tid 881423] [client 4.194.24.143:61911] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/sump1.php"] [unique_id "alxfOQWL-zKlchkVWS1V8gAAAFs"]
[Sat Jul 18 23:23:05.107291 2026] [security2:error] [pid 882519:tid 882670] [client 3.21.39.251:51196] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/php-info.php"] [unique_id "alxfOaL84xJUTmx6eO6ntQAAAJo"]
[Sat Jul 18 23:23:05.129725 2026] [security2:error] [pid 882519:tid 882699] [client 14.224.227.113:59249] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxfOaL84xJUTmx6eO6ntgAAALc"]
[Sat Jul 18 23:23:05.207625 2026] [security2:error] [pid 882519:tid 882555] [remote 78.46.99.182:51016] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 182.99.46.78.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "hilltopnurseryinc.com"] [uri "/wp-login.php"] [unique_id "alxfOaL84xJUTmx6eO6nuQAAwyM"]
[Sat Jul 18 23:23:05.240335 2026] [security2:error] [pid 881201:tid 881345] [client 45.3.45.242:10961] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 242.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxfOQWL-zKlchkVWS1V9AAAAA0"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:23:05.259542 2026] [security2:error] [pid 881201:tid 881335] [client 3.21.39.251:51198] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/phpversion.php"] [unique_id "alxfOQWL-zKlchkVWS1V9wAAAAM"]
[Sat Jul 18 23:23:05.411213 2026] [security2:error] [pid 882519:tid 882766] [client 3.21.39.251:51208] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/_phpinfo.php"] [unique_id "alxfOaL84xJUTmx6eO6nzwAAAPo"]
[Sat Jul 18 23:23:05.507364 2026] [security2:error] [pid 882519:tid 882545] [remote 78.46.99.182:51016] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 182.99.46.78.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "hilltopnurseryinc.com"] [uri "/wp-login.php"] [unique_id "alxfOaL84xJUTmx6eO6n1wAAkxk"], referer: https://hilltopnurseryinc.com/wp-login.php
[Sat Jul 18 23:23:05.564548 2026] [security2:error] [pid 882519:tid 882772] [client 3.21.39.251:51210] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/old_phpinfo.php"] [unique_id "alxfOaL84xJUTmx6eO6n2gAAAQA"]
[Sat Jul 18 23:23:05.613886 2026] [security2:error] [pid 882519:tid 882651] [client 4.194.24.143:44000] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/system.php"] [unique_id "alxfOaL84xJUTmx6eO6n3gAAAIc"]
[Sat Jul 18 23:23:05.716997 2026] [security2:error] [pid 882519:tid 882740] [client 3.21.39.251:51226] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/server-info.php"] [unique_id "alxfOaL84xJUTmx6eO6n4QAAAOA"]
[Sat Jul 18 23:23:05.869419 2026] [security2:error] [pid 882519:tid 882656] [client 3.21.39.251:51232] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/server-status.php"] [unique_id "alxfOaL84xJUTmx6eO6n6QAAAIw"]
[Sat Jul 18 23:23:06.144387 2026] [security2:error] [pid 882519:tid 882731] [client 3.21.39.251:51236] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/webroot/index.php/_environment"] [unique_id "alxfOqL84xJUTmx6eO6n-QAAANc"]
[Sat Jul 18 23:23:06.214325 2026] [security2:error] [pid 882519:tid 882699] [client 4.194.24.143:44644] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/system/03n1hob7p03r2npdefault.php"] [unique_id "alxfOqL84xJUTmx6eO6n_AAAALc"]
[Sat Jul 18 23:23:06.298631 2026] [security2:error] [pid 881201:tid 881333] [client 3.21.39.251:51238] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/mail/phpinfo.php"] [unique_id "alxfOgWL-zKlchkVWS1WAgAAAAE"]
[Sat Jul 18 23:23:06.459038 2026] [security2:error] [pid 882519:tid 882709] [client 3.21.39.251:51244] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/cpanel/phpinfo.php"] [unique_id "alxfOqL84xJUTmx6eO6oCwAAAME"]
[Sat Jul 18 23:23:06.581276 2026] [security2:error] [pid 882519:tid 882707] [client 31.171.130.25:31823] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/lufix.php"] [unique_id "alxfOqL84xJUTmx6eO6oDgAAAL8"]
[Sat Jul 18 23:23:06.616461 2026] [security2:error] [pid 882519:tid 882773] [client 3.21.39.251:51246] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/hosting/phpinfo.php"] [unique_id "alxfOqL84xJUTmx6eO6oEAAAAQE"]
[Sat Jul 18 23:23:06.770494 2026] [security2:error] [pid 882519:tid 882655] [client 3.21.39.251:51262] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/webmail/phpinfo.php"] [unique_id "alxfOqL84xJUTmx6eO6oHAAAAIs"]
[Sat Jul 18 23:23:06.797219 2026] [security2:error] [pid 882519:tid 882694] [client 4.194.24.143:44013] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/system/cj5ha2rah8lyiqqdefault.php"] [unique_id "alxfOqL84xJUTmx6eO6oHQAAALI"]
[Sat Jul 18 23:23:06.926261 2026] [security2:error] [pid 882519:tid 882744] [client 3.21.39.251:51268] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/smtp/phpinfo.php"] [unique_id "alxfOqL84xJUTmx6eO6oJQAAAOQ"]
[Sat Jul 18 23:23:07.076995 2026] [security2:error] [pid 882519:tid 882768] [client 65.111.27.88:20967] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 88.27.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxfO6L84xJUTmx6eO6oJwAAAPw"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:23:07.078894 2026] [security2:error] [pid 882519:tid 882725] [client 3.21.39.251:51278] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/phpinfo.php.bak"] [unique_id "alxfO6L84xJUTmx6eO6oKwAAANE"]
[Sat Jul 18 23:23:07.234680 2026] [security2:error] [pid 882519:tid 882741] [client 3.21.39.251:51282] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/phpinfo.php.old"] [unique_id "alxfO6L84xJUTmx6eO6oMQAAAOE"]
[Sat Jul 18 23:23:07.388129 2026] [security2:error] [pid 882519:tid 882699] [client 3.21.39.251:51288] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/phpinfo.php~"] [unique_id "alxfO6L84xJUTmx6eO6oOAAAALc"]
[Sat Jul 18 23:23:07.431313 2026] [security2:error] [pid 882519:tid 882774] [client 4.194.24.143:61915] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/system_log.php"] [unique_id "alxfO6L84xJUTmx6eO6oOgAAAQI"]
[Sat Jul 18 23:23:07.542349 2026] [security2:error] [pid 881201:tid 881401] [client 3.21.39.251:51290] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/info.php.bak"] [unique_id "alxfOwWL-zKlchkVWS1WEAAAAEU"]
[Sat Jul 18 23:23:07.696511 2026] [security2:error] [pid 882519:tid 882776] [client 3.21.39.251:51304] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/phpinfo.php.save"] [unique_id "alxfO6L84xJUTmx6eO6oQgAAAQQ"]
[Sat Jul 18 23:23:07.719037 2026] [security2:error] [pid 881201:tid 881403] [client 104.207.60.96:18105] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 96.60.207.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxfOwWL-zKlchkVWS1WEwAAAEc"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:23:07.848546 2026] [security2:error] [pid 882519:tid 882719] [client 3.21.39.251:51316] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/staging/phpinfo.php"] [unique_id "alxfO6L84xJUTmx6eO6oRgAAAMs"]
[Sat Jul 18 23:23:07.976125 2026] [security2:error] [pid 881201:tid 881339] [client 4.194.24.143:43984] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/t.php"] [unique_id "alxfOwWL-zKlchkVWS1WFwAAAAc"]
[Sat Jul 18 23:23:07.999820 2026] [security2:error] [pid 882519:tid 882750] [client 3.21.39.251:51332] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/beta/phpinfo.php"] [unique_id "alxfO6L84xJUTmx6eO6oTAAAAOo"]
[Sat Jul 18 23:23:08.110050 2026] [security2:error] [pid 882519:tid 882692] [client 31.171.130.14:61885] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-ef628ae5.gjz.wtn.mybluehost.me"] [uri "/style.php"] [unique_id "alxfPKL84xJUTmx6eO6oUgAAALA"]
[Sat Jul 18 23:23:08.152508 2026] [security2:error] [pid 882519:tid 882713] [client 3.21.39.251:51344] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/uat/phpinfo.php"] [unique_id "alxfPKL84xJUTmx6eO6oVgAAAMU"]
[Sat Jul 18 23:23:08.304676 2026] [security2:error] [pid 882519:tid 882701] [client 3.21.39.251:51350] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/qa/phpinfo.php"] [unique_id "alxfPKL84xJUTmx6eO6oWgAAALk"]
[Sat Jul 18 23:23:08.340248 2026] [security2:error] [pid 881201:tid 881405] [client 190.245.146.99:50817] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfPAWL-zKlchkVWS1WHAAAAEk"]
[Sat Jul 18 23:23:08.342578 2026] [security2:error] [pid 882519:tid 882655] [client 65.111.26.198:58511] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 198.26.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxfPKL84xJUTmx6eO6oWwAAAIs"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:23:08.346243 2026] [security2:error] [pid 881201:tid 881405] [client 190.245.146.99:50817] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfPAWL-zKlchkVWS1WHAAAAEk"]
[Sat Jul 18 23:23:08.457603 2026] [security2:error] [pid 881201:tid 881363] [client 3.21.39.251:51364] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/preview/phpinfo.php"] [unique_id "alxfPAWL-zKlchkVWS1WHwAAAB8"]
[Sat Jul 18 23:23:08.469085 2026] [security2:error] [pid 881201:tid 881337] [client 103.112.136.30:33137] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 30.136.112.103.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "jndsupport.com"] [uri "/wp-comments-post.php"] [unique_id "alxfPAWL-zKlchkVWS1WHQAAAAU"]
[Sat Jul 18 23:23:08.469182 2026] [security2:error] [pid 881201:tid 881337] [client 103.112.136.30:33137] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "409"] [hostname "jndsupport.com"] [uri "/wp-comments-post.php"] [unique_id "alxfPAWL-zKlchkVWS1WHQAAAAU"]
[Sat Jul 18 23:23:08.517584 2026] [security2:error] [pid 881201:tid 881456] [client 4.194.24.143:17872] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/term.php"] [unique_id "alxfPAWL-zKlchkVWS1WIAAAAHw"]
[Sat Jul 18 23:23:08.612091 2026] [security2:error] [pid 882519:tid 882680] [client 3.21.39.251:51370] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/www/phpinfo.php"] [unique_id "alxfPKL84xJUTmx6eO6oaQAAAKQ"]
[Sat Jul 18 23:23:08.769325 2026] [security2:error] [pid 881201:tid 881360] [client 3.21.39.251:51382] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/htdocs/phpinfo.php"] [unique_id "alxfPAWL-zKlchkVWS1WJAAAABw"]
[Sat Jul 18 23:23:08.799274 2026] [security2:error] [pid 881201:tid 881457] [client 27.34.68.67:35572] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfPAWL-zKlchkVWS1WJQAAAH0"]
[Sat Jul 18 23:23:08.799388 2026] [security2:error] [pid 881201:tid 881457] [client 27.34.68.67:35572] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfPAWL-zKlchkVWS1WJQAAAH0"]
[Sat Jul 18 23:23:08.829838 2026] [security2:error] [pid 882519:tid 882744] [client 223.185.61.63:12503] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfPKL84xJUTmx6eO6ocgAAAOQ"]
[Sat Jul 18 23:23:08.829965 2026] [security2:error] [pid 882519:tid 882744] [client 223.185.61.63:12503] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfPKL84xJUTmx6eO6ocgAAAOQ"]
[Sat Jul 18 23:23:08.925094 2026] [security2:error] [pid 881201:tid 881447] [client 3.21.39.251:51390] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/public_html/phpinfo.php"] [unique_id "alxfPAWL-zKlchkVWS1WJwAAAHM"]
[Sat Jul 18 23:23:09.078075 2026] [security2:error] [pid 881201:tid 881395] [client 3.21.39.251:51402] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/site/phpinfo.php"] [unique_id "alxfPQWL-zKlchkVWS1WKgAAAD8"]
[Sat Jul 18 23:23:09.111448 2026] [security2:error] [pid 882519:tid 882693] [client 4.194.24.143:44619] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/test.php"] [unique_id "alxfPaL84xJUTmx6eO6oeQAAALE"]
[Sat Jul 18 23:23:09.229145 2026] [security2:error] [pid 882519:tid 882662] [client 3.21.39.251:51404] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/docs/phpinfo.php"] [unique_id "alxfPaL84xJUTmx6eO6ogQAAAJI"]
[Sat Jul 18 23:23:09.383253 2026] [security2:error] [pid 882519:tid 882706] [client 3.21.39.251:51420] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/wp-admin/phpinfo.php"] [unique_id "alxfPaL84xJUTmx6eO6oiQAAAL4"]
[Sat Jul 18 23:23:09.537038 2026] [security2:error] [pid 881201:tid 881345] [client 3.21.39.251:51430] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/administrator/phpinfo.php"] [unique_id "alxfPQWL-zKlchkVWS1WNQAAAA0"]
[Sat Jul 18 23:23:09.691264 2026] [security2:error] [pid 881201:tid 881357] [client 3.21.39.251:51444] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/core/phpinfo.php"] [unique_id "alxfPQWL-zKlchkVWS1WNgAAABk"]
[Sat Jul 18 23:23:09.717818 2026] [security2:error] [pid 881201:tid 881454] [client 4.194.24.143:43977] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/test1.php"] [unique_id "alxfPQWL-zKlchkVWS1WOwAAAHo"]
[Sat Jul 18 23:23:09.850632 2026] [security2:error] [pid 882519:tid 882712] [client 3.21.39.251:51448] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oda.jiv.mybluehost.me"] [uri "/includes/phpinfo.php"] [unique_id "alxfPaL84xJUTmx6eO6onAAAAMQ"]
[Sat Jul 18 23:23:10.083430 2026] [security2:error] [pid 882519:tid 882653] [client 171.4.232.110:48601] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfPqL84xJUTmx6eO6opQAAAIk"]
[Sat Jul 18 23:23:10.083576 2026] [security2:error] [pid 882519:tid 882653] [client 171.4.232.110:48601] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfPqL84xJUTmx6eO6opQAAAIk"]
[Sat Jul 18 23:23:10.219166 2026] [security2:error] [pid 882519:tid 882633] [remote 68.178.160.25:52066] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "deltat24.com"] [uri "/wp-login.php"] [unique_id "alxfPqL84xJUTmx6eO6oqQAAs3E"]
[Sat Jul 18 23:23:10.265627 2026] [security2:error] [pid 882519:tid 882714] [client 4.194.24.143:17864] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/tfm.php"] [unique_id "alxfPqL84xJUTmx6eO6oqgAAAMY"]
[Sat Jul 18 23:23:10.320558 2026] [security2:error] [pid 881201:tid 881332] [client 216.73.217.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "aleishapenny.ca"] [uri "/index.php"] [unique_id "alxfPgWL-zKlchkVWS1WQwAAABo"]
[Sat Jul 18 23:23:10.618881 2026] [security2:error] [pid 882519:tid 882751] [client 216.73.217.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "aleishapenny.ca"] [uri "/index.php"] [unique_id "alxfPqL84xJUTmx6eO6otwAA6wc"]
[Sat Jul 18 23:23:10.833124 2026] [security2:error] [pid 881201:tid 881401] [client 4.194.24.143:44660] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/thebe.php"] [unique_id "alxfPgWL-zKlchkVWS1WTQAAAEU"]
[Sat Jul 18 23:23:11.339208 2026] [proxy:error] [pid 882519:tid 882735] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:23:11.339291 2026] [proxy_http:error] [pid 882519:tid 882735] [client 193.47.62.168:32888] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:23:11.339968 2026] [proxy:error] [pid 882519:tid 882735] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:23:11.340000 2026] [proxy_http:error] [pid 882519:tid 882735] [client 193.47.62.168:32888] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:23:11.389876 2026] [security2:error] [pid 881201:tid 881363] [client 4.194.24.143:43979] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/themes.php"] [unique_id "alxfPwWL-zKlchkVWS1WXwAAAB8"]
[Sat Jul 18 23:23:11.635363 2026] [security2:error] [pid 882519:tid 882558] [remote 68.178.160.25:52066] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "deltat24.com"] [uri "/wp-login.php"] [unique_id "alxfP6L84xJUTmx6eO6o4gAAuyY"], referer: https://deltat24.com/wp-login.php
[Sat Jul 18 23:23:11.683833 2026] [security2:error] [pid 881201:tid 881218] [remote 103.75.185.95:45456] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxfPwWL-zKlchkVWS1WZAAAKg8"]
[Sat Jul 18 23:23:11.899858 2026] [security2:error] [pid 882519:tid 882742] [client 223.228.182.224:43221] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxfP6L84xJUTmx6eO6o7QAAAOI"]
[Sat Jul 18 23:23:11.899960 2026] [security2:error] [pid 882519:tid 882742] [client 223.228.182.224:43221] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxfP6L84xJUTmx6eO6o7QAAAOI"]
[Sat Jul 18 23:23:11.944291 2026] [security2:error] [pid 881201:tid 881352] [client 4.194.24.143:34212] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/tiny.php"] [unique_id "alxfPwWL-zKlchkVWS1WbgAAABQ"]
[Sat Jul 18 23:23:12.193548 2026] [security2:error] [pid 881201:tid 881209] [remote 103.75.185.95:45456] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxfQAWL-zKlchkVWS1WdQAAVAY"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:23:12.506189 2026] [security2:error] [pid 881201:tid 881378] [client 4.194.24.143:61942] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ravmike.com"] [uri "/tmp/byp.php"] [unique_id "alxfQAWL-zKlchkVWS1WfAAAAC4"]
[Sat Jul 18 23:23:12.881614 2026] [security2:error] [pid 881201:tid 881277] [remote 68.178.160.25:52054] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxfQAWL-zKlchkVWS1WfwAATEo"]
[Sat Jul 18 23:23:13.169439 2026] [security2:error] [pid 882519:tid 882737] [client 124.29.246.106:55532] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxfQaL84xJUTmx6eO6pJgAAAN0"]
[Sat Jul 18 23:23:13.169536 2026] [security2:error] [pid 882519:tid 882737] [client 124.29.246.106:55532] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxfQaL84xJUTmx6eO6pJgAAAN0"]
[Sat Jul 18 23:23:13.314736 2026] [security2:error] [pid 882519:tid 882775] [client 106.222.249.209:24245] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfQaL84xJUTmx6eO6pKgAAAQM"]
[Sat Jul 18 23:23:13.314872 2026] [security2:error] [pid 882519:tid 882775] [client 106.222.249.209:24245] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfQaL84xJUTmx6eO6pKgAAAQM"]
[Sat Jul 18 23:23:13.330042 2026] [security2:error] [pid 882519:tid 882743] [client 57.141.18.93:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "bandsir.com"] [uri "/index.php"] [unique_id "alxfQKL84xJUTmx6eO6pGwAAAOM"]
[Sat Jul 18 23:23:13.600218 2026] [security2:error] [pid 882519:tid 882687] [client 65.111.28.92:27267] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxfQaL84xJUTmx6eO6pNgAAAKs"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:23:13.724328 2026] [security2:error] [pid 882519:tid 882561] [remote 31.42.184.154:38918] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "massagelacey.com"] [uri "/wp-login.php"] [unique_id "alxfQaL84xJUTmx6eO6pOQAAyik"]
[Sat Jul 18 23:23:13.875016 2026] [security2:error] [pid 882519:tid 882684] [client 119.154.81.234:51222] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfQaL84xJUTmx6eO6pQAAAAKg"]
[Sat Jul 18 23:23:13.875117 2026] [security2:error] [pid 882519:tid 882684] [client 119.154.81.234:51222] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfQaL84xJUTmx6eO6pQAAAAKg"]
[Sat Jul 18 23:23:13.948144 2026] [security2:error] [pid 882519:tid 882593] [remote 31.42.184.154:38918] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "massagelacey.com"] [uri "/wp-login.php"] [unique_id "alxfQaL84xJUTmx6eO6pSQAA7Ek"], referer: https://massagelacey.com/wp-login.php
[Sat Jul 18 23:23:14.192478 2026] [security2:error] [pid 882519:tid 882696] [client 50.116.65.227:57060] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "lifeisbetterlakeside.com"] [uri "/wp-content/uploads/2024/08/IMG_8766.jpeg"] [unique_id "alxfQqL84xJUTmx6eO6pUAAAAME"]
[Sat Jul 18 23:23:14.990863 2026] [security2:error] [pid 881201:tid 881231] [remote 205.196.217.58:43390] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.217.196.205.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxfQgWL-zKlchkVWS1WmAAAcBw"]
[Sat Jul 18 23:23:15.253057 2026] [security2:error] [pid 881201:tid 881316] [remote 68.178.160.25:52054] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxfQwWL-zKlchkVWS1WnQAAHnE"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:23:15.396968 2026] [security2:error] [pid 881201:tid 881280] [remote 205.196.217.58:43390] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.217.196.205.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxfQwWL-zKlchkVWS1WoAAANk0"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:23:15.633436 2026] [security2:error] [pid 882519:tid 882693] [client 57.141.18.28:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxfQ6L84xJUTmx6eO6pmQAAALE"]
[Sat Jul 18 23:23:16.092893 2026] [security2:error] [pid 882519:tid 882700] [client 34.210.88.185:19830] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.88.210.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxfRKL84xJUTmx6eO6ptwAAALg"]
[Sat Jul 18 23:23:17.730792 2026] [security2:error] [pid 882519:tid 882748] [client 71.204.85.100:34763] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "lifeisbetterlakeside.com"] [uri "/index.php"] [unique_id "alxfRaL84xJUTmx6eO6p9gAA6BA"], referer: https://lifeisbetterlakeside.com/lemurs-up-close-and-personal-at-the-alabama-gulf-coast-zoo-part-2/
[Sat Jul 18 23:23:17.895297 2026] [security2:error] [pid 882519:tid 882740] [client 20.206.107.78:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 78.107.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cimexenvironmental.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "alxfRaL84xJUTmx6eO6qEAAAAOA"]
[Sat Jul 18 23:23:17.895408 2026] [security2:error] [pid 882519:tid 882740] [client 20.206.107.78:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cimexenvironmental.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "alxfRaL84xJUTmx6eO6qEAAAAOA"]
[Sat Jul 18 23:23:18.263377 2026] [security2:error] [pid 882519:tid 882579] [remote 4.205.168.44:53656] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "zbj.ahr.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxfRqL84xJUTmx6eO6qKAAAujs"]
[Sat Jul 18 23:23:18.263688 2026] [security2:error] [pid 882519:tid 882702] [client 4.205.168.44:53656] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "zbj.ahr.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxfRqL84xJUTmx6eO6qKAAAujs"]
[Sat Jul 18 23:23:18.284147 2026] [security2:error] [pid 882519:tid 882729] [client 31.171.130.7:40665] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/ms-themes.php"] [unique_id "alxfRqL84xJUTmx6eO6qKQAAANU"]
[Sat Jul 18 23:23:18.336818 2026] [security2:error] [pid 882519:tid 882727] [client 31.171.130.23:46535] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/ms-themes.php"] [unique_id "alxfRqL84xJUTmx6eO6qLAAAANM"]
[Sat Jul 18 23:23:18.343029 2026] [security2:error] [pid 881201:tid 881377] [client 31.171.130.48:61391] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/ms-themes.php"] [unique_id "alxfRgWL-zKlchkVWS1WyQAAAC0"]
[Sat Jul 18 23:23:18.373287 2026] [security2:error] [pid 881201:tid 881446] [client 31.171.130.29:60667] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/ms-themes.php"] [unique_id "alxfRgWL-zKlchkVWS1WygAAAHI"]
[Sat Jul 18 23:23:18.393735 2026] [security2:error] [pid 882519:tid 882769] [client 31.171.130.44:26201] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/ms-themes.php"] [unique_id "alxfRqL84xJUTmx6eO6qLwAAAP0"]
[Sat Jul 18 23:23:18.405281 2026] [security2:error] [pid 881201:tid 881334] [client 31.171.130.10:42561] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/ms-themes.php"] [unique_id "alxfRgWL-zKlchkVWS1WywAAAAI"]
[Sat Jul 18 23:23:18.732542 2026] [security2:error] [pid 881201:tid 881412] [client 3.108.60.216:40976] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxfRgWL-zKlchkVWS1W1QAAAFA"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:23:18.778405 2026] [security2:error] [pid 882519:tid 882674] [client 31.171.130.39:45547] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/chosen.php"] [unique_id "alxfRqL84xJUTmx6eO6qPgAAAJ4"]
[Sat Jul 18 23:23:18.798715 2026] [security2:error] [pid 882519:tid 882726] [client 190.245.146.99:51341] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfRqL84xJUTmx6eO6qPwAAANI"]
[Sat Jul 18 23:23:18.804922 2026] [security2:error] [pid 882519:tid 882726] [client 190.245.146.99:51341] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfRqL84xJUTmx6eO6qPwAAANI"]
[Sat Jul 18 23:23:18.811894 2026] [security2:error] [pid 882519:tid 882669] [client 31.171.130.32:60133] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/chosen.php"] [unique_id "alxfRqL84xJUTmx6eO6qQAAAAJk"]
[Sat Jul 18 23:23:18.826963 2026] [security2:error] [pid 881201:tid 881455] [client 31.171.130.43:31837] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/chosen.php"] [unique_id "alxfRgWL-zKlchkVWS1W1gAAAHs"]
[Sat Jul 18 23:23:18.890969 2026] [security2:error] [pid 882519:tid 882690] [client 31.171.130.10:62553] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/chosen.php"] [unique_id "alxfRqL84xJUTmx6eO6qRwAAAK4"]
[Sat Jul 18 23:23:18.904837 2026] [security2:error] [pid 881201:tid 881431] [client 31.171.130.14:22171] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/chosen.php"] [unique_id "alxfRgWL-zKlchkVWS1W1wAAAGM"]
[Sat Jul 18 23:23:18.909469 2026] [security2:error] [pid 882519:tid 882740] [client 31.171.130.30:36215] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/chosen.php"] [unique_id "alxfRqL84xJUTmx6eO6qSAAAAOA"]
[Sat Jul 18 23:23:19.196426 2026] [autoindex:error] [pid 882519:tid 882699] [client 20.206.107.78:0] AH01276: Cannot serve directory /home3/cimexenv/public_html/.well-known/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:23:19.196913 2026] [security2:error] [pid 882519:tid 882699] [client 20.206.107.78:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "404"] [hostname "cimexenvironmental.com"] [uri "/cgi-sys/403.html"] [unique_id "alxfR6L84xJUTmx6eO6qUgAAALc"]
[Sat Jul 18 23:23:19.276929 2026] [security2:error] [pid 881201:tid 881374] [client 31.171.130.39:46357] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/file.php"] [unique_id "alxfRwWL-zKlchkVWS1W3wAAACo"]
[Sat Jul 18 23:23:19.300262 2026] [security2:error] [pid 882519:tid 882667] [client 50.116.65.227:55360] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "lifeisbetterlakeside.com"] [uri "/wp-content/uploads/2024/08/IMG_8766.jpeg"] [unique_id "alxfR6L84xJUTmx6eO6qWAAAAJc"]
[Sat Jul 18 23:23:19.334291 2026] [security2:error] [pid 882519:tid 882687] [client 27.34.68.67:51214] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfR6L84xJUTmx6eO6qWwAAAKs"]
[Sat Jul 18 23:23:19.334418 2026] [security2:error] [pid 882519:tid 882687] [client 27.34.68.67:51214] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfR6L84xJUTmx6eO6qWwAAAKs"]
[Sat Jul 18 23:23:19.362418 2026] [security2:error] [pid 881201:tid 881354] [client 31.171.130.51:61741] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/ms-themes.php"] [unique_id "alxfRwWL-zKlchkVWS1W4QAAABY"]
[Sat Jul 18 23:23:19.427232 2026] [security2:error] [pid 882519:tid 882776] [client 31.171.130.6:32069] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/file.php"] [unique_id "alxfR6L84xJUTmx6eO6qYAAAAQQ"]
[Sat Jul 18 23:23:19.427273 2026] [security2:error] [pid 882519:tid 882755] [client 31.171.130.10:31735] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/file.php"] [unique_id "alxfR6L84xJUTmx6eO6qYQAAAO8"]
[Sat Jul 18 23:23:19.434210 2026] [security2:error] [pid 882519:tid 882756] [client 31.171.130.44:37827] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/file.php"] [unique_id "alxfR6L84xJUTmx6eO6qYgAAAPA"]
[Sat Jul 18 23:23:19.540856 2026] [security2:error] [pid 881201:tid 881423] [client 113.160.97.242:62569] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "wpad"] [uri "/wpad.dat"] [unique_id "alxfRwWL-zKlchkVWS1W4gAAAFs"]
[Sat Jul 18 23:23:19.540923 2026] [security2:error] [pid 882519:tid 882650] [client 113.160.97.242:62568] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "wpad"] [uri "/wpad.dat"] [unique_id "alxfR6L84xJUTmx6eO6qZgAAAIY"]
[Sat Jul 18 23:23:19.549480 2026] [security2:error] [pid 881201:tid 881365] [client 113.160.97.242:62567] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "wpad"] [uri "/wpad.dat"] [unique_id "alxfRwWL-zKlchkVWS1W4wAAACE"]
[Sat Jul 18 23:23:19.639785 2026] [security2:error] [pid 882519:tid 882717] [client 223.185.61.63:14788] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfR6L84xJUTmx6eO6qawAAAMk"]
[Sat Jul 18 23:23:19.639876 2026] [security2:error] [pid 882519:tid 882717] [client 223.185.61.63:14788] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfR6L84xJUTmx6eO6qawAAAMk"]
[Sat Jul 18 23:23:19.836557 2026] [security2:error] [pid 882519:tid 882672] [client 31.171.130.16:41701] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/flower.php"] [unique_id "alxfR6L84xJUTmx6eO6qdwAAAJw"]
[Sat Jul 18 23:23:19.857728 2026] [security2:error] [pid 882519:tid 882772] [client 31.171.130.27:60105] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/chosen.php"] [unique_id "alxfR6L84xJUTmx6eO6qeQAAAQA"]
[Sat Jul 18 23:23:19.922777 2026] [security2:error] [pid 882519:tid 882690] [client 31.171.130.21:31491] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/flower.php"] [unique_id "alxfR6L84xJUTmx6eO6qfQAAAK4"]
[Sat Jul 18 23:23:19.922847 2026] [security2:error] [pid 882519:tid 882681] [client 31.171.130.2:59573] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/flower.php"] [unique_id "alxfR6L84xJUTmx6eO6qfgAAAKU"]
[Sat Jul 18 23:23:19.966241 2026] [security2:error] [pid 881201:tid 881352] [client 31.171.130.24:57349] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/flower.php"] [unique_id "alxfRwWL-zKlchkVWS1W6QAAABQ"]
[Sat Jul 18 23:23:20.399398 2026] [security2:error] [pid 882519:tid 882738] [client 31.171.130.26:51029] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/file.php"] [unique_id "alxfSKL84xJUTmx6eO6qkwAAAN4"]
[Sat Jul 18 23:23:20.517318 2026] [security2:error] [pid 882519:tid 882773] [client 31.171.130.13:56195] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/gifclass.php"] [unique_id "alxfSKL84xJUTmx6eO6qmAAAAQE"]
[Sat Jul 18 23:23:20.517805 2026] [security2:error] [pid 882519:tid 882702] [client 31.171.130.29:46247] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/gifclass.php"] [unique_id "alxfSKL84xJUTmx6eO6qmQAAALo"]
[Sat Jul 18 23:23:20.521061 2026] [security2:error] [pid 881201:tid 881425] [client 31.171.130.5:42367] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/file.php"] [unique_id "alxfSAWL-zKlchkVWS1W-AAAAF0"]
[Sat Jul 18 23:23:20.521968 2026] [security2:error] [pid 881201:tid 881459] [client 31.171.130.28:53455] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/file.php"] [unique_id "alxfSAWL-zKlchkVWS1W-QAAAH8"]
[Sat Jul 18 23:23:20.653096 2026] [security2:error] [pid 882519:tid 882743] [client 31.171.130.41:36007] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/gifclass.php"] [unique_id "alxfSKL84xJUTmx6eO6qoAAAAOM"]
[Sat Jul 18 23:23:20.663643 2026] [security2:error] [pid 882519:tid 882763] [client 31.171.130.41:25849] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/gifclass.php"] [unique_id "alxfSKL84xJUTmx6eO6qogAAAPc"]
[Sat Jul 18 23:23:20.678597 2026] [security2:error] [pid 882519:tid 882693] [client 171.4.232.110:48923] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfSKL84xJUTmx6eO6qowAAALE"]
[Sat Jul 18 23:23:20.678705 2026] [security2:error] [pid 882519:tid 882693] [client 171.4.232.110:48923] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfSKL84xJUTmx6eO6qowAAALE"]
[Sat Jul 18 23:23:20.929089 2026] [security2:error] [pid 882519:tid 882694] [client 31.171.130.42:30297] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/flower.php"] [unique_id "alxfSKL84xJUTmx6eO6qrwAAALI"]
[Sat Jul 18 23:23:21.014837 2026] [security2:error] [pid 882519:tid 882641] [remote 68.178.160.25:60030] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxfSaL84xJUTmx6eO6qswAAvHk"]
[Sat Jul 18 23:23:21.025148 2026] [security2:error] [pid 881201:tid 881408] [client 31.171.130.13:41839] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/bless.php"] [unique_id "alxfSQWL-zKlchkVWS1W_gAAAEw"]
[Sat Jul 18 23:23:21.031307 2026] [ssl:error] [pid 882519:tid 882741] [client 54.86.115.253:57406] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname zeh.sqg.mybluehost.me provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:23:21.050694 2026] [security2:error] [pid 882519:tid 882681] [client 31.171.130.29:32273] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/flower.php"] [unique_id "alxfSaL84xJUTmx6eO6qtwAAAKU"]
[Sat Jul 18 23:23:21.066054 2026] [security2:error] [pid 881201:tid 881453] [client 31.171.130.42:30109] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/flower.php"] [unique_id "alxfSQWL-zKlchkVWS1W_wAAAHk"]
[Sat Jul 18 23:23:21.174421 2026] [security2:error] [pid 882519:tid 882719] [client 31.171.130.7:27955] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/bless.php"] [unique_id "alxfSaL84xJUTmx6eO6qugAAAMs"]
[Sat Jul 18 23:23:21.204488 2026] [security2:error] [pid 881201:tid 881442] [client 31.171.130.3:30725] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/bless.php"] [unique_id "alxfSQWL-zKlchkVWS1XAQAAAG4"]
[Sat Jul 18 23:23:21.454198 2026] [security2:error] [pid 882519:tid 882703] [client 31.171.130.30:58907] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/gifclass.php"] [unique_id "alxfSaL84xJUTmx6eO6qyAAAALs"]
[Sat Jul 18 23:23:21.567989 2026] [security2:error] [pid 882519:tid 882714] [client 31.171.130.14:53875] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/gifclass.php"] [unique_id "alxfSaL84xJUTmx6eO6qzAAAAMY"]
[Sat Jul 18 23:23:21.568380 2026] [security2:error] [pid 881201:tid 881364] [client 31.171.130.26:35807] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/gifclass.php"] [unique_id "alxfSQWL-zKlchkVWS1XCwAAACA"]
[Sat Jul 18 23:23:21.697572 2026] [security2:error] [pid 881201:tid 881435] [client 31.171.130.18:40543] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/class-t.api.php"] [unique_id "alxfSQWL-zKlchkVWS1XDQAAAGc"]
[Sat Jul 18 23:23:21.709545 2026] [security2:error] [pid 881201:tid 881412] [client 31.171.130.43:30773] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/class-t.api.php"] [unique_id "alxfSQWL-zKlchkVWS1XDwAAAFA"]
[Sat Jul 18 23:23:22.073633 2026] [security2:error] [pid 882519:tid 882746] [client 31.171.130.17:46925] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/bless.php"] [unique_id "alxfSqL84xJUTmx6eO6q6AAAAOY"]
[Sat Jul 18 23:23:22.137482 2026] [security2:error] [pid 882519:tid 882603] [remote 68.178.160.25:39320] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxfSqL84xJUTmx6eO6q6gAA-lM"]
[Sat Jul 18 23:23:22.182069 2026] [security2:error] [pid 882519:tid 882685] [client 31.171.130.52:50369] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/bless.php"] [unique_id "alxfSqL84xJUTmx6eO6q7AAAAKk"]
[Sat Jul 18 23:23:22.256583 2026] [security2:error] [pid 882519:tid 882734] [client 45.3.45.123:32573] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 123.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxfSqL84xJUTmx6eO6q7wAAANo"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:23:22.357416 2026] [security2:error] [pid 882519:tid 882656] [client 31.171.130.42:23035] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/bless.php"] [unique_id "alxfSqL84xJUTmx6eO6q_AAAAIw"]
[Sat Jul 18 23:23:22.393923 2026] [security2:error] [pid 882519:tid 882653] [client 31.171.130.24:51271] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/blurbs.php"] [unique_id "alxfSqL84xJUTmx6eO6rAQAAAIk"]
[Sat Jul 18 23:23:22.483900 2026] [security2:error] [pid 881201:tid 881382] [client 31.171.130.44:52325] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/blurbs.php"] [unique_id "alxfSgWL-zKlchkVWS1XGwAAADI"]
[Sat Jul 18 23:23:22.585929 2026] [security2:error] [pid 882519:tid 882715] [client 31.171.130.20:45811] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/class-t.api.php"] [unique_id "alxfSqL84xJUTmx6eO6rBwAAAMc"]
[Sat Jul 18 23:23:22.608735 2026] [security2:error] [pid 882519:tid 882697] [client 31.171.130.13:29185] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/class-t.api.php"] [unique_id "alxfSqL84xJUTmx6eO6rCQAAALU"]
[Sat Jul 18 23:23:22.673524 2026] [security2:error] [pid 882519:tid 882683] [client 31.171.130.43:65343] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/class-t.api.php"] [unique_id "alxfSqL84xJUTmx6eO6rDQAAAKc"]
[Sat Jul 18 23:23:22.695627 2026] [security2:error] [pid 882519:tid 882674] [client 223.228.182.224:27046] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxfSqL84xJUTmx6eO6rDwAAAJ4"]
[Sat Jul 18 23:23:22.695743 2026] [security2:error] [pid 882519:tid 882674] [client 223.228.182.224:27046] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxfSqL84xJUTmx6eO6rDwAAAJ4"]
[Sat Jul 18 23:23:22.754877 2026] [security2:error] [pid 882519:tid 882526] [remote 68.178.160.25:60044] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.upf.ztf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxfSqL84xJUTmx6eO6rEQAA6wY"]
[Sat Jul 18 23:23:22.755033 2026] [security2:error] [pid 882519:tid 882751] [client 68.178.160.25:60044] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "mail.upf.ztf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxfSqL84xJUTmx6eO6rEQAA6wY"]
[Sat Jul 18 23:23:22.874849 2026] [security2:error] [pid 882519:tid 882696] [client 31.171.130.46:20265] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/akcc.php"] [unique_id "alxfSqL84xJUTmx6eO6rGQAAALQ"]
[Sat Jul 18 23:23:22.964228 2026] [security2:error] [pid 882519:tid 882698] [client 31.171.130.38:42961] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/akcc.php"] [unique_id "alxfSqL84xJUTmx6eO6rIQAAALY"]
[Sat Jul 18 23:23:22.991529 2026] [security2:error] [pid 882519:tid 882556] [remote 68.178.160.25:60030] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxfSqL84xJUTmx6eO6rIwAAvSQ"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:23:23.075270 2026] [security2:error] [pid 882519:tid 882704] [client 31.171.130.22:50665] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/blurbs.php"] [unique_id "alxfS6L84xJUTmx6eO6rJwAAALw"]
[Sat Jul 18 23:23:23.089565 2026] [security2:error] [pid 882519:tid 882723] [client 31.171.130.45:63807] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/blurbs.php"] [unique_id "alxfS6L84xJUTmx6eO6rKAAAAM8"]
[Sat Jul 18 23:23:23.159838 2026] [security2:error] [pid 882519:tid 882716] [client 31.171.130.7:42293] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/blurbs.php"] [unique_id "alxfS6L84xJUTmx6eO6rLgAAAMg"]
[Sat Jul 18 23:23:23.194862 2026] [security2:error] [pid 882519:tid 882740] [client 31.171.130.28:36601] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/bless.php"] [unique_id "alxfS6L84xJUTmx6eO6rMQAAAOA"]
[Sat Jul 18 23:23:23.449228 2026] [security2:error] [pid 881201:tid 881361] [client 31.171.130.41:56559] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/abcd.php"] [unique_id "alxfSwWL-zKlchkVWS1XLQAAAB0"]
[Sat Jul 18 23:23:23.556093 2026] [security2:error] [pid 881201:tid 881437] [client 31.171.130.39:34483] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/akcc.php"] [unique_id "alxfSwWL-zKlchkVWS1XNAAAAGk"]
[Sat Jul 18 23:23:23.563807 2026] [security2:error] [pid 881201:tid 881452] [client 31.171.130.26:35327] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/akcc.php"] [unique_id "alxfSwWL-zKlchkVWS1XNQAAAHg"]
[Sat Jul 18 23:23:23.598696 2026] [autoindex:error] [pid 882519:tid 882685] [client 20.193.250.173:63665] AH01276: Cannot serve directory /home1/zanjanfr/public_html/gertoger/wp-admin/css/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sat Jul 18 23:23:23.680299 2026] [security2:error] [pid 882519:tid 882699] [client 31.171.130.52:55065] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/class-t.api.php"] [unique_id "alxfS6L84xJUTmx6eO6rRQAAALc"]
[Sat Jul 18 23:23:23.748585 2026] [security2:error] [pid 881201:tid 881243] [remote 152.228.213.32:34550] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "narv.co"] [uri "/wp-login.php"] [unique_id "alxfSwWL-zKlchkVWS1XNgAABig"]
[Sat Jul 18 23:23:23.872041 2026] [security2:error] [pid 882519:tid 882754] [client 31.171.130.23:32931] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/class-t.api.php"] [unique_id "alxfS6L84xJUTmx6eO6rTQAAAO4"]
[Sat Jul 18 23:23:23.926006 2026] [security2:error] [pid 882519:tid 882726] [client 106.222.249.209:10222] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfS6L84xJUTmx6eO6rUQAAANI"]
[Sat Jul 18 23:23:23.926365 2026] [security2:error] [pid 882519:tid 882726] [client 106.222.249.209:10222] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfS6L84xJUTmx6eO6rUQAAANI"]
[Sat Jul 18 23:23:23.932175 2026] [security2:error] [pid 881201:tid 881234] [remote 152.228.213.32:34550] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "narv.co"] [uri "/wp-login.php"] [unique_id "alxfSwWL-zKlchkVWS1XPAAAGh8"], referer: https://narv.co/wp-login.php
[Sat Jul 18 23:23:24.109419 2026] [security2:error] [pid 882519:tid 882728] [client 31.171.130.26:61279] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/abcd.php"] [unique_id "alxfTKL84xJUTmx6eO6rWgAAANQ"]
[Sat Jul 18 23:23:24.123524 2026] [security2:error] [pid 882519:tid 882752] [client 31.171.130.36:20309] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/abcd.php"] [unique_id "alxfTKL84xJUTmx6eO6rXAAAAOw"]
[Sat Jul 18 23:23:24.162937 2026] [security2:error] [pid 882519:tid 882748] [client 31.171.130.21:29503] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/blurbs.php"] [unique_id "alxfTKL84xJUTmx6eO6rYAAAAOg"]
[Sat Jul 18 23:23:24.257551 2026] [security2:error] [pid 882519:tid 882693] [client 124.29.207.185:55995] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxfTKL84xJUTmx6eO6rYwAAALE"]
[Sat Jul 18 23:23:24.257670 2026] [security2:error] [pid 882519:tid 882693] [client 124.29.207.185:55995] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxfTKL84xJUTmx6eO6rYwAAALE"]
[Sat Jul 18 23:23:24.265065 2026] [security2:error] [pid 882519:tid 882549] [remote 68.178.160.25:39320] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxfTKL84xJUTmx6eO6rZAAAqB0"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:23:24.364713 2026] [security2:error] [pid 882519:tid 882678] [client 31.171.130.5:31131] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/blurbs.php"] [unique_id "alxfTKL84xJUTmx6eO6rbAAAAKI"]
[Sat Jul 18 23:23:24.378320 2026] [security2:error] [pid 882519:tid 882724] [client 31.171.130.11:32033] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/abcd.php"] [unique_id "alxfTKL84xJUTmx6eO6rbQAAANA"]
[Sat Jul 18 23:23:24.400990 2026] [security2:error] [pid 882519:tid 882757] [client 119.154.81.234:51691] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfTKL84xJUTmx6eO6rbgAAAPE"]
[Sat Jul 18 23:23:24.401085 2026] [security2:error] [pid 882519:tid 882757] [client 119.154.81.234:51691] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfTKL84xJUTmx6eO6rbgAAAPE"]
[Sat Jul 18 23:23:24.573006 2026] [security2:error] [pid 882519:tid 882736] [client 65.111.28.148:28901] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 148.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxfTKL84xJUTmx6eO6rdwAAANw"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:23:24.622394 2026] [security2:error] [pid 881201:tid 881339] [client 31.171.130.51:58595] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/shelp.php"] [unique_id "alxfTAWL-zKlchkVWS1XRAAAAAc"]
[Sat Jul 18 23:23:24.665413 2026] [security2:error] [pid 882519:tid 882683] [client 31.171.130.42:61243] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/shelp.php"] [unique_id "alxfTKL84xJUTmx6eO6rfAAAAKc"]
[Sat Jul 18 23:23:24.665684 2026] [security2:error] [pid 881201:tid 881366] [client 31.171.130.48:27457] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/akcc.php"] [unique_id "alxfTAWL-zKlchkVWS1XRQAAACI"]
[Sat Jul 18 23:23:24.773186 2026] [security2:error] [pid 882519:tid 882758] [client 31.171.130.3:35973] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/akcc.php"] [unique_id "alxfTKL84xJUTmx6eO6rfgAAAPI"]
[Sat Jul 18 23:23:24.843236 2026] [security2:error] [pid 881201:tid 881377] [client 31.171.130.36:61145] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/akcc.php"] [unique_id "alxfTAWL-zKlchkVWS1XRgAAAC0"]
[Sat Jul 18 23:23:24.934169 2026] [security2:error] [pid 881201:tid 881228] [remote 152.228.213.32:50918] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thierry-henry.fr"] [uri "/wp-login.php"] [unique_id "alxfTAWL-zKlchkVWS1XSAAAQxk"]
[Sat Jul 18 23:23:24.945826 2026] [security2:error] [pid 882519:tid 882660] [client 31.171.130.41:46169] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/shelp.php"] [unique_id "alxfTKL84xJUTmx6eO6rhgAAAJA"]
[Sat Jul 18 23:23:25.114960 2026] [security2:error] [pid 881201:tid 881258] [remote 152.228.213.32:50918] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thierry-henry.fr"] [uri "/wp-login.php"] [unique_id "alxfTQWL-zKlchkVWS1XTAAASTc"], referer: https://thierry-henry.fr/wp-login.php
[Sat Jul 18 23:23:25.115312 2026] [security2:error] [pid 882519:tid 882692] [client 31.171.130.48:62121] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/cord.php"] [unique_id "alxfTaL84xJUTmx6eO6rkwAAALA"]
[Sat Jul 18 23:23:25.145876 2026] [security2:error] [pid 882519:tid 882681] [client 31.171.130.46:49901] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/abcd.php"] [unique_id "alxfTaL84xJUTmx6eO6rlAAAAKU"]
[Sat Jul 18 23:23:25.426193 2026] [security2:error] [pid 881201:tid 881223] [remote 217.182.128.41:44418] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.128.182.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxfTQWL-zKlchkVWS1XTQAADBQ"]
[Sat Jul 18 23:23:25.670843 2026] [security2:error] [pid 882519:tid 882701] [client 31.171.130.2:36459] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/abcd.php"] [unique_id "alxfTaL84xJUTmx6eO6rsQAAALk"]
[Sat Jul 18 23:23:25.739594 2026] [security2:error] [pid 881201:tid 881269] [remote 217.182.128.41:44418] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.128.182.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxfTQWL-zKlchkVWS1XUgAAd0I"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:23:25.861810 2026] [ssl:error] [pid 881201:tid 881436] [client 104.48.69.105:52218] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname blog.danwolfe.us provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:23:25.912024 2026] [security2:error] [pid 882519:tid 882650] [client 31.171.130.46:45277] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/abcd.php"] [unique_id "alxfTaL84xJUTmx6eO6rtwAAAIY"]
[Sat Jul 18 23:23:25.927279 2026] [security2:error] [pid 882519:tid 882776] [client 31.171.130.4:46903] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/dex.php"] [unique_id "alxfTaL84xJUTmx6eO6ruAAAAQQ"]
[Sat Jul 18 23:23:25.930032 2026] [security2:error] [pid 882519:tid 882679] [client 31.171.130.4:32303] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/shelp.php"] [unique_id "alxfTaL84xJUTmx6eO6ruQAAAKM"]
[Sat Jul 18 23:23:25.930108 2026] [security2:error] [pid 882519:tid 882751] [client 31.171.130.36:52983] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/cord.php"] [unique_id "alxfTaL84xJUTmx6eO6rugAAAOs"]
[Sat Jul 18 23:23:25.984492 2026] [security2:error] [pid 882519:tid 882745] [client 31.171.130.43:49589] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/shelp.php"] [unique_id "alxfTaL84xJUTmx6eO6rvQAAAOU"]
[Sat Jul 18 23:23:26.047676 2026] [autoindex:error] [pid 882519:tid 882653] [client 124.221.140.98:33954] AH01276: Cannot serve directory /home1/thesums1/public_html/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: http://thesummercampstore.com
[Sat Jul 18 23:23:26.234704 2026] [security2:error] [pid 881201:tid 881347] [client 31.171.130.15:54591] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/cord.php"] [unique_id "alxfTgWL-zKlchkVWS1XXgAAAA8"]
[Sat Jul 18 23:23:26.399808 2026] [security2:error] [pid 882519:tid 882748] [client 31.171.130.49:25751] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/shelp.php"] [unique_id "alxfTqL84xJUTmx6eO6rxwAAAOg"]
[Sat Jul 18 23:23:26.404777 2026] [security2:error] [pid 882519:tid 882654] [client 213.180.203.234:51800] ModSecurity: Access denied with code 429 (phase 2). Pattern match "Mozilla\\\\/5\\\\.0 \\\\(compatible; YandexBot\\\\/3\\\\.0; \\\\+http:\\\\/\\\\/yandex\\\\.com\\\\/bots\\\\)" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/othercrawler.conf"] [line "3"] [id "901008"] [msg "Yandex Crawler 429 ADDED BY MONITORING DO NOT WHITELIST"] [hostname "heroesoftomorrow.us"] [uri "/robots.txt"] [unique_id "alxfTqL84xJUTmx6eO6ryAAAAIo"]
[Sat Jul 18 23:23:26.433459 2026] [security2:error] [pid 882519:tid 882719] [client 31.171.130.52:64571] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxfTqL84xJUTmx6eO6rygAAAMs"]
[Sat Jul 18 23:23:26.435497 2026] [security2:error] [pid 882519:tid 882723] [client 31.171.130.36:50183] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/cord.php"] [unique_id "alxfTqL84xJUTmx6eO6rywAAAM8"]
[Sat Jul 18 23:23:26.435660 2026] [security2:error] [pid 882519:tid 882690] [client 31.171.130.42:58665] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/dex.php"] [unique_id "alxfTqL84xJUTmx6eO6rzAAAAK4"]
[Sat Jul 18 23:23:26.747262 2026] [security2:error] [pid 882519:tid 882753] [client 31.171.130.16:25383] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/cord.php"] [unique_id "alxfTqL84xJUTmx6eO6r3wAAAO0"]
[Sat Jul 18 23:23:26.860096 2026] [security2:error] [pid 882519:tid 882715] [client 31.171.130.24:40817] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/dex.php"] [unique_id "alxfTqL84xJUTmx6eO6r4AAAAMc"]
[Sat Jul 18 23:23:26.922433 2026] [security2:error] [pid 882519:tid 882686] [client 31.171.130.29:54505] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/cord.php"] [unique_id "alxfTqL84xJUTmx6eO6r5wAAAKo"]
[Sat Jul 18 23:23:26.926921 2026] [security2:error] [pid 882519:tid 882662] [client 31.171.130.25:64725] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/zwso.php"] [unique_id "alxfTqL84xJUTmx6eO6r6AAAAJI"]
[Sat Jul 18 23:23:26.929054 2026] [security2:error] [pid 882519:tid 882677] [client 31.171.130.24:22027] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxfTqL84xJUTmx6eO6r6QAAAKE"]
[Sat Jul 18 23:23:27.123248 2026] [security2:error] [pid 882519:tid 882649] [client 57.141.18.24:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxfTqL84xJUTmx6eO6r6gAAAIU"]
[Sat Jul 18 23:23:27.193899 2026] [security2:error] [pid 881201:tid 881367] [client 31.171.130.26:49137] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/shelp.php"] [unique_id "alxfTwWL-zKlchkVWS1XdAAAACM"]
[Sat Jul 18 23:23:27.207893 2026] [security2:error] [pid 881201:tid 881209] [remote 72.167.132.114:58462] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "wgs.doq.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfTwWL-zKlchkVWS1XdgAAdQY"]
[Sat Jul 18 23:23:27.237743 2026] [security2:error] [pid 882519:tid 882660] [client 31.171.130.3:48687] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/dex.php"] [unique_id "alxfT6L84xJUTmx6eO6r-AAAAJA"]
[Sat Jul 18 23:23:27.409363 2026] [security2:error] [pid 882519:tid 882766] [client 31.171.130.28:24963] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxfT6L84xJUTmx6eO6r_QAAAPo"]
[Sat Jul 18 23:23:27.460993 2026] [security2:error] [pid 882519:tid 882746] [client 31.171.130.22:62325] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxfT6L84xJUTmx6eO6r_wAAAOY"]
[Sat Jul 18 23:23:27.500908 2026] [security2:error] [pid 882519:tid 882771] [client 31.171.130.19:41709] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/dex.php"] [unique_id "alxfT6L84xJUTmx6eO6sAgAAAP8"]
[Sat Jul 18 23:23:27.511453 2026] [security2:error] [pid 882519:tid 882716] [client 31.171.130.39:53149] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/zwso.php"] [unique_id "alxfT6L84xJUTmx6eO6sBAAAAMg"]
[Sat Jul 18 23:23:27.672727 2026] [security2:error] [pid 881201:tid 881266] [remote 72.167.132.114:58462] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "wgs.doq.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfTwWL-zKlchkVWS1XfQAALj8"], referer: https://wgs.doq.mybluehost.me/wp-login.php
[Sat Jul 18 23:23:27.688945 2026] [security2:error] [pid 882519:tid 882656] [client 31.171.130.41:53351] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/cord.php"] [unique_id "alxfT6L84xJUTmx6eO6sDgAAAIw"]
[Sat Jul 18 23:23:27.721114 2026] [security2:error] [pid 882519:tid 882693] [client 31.171.130.16:28397] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxfT6L84xJUTmx6eO6sEAAAALE"]
[Sat Jul 18 23:23:27.883990 2026] [security2:error] [pid 882519:tid 882721] [client 31.171.130.27:35969] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/zwso.php"] [unique_id "alxfT6L84xJUTmx6eO6sEwAAAM0"]
[Sat Jul 18 23:23:27.988756 2026] [security2:error] [pid 882519:tid 882744] [client 31.171.130.16:58931] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxfT6L84xJUTmx6eO6sHAAAAOQ"]
[Sat Jul 18 23:23:27.989584 2026] [security2:error] [pid 882519:tid 882664] [client 31.171.130.12:36331] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/dex.php"] [unique_id "alxfT6L84xJUTmx6eO6sHQAAAJQ"]
[Sat Jul 18 23:23:27.994660 2026] [security2:error] [pid 882519:tid 882722] [client 31.171.130.18:50341] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxfT6L84xJUTmx6eO6sHgAAAM4"]
[Sat Jul 18 23:23:28.181730 2026] [security2:error] [pid 882519:tid 882659] [client 31.171.130.24:50153] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/dex.php"] [unique_id "alxfUKL84xJUTmx6eO6sKAAAAI8"]
[Sat Jul 18 23:23:28.467732 2026] [security2:error] [pid 882519:tid 882726] [client 31.171.130.17:38549] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/zwso.php"] [unique_id "alxfUKL84xJUTmx6eO6sNwAAANI"]
[Sat Jul 18 23:23:28.631716 2026] [security2:error] [pid 882519:tid 882723] [client 113.160.97.242:62577] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "wpad"] [uri "/wpad.dat"] [unique_id "alxfUKL84xJUTmx6eO6sPAAAAM8"]
[Sat Jul 18 23:23:28.634800 2026] [security2:error] [pid 882519:tid 882745] [client 113.160.97.242:62576] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "wpad"] [uri "/wpad.dat"] [unique_id "alxfUKL84xJUTmx6eO6sPQAAAOU"]
[Sat Jul 18 23:23:28.634800 2026] [security2:error] [pid 881201:tid 881405] [client 113.160.97.242:62575] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "wpad"] [uri "/wpad.dat"] [unique_id "alxfUAWL-zKlchkVWS1XjwAAAEk"]
[Sat Jul 18 23:23:28.640135 2026] [security2:error] [pid 882519:tid 882743] [client 31.171.130.30:21157] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxfUKL84xJUTmx6eO6sPgAAAOM"]
[Sat Jul 18 23:23:28.675279 2026] [security2:error] [pid 882519:tid 882740] [client 31.171.130.31:27915] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/bolt.php"] [unique_id "alxfUKL84xJUTmx6eO6sQwAAAOA"]
[Sat Jul 18 23:23:28.675343 2026] [security2:error] [pid 882519:tid 882682] [client 31.171.130.23:61607] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxfUKL84xJUTmx6eO6sRAAAAKY"]
[Sat Jul 18 23:23:28.693705 2026] [security2:error] [pid 882519:tid 882610] [remote 188.138.102.156:46048] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.think-islam.com"] [uri "/wp-login.php"] [unique_id "alxfUKL84xJUTmx6eO6sRQAAq1o"]
[Sat Jul 18 23:23:28.918384 2026] [security2:error] [pid 882519:tid 882647] [remote 188.138.102.156:46048] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.think-islam.com"] [uri "/wp-login.php"] [unique_id "alxfUKL84xJUTmx6eO6sTAAAxX8"], referer: https://mail.think-islam.com/wp-login.php
[Sat Jul 18 23:23:29.074461 2026] [security2:error] [pid 881201:tid 881421] [client 31.171.130.5:38445] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/bolt.php"] [unique_id "alxfUQWL-zKlchkVWS1XlQAAAFk"]
[Sat Jul 18 23:23:29.146265 2026] [security2:error] [pid 882519:tid 882664] [client 31.171.130.51:27405] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxfUaL84xJUTmx6eO6sVwAAAJQ"]
[Sat Jul 18 23:23:29.254204 2026] [security2:error] [pid 882519:tid 882674] [client 31.171.130.30:35683] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/bolt.php"] [unique_id "alxfUaL84xJUTmx6eO6sXgAAAJ4"]
[Sat Jul 18 23:23:29.269486 2026] [security2:error] [pid 881201:tid 881422] [client 31.171.130.46:24439] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/cjfuns.php"] [unique_id "alxfUQWL-zKlchkVWS1XmwAAAFo"]
[Sat Jul 18 23:23:29.272475 2026] [security2:error] [pid 881201:tid 881372] [client 31.171.130.22:61465] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/zwso.php"] [unique_id "alxfUQWL-zKlchkVWS1XnAAAACg"]
[Sat Jul 18 23:23:29.387473 2026] [security2:error] [pid 882519:tid 882708] [client 190.245.146.99:51864] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfUaL84xJUTmx6eO6sagAAAMA"]
[Sat Jul 18 23:23:29.387560 2026] [security2:error] [pid 882519:tid 882708] [client 190.245.146.99:51864] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfUaL84xJUTmx6eO6sagAAAMA"]
[Sat Jul 18 23:23:29.639424 2026] [security2:error] [pid 882519:tid 882692] [client 31.171.130.38:64137] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/cjfuns.php"] [unique_id "alxfUaL84xJUTmx6eO6sdgAAALA"]
[Sat Jul 18 23:23:29.782202 2026] [ssl:error] [pid 882519:tid 882743] [client 104.48.69.105:48414] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname www.bandsir.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:23:29.842277 2026] [security2:error] [pid 882519:tid 882709] [client 31.171.130.40:39257] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/bolt.php"] [unique_id "alxfUaL84xJUTmx6eO6sgAAAAME"]
[Sat Jul 18 23:23:29.859279 2026] [security2:error] [pid 882519:tid 882763] [client 31.171.130.29:63441] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxfUaL84xJUTmx6eO6sgQAAAPc"]
[Sat Jul 18 23:23:29.860713 2026] [security2:error] [pid 882519:tid 882775] [client 31.171.130.1:39389] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/zwso.php"] [unique_id "alxfUaL84xJUTmx6eO6sggAAAQM"]
[Sat Jul 18 23:23:29.861015 2026] [security2:error] [pid 882519:tid 882719] [client 31.171.130.10:32847] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/cjfuns.php"] [unique_id "alxfUaL84xJUTmx6eO6sgwAAAMs"]
[Sat Jul 18 23:23:29.891581 2026] [security2:error] [pid 882519:tid 882681] [client 31.171.130.47:21073] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxfUaL84xJUTmx6eO6shAAAAKU"]
[Sat Jul 18 23:23:29.894636 2026] [security2:error] [pid 882519:tid 882656] [client 31.171.130.44:20093] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxfUaL84xJUTmx6eO6shQAAAIw"]
[Sat Jul 18 23:23:30.029796 2026] [security2:error] [pid 882519:tid 882665] [client 27.34.68.67:2559] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfUqL84xJUTmx6eO6sjAAAAJU"]
[Sat Jul 18 23:23:30.029893 2026] [security2:error] [pid 882519:tid 882665] [client 27.34.68.67:2559] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfUqL84xJUTmx6eO6sjAAAAJU"]
[Sat Jul 18 23:23:30.033420 2026] [security2:error] [pid 882519:tid 882758] [client 223.185.61.63:27432] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfUqL84xJUTmx6eO6sjQAAAPI"]
[Sat Jul 18 23:23:30.033543 2026] [security2:error] [pid 882519:tid 882758] [client 223.185.61.63:27432] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfUqL84xJUTmx6eO6sjQAAAPI"]
[Sat Jul 18 23:23:30.097665 2026] [security2:error] [pid 882519:tid 882757] [client 13.232.206.133:60872] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "200"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxfUaL84xJUTmx6eO6sbgAAAPE"]
[Sat Jul 18 23:23:30.139571 2026] [security2:error] [pid 882519:tid 882727] [client 31.171.130.37:34743] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxfUqL84xJUTmx6eO6skQAAANM"]
[Sat Jul 18 23:23:30.497677 2026] [security2:error] [pid 882519:tid 882663] [client 31.171.130.49:22451] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/bolt.php"] [unique_id "alxfUqL84xJUTmx6eO6sowAAAJM"]
[Sat Jul 18 23:23:30.556463 2026] [security2:error] [pid 882519:tid 882668] [client 31.171.130.37:47207] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxfUqL84xJUTmx6eO6spQAAAJg"]
[Sat Jul 18 23:23:30.616574 2026] [security2:error] [pid 882519:tid 882717] [client 31.171.130.23:48303] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/zwso.php"] [unique_id "alxfUqL84xJUTmx6eO6sqgAAAMk"]
[Sat Jul 18 23:23:30.619187 2026] [security2:error] [pid 882519:tid 882650] [client 31.171.130.23:34675] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxfUqL84xJUTmx6eO6sqwAAAIY"]
[Sat Jul 18 23:23:30.620845 2026] [security2:error] [pid 882519:tid 882698] [client 31.171.130.35:59807] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxfUqL84xJUTmx6eO6srAAAALY"]
[Sat Jul 18 23:23:30.733527 2026] [security2:error] [pid 881201:tid 881424] [client 31.171.130.38:40089] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxfUgWL-zKlchkVWS1XqgAAAFw"]
[Sat Jul 18 23:23:30.986693 2026] [security2:error] [pid 882519:tid 882657] [client 31.171.130.32:50463] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/cjfuns.php"] [unique_id "alxfUqL84xJUTmx6eO6svwAAAI0"]
[Sat Jul 18 23:23:31.060173 2026] [security2:error] [pid 882519:tid 882724] [client 31.171.130.48:27537] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/wp-content/index.php"] [unique_id "alxfU6L84xJUTmx6eO6sxwAAANA"]
[Sat Jul 18 23:23:31.116082 2026] [security2:error] [pid 881201:tid 881416] [client 31.171.130.19:33865] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxfUwWL-zKlchkVWS1XrwAAAFQ"]
[Sat Jul 18 23:23:31.119989 2026] [security2:error] [pid 882519:tid 882680] [client 31.171.130.21:21309] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxfU6L84xJUTmx6eO6syAAAAKQ"]
[Sat Jul 18 23:23:31.120027 2026] [security2:error] [pid 882519:tid 882761] [client 31.171.130.13:63915] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/bolt.php"] [unique_id "alxfU6L84xJUTmx6eO6syQAAAPU"]
[Sat Jul 18 23:23:31.213292 2026] [security2:error] [pid 881201:tid 881439] [client 171.4.232.110:63618] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfUwWL-zKlchkVWS1XsgAAAGs"]
[Sat Jul 18 23:23:31.213425 2026] [security2:error] [pid 881201:tid 881439] [client 171.4.232.110:63618] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfUwWL-zKlchkVWS1XsgAAAGs"]
[Sat Jul 18 23:23:31.247381 2026] [security2:error] [pid 882519:tid 882576] [remote 31.42.184.154:36490] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxfU6L84xJUTmx6eO6s0AAAvDg"]
[Sat Jul 18 23:23:31.247531 2026] [security2:error] [pid 882519:tid 882704] [client 31.42.184.154:36490] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxfU6L84xJUTmx6eO6s0AAAvDg"]
[Sat Jul 18 23:23:31.540320 2026] [security2:error] [pid 882519:tid 882663] [client 31.171.130.16:38959] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxfU6L84xJUTmx6eO6s3wAAAJM"]
[Sat Jul 18 23:23:31.563695 2026] [security2:error] [pid 881201:tid 881368] [client 31.171.130.24:51349] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/ioxi-o.php"] [unique_id "alxfUwWL-zKlchkVWS1XtwAAACQ"]
[Sat Jul 18 23:23:31.589505 2026] [security2:error] [pid 882519:tid 882697] [client 74.208.214.194:47374] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxfU6L84xJUTmx6eO6s4QAAALU"]
[Sat Jul 18 23:23:31.638307 2026] [security2:error] [pid 882519:tid 882746] [client 31.171.130.8:56981] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/bolt.php"] [unique_id "alxfU6L84xJUTmx6eO6s5wAAAOY"]
[Sat Jul 18 23:23:31.639745 2026] [security2:error] [pid 882519:tid 882691] [client 31.171.130.35:42273] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/cjfuns.php"] [unique_id "alxfU6L84xJUTmx6eO6s6AAAAK8"]
[Sat Jul 18 23:23:31.775583 2026] [security2:error] [pid 882519:tid 882654] [client 74.208.214.194:47384] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxfU6L84xJUTmx6eO6s8AAAAIo"]
[Sat Jul 18 23:23:32.055395 2026] [security2:error] [pid 882519:tid 882755] [client 31.171.130.2:37755] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/insc.php"] [unique_id "alxfVKL84xJUTmx6eO6s-gAAAO8"]
[Sat Jul 18 23:23:32.071556 2026] [security2:error] [pid 882519:tid 882774] [client 31.171.130.2:29137] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxfVKL84xJUTmx6eO6s-wAAAQI"]
[Sat Jul 18 23:23:32.118630 2026] [security2:error] [pid 882519:tid 882661] [client 31.171.130.23:39983] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/cjfuns.php"] [unique_id "alxfVKL84xJUTmx6eO6tAgAAAJE"]
[Sat Jul 18 23:23:32.127354 2026] [security2:error] [pid 882519:tid 882732] [client 31.171.130.39:45371] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxfVKL84xJUTmx6eO6tAwAAANg"]
[Sat Jul 18 23:23:32.276617 2026] [security2:error] [pid 882519:tid 882738] [client 31.171.130.34:21921] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/wp-content/index.php"] [unique_id "alxfVKL84xJUTmx6eO6tCQAAAN4"]
[Sat Jul 18 23:23:32.557834 2026] [security2:error] [pid 882519:tid 882742] [client 31.171.130.50:32251] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/classwithtostring.php"] [unique_id "alxfVKL84xJUTmx6eO6tEgAAAOI"]
[Sat Jul 18 23:23:32.566489 2026] [security2:error] [pid 881201:tid 881383] [client 31.171.130.9:20871] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/wp-content/index.php"] [unique_id "alxfVAWL-zKlchkVWS1XwwAAADM"]
[Sat Jul 18 23:23:32.604949 2026] [security2:error] [pid 882519:tid 882717] [client 31.171.130.7:41397] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxfVKL84xJUTmx6eO6tEwAAAMk"]
[Sat Jul 18 23:23:32.659510 2026] [security2:error] [pid 882519:tid 882735] [client 31.171.130.37:43479] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/wp-content/index.php"] [unique_id "alxfVKL84xJUTmx6eO6tFwAAANs"]
[Sat Jul 18 23:23:32.704851 2026] [security2:error] [pid 882519:tid 882702] [client 31.171.130.24:26111] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/cjfuns.php"] [unique_id "alxfVKL84xJUTmx6eO6tGAAAALo"]
[Sat Jul 18 23:23:33.041855 2026] [security2:error] [pid 882519:tid 882678] [client 31.171.130.18:52561] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/txets.php"] [unique_id "alxfVaL84xJUTmx6eO6tKgAAAKI"]
[Sat Jul 18 23:23:33.049098 2026] [security2:error] [pid 882519:tid 882667] [client 31.171.130.19:50021] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/ioxi-o.php"] [unique_id "alxfVaL84xJUTmx6eO6tKwAAAJc"]
[Sat Jul 18 23:23:33.088970 2026] [security2:error] [pid 882519:tid 882714] [client 31.171.130.4:63839] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxfVaL84xJUTmx6eO6tLQAAAMY"]
[Sat Jul 18 23:23:33.097667 2026] [proxy:error] [pid 881201:tid 881391] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:23:33.097736 2026] [proxy_http:error] [pid 881201:tid 881391] [client 78.108.218.142:40950] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:23:33.098207 2026] [proxy:error] [pid 881201:tid 881391] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:23:33.098242 2026] [proxy_http:error] [pid 881201:tid 881391] [client 78.108.218.142:40950] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:23:33.194775 2026] [security2:error] [pid 881201:tid 881393] [client 31.171.130.22:22235] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxfVQWL-zKlchkVWS1X0QAAAD0"]
[Sat Jul 18 23:23:33.299521 2026] [security2:error] [pid 881201:tid 881244] [remote 103.90.234.13:55702] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.234.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxfVQWL-zKlchkVWS1X1QAAeSk"]
[Sat Jul 18 23:23:33.538497 2026] [security2:error] [pid 882519:tid 882701] [client 31.171.130.19:30589] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxfVaL84xJUTmx6eO6tPAAAALk"]
[Sat Jul 18 23:23:33.543912 2026] [security2:error] [pid 882519:tid 882662] [client 31.171.130.32:46813] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/insc.php"] [unique_id "alxfVaL84xJUTmx6eO6tPQAAAJI"]
[Sat Jul 18 23:23:33.646064 2026] [security2:error] [pid 881201:tid 881431] [client 31.171.130.38:62233] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/wp-content/index.php"] [unique_id "alxfVQWL-zKlchkVWS1X2wAAAGM"]
[Sat Jul 18 23:23:33.692953 2026] [security2:error] [pid 882519:tid 882596] [remote 117.0.21.154:49728] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxfVaL84xJUTmx6eO6tQwAA_Uw"]
[Sat Jul 18 23:23:33.708546 2026] [security2:error] [pid 882519:tid 882753] [client 31.171.130.32:31833] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxfVaL84xJUTmx6eO6tRAAAAO0"]
[Sat Jul 18 23:23:33.722097 2026] [security2:error] [pid 881201:tid 881219] [remote 103.90.234.13:55702] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.234.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxfVQWL-zKlchkVWS1X3AAAKBA"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:23:33.785843 2026] [security2:error] [pid 882519:tid 882653] [client 31.171.130.2:48993] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxfVaL84xJUTmx6eO6tRgAAAIk"]
[Sat Jul 18 23:23:33.885355 2026] [security2:error] [pid 881201:tid 881353] [client 31.171.130.12:58171] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/ioxi-o.php"] [unique_id "alxfVQWL-zKlchkVWS1X4AAAABU"]
[Sat Jul 18 23:23:34.019732 2026] [security2:error] [pid 882519:tid 882692] [client 31.171.130.13:42535] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/wp-admin/txets.php"] [unique_id "alxfVqL84xJUTmx6eO6tUgAAALA"]
[Sat Jul 18 23:23:34.042985 2026] [security2:error] [pid 882519:tid 882696] [client 31.171.130.24:35649] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/classwithtostring.php"] [unique_id "alxfVqL84xJUTmx6eO6tVAAAALQ"]
[Sat Jul 18 23:23:34.123021 2026] [security2:error] [pid 881201:tid 881402] [client 31.171.130.28:59471] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/ioxi-o.php"] [unique_id "alxfVgWL-zKlchkVWS1X5AAAAEY"]
[Sat Jul 18 23:23:34.149300 2026] [security2:error] [pid 882519:tid 882760] [client 31.171.130.20:62157] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/ioxi-o.php"] [unique_id "alxfVqL84xJUTmx6eO6tWAAAAPQ"]
[Sat Jul 18 23:23:34.167650 2026] [security2:error] [pid 881201:tid 881313] [remote 138.197.175.250:50002] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 250.175.197.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.nvy.ppp.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxfVgWL-zKlchkVWS1X5QAAE24"]
[Sat Jul 18 23:23:34.167804 2026] [security2:error] [pid 881201:tid 881351] [client 138.197.175.250:50002] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "mail.nvy.ppp.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxfVgWL-zKlchkVWS1X5QAAE24"]
[Sat Jul 18 23:23:34.168822 2026] [security2:error] [pid 882519:tid 882623] [remote 4.205.168.44:38168] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxfVqL84xJUTmx6eO6tWQAAsmc"]
[Sat Jul 18 23:23:34.168982 2026] [security2:error] [pid 882519:tid 882694] [client 4.205.168.44:38168] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxfVqL84xJUTmx6eO6tWQAAsmc"]
[Sat Jul 18 23:23:34.180530 2026] [security2:error] [pid 882519:tid 882621] [remote 117.0.21.154:49728] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxfVqL84xJUTmx6eO6tXAAAyGU"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:23:34.214119 2026] [security2:error] [pid 881201:tid 881376] [client 31.171.130.34:54643] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/wp-content/index.php"] [unique_id "alxfVgWL-zKlchkVWS1X5wAAACw"]
[Sat Jul 18 23:23:34.244605 2026] [security2:error] [pid 881201:tid 881381] [client 124.29.207.185:56452] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxfVgWL-zKlchkVWS1X6AAAADE"]
[Sat Jul 18 23:23:34.245068 2026] [security2:error] [pid 881201:tid 881381] [client 124.29.207.185:56452] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxfVgWL-zKlchkVWS1X6AAAADE"]
[Sat Jul 18 23:23:34.308143 2026] [security2:error] [pid 882519:tid 882656] [client 31.171.130.10:24673] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/wp-content/index.php"] [unique_id "alxfVqL84xJUTmx6eO6tYwAAAIw"]
[Sat Jul 18 23:23:34.377268 2026] [ssl:error] [pid 881201:tid 881345] [client 104.48.69.105:48418] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname www.icemarc.org provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:23:34.443161 2026] [security2:error] [pid 882519:tid 882740] [client 31.171.130.44:53267] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/insc.php"] [unique_id "alxfVqL84xJUTmx6eO6tbQAAAOA"]
[Sat Jul 18 23:23:34.476770 2026] [security2:error] [pid 881201:tid 881337] [client 65.111.28.5:38637] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxfVgWL-zKlchkVWS1X9AAAAAU"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:23:34.503717 2026] [security2:error] [pid 882519:tid 882770] [client 31.171.130.16:36447] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/wp-includes/txets.php"] [unique_id "alxfVqL84xJUTmx6eO6tbwAAAP4"]
[Sat Jul 18 23:23:34.551009 2026] [security2:error] [pid 882519:tid 882661] [client 31.171.130.25:45305] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/txets.php"] [unique_id "alxfVqL84xJUTmx6eO6tcgAAAJE"]
[Sat Jul 18 23:23:34.601316 2026] [security2:error] [pid 882519:tid 882701] [client 31.171.130.22:60569] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/insc.php"] [unique_id "alxfVqL84xJUTmx6eO6tdQAAALk"]
[Sat Jul 18 23:23:34.629538 2026] [security2:error] [pid 881201:tid 881394] [client 31.171.130.50:27055] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/insc.php"] [unique_id "alxfVgWL-zKlchkVWS1X-QAAAD4"]
[Sat Jul 18 23:23:34.697806 2026] [security2:error] [pid 882519:tid 882685] [client 31.171.130.5:21877] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/ioxi-o.php"] [unique_id "alxfVqL84xJUTmx6eO6tdwAAAKk"]
[Sat Jul 18 23:23:34.699769 2026] [security2:error] [pid 881201:tid 881398] [client 106.222.249.209:32512] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfVgWL-zKlchkVWS1X-gAAAEI"]
[Sat Jul 18 23:23:34.699859 2026] [security2:error] [pid 881201:tid 881398] [client 106.222.249.209:32512] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfVgWL-zKlchkVWS1X-gAAAEI"]
[Sat Jul 18 23:23:34.808188 2026] [security2:error] [pid 881201:tid 881392] [client 31.171.130.3:65189] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/ioxi-o.php"] [unique_id "alxfVgWL-zKlchkVWS1X_QAAADw"]
[Sat Jul 18 23:23:34.971837 2026] [security2:error] [pid 882519:tid 882658] [client 31.171.130.6:30165] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/classwithtostring.php"] [unique_id "alxfVqL84xJUTmx6eO6tgwAAAI4"]
[Sat Jul 18 23:23:34.978722 2026] [proxy:error] [pid 881201:tid 881383] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:23:34.978830 2026] [proxy_http:error] [pid 881201:tid 881383] [client 193.47.62.168:39742] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:23:34.979442 2026] [proxy:error] [pid 881201:tid 881383] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:23:34.979479 2026] [proxy_http:error] [pid 881201:tid 881383] [client 193.47.62.168:39742] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:23:34.997695 2026] [security2:error] [pid 882519:tid 882742] [client 31.171.130.17:30857] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/goods.php"] [unique_id "alxfVqL84xJUTmx6eO6thAAAAOI"]
[Sat Jul 18 23:23:35.007793 2026] [security2:error] [pid 882519:tid 882714] [client 119.154.81.234:52158] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfV6L84xJUTmx6eO6thQAAAMY"]
[Sat Jul 18 23:23:35.007894 2026] [security2:error] [pid 882519:tid 882714] [client 119.154.81.234:52158] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfV6L84xJUTmx6eO6thQAAAMY"]
[Sat Jul 18 23:23:35.073534 2026] [security2:error] [pid 882519:tid 882669] [client 31.171.130.24:58963] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxfV6L84xJUTmx6eO6tigAAAJk"]
[Sat Jul 18 23:23:35.099620 2026] [security2:error] [pid 882519:tid 882754] [client 31.171.130.32:31483] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/classwithtostring.php"] [unique_id "alxfV6L84xJUTmx6eO6tjQAAAO4"]
[Sat Jul 18 23:23:35.110166 2026] [security2:error] [pid 881201:tid 881405] [client 31.171.130.20:35369] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/classwithtostring.php"] [unique_id "alxfVwWL-zKlchkVWS1YCQAAAEk"]
[Sat Jul 18 23:23:35.205335 2026] [security2:error] [pid 882519:tid 882692] [client 31.171.130.28:38201] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/insc.php"] [unique_id "alxfV6L84xJUTmx6eO6tkAAAALA"]
[Sat Jul 18 23:23:35.310513 2026] [security2:error] [pid 882519:tid 882733] [client 31.171.130.12:49931] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/insc.php"] [unique_id "alxfV6L84xJUTmx6eO6tlAAAANk"]
[Sat Jul 18 23:23:35.504631 2026] [security2:error] [pid 882519:tid 882737] [client 65.111.28.94:36769] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 94.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxfV6L84xJUTmx6eO6tmgAAAN0"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:23:35.526142 2026] [security2:error] [pid 882519:tid 882520] [remote 152.228.213.32:49174] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfV6L84xJUTmx6eO6tnAAA-gA"]
[Sat Jul 18 23:23:35.542215 2026] [security2:error] [pid 882519:tid 882681] [client 31.171.130.28:33097] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/wp-editor.php"] [unique_id "alxfV6L84xJUTmx6eO6tnQAAAKU"]
[Sat Jul 18 23:23:35.544107 2026] [security2:error] [pid 882519:tid 882632] [remote 31.42.184.154:36506] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfV6L84xJUTmx6eO6tngAAinA"]
[Sat Jul 18 23:23:35.561699 2026] [security2:error] [pid 882519:tid 882768] [client 31.171.130.31:61399] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/wp-admin/txets.php"] [unique_id "alxfV6L84xJUTmx6eO6toAAAAPw"]
[Sat Jul 18 23:23:35.604197 2026] [security2:error] [pid 882519:tid 882755] [client 31.171.130.18:50683] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/txets.php"] [unique_id "alxfV6L84xJUTmx6eO6towAAAO8"]
[Sat Jul 18 23:23:35.623594 2026] [security2:error] [pid 882519:tid 882730] [client 31.171.130.43:24331] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/txets.php"] [unique_id "alxfV6L84xJUTmx6eO6tpQAAANY"]
[Sat Jul 18 23:23:35.667233 2026] [security2:error] [pid 881201:tid 881359] [client 50.116.65.227:23782] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxfVwWL-zKlchkVWS1YEAAAABs"]
[Sat Jul 18 23:23:35.682917 2026] [security2:error] [pid 881201:tid 881436] [client 50.116.65.227:44796] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxfVwWL-zKlchkVWS1YEQAAAGg"]
[Sat Jul 18 23:23:35.715539 2026] [security2:error] [pid 882519:tid 882531] [remote 152.228.213.32:49174] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfV6L84xJUTmx6eO6tqAAA9Qs"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:23:35.801308 2026] [security2:error] [pid 882519:tid 882525] [remote 31.42.184.154:36506] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfV6L84xJUTmx6eO6tsQAA7QU"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:23:35.808382 2026] [security2:error] [pid 882519:tid 882676] [client 31.171.130.37:58119] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/classwithtostring.php"] [unique_id "alxfV6L84xJUTmx6eO6tsgAAAKA"]
[Sat Jul 18 23:23:35.958949 2026] [security2:error] [pid 882519:tid 882764] [client 31.171.130.34:64755] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/classwithtostring.php"] [unique_id "alxfV6L84xJUTmx6eO6ttwAAAPg"]
[Sat Jul 18 23:23:36.190956 2026] [security2:error] [pid 882519:tid 882695] [client 217.181.92.40:36447] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 40.92.181.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxfWKL84xJUTmx6eO6tvgAAALM"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:23:36.295994 2026] [security2:error] [pid 882519:tid 882722] [client 31.171.130.37:41169] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/txets.php"] [unique_id "alxfWKL84xJUTmx6eO6txQAAAM4"]
[Sat Jul 18 23:23:36.396791 2026] [security2:error] [pid 882519:tid 882709] [client 31.171.130.13:50083] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/lufix.php"] [unique_id "alxfWKL84xJUTmx6eO6tyQAAAME"]
[Sat Jul 18 23:23:36.448837 2026] [security2:error] [pid 882519:tid 882671] [client 31.171.130.11:56651] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxfWKL84xJUTmx6eO6tywAAAJs"]
[Sat Jul 18 23:23:36.519238 2026] [security2:error] [pid 882519:tid 882681] [client 31.171.130.24:56885] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/txets.php"] [unique_id "alxfWKL84xJUTmx6eO6t1AAAAKU"]
[Sat Jul 18 23:23:36.520596 2026] [security2:error] [pid 882519:tid 882741] [client 31.171.130.49:43771] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/wp-includes/txets.php"] [unique_id "alxfWKL84xJUTmx6eO6t1QAAAOE"]
[Sat Jul 18 23:23:36.549232 2026] [security2:error] [pid 881201:tid 881395] [client 31.171.130.13:43579] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/txets.php"] [unique_id "alxfWAWL-zKlchkVWS1YIgAAAD8"]
[Sat Jul 18 23:23:36.930844 2026] [security2:error] [pid 882519:tid 882718] [client 31.171.130.37:58925] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jhavoctattoos.com"] [uri "/style.php"] [unique_id "alxfWKL84xJUTmx6eO6t7QAAAMo"]
[Sat Jul 18 23:23:36.974976 2026] [security2:error] [pid 881201:tid 881413] [client 65.111.28.164:54287] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxfWAWL-zKlchkVWS1YJQAAAFE"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:23:37.014969 2026] [security2:error] [pid 882519:tid 882764] [client 31.171.130.27:46341] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/wp-admin/txets.php"] [unique_id "alxfWaL84xJUTmx6eO6t7gAAAPg"]
[Sat Jul 18 23:23:37.052901 2026] [security2:error] [pid 882519:tid 882658] [client 31.171.130.18:42519] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxfWaL84xJUTmx6eO6t8QAAAI4"]
[Sat Jul 18 23:23:37.091202 2026] [security2:error] [pid 882519:tid 882665] [client 31.171.130.11:44881] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxfWaL84xJUTmx6eO6t8wAAAJU"]
[Sat Jul 18 23:23:37.491448 2026] [security2:error] [pid 882519:tid 882733] [client 31.171.130.22:51405] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxfWaL84xJUTmx6eO6uAgAAANk"]
[Sat Jul 18 23:23:37.702664 2026] [security2:error] [pid 881201:tid 881387] [client 31.171.130.13:47747] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/wp-admin/txets.php"] [unique_id "alxfWQWL-zKlchkVWS1YNgAAADc"]
[Sat Jul 18 23:23:37.938004 2026] [security2:error] [pid 882519:tid 882716] [client 65.111.26.198:17515] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 198.26.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxfWaL84xJUTmx6eO6uFgAAAMg"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:23:37.962884 2026] [security2:error] [pid 882519:tid 882745] [client 31.171.130.22:28131] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxfWaL84xJUTmx6eO6uFwAAAOU"]
[Sat Jul 18 23:23:38.002964 2026] [security2:error] [pid 882519:tid 882770] [client 31.171.130.43:37861] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/wp-admin/txets.php"] [unique_id "alxfWqL84xJUTmx6eO6uGAAAAP4"]
[Sat Jul 18 23:23:38.014614 2026] [security2:error] [pid 882519:tid 882739] [client 113.160.97.242:62581] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxfWqL84xJUTmx6eO6uGQAAAN8"]
[Sat Jul 18 23:23:38.040302 2026] [security2:error] [pid 882519:tid 882590] [remote 72.167.132.114:38986] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "jhavoctattoos.com"] [uri "/wp-login.php"] [unique_id "alxfWqL84xJUTmx6eO6uGwAA_EY"]
[Sat Jul 18 23:23:38.073864 2026] [security2:error] [pid 882519:tid 882773] [client 31.171.130.29:56967] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/goods.php"] [unique_id "alxfWqL84xJUTmx6eO6uHwAAAQE"]
[Sat Jul 18 23:23:38.207059 2026] [security2:error] [pid 882519:tid 882742] [client 31.171.130.50:38491] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/wp-includes/txets.php"] [unique_id "alxfWqL84xJUTmx6eO6uLQAAAOI"]
[Sat Jul 18 23:23:38.591103 2026] [security2:error] [pid 882519:tid 882723] [client 45.3.44.214:11041] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 214.44.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxfWqL84xJUTmx6eO6uQwAAAM8"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:23:38.675886 2026] [security2:error] [pid 881201:tid 881389] [client 31.171.130.44:22769] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/wp-admin/txets.php"] [unique_id "alxfWgWL-zKlchkVWS1YQQAAADk"]
[Sat Jul 18 23:23:38.676584 2026] [security2:error] [pid 881201:tid 881377] [client 31.171.130.13:48563] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/wp-includes/txets.php"] [unique_id "alxfWgWL-zKlchkVWS1YQgAAAC0"]
[Sat Jul 18 23:23:38.847033 2026] [security2:error] [pid 882519:tid 882770] [client 31.171.130.22:55655] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/goods.php"] [unique_id "alxfWqL84xJUTmx6eO6uSgAAAP4"]
[Sat Jul 18 23:23:38.865052 2026] [security2:error] [pid 882519:tid 882594] [remote 72.167.132.114:38986] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "jhavoctattoos.com"] [uri "/wp-login.php"] [unique_id "alxfWqL84xJUTmx6eO6uTAAA9Uo"], referer: https://jhavoctattoos.com/wp-login.php
[Sat Jul 18 23:23:38.882828 2026] [security2:error] [pid 882519:tid 882732] [client 31.171.130.25:55147] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/wp-admin/txets.php"] [unique_id "alxfWqL84xJUTmx6eO6uTwAAANg"]
[Sat Jul 18 23:23:38.925040 2026] [security2:error] [pid 881201:tid 881339] [client 31.171.130.3:40395] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/wp-includes/txets.php"] [unique_id "alxfWgWL-zKlchkVWS1YRQAAAAc"]
[Sat Jul 18 23:23:38.992238 2026] [security2:error] [pid 882519:tid 882700] [client 31.171.130.18:60025] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/wp-editor.php"] [unique_id "alxfWqL84xJUTmx6eO6uVAAAALg"]
[Sat Jul 18 23:23:39.199631 2026] [security2:error] [pid 882519:tid 882775] [client 31.171.130.21:43759] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/goods.php"] [unique_id "alxfW6L84xJUTmx6eO6uXQAAAQM"]
[Sat Jul 18 23:23:39.205424 2026] [security2:error] [pid 882519:tid 882686] [client 31.171.130.17:21191] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/wp-includes/txets.php"] [unique_id "alxfW6L84xJUTmx6eO6uXwAAAKo"]
[Sat Jul 18 23:23:39.222014 2026] [security2:error] [pid 882519:tid 882674] [client 104.207.50.71:53901] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 71.50.207.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxfW6L84xJUTmx6eO6uXAAAAJ4"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:23:39.333360 2026] [security2:error] [pid 882519:tid 882724] [client 65.111.28.139:21679] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 139.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxfW6L84xJUTmx6eO6uawAAANA"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:23:39.406083 2026] [security2:error] [pid 881201:tid 881435] [client 31.171.130.3:28891] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/wp-editor.php"] [unique_id "alxfWwWL-zKlchkVWS1YUQAAAGc"]
[Sat Jul 18 23:23:39.462870 2026] [security2:error] [pid 882519:tid 882656] [client 31.171.130.24:65193] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/wp-includes/txets.php"] [unique_id "alxfW6L84xJUTmx6eO6ucAAAAIw"]
[Sat Jul 18 23:23:39.469986 2026] [security2:error] [pid 881201:tid 881396] [client 31.171.130.24:49363] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/goods.php"] [unique_id "alxfWwWL-zKlchkVWS1YUgAAAEA"]
[Sat Jul 18 23:23:39.524669 2026] [security2:error] [pid 881201:tid 881431] [client 31.171.130.38:60563] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/lufix.php"] [unique_id "alxfWwWL-zKlchkVWS1YUwAAAGM"]
[Sat Jul 18 23:23:39.784519 2026] [security2:error] [pid 881201:tid 881305] [remote 68.178.160.25:43312] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "fineartsfactory.net"] [uri "/wp-login.php"] [unique_id "alxfWwWL-zKlchkVWS1YYAAALmY"]
[Sat Jul 18 23:23:39.808104 2026] [security2:error] [pid 882519:tid 882745] [client 31.171.130.15:32801] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/goods.php"] [unique_id "alxfW6L84xJUTmx6eO6ufQAAAOU"]
[Sat Jul 18 23:23:39.913362 2026] [security2:error] [pid 882519:tid 882713] [client 190.245.146.99:52386] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfW6L84xJUTmx6eO6ugAAAAMU"]
[Sat Jul 18 23:23:39.919288 2026] [security2:error] [pid 882519:tid 882713] [client 190.245.146.99:52386] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfW6L84xJUTmx6eO6ugAAAAMU"]
[Sat Jul 18 23:23:40.017002 2026] [security2:error] [pid 882519:tid 882773] [client 31.171.130.39:21375] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/wp-editor.php"] [unique_id "alxfXKL84xJUTmx6eO6ugwAAAQE"]
[Sat Jul 18 23:23:40.587384 2026] [security2:error] [pid 882519:tid 882693] [client 27.34.68.67:16985] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfXKL84xJUTmx6eO6umQAAALE"]
[Sat Jul 18 23:23:40.587479 2026] [security2:error] [pid 882519:tid 882693] [client 27.34.68.67:16985] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfXKL84xJUTmx6eO6umQAAALE"]
[Sat Jul 18 23:23:40.649828 2026] [security2:error] [pid 881201:tid 881450] [client 223.185.61.63:26597] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfXAWL-zKlchkVWS1YcAAAAHY"]
[Sat Jul 18 23:23:40.649958 2026] [security2:error] [pid 881201:tid 881450] [client 223.185.61.63:26597] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfXAWL-zKlchkVWS1YcAAAAHY"]
[Sat Jul 18 23:23:40.746491 2026] [security2:error] [pid 882519:tid 882625] [remote 20.153.140.50:56410] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxfXKL84xJUTmx6eO6uoAAA_Gk"]
[Sat Jul 18 23:23:41.175309 2026] [proxy:error] [pid 882519:tid 882726] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:23:41.175400 2026] [proxy_http:error] [pid 882519:tid 882726] [client 193.47.62.168:39758] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:23:41.176176 2026] [proxy:error] [pid 882519:tid 882726] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:23:41.176216 2026] [proxy_http:error] [pid 882519:tid 882726] [client 193.47.62.168:39758] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:23:41.228734 2026] [security2:error] [pid 882519:tid 882633] [remote 20.153.140.50:56410] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxfXaL84xJUTmx6eO6usgAAhXE"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:23:41.382808 2026] [security2:error] [pid 882519:tid 882741] [client 31.171.130.38:52025] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/lufix.php"] [unique_id "alxfXaL84xJUTmx6eO6utwAAAOE"]
[Sat Jul 18 23:23:41.564576 2026] [security2:error] [pid 881201:tid 881271] [remote 68.178.160.25:43312] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "fineartsfactory.net"] [uri "/wp-login.php"] [unique_id "alxfXQWL-zKlchkVWS1YiAAASUQ"], referer: https://fineartsfactory.net/wp-login.php
[Sat Jul 18 23:23:41.648643 2026] [security2:error] [pid 882519:tid 882712] [client 31.171.130.42:47799] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/wp-editor.php"] [unique_id "alxfXaL84xJUTmx6eO6uxwAAAMQ"]
[Sat Jul 18 23:23:41.687043 2026] [security2:error] [pid 882519:tid 882766] [client 31.171.130.25:22159] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jhavoctattoos.com"] [uri "/style.php"] [unique_id "alxfXaL84xJUTmx6eO6uzAAAAPo"]
[Sat Jul 18 23:23:41.854522 2026] [security2:error] [pid 882519:tid 882748] [client 171.4.232.110:49555] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfXaL84xJUTmx6eO6u0gAAAOg"]
[Sat Jul 18 23:23:41.854619 2026] [security2:error] [pid 882519:tid 882748] [client 171.4.232.110:49555] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfXaL84xJUTmx6eO6u0gAAAOg"]
[Sat Jul 18 23:23:41.976163 2026] [security2:error] [pid 882519:tid 882674] [client 31.171.130.39:22371] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/style.php"] [unique_id "alxfXaL84xJUTmx6eO6u2gAAAJ4"]
[Sat Jul 18 23:23:42.375186 2026] [security2:error] [pid 881201:tid 881349] [client 31.171.130.8:58591] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/lufix.php"] [unique_id "alxfXgWL-zKlchkVWS1YlAAAABE"]
[Sat Jul 18 23:23:42.471746 2026] [security2:error] [pid 882519:tid 882530] [remote 83.142.225.90:58062] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 90.225.142.83.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.cathybuffini.com"] [uri "/wp-login.php"] [unique_id "alxfXqL84xJUTmx6eO6u6wAA8Qo"]
[Sat Jul 18 23:23:42.549742 2026] [security2:error] [pid 881201:tid 881406] [client 31.171.130.50:60919] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/goods.php"] [unique_id "alxfXgWL-zKlchkVWS1YmwAAAEo"]
[Sat Jul 18 23:23:42.632808 2026] [security2:error] [pid 882519:tid 882643] [remote 83.142.225.90:58062] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 90.225.142.83.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.cathybuffini.com"] [uri "/wp-login.php"] [unique_id "alxfXqL84xJUTmx6eO6u9AAA5ns"], referer: https://mail.cathybuffini.com/wp-login.php
[Sat Jul 18 23:23:42.941045 2026] [security2:error] [pid 882519:tid 882719] [client 31.171.130.44:50103] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/lufix.php"] [unique_id "alxfXqL84xJUTmx6eO6vCAAAAMs"]
[Sat Jul 18 23:23:42.941068 2026] [security2:error] [pid 882519:tid 882759] [client 31.171.130.10:49815] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/wp-editor.php"] [unique_id "alxfXqL84xJUTmx6eO6vCQAAAPM"]
[Sat Jul 18 23:23:43.472413 2026] [security2:error] [pid 882519:tid 882650] [client 31.171.130.6:23341] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.jhavoctattoos.com"] [uri "/style.php"] [unique_id "alxfX6L84xJUTmx6eO6vIgAAAIY"]
[Sat Jul 18 23:23:43.626562 2026] [security2:error] [pid 882519:tid 882723] [client 31.171.130.44:49069] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.jhavoctattoos.com"] [uri "/style.php"] [unique_id "alxfX6L84xJUTmx6eO6vLQAAAM8"]
[Sat Jul 18 23:23:43.627650 2026] [security2:error] [pid 882519:tid 882729] [client 31.171.130.33:43303] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/wp-editor.php"] [unique_id "alxfX6L84xJUTmx6eO6vLgAAANU"]
[Sat Jul 18 23:23:43.763777 2026] [security2:error] [pid 882519:tid 882713] [client 31.171.130.41:58409] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/lufix.php"] [unique_id "alxfX6L84xJUTmx6eO6vNQAAAMU"]
[Sat Jul 18 23:23:43.831844 2026] [security2:error] [pid 882519:tid 882692] [client 65.111.28.241:44697] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 241.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxfX6L84xJUTmx6eO6vNwAAALA"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:23:44.030613 2026] [proxy:error] [pid 882519:tid 882737] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:23:44.030679 2026] [proxy_http:error] [pid 882519:tid 882737] [client 207.241.173.67:62844] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:23:44.031126 2026] [proxy:error] [pid 882519:tid 882737] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:23:44.031160 2026] [proxy_http:error] [pid 882519:tid 882737] [client 207.241.173.67:62844] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:23:44.135942 2026] [proxy:error] [pid 882519:tid 882706] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:23:44.135984 2026] [proxy_http:error] [pid 882519:tid 882706] [client 207.241.173.67:56130] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:23:44.136528 2026] [proxy:error] [pid 882519:tid 882706] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:23:44.136551 2026] [proxy_http:error] [pid 882519:tid 882706] [client 207.241.173.67:56130] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:23:44.507290 2026] [security2:error] [pid 882519:tid 882691] [client 31.171.130.7:37003] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/lufix.php"] [unique_id "alxfYKL84xJUTmx6eO6vYQAAAK8"]
[Sat Jul 18 23:23:44.795454 2026] [security2:error] [pid 882519:tid 882673] [client 114.119.130.3:31369] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "floorsourcestock.com"] [uri "/product-category/carpet/"] [unique_id "alxfYKL84xJUTmx6eO6vbwAAAJ0"], referer: https://floorsourcestock.com/product/cherry-creek-plus-in-iron-by-engineered-floors-dreamweaver/
[Sat Jul 18 23:23:44.824945 2026] [security2:error] [pid 882519:tid 882728] [client 31.171.130.16:52933] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jhavoctattoos.com"] [uri "/style.php"] [unique_id "alxfYKL84xJUTmx6eO6vcgAAANQ"]
[Sat Jul 18 23:23:44.901856 2026] [proxy:error] [pid 881201:tid 881338] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:23:44.901889 2026] [proxy_http:error] [pid 881201:tid 881338] [client 207.241.173.67:56142] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:23:44.902322 2026] [proxy:error] [pid 881201:tid 881338] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:23:44.902346 2026] [proxy_http:error] [pid 881201:tid 881338] [client 207.241.173.67:56142] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:23:45.017885 2026] [proxy:error] [pid 881201:tid 881390] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:23:45.017948 2026] [proxy_http:error] [pid 881201:tid 881390] [client 207.241.173.67:56140] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:23:45.018483 2026] [proxy:error] [pid 881201:tid 881390] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:23:45.018509 2026] [proxy_http:error] [pid 881201:tid 881390] [client 207.241.173.67:56140] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:23:45.078535 2026] [security2:error] [pid 882519:tid 882583] [remote 68.178.160.25:40158] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxfYaL84xJUTmx6eO6vfQAAjz8"]
[Sat Jul 18 23:23:45.312502 2026] [security2:error] [pid 881201:tid 881339] [client 31.171.130.33:39703] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "jhavoctattoos.com"] [uri "/style.php"] [unique_id "alxfYQWL-zKlchkVWS1YyQAAAAc"]
[Sat Jul 18 23:23:45.332577 2026] [security2:error] [pid 882519:tid 882746] [client 106.222.249.209:32055] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfYaL84xJUTmx6eO6vhQAAAOY"]
[Sat Jul 18 23:23:45.332669 2026] [security2:error] [pid 882519:tid 882746] [client 106.222.249.209:32055] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfYaL84xJUTmx6eO6vhQAAAOY"]
[Sat Jul 18 23:23:45.347278 2026] [security2:error] [pid 882519:tid 882613] [remote 134.209.147.209:59242] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.147.209.134.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxfYaL84xJUTmx6eO6vhwAAxF0"]
[Sat Jul 18 23:23:45.524051 2026] [security2:error] [pid 881201:tid 881355] [client 119.154.81.234:52609] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfYQWL-zKlchkVWS1YzgAAABc"]
[Sat Jul 18 23:23:45.524171 2026] [security2:error] [pid 881201:tid 881355] [client 119.154.81.234:52609] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfYQWL-zKlchkVWS1YzgAAABc"]
[Sat Jul 18 23:23:45.607486 2026] [security2:error] [pid 882519:tid 882734] [client 220.196.160.30:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxfYaL84xJUTmx6eO6vjgAAANo"]
[Sat Jul 18 23:23:45.741017 2026] [security2:error] [pid 882519:tid 882641] [remote 134.209.147.209:59242] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.147.209.134.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxfYaL84xJUTmx6eO6voQAA5Xk"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:23:46.319872 2026] [security2:error] [pid 882519:tid 882635] [remote 68.178.160.25:40158] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxfYqL84xJUTmx6eO6vvgAA5nM"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:23:46.761034 2026] [security2:error] [pid 882519:tid 882535] [remote 68.178.160.25:40164] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "jndsupport.com"] [uri "/wp-login.php"] [unique_id "alxfYqL84xJUTmx6eO6vzwAAwQ8"]
[Sat Jul 18 23:23:47.321953 2026] [security2:error] [pid 882519:tid 882662] [client 124.29.246.106:43492] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxfY6L84xJUTmx6eO6v6AAAAJI"]
[Sat Jul 18 23:23:47.322041 2026] [security2:error] [pid 882519:tid 882662] [client 124.29.246.106:43492] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxfY6L84xJUTmx6eO6v6AAAAJI"]
[Sat Jul 18 23:23:48.675303 2026] [security2:error] [pid 882519:tid 882545] [remote 20.153.140.50:48914] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "grndl.com"] [uri "/xmlrpc.php"] [unique_id "alxfZKL84xJUTmx6eO6wIwAApxk"]
[Sat Jul 18 23:23:48.675546 2026] [security2:error] [pid 882519:tid 882683] [client 20.153.140.50:48914] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "grndl.com"] [uri "/xmlrpc.php"] [unique_id "alxfZKL84xJUTmx6eO6wIwAApxk"]
[Sat Jul 18 23:23:48.700954 2026] [security2:error] [pid 882519:tid 882528] [remote 68.178.160.25:40164] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "jndsupport.com"] [uri "/wp-login.php"] [unique_id "alxfZKL84xJUTmx6eO6wJQAAiAg"], referer: https://jndsupport.com/wp-login.php
[Sat Jul 18 23:23:49.132087 2026] [security2:error] [pid 881201:tid 881442] [client 65.111.28.58:60603] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxfZQWL-zKlchkVWS1ZAgAAAG4"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:23:49.762089 2026] [security2:error] [pid 882519:tid 882696] [client 47.128.121.82:28506] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "lifeisbetterlakeside.com"] [uri "/index.php"] [unique_id "alxfZaL84xJUTmx6eO6wSQAAtD0"]
[Sat Jul 18 23:23:49.990880 2026] [security2:error] [pid 882519:tid 882566] [remote 113.160.142.119:39784] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "wathenbartlett.co.uk"] [uri "/wp-login.php"] [unique_id "alxfZaL84xJUTmx6eO6wWgAAxS4"]
[Sat Jul 18 23:23:50.452859 2026] [security2:error] [pid 882519:tid 882712] [client 190.245.146.99:52905] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfZqL84xJUTmx6eO6wbwAAAMQ"]
[Sat Jul 18 23:23:50.452968 2026] [security2:error] [pid 882519:tid 882712] [client 190.245.146.99:52905] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfZqL84xJUTmx6eO6wbwAAAMQ"]
[Sat Jul 18 23:23:50.512533 2026] [security2:error] [pid 882519:tid 882580] [remote 113.160.142.119:39784] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "wathenbartlett.co.uk"] [uri "/wp-login.php"] [unique_id "alxfZqL84xJUTmx6eO6wdAAA3Dw"], referer: https://wathenbartlett.co.uk/wp-login.php
[Sat Jul 18 23:23:51.019103 2026] [security2:error] [pid 882519:tid 882680] [client 27.34.68.67:28285] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfZ6L84xJUTmx6eO6wiAAAAKQ"]
[Sat Jul 18 23:23:51.019186 2026] [security2:error] [pid 882519:tid 882680] [client 27.34.68.67:28285] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfZ6L84xJUTmx6eO6wiAAAAKQ"]
[Sat Jul 18 23:23:51.224046 2026] [security2:error] [pid 882519:tid 882677] [client 223.185.61.63:2410] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfZ6L84xJUTmx6eO6wkQAAAKE"]
[Sat Jul 18 23:23:51.224207 2026] [security2:error] [pid 882519:tid 882677] [client 223.185.61.63:2410] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfZ6L84xJUTmx6eO6wkQAAAKE"]
[Sat Jul 18 23:23:51.365713 2026] [security2:error] [pid 881201:tid 881374] [client 65.0.26.70:22740] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.26.0.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxfZwWL-zKlchkVWS1ZJgAAACo"]
[Sat Jul 18 23:23:52.312705 2026] [security2:error] [pid 881201:tid 881373] [client 65.0.26.70:22754] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.26.0.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxfaAWL-zKlchkVWS1ZMwAAACk"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:23:52.458463 2026] [security2:error] [pid 882519:tid 882706] [client 171.4.232.110:64628] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfaKL84xJUTmx6eO6wtwAAAL4"]
[Sat Jul 18 23:23:52.458560 2026] [security2:error] [pid 882519:tid 882706] [client 171.4.232.110:64628] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfaKL84xJUTmx6eO6wtwAAAL4"]
[Sat Jul 18 23:23:53.734659 2026] [security2:error] [pid 881201:tid 881457] [client 114.119.144.42:44411] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "suretybonds-california.com"] [uri "/"] [unique_id "alxfaQWL-zKlchkVWS1ZTwAAAH0"], referer: http://suretybonds-california.com/
[Sat Jul 18 23:23:54.261839 2026] [security2:error] [pid 882519:tid 882750] [client 74.7.227.179:58068] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxfaqL84xJUTmx6eO6w7gAA6hQ"], referer: https://tejasenvironmental.com/p=317911
[Sat Jul 18 23:23:54.967949 2026] [security2:error] [pid 881201:tid 881429] [client 45.3.45.128:54185] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "155"] [id "900406"] [msg "wp-login POST logging"] [data "200"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxfagWL-zKlchkVWS1ZYQAAAGE"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:23:55.078911 2026] [core:error] [pid 882519:tid 882695] [client 50.116.65.227:28422] AH00135: Invalid method in request PURGE /.* HTTP/1.1
[Sat Jul 18 23:23:55.089008 2026] [core:error] [pid 882519:tid 882673] [client 50.116.65.227:28428] AH00135: Invalid method in request PURGE /.* HTTP/1.1
[Sat Jul 18 23:23:55.525984 2026] [security2:error] [pid 882519:tid 882750] [client 142.147.175.11:30556] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.sesamegreenbeans.com"] [uri "/index.php"] [unique_id "alxfa6L84xJUTmx6eO6xLQAA6gg"]
[Sat Jul 18 23:23:55.817530 2026] [security2:error] [pid 881201:tid 881450] [client 106.222.249.209:15698] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfawWL-zKlchkVWS1ZcAAAAHY"]
[Sat Jul 18 23:23:55.817655 2026] [security2:error] [pid 881201:tid 881450] [client 106.222.249.209:15698] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfawWL-zKlchkVWS1ZcAAAAHY"]
[Sat Jul 18 23:23:56.121551 2026] [security2:error] [pid 882519:tid 882662] [client 119.154.81.234:53065] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfbKL84xJUTmx6eO6xTQAAAJI"]
[Sat Jul 18 23:23:56.121839 2026] [security2:error] [pid 882519:tid 882662] [client 119.154.81.234:53065] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfbKL84xJUTmx6eO6xTQAAAJI"]
[Sat Jul 18 23:23:56.317203 2026] [security2:error] [pid 882519:tid 882725] [client 50.116.65.227:33602] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxfbKL84xJUTmx6eO6xWQAAANE"]
[Sat Jul 18 23:23:56.333376 2026] [security2:error] [pid 881201:tid 881357] [client 50.116.65.227:28450] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxfbAWL-zKlchkVWS1ZdQAAABk"]
[Sat Jul 18 23:23:56.925909 2026] [security2:error] [pid 882519:tid 882565] [remote 8.217.108.67:8384] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfbKL84xJUTmx6eO6xfAAA2S0"]
[Sat Jul 18 23:23:57.470238 2026] [security2:error] [pid 882519:tid 882602] [remote 8.217.108.67:8378] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.ait.afz.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfbaL84xJUTmx6eO6xlgAA_1I"]
[Sat Jul 18 23:23:57.679179 2026] [security2:error] [pid 882519:tid 882583] [remote 103.90.234.13:42738] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.234.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxfbaL84xJUTmx6eO6xnQABBD8"]
[Sat Jul 18 23:23:58.102193 2026] [security2:error] [pid 882519:tid 882569] [remote 103.90.234.13:42738] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.234.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxfbqL84xJUTmx6eO6xrgAAljE"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:23:58.891182 2026] [security2:error] [pid 882519:tid 882625] [remote 8.217.108.67:8378] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.ait.afz.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfbqL84xJUTmx6eO6xxgAA6Wk"], referer: https://mail.ait.afz.mybluehost.me/wp-login.php
[Sat Jul 18 23:23:59.475459 2026] [security2:error] [pid 882519:tid 882634] [remote 8.217.108.67:8384] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfb6L84xJUTmx6eO6x3AAAjXI"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:23:59.676609 2026] [security2:error] [pid 882519:tid 882712] [client 141.255.164.66:39934] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\w ?(?:user|and)(\\\\w+)char ?\\\\([0-9]| \\\\b(?:execute|convert) ?\\\\(|; ?\\\\bdelete\\\\b.{1,100}?; ?(?:insert|declare @|varchar) ?|\\\\bdrop\\\\b .{1,100} table |(?:declare|convert) .{1,100} varchar\\\\(|null ?, ?null ?, ?(?:accesslevel|user_?name) ?,|\\\\bconcat ..." at ARGS:requests.requests.body.requests.requests.path. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "395"] [id "340157"] [rev "38"] [msg "Atomicorp.com WAF Rules: Generic SQL inline command protection"] [data "union select ,ARGS:requests.requests.body.requests.requests.path"] [severity "CRITICAL"] [tag "SQLi"] [hostname "holistichealthmassagenz.com"] [uri "/"] [unique_id "alxfb6L84xJUTmx6eO6x1QAAAMQ"]
[Sat Jul 18 23:23:59.697139 2026] [security2:error] [pid 881201:tid 881289] [remote 41.76.213.235:59692] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxfbwWL-zKlchkVWS1ZoQAACFY"]
[Sat Jul 18 23:23:59.697259 2026] [security2:error] [pid 881201:tid 881340] [client 41.76.213.235:59692] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxfbwWL-zKlchkVWS1ZoQAACFY"]
[Sat Jul 18 23:24:01.005065 2026] [security2:error] [pid 882519:tid 882769] [client 190.245.146.99:53425] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfcaL84xJUTmx6eO6yDgAAAP0"]
[Sat Jul 18 23:24:01.018145 2026] [security2:error] [pid 882519:tid 882769] [client 190.245.146.99:53425] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfcaL84xJUTmx6eO6yDgAAAP0"]
[Sat Jul 18 23:24:01.592853 2026] [security2:error] [pid 881201:tid 881267] [remote 163.227.186.27:45594] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxfcQWL-zKlchkVWS1ZxQAAREA"]
[Sat Jul 18 23:24:01.671838 2026] [security2:error] [pid 881201:tid 881390] [client 27.34.68.67:60908] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfcQWL-zKlchkVWS1ZxwAAADo"]
[Sat Jul 18 23:24:01.671995 2026] [security2:error] [pid 881201:tid 881390] [client 27.34.68.67:60908] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfcQWL-zKlchkVWS1ZxwAAADo"]
[Sat Jul 18 23:24:01.842628 2026] [security2:error] [pid 881201:tid 881341] [client 223.185.61.63:8935] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfcQWL-zKlchkVWS1ZyQAAAAk"]
[Sat Jul 18 23:24:01.842780 2026] [security2:error] [pid 881201:tid 881341] [client 223.185.61.63:8935] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfcQWL-zKlchkVWS1ZyQAAAAk"]
[Sat Jul 18 23:24:02.068914 2026] [security2:error] [pid 881201:tid 881308] [remote 163.227.186.27:45594] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxfcgWL-zKlchkVWS1Z1AAAHGk"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:24:02.320295 2026] [security2:error] [pid 881201:tid 881359] [client 72.252.198.61:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "kingsafety.ca"] [uri "/index.php"] [unique_id "alxfcgWL-zKlchkVWS1Z2AAAABs"]
[Sat Jul 18 23:24:02.869885 2026] [proxy:error] [pid 881201:tid 881438] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:24:02.869963 2026] [proxy_http:error] [pid 881201:tid 881438] [client 193.47.62.168:52814] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:24:02.870581 2026] [proxy:error] [pid 881201:tid 881438] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:24:02.870612 2026] [proxy_http:error] [pid 881201:tid 881438] [client 193.47.62.168:52814] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:24:03.073229 2026] [security2:error] [pid 881201:tid 881340] [client 171.4.232.110:65132] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfcwWL-zKlchkVWS1Z6wAAAAg"]
[Sat Jul 18 23:24:03.073380 2026] [security2:error] [pid 881201:tid 881340] [client 171.4.232.110:65132] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfcwWL-zKlchkVWS1Z6wAAAAg"]
[Sat Jul 18 23:24:04.116116 2026] [proxy:error] [pid 882519:tid 882711] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:24:04.116196 2026] [proxy_http:error] [pid 882519:tid 882711] [client 193.47.62.168:47444] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:24:04.116830 2026] [proxy:error] [pid 882519:tid 882711] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:24:04.116873 2026] [proxy_http:error] [pid 882519:tid 882711] [client 193.47.62.168:47444] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:24:04.702309 2026] [security2:error] [pid 881201:tid 881330] [remote 128.199.203.39:52054] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 39.203.199.128.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfdAWL-zKlchkVWS1Z_gAAXX8"]
[Sat Jul 18 23:24:04.843687 2026] [security2:error] [pid 882519:tid 882719] [client 50.116.65.227:42418] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxfdKL84xJUTmx6eO6y3QAAAMs"]
[Sat Jul 18 23:24:04.858071 2026] [security2:error] [pid 882519:tid 882745] [client 50.116.65.227:59222] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxfdKL84xJUTmx6eO6y3gAAAOU"]
[Sat Jul 18 23:24:05.078378 2026] [security2:error] [pid 881201:tid 881230] [remote 128.199.203.39:52054] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 39.203.199.128.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfdQWL-zKlchkVWS1aAgAAWxs"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:24:05.598551 2026] [security2:error] [pid 882519:tid 882748] [client 190.196.238.9:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mtlegnews.gov"] [uri "/index.php"] [unique_id "alxfdaL84xJUTmx6eO6y9gAAAOg"]
[Sat Jul 18 23:24:06.429792 2026] [security2:error] [pid 882519:tid 882719] [client 106.222.249.209:22191] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfdqL84xJUTmx6eO6zKAAAAMs"]
[Sat Jul 18 23:24:06.429972 2026] [security2:error] [pid 882519:tid 882719] [client 106.222.249.209:22191] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfdqL84xJUTmx6eO6zKAAAAMs"]
[Sat Jul 18 23:24:06.734520 2026] [security2:error] [pid 882519:tid 882712] [client 119.154.81.234:53524] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfdqL84xJUTmx6eO6zOQAAAMQ"]
[Sat Jul 18 23:24:06.734619 2026] [security2:error] [pid 882519:tid 882712] [client 119.154.81.234:53524] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfdqL84xJUTmx6eO6zOQAAAMQ"]
[Sat Jul 18 23:24:07.708042 2026] [security2:error] [pid 882519:tid 882595] [remote 57.141.18.15:51662] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.18.141.57.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/product/3802589"] [unique_id "alxfd6L84xJUTmx6eO6zZQAA60s"]
[Sat Jul 18 23:24:08.281527 2026] [security2:error] [pid 882519:tid 882677] [client 124.29.207.185:57814] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxfeKL84xJUTmx6eO6zewAAAKE"]
[Sat Jul 18 23:24:08.281663 2026] [security2:error] [pid 882519:tid 882677] [client 124.29.207.185:57814] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxfeKL84xJUTmx6eO6zewAAAKE"]
[Sat Jul 18 23:24:09.347643 2026] [security2:error] [pid 881201:tid 881346] [client 168.199.101.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxfeQWL-zKlchkVWS1aQwAAAA4"]
[Sat Jul 18 23:24:09.864710 2026] [security2:error] [pid 882519:tid 882637] [remote 72.167.132.114:44142] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxfeaL84xJUTmx6eO6zsQAA9HU"]
[Sat Jul 18 23:24:10.083643 2026] [security2:error] [pid 882519:tid 882646] [remote 72.167.132.114:44142] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxfeqL84xJUTmx6eO6zuwAAwn4"], referer: https://mezzacraft.com/wp-login.php
[Sat Jul 18 23:24:11.161674 2026] [ssl:error] [pid 882519:tid 882740] [client 98.88.137.2:29598] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname autoconfig.celeritech-de.yfm.wvg.mybluehost.me provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:24:11.495823 2026] [security2:error] [pid 882519:tid 882727] [client 190.245.146.99:53949] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfe6L84xJUTmx6eO6z9wAAANM"]
[Sat Jul 18 23:24:11.495922 2026] [security2:error] [pid 882519:tid 882727] [client 190.245.146.99:53949] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfe6L84xJUTmx6eO6z9wAAANM"]
[Sat Jul 18 23:24:11.823294 2026] [security2:error] [pid 881201:tid 881291] [remote 152.228.213.32:48580] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ivetstrategies.com"] [uri "/xmlrpc.php"] [unique_id "alxfewWL-zKlchkVWS1aYAAAfFg"]
[Sat Jul 18 23:24:11.823448 2026] [security2:error] [pid 881201:tid 881456] [client 152.228.213.32:48580] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ivetstrategies.com"] [uri "/xmlrpc.php"] [unique_id "alxfewWL-zKlchkVWS1aYAAAfFg"]
[Sat Jul 18 23:24:11.982078 2026] [security2:error] [pid 882519:tid 882724] [client 116.179.32.142:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "mezzacraft.com"] [uri "/index.php"] [unique_id "alxfeqL84xJUTmx6eO6zwgAAANA"]
[Sat Jul 18 23:24:12.238249 2026] [security2:error] [pid 881201:tid 881447] [client 27.34.68.67:32997] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxffAWL-zKlchkVWS1aagAAAHM"]
[Sat Jul 18 23:24:12.238363 2026] [security2:error] [pid 881201:tid 881447] [client 27.34.68.67:32997] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxffAWL-zKlchkVWS1aagAAAHM"]
[Sat Jul 18 23:24:12.398829 2026] [security2:error] [pid 881201:tid 881417] [client 223.185.61.63:22186] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxffAWL-zKlchkVWS1abQAAAFU"]
[Sat Jul 18 23:24:12.403475 2026] [security2:error] [pid 881201:tid 881417] [client 223.185.61.63:22186] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxffAWL-zKlchkVWS1abQAAAFU"]
[Sat Jul 18 23:24:12.575905 2026] [security2:error] [pid 882519:tid 882535] [remote 199.189.225.167:47965] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.225.189.199.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "qualitycoatingsinspection.com"] [uri "/wp-login.php"] [unique_id "alxffKL84xJUTmx6eO60KQAAmw8"]
[Sat Jul 18 23:24:12.809229 2026] [security2:error] [pid 882519:tid 882538] [remote 199.189.225.167:47965] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.225.189.199.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "qualitycoatingsinspection.com"] [uri "/wp-login.php"] [unique_id "alxffKL84xJUTmx6eO60NgAAyxI"], referer: https://qualitycoatingsinspection.com/wp-login.php
[Sat Jul 18 23:24:13.663742 2026] [security2:error] [pid 882519:tid 882699] [client 171.4.232.110:50569] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxffaL84xJUTmx6eO60WwAAALc"]
[Sat Jul 18 23:24:13.663852 2026] [security2:error] [pid 882519:tid 882699] [client 171.4.232.110:50569] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxffaL84xJUTmx6eO60WwAAALc"]
[Sat Jul 18 23:24:13.869311 2026] [security2:error] [pid 881201:tid 881261] [remote 72.167.132.114:44152] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxffQWL-zKlchkVWS1agAAALjo"]
[Sat Jul 18 23:24:14.346192 2026] [security2:error] [pid 882519:tid 882650] [client 205.185.117.197:49484] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 197.117.185.205.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "emsbodystorm.com"] [uri "/wp-login.php"] [unique_id "alxffqL84xJUTmx6eO60egAAAIY"]
[Sat Jul 18 23:24:14.908589 2026] [security2:error] [pid 881201:tid 881277] [remote 72.167.132.114:44152] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxffgWL-zKlchkVWS1akAAACUo"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:24:15.280742 2026] [security2:error] [pid 882519:tid 882758] [client 45.3.45.53:63471] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 53.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxff6L84xJUTmx6eO60mwAAAPI"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:24:15.828533 2026] [security2:error] [pid 881201:tid 881272] [remote 31.42.184.154:59874] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxffwWL-zKlchkVWS1anAAAWUU"]
[Sat Jul 18 23:24:15.828639 2026] [security2:error] [pid 881201:tid 881421] [client 31.42.184.154:59874] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxffwWL-zKlchkVWS1anAAAWUU"]
[Sat Jul 18 23:24:16.288621 2026] [security2:error] [pid 881201:tid 881362] [client 124.29.246.106:58272] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxfgAWL-zKlchkVWS1apAAAAB4"]
[Sat Jul 18 23:24:16.288825 2026] [security2:error] [pid 881201:tid 881362] [client 124.29.246.106:58272] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxfgAWL-zKlchkVWS1apAAAAB4"]
[Sat Jul 18 23:24:16.863721 2026] [security2:error] [pid 881201:tid 881231] [remote 72.167.132.114:35336] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "adastra.love"] [uri "/wp-login.php"] [unique_id "alxfgAWL-zKlchkVWS1arQAAWhw"]
[Sat Jul 18 23:24:17.085838 2026] [security2:error] [pid 882519:tid 882597] [remote 68.183.43.38:48322] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 38.43.183.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxfgaL84xJUTmx6eO603gAAq00"]
[Sat Jul 18 23:24:17.160143 2026] [security2:error] [pid 882519:tid 882761] [client 106.222.249.209:32829] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfgaL84xJUTmx6eO603wAAAPU"]
[Sat Jul 18 23:24:17.160572 2026] [security2:error] [pid 882519:tid 882761] [client 106.222.249.209:32829] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfgaL84xJUTmx6eO603wAAAPU"]
[Sat Jul 18 23:24:17.192166 2026] [security2:error] [pid 881201:tid 881375] [client 45.3.44.144:19773] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 144.44.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxfgQWL-zKlchkVWS1atgAAACs"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:24:17.265443 2026] [security2:error] [pid 882519:tid 882639] [remote 68.183.43.38:48322] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 38.43.183.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxfgaL84xJUTmx6eO605QAAtHc"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:24:17.288411 2026] [security2:error] [pid 881201:tid 881381] [client 119.154.81.234:53986] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfgQWL-zKlchkVWS1atwAAADE"]
[Sat Jul 18 23:24:17.288537 2026] [security2:error] [pid 881201:tid 881381] [client 119.154.81.234:53986] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfgQWL-zKlchkVWS1atwAAADE"]
[Sat Jul 18 23:24:17.291678 2026] [security2:error] [pid 882519:tid 882755] [client 223.228.182.224:11242] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxfgaL84xJUTmx6eO605wAAAO8"]
[Sat Jul 18 23:24:17.291817 2026] [security2:error] [pid 882519:tid 882755] [client 223.228.182.224:11242] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxfgaL84xJUTmx6eO605wAAAO8"]
[Sat Jul 18 23:24:17.580774 2026] [security2:error] [pid 881201:tid 881315] [remote 72.167.132.114:35336] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "adastra.love"] [uri "/wp-login.php"] [unique_id "alxfgQWL-zKlchkVWS1avwAASXA"], referer: https://adastra.love/wp-login.php
[Sat Jul 18 23:24:18.052063 2026] [security2:error] [pid 882519:tid 882734] [client 104.207.52.60:57883] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 60.52.207.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxfgqL84xJUTmx6eO61BgAAANo"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:24:19.144516 2026] [security2:error] [pid 882519:tid 882670] [client 113.160.97.242:62580] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "wpad"] [uri "/wpad.dat"] [unique_id "alxfg6L84xJUTmx6eO61LwAAAJo"]
[Sat Jul 18 23:24:19.332534 2026] [security2:error] [pid 882519:tid 882549] [remote 202.51.202.242:56522] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 242.202.51.202.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxfg6L84xJUTmx6eO61NwAAux0"]
[Sat Jul 18 23:24:20.644123 2026] [security2:error] [pid 881201:tid 881416] [client 52.221.236.148:27894] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 148.236.221.52.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxfhAWL-zKlchkVWS1a8wAAAFQ"]
[Sat Jul 18 23:24:20.884570 2026] [security2:error] [pid 882519:tid 882571] [remote 4.205.168.44:37728] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfhKL84xJUTmx6eO61bQAA6jM"]
[Sat Jul 18 23:24:21.558721 2026] [security2:error] [pid 882519:tid 882729] [client 18.139.208.24:49760] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.208.139.18.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxfhaL84xJUTmx6eO61iwAAANU"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:24:21.982981 2026] [security2:error] [pid 881201:tid 881384] [client 190.245.146.99:54473] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfhQWL-zKlchkVWS1bDAAAADQ"]
[Sat Jul 18 23:24:21.983122 2026] [security2:error] [pid 881201:tid 881384] [client 190.245.146.99:54473] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfhQWL-zKlchkVWS1bDAAAADQ"]
[Sat Jul 18 23:24:21.986800 2026] [security2:error] [pid 881201:tid 881333] [client 88.201.241.104:34878] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.241.201.88.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ouw.egd.mybluehost.me"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxfhQWL-zKlchkVWS1bCgAAAAE"], referer: https://ouw.egd.mybluehost.me/
[Sat Jul 18 23:24:22.467733 2026] [security2:error] [pid 881201:tid 881380] [client 57.141.18.43:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxfhgWL-zKlchkVWS1bGAAAADA"]
[Sat Jul 18 23:24:22.809030 2026] [security2:error] [pid 882519:tid 882677] [client 27.34.68.67:37165] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfhqL84xJUTmx6eO61tgAAAKE"]
[Sat Jul 18 23:24:22.809173 2026] [security2:error] [pid 882519:tid 882677] [client 27.34.68.67:37165] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfhqL84xJUTmx6eO61tgAAAKE"]
[Sat Jul 18 23:24:22.944945 2026] [security2:error] [pid 881201:tid 881443] [client 223.185.61.63:16746] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfhgWL-zKlchkVWS1bJgAAAG8"]
[Sat Jul 18 23:24:22.945046 2026] [security2:error] [pid 881201:tid 881443] [client 223.185.61.63:16746] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfhgWL-zKlchkVWS1bJgAAAG8"]
[Sat Jul 18 23:24:23.788655 2026] [security2:error] [pid 882519:tid 882759] [client 65.0.26.70:42616] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.26.0.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxfh6L84xJUTmx6eO611QAAAPM"]
[Sat Jul 18 23:24:23.788770 2026] [security2:error] [pid 882519:tid 882759] [client 65.0.26.70:42616] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxfh6L84xJUTmx6eO611QAAAPM"]
[Sat Jul 18 23:24:23.963865 2026] [security2:error] [pid 882519:tid 882631] [remote 157.66.47.83:41910] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "worbals.com"] [uri "/wp-login.php"] [unique_id "alxfh6L84xJUTmx6eO612QAApW8"]
[Sat Jul 18 23:24:24.202486 2026] [security2:error] [pid 881201:tid 881370] [client 171.4.232.110:51163] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfiAWL-zKlchkVWS1bOQAAACY"]
[Sat Jul 18 23:24:24.202626 2026] [security2:error] [pid 881201:tid 881370] [client 171.4.232.110:51163] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfiAWL-zKlchkVWS1bOQAAACY"]
[Sat Jul 18 23:24:24.243144 2026] [security2:error] [pid 882519:tid 882522] [remote 4.205.168.44:37728] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfiKL84xJUTmx6eO614wAAzAI"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:24:24.398581 2026] [security2:error] [pid 882519:tid 882526] [remote 157.66.47.83:41910] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "worbals.com"] [uri "/wp-login.php"] [unique_id "alxfiKL84xJUTmx6eO616QAAigY"], referer: https://worbals.com/wp-login.php
[Sat Jul 18 23:24:24.404425 2026] [security2:error] [pid 881201:tid 881415] [client 136.243.222.140:56656] ModSecurity: Warning. Matched phrase "DomainStatsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "www.ccsdifference.com"] [uri "/index.php"] [unique_id "alxfhwWL-zKlchkVWS1bMwAAAD4"]
[Sat Jul 18 23:24:26.241725 2026] [security2:error] [pid 882519:tid 882552] [remote 68.178.160.25:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "innovativecleaningsvs.com"] [uri "/wp-login.php"] [unique_id "alxfiqL84xJUTmx6eO62JgAAmSA"]
[Sat Jul 18 23:24:26.244369 2026] [security2:error] [pid 881201:tid 881449] [client 45.3.45.140:45375] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 140.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxfigWL-zKlchkVWS1bgAAAAHU"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:24:27.339942 2026] [security2:error] [pid 881201:tid 881459] [client 124.29.207.185:58716] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxfiwWL-zKlchkVWS1blwAAAH8"]
[Sat Jul 18 23:24:27.340228 2026] [security2:error] [pid 881201:tid 881459] [client 124.29.207.185:58716] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxfiwWL-zKlchkVWS1blwAAAH8"]
[Sat Jul 18 23:24:27.828611 2026] [security2:error] [pid 881201:tid 881387] [client 34.73.232.127:9234] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "justinagrayman.com"] [uri "/wp-json/batch/v1"] [unique_id "alxfiwWL-zKlchkVWS1bnQAAADc"]
[Sat Jul 18 23:24:27.849179 2026] [security2:error] [pid 882519:tid 882759] [client 119.154.81.234:54445] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfi6L84xJUTmx6eO62XQAAAPM"]
[Sat Jul 18 23:24:27.849458 2026] [security2:error] [pid 882519:tid 882759] [client 119.154.81.234:54445] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfi6L84xJUTmx6eO62XQAAAPM"]
[Sat Jul 18 23:24:27.894976 2026] [security2:error] [pid 882519:tid 882661] [client 106.222.249.209:21675] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfi6L84xJUTmx6eO62YgAAAJE"]
[Sat Jul 18 23:24:27.895115 2026] [security2:error] [pid 882519:tid 882661] [client 106.222.249.209:21675] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfi6L84xJUTmx6eO62YgAAAJE"]
[Sat Jul 18 23:24:28.364410 2026] [security2:error] [pid 881201:tid 881359] [client 34.73.232.127:9234] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "justinagrayman.com"] [uri "/"] [unique_id "alxfjAWL-zKlchkVWS1bpAAAABs"]
[Sat Jul 18 23:24:28.406040 2026] [security2:error] [pid 882519:tid 882616] [remote 103.75.185.95:57990] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxfjKL84xJUTmx6eO62eQAA_WA"]
[Sat Jul 18 23:24:28.736103 2026] [security2:error] [pid 882519:tid 882609] [remote 68.178.160.25:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "innovativecleaningsvs.com"] [uri "/wp-login.php"] [unique_id "alxfjKL84xJUTmx6eO62hAAAtVk"], referer: https://innovativecleaningsvs.com/wp-login.php
[Sat Jul 18 23:24:28.926852 2026] [security2:error] [pid 882519:tid 882618] [remote 103.75.185.95:57990] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxfjKL84xJUTmx6eO62igAA3WI"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:24:29.154907 2026] [security2:error] [pid 881201:tid 881362] [client 57.141.18.65:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxfjAWL-zKlchkVWS1brgAAAB4"]
[Sat Jul 18 23:24:29.586080 2026] [security2:error] [pid 882519:tid 882637] [remote 20.153.140.50:32798] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-login.php"] [unique_id "alxfjaL84xJUTmx6eO62pgAA83U"]
[Sat Jul 18 23:24:30.024182 2026] [security2:error] [pid 882519:tid 882629] [remote 20.153.140.50:32798] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-login.php"] [unique_id "alxfjqL84xJUTmx6eO62ugAA9G0"], referer: https://swafforddetailing.com/wp-login.php
[Sat Jul 18 23:24:30.646295 2026] [security2:error] [pid 882519:tid 882668] [client 34.73.105.183:21442] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "villa-m-medjugorje.com"] [uri "/wp-json/batch/v1"] [unique_id "alxfjqL84xJUTmx6eO621wAAAJg"]
[Sat Jul 18 23:24:31.051213 2026] [proxy:error] [pid 882519:tid 882708] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:24:31.051254 2026] [proxy_http:error] [pid 882519:tid 882708] [client 54.89.97.88:58082] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:24:31.051347 2026] [proxy:error] [pid 882519:tid 882662] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:24:31.051412 2026] [proxy_http:error] [pid 882519:tid 882662] [client 54.89.97.88:58070] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:24:31.051708 2026] [proxy:error] [pid 882519:tid 882708] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:24:31.051734 2026] [proxy_http:error] [pid 882519:tid 882708] [client 54.89.97.88:58082] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:24:31.051967 2026] [proxy:error] [pid 882519:tid 882662] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:24:31.052012 2026] [proxy_http:error] [pid 882519:tid 882662] [client 54.89.97.88:58070] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:24:31.094832 2026] [security2:error] [pid 882519:tid 882666] [client 34.73.105.183:21442] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "villa-m-medjugorje.com"] [uri "/"] [unique_id "alxfj6L84xJUTmx6eO627wAAAJY"]
[Sat Jul 18 23:24:31.624640 2026] [security2:error] [pid 881201:tid 881398] [client 54.89.97.88:58154] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "autodiscover.entraalnuevomundo.com"] [uri "/.env"] [unique_id "alxfjwWL-zKlchkVWS1b0wAAAEI"]
[Sat Jul 18 23:24:31.651083 2026] [security2:error] [pid 882519:tid 882747] [client 113.44.126.57:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxfj6L84xJUTmx6eO62-wAA5wY"]
[Sat Jul 18 23:24:32.061050 2026] [security2:error] [pid 881201:tid 881440] [client 54.89.97.88:58174] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "entraalnuevomundo.com"] [uri "/.env"] [unique_id "alxfkAWL-zKlchkVWS1b2gAAAGw"]
[Sat Jul 18 23:24:32.061161 2026] [proxy:error] [pid 882519:tid 882674] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:24:32.061220 2026] [proxy:error] [pid 881201:tid 881334] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:24:32.061227 2026] [proxy_http:error] [pid 882519:tid 882674] [client 54.89.97.88:58184] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:24:32.061258 2026] [proxy_http:error] [pid 881201:tid 881334] [client 54.89.97.88:58168] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:24:32.061885 2026] [proxy:error] [pid 882519:tid 882674] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:24:32.061927 2026] [proxy_http:error] [pid 882519:tid 882674] [client 54.89.97.88:58184] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:24:32.061972 2026] [proxy:error] [pid 881201:tid 881334] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:24:32.062017 2026] [proxy_http:error] [pid 881201:tid 881334] [client 54.89.97.88:58168] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:24:32.135432 2026] [security2:error] [pid 882519:tid 882665] [client 74.208.214.194:35990] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxfkKL84xJUTmx6eO63IQAAAJU"]
[Sat Jul 18 23:24:32.219178 2026] [security2:error] [pid 882519:tid 882724] [client 54.89.97.88:58210] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "mail.entraalnuevomundo.com"] [uri "/.env"] [unique_id "alxfkKL84xJUTmx6eO63IwAAANA"]
[Sat Jul 18 23:24:32.260343 2026] [security2:error] [pid 882519:tid 882731] [client 54.89.97.88:58192] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.entraalnuevomundo.com"] [uri "/.env"] [unique_id "alxfkKL84xJUTmx6eO63JQAAANc"]
[Sat Jul 18 23:24:32.504073 2026] [security2:error] [pid 881201:tid 881435] [client 190.245.146.99:54996] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfkAWL-zKlchkVWS1b5AAAAGc"]
[Sat Jul 18 23:24:32.504183 2026] [security2:error] [pid 881201:tid 881435] [client 190.245.146.99:54996] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfkAWL-zKlchkVWS1b5AAAAGc"]
[Sat Jul 18 23:24:33.350280 2026] [security2:error] [pid 882519:tid 882747] [client 27.34.68.67:63803] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfkaL84xJUTmx6eO63VQAAAOc"]
[Sat Jul 18 23:24:33.350371 2026] [security2:error] [pid 882519:tid 882747] [client 27.34.68.67:63803] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfkaL84xJUTmx6eO63VQAAAOc"]
[Sat Jul 18 23:24:33.365495 2026] [security2:error] [pid 881201:tid 881212] [remote 31.42.184.154:50768] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxfkQWL-zKlchkVWS1b-AAACAk"]
[Sat Jul 18 23:24:33.523300 2026] [security2:error] [pid 882519:tid 882757] [client 223.185.61.63:20971] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfkaL84xJUTmx6eO63YAAAAPE"]
[Sat Jul 18 23:24:33.523392 2026] [security2:error] [pid 882519:tid 882757] [client 223.185.61.63:20971] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfkaL84xJUTmx6eO63YAAAAPE"]
[Sat Jul 18 23:24:33.607731 2026] [security2:error] [pid 881201:tid 881214] [remote 31.42.184.154:50768] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxfkQWL-zKlchkVWS1b-wAAPgs"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:24:34.813304 2026] [security2:error] [pid 882519:tid 882613] [remote 217.113.60.80:57530] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.60.113.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxfkqL84xJUTmx6eO63oQAA-F0"]
[Sat Jul 18 23:24:34.839411 2026] [security2:error] [pid 881201:tid 881348] [client 171.4.232.110:51823] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfkgWL-zKlchkVWS1cCwAAABA"]
[Sat Jul 18 23:24:34.839527 2026] [security2:error] [pid 881201:tid 881348] [client 171.4.232.110:51823] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfkgWL-zKlchkVWS1cCwAAABA"]
[Sat Jul 18 23:24:35.026602 2026] [security2:error] [pid 882519:tid 882621] [remote 217.113.60.80:57530] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.60.113.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxfk6L84xJUTmx6eO63sAAAk2U"], referer: https://mezzacraft.com/wp-login.php
[Sat Jul 18 23:24:35.587240 2026] [security2:error] [pid 882519:tid 882772] [client 45.3.45.148:52213] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 148.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxfk6L84xJUTmx6eO63wQAAAQA"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:24:35.906206 2026] [security2:error] [pid 881201:tid 881207] [remote 91.142.222.105:40352] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "wgs.doq.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxfkwWL-zKlchkVWS1cIQAAUAQ"]
[Sat Jul 18 23:24:35.906391 2026] [security2:error] [pid 881201:tid 881412] [client 91.142.222.105:40352] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "wgs.doq.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxfkwWL-zKlchkVWS1cIQAAUAQ"]
[Sat Jul 18 23:24:36.722531 2026] [security2:error] [pid 881201:tid 881247] [remote 165.232.170.247:53810] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 247.170.232.165.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxflAWL-zKlchkVWS1cKgAAPyw"]
[Sat Jul 18 23:24:36.925349 2026] [security2:error] [pid 882519:tid 882689] [client 104.207.61.211:60365] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 211.61.207.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxflKL84xJUTmx6eO64AgAAAK0"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:24:37.103250 2026] [security2:error] [pid 881201:tid 881211] [remote 165.232.170.247:53810] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 247.170.232.165.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxflQWL-zKlchkVWS1cMgAAJgg"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:24:37.222408 2026] [security2:error] [pid 882519:tid 882665] [client 124.29.246.106:59149] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxflaL84xJUTmx6eO64CgAAAJU"]
[Sat Jul 18 23:24:37.222520 2026] [security2:error] [pid 882519:tid 882665] [client 124.29.246.106:59149] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxflaL84xJUTmx6eO64CgAAAJU"]
[Sat Jul 18 23:24:37.778779 2026] [security2:error] [pid 882519:tid 882723] [client 52.207.32.99:54798] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.32.207.52.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxflaL84xJUTmx6eO64KAAAAM8"]
[Sat Jul 18 23:24:37.778901 2026] [security2:error] [pid 882519:tid 882723] [client 52.207.32.99:54798] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxflaL84xJUTmx6eO64KAAAAM8"]
[Sat Jul 18 23:24:38.360080 2026] [security2:error] [pid 882519:tid 882729] [client 119.154.81.234:54903] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxflqL84xJUTmx6eO64RQAAANU"]
[Sat Jul 18 23:24:38.360196 2026] [security2:error] [pid 882519:tid 882729] [client 119.154.81.234:54903] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxflqL84xJUTmx6eO64RQAAANU"]
[Sat Jul 18 23:24:38.528970 2026] [security2:error] [pid 882519:tid 882662] [client 106.222.249.209:29476] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxflqL84xJUTmx6eO64SgAAAJI"]
[Sat Jul 18 23:24:38.529143 2026] [security2:error] [pid 882519:tid 882662] [client 106.222.249.209:29476] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxflqL84xJUTmx6eO64SgAAAJI"]
[Sat Jul 18 23:24:38.835618 2026] [security2:error] [pid 882519:tid 882709] [client 223.228.182.224:53151] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxflqL84xJUTmx6eO64VwAAAME"]
[Sat Jul 18 23:24:38.835756 2026] [security2:error] [pid 882519:tid 882709] [client 223.228.182.224:53151] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxflqL84xJUTmx6eO64VwAAAME"]
[Sat Jul 18 23:24:39.663210 2026] [security2:error] [pid 882519:tid 882723] [client 34.73.105.183:34656] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "villa-m-medjugorje.com"] [uri "/"] [unique_id "alxfl6L84xJUTmx6eO64gwAAAM8"]
[Sat Jul 18 23:24:40.502052 2026] [security2:error] [pid 882519:tid 882616] [remote 154.61.75.100:48364] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxfmKL84xJUTmx6eO64rgAAq2A"]
[Sat Jul 18 23:24:40.682158 2026] [security2:error] [pid 882519:tid 882565] [remote 117.0.21.154:50756] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfmKL84xJUTmx6eO64tQAAmy0"]
[Sat Jul 18 23:24:40.812210 2026] [security2:error] [pid 882519:tid 882702] [client 3.108.60.216:55476] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxfmKL84xJUTmx6eO64vQAAALo"]
[Sat Jul 18 23:24:40.812293 2026] [security2:error] [pid 882519:tid 882702] [client 3.108.60.216:55476] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxfmKL84xJUTmx6eO64vQAAALo"]
[Sat Jul 18 23:24:40.815439 2026] [security2:error] [pid 881201:tid 881400] [client 15.237.217.173:54022] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 173.217.237.15.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxfmAWL-zKlchkVWS1cVQAAAEQ"]
[Sat Jul 18 23:24:40.815552 2026] [security2:error] [pid 881201:tid 881400] [client 15.237.217.173:54022] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxfmAWL-zKlchkVWS1cVQAAAEQ"]
[Sat Jul 18 23:24:41.063234 2026] [security2:error] [pid 882519:tid 882585] [remote 154.61.75.100:48364] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxfmaL84xJUTmx6eO64yAAA2EE"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:24:41.265687 2026] [proxy:error] [pid 882519:tid 882755] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:24:41.265786 2026] [proxy_http:error] [pid 882519:tid 882755] [client 193.47.62.168:45256] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:24:41.266408 2026] [proxy:error] [pid 882519:tid 882755] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:24:41.266438 2026] [proxy_http:error] [pid 882519:tid 882755] [client 193.47.62.168:45256] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:24:41.737377 2026] [security2:error] [pid 882519:tid 882533] [remote 117.0.21.154:50756] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfmaL84xJUTmx6eO646AAAmw0"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:24:42.986191 2026] [security2:error] [pid 882519:tid 882695] [client 190.245.146.99:55518] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfmqL84xJUTmx6eO65LQAAALM"]
[Sat Jul 18 23:24:42.992337 2026] [security2:error] [pid 882519:tid 882695] [client 190.245.146.99:55518] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfmqL84xJUTmx6eO65LQAAALM"]
[Sat Jul 18 23:24:43.935635 2026] [security2:error] [pid 882519:tid 882768] [client 27.34.68.67:25343] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfm6L84xJUTmx6eO65TwAAAPw"]
[Sat Jul 18 23:24:43.935838 2026] [security2:error] [pid 882519:tid 882768] [client 27.34.68.67:25343] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfm6L84xJUTmx6eO65TwAAAPw"]
[Sat Jul 18 23:24:44.223217 2026] [security2:error] [pid 881201:tid 881417] [client 223.185.61.63:3840] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfnAWL-zKlchkVWS1cgAAAAFU"]
[Sat Jul 18 23:24:44.223313 2026] [security2:error] [pid 881201:tid 881417] [client 223.185.61.63:3840] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfnAWL-zKlchkVWS1cgAAAAFU"]
[Sat Jul 18 23:24:45.186852 2026] [proxy:error] [pid 882519:tid 882689] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:24:45.186912 2026] [proxy_http:error] [pid 882519:tid 882689] [client 193.47.62.168:46322] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:24:45.187343 2026] [proxy:error] [pid 882519:tid 882689] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:24:45.187370 2026] [proxy_http:error] [pid 882519:tid 882689] [client 193.47.62.168:46322] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:24:45.191680 2026] [security2:error] [pid 882519:tid 882620] [remote 142.93.10.93:60520] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 93.10.93.142.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxfnaL84xJUTmx6eO65rgABAmQ"]
[Sat Jul 18 23:24:45.371354 2026] [security2:error] [pid 882519:tid 882615] [remote 47.128.99.74:61818] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "adambergeron.com"] [uri "/aposta-gratis-jogo-do-brasil-2024-01-19-id-2510.pdf"] [unique_id "alxfnaL84xJUTmx6eO65wAAAh18"]
[Sat Jul 18 23:24:45.388028 2026] [security2:error] [pid 882519:tid 882521] [remote 142.93.10.93:60520] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 93.10.93.142.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxfnaL84xJUTmx6eO65wQAAxQE"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:24:45.389880 2026] [security2:error] [pid 882519:tid 882660] [client 222.154.143.251:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "origine.nz"] [uri "/index.php"] [unique_id "alxfnaL84xJUTmx6eO65pQAAkDo"], referer: https://origine.nz/
[Sat Jul 18 23:24:45.438831 2026] [security2:error] [pid 881201:tid 881375] [client 171.4.232.110:52525] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfnQWL-zKlchkVWS1cjAAAACs"]
[Sat Jul 18 23:24:45.438948 2026] [security2:error] [pid 881201:tid 881375] [client 171.4.232.110:52525] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfnQWL-zKlchkVWS1cjAAAACs"]
[Sat Jul 18 23:24:46.007014 2026] [security2:error] [pid 882519:tid 882730] [client 195.170.172.102:37690] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "lifetalkswithkay.com"] [uri "/secrets.json"] [unique_id "alxfnqL84xJUTmx6eO657AAAANY"]
[Sat Jul 18 23:24:46.027472 2026] [security2:error] [pid 882519:tid 882692] [client 195.170.172.102:33162] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "lifetalkswithkay.com"] [uri "/.env"] [unique_id "alxfnqL84xJUTmx6eO657gAAALA"]
[Sat Jul 18 23:24:46.028475 2026] [security2:error] [pid 882519:tid 882733] [client 195.170.172.102:33232] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "lifetalkswithkay.com"] [uri "/.env.backup"] [unique_id "alxfnqL84xJUTmx6eO658QAAANk"]
[Sat Jul 18 23:24:46.035516 2026] [security2:error] [pid 882519:tid 882676] [client 195.170.172.102:33188] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\.bak|\\\\.bak\\\\.php)$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1260"] [id "390582"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that nclude .bak)"] [severity "CRITICAL"] [hostname "lifetalkswithkay.com"] [uri "/.env.bak"] [unique_id "alxfnqL84xJUTmx6eO659QAAAKA"]
[Sat Jul 18 23:24:46.599787 2026] [security2:error] [pid 882519:tid 882745] [client 217.181.90.95:26017] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.90.181.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxfnqL84xJUTmx6eO66EwAAAOU"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:24:47.171723 2026] [security2:error] [pid 882519:tid 882617] [remote 47.128.23.30:23620] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "massagelacey.com"] [uri "/blog/"] [unique_id "alxfn6L84xJUTmx6eO66NQABBGE"]
[Sat Jul 18 23:24:47.613279 2026] [security2:error] [pid 882519:tid 882632] [remote 128.199.203.39:55792] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 39.203.199.128.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxfn6L84xJUTmx6eO66RgAAwnA"]
[Sat Jul 18 23:24:47.809255 2026] [security2:error] [pid 882519:tid 882764] [client 195.170.172.102:33152] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "lifetalkswithkay.com"] [uri "/backend/.git/HEAD"] [unique_id "alxfn6L84xJUTmx6eO66TwAAAPg"]
[Sat Jul 18 23:24:47.809437 2026] [security2:error] [pid 882519:tid 882764] [client 195.170.172.102:33152] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "lifetalkswithkay.com"] [uri "/backend/.git/HEAD"] [unique_id "alxfn6L84xJUTmx6eO66TwAAAPg"]
[Sat Jul 18 23:24:48.050642 2026] [security2:error] [pid 882519:tid 882588] [remote 128.199.203.39:55792] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 39.203.199.128.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxfoKL84xJUTmx6eO66XwAAxkQ"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:24:48.191972 2026] [security2:error] [pid 882519:tid 882709] [client 77.83.36.161:30528] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.36.83.77.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "amberhillstyle.com"] [uri "/administrator/index.php"] [unique_id "alxfoKL84xJUTmx6eO66YwAAAME"]
[Sat Jul 18 23:24:48.360712 2026] [security2:error] [pid 882519:tid 882692] [client 124.29.246.106:59586] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxfoKL84xJUTmx6eO66bgAAALA"]
[Sat Jul 18 23:24:48.360816 2026] [security2:error] [pid 882519:tid 882692] [client 124.29.246.106:59586] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxfoKL84xJUTmx6eO66bgAAALA"]
[Sat Jul 18 23:24:48.418679 2026] [security2:error] [pid 882519:tid 882571] [remote 68.178.160.25:36362] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxfoKL84xJUTmx6eO66cQAAnzM"]
[Sat Jul 18 23:24:48.825393 2026] [security2:error] [pid 882519:tid 882591] [remote 31.42.184.154:41160] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "website-e4de5cd0.epu.kzx.mybluehost.me"] [uri "/wp/xmlrpc.php"] [unique_id "alxfoKL84xJUTmx6eO66hAAA-Ec"]
[Sat Jul 18 23:24:48.825524 2026] [security2:error] [pid 882519:tid 882764] [client 31.42.184.154:41160] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "website-e4de5cd0.epu.kzx.mybluehost.me"] [uri "/wp/xmlrpc.php"] [unique_id "alxfoKL84xJUTmx6eO66hAAA-Ec"]
[Sat Jul 18 23:24:48.845593 2026] [security2:error] [pid 882519:tid 882731] [client 77.83.36.161:30917] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.36.83.77.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "amberhillstyle.com"] [uri "/administrator/index.php"] [unique_id "alxfoKL84xJUTmx6eO66hQAAANc"]
[Sat Jul 18 23:24:48.950161 2026] [security2:error] [pid 882519:tid 882677] [client 119.154.81.234:55351] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfoKL84xJUTmx6eO66iwAAAKE"]
[Sat Jul 18 23:24:48.950445 2026] [security2:error] [pid 882519:tid 882677] [client 119.154.81.234:55351] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfoKL84xJUTmx6eO66iwAAAKE"]
[Sat Jul 18 23:24:48.978171 2026] [security2:error] [pid 882519:tid 882605] [remote 5.182.209.54:59218] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.209.182.5.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfoKL84xJUTmx6eO66jgAA81U"]
[Sat Jul 18 23:24:49.155566 2026] [security2:error] [pid 882519:tid 882612] [remote 5.182.209.54:59218] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.209.182.5.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfoaL84xJUTmx6eO66mgAA31w"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:24:49.210685 2026] [security2:error] [pid 882519:tid 882718] [client 106.222.249.209:29346] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfoaL84xJUTmx6eO66nAAAAMo"]
[Sat Jul 18 23:24:49.210795 2026] [security2:error] [pid 882519:tid 882718] [client 106.222.249.209:29346] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfoaL84xJUTmx6eO66nAAAAMo"]
[Sat Jul 18 23:24:49.548281 2026] [security2:error] [pid 882519:tid 882776] [client 77.83.36.161:31280] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.36.83.77.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "amberhillstyle.com"] [uri "/administrator/index.php"] [unique_id "alxfoaL84xJUTmx6eO66rAAAAQQ"]
[Sat Jul 18 23:24:49.566108 2026] [security2:error] [pid 882519:tid 882758] [client 50.116.65.227:38146] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "oldracelimited.com"] [uri "/index.php"] [unique_id "alxfoaL84xJUTmx6eO66pgAAAPI"]
[Sat Jul 18 23:24:49.722254 2026] [security2:error] [pid 882519:tid 882752] [client 223.228.182.224:52529] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxfoaL84xJUTmx6eO66tgAAAOw"]
[Sat Jul 18 23:24:49.726909 2026] [security2:error] [pid 882519:tid 882752] [client 223.228.182.224:52529] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxfoaL84xJUTmx6eO66tgAAAOw"]
[Sat Jul 18 23:24:49.735451 2026] [security2:error] [pid 882519:tid 882743] [client 50.116.65.227:38150] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "oldracelimited.com"] [uri "/index.php"] [unique_id "alxfoaL84xJUTmx6eO66rwAAAOM"]
[Sat Jul 18 23:24:50.001656 2026] [security2:error] [pid 882519:tid 882656] [client 57.141.18.105:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxfoaL84xJUTmx6eO66uwAAAIw"]
[Sat Jul 18 23:24:50.212656 2026] [security2:error] [pid 882519:tid 882737] [client 222.154.143.251:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "origine.nz"] [uri "/index.php"] [unique_id "alxfoaL84xJUTmx6eO66vQAA3Xk"], referer: https://origine.nz/
[Sat Jul 18 23:24:50.407800 2026] [security2:error] [pid 882519:tid 882610] [remote 68.178.160.25:36362] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxfoqL84xJUTmx6eO661wAAt1o"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:24:50.506115 2026] [security2:error] [pid 881201:tid 881358] [client 18.232.93.255:0] ModSecurity: Warning. Matched phrase "ADmantX" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "curlsnpearlsss.com"] [uri "/index.php"] [unique_id "alxfoQWL-zKlchkVWS1cxAAAABo"]
[Sat Jul 18 23:24:50.527792 2026] [security2:error] [pid 882519:tid 882754] [client 18.232.93.255:14956] ModSecurity: Warning. Matched phrase "ADmantX" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "curlsnpearlsss.com"] [uri "/coquito-bites-coconut-rum-balls/"] [unique_id "alxfoaL84xJUTmx6eO66sQAAAO4"]
[Sat Jul 18 23:24:50.555745 2026] [security2:error] [pid 881201:tid 881227] [remote 113.160.142.119:49612] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thierry-henry.fr"] [uri "/wp-login.php"] [unique_id "alxfogWL-zKlchkVWS1c2gAAIRg"]
[Sat Jul 18 23:24:50.982953 2026] [security2:error] [pid 881201:tid 881401] [client 13.232.206.133:46064] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "155"] [id "900406"] [msg "wp-login POST logging"] [data "200"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxfogWL-zKlchkVWS1c1AAAAEU"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:24:51.070548 2026] [security2:error] [pid 881201:tid 881210] [remote 113.160.142.119:49612] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thierry-henry.fr"] [uri "/wp-login.php"] [unique_id "alxfowWL-zKlchkVWS1c5QAANQc"], referer: https://thierry-henry.fr/wp-login.php
[Sat Jul 18 23:24:52.723242 2026] [security2:error] [pid 882519:tid 882684] [client 57.141.18.100:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxfpKL84xJUTmx6eO67LAAAAKg"]
[Sat Jul 18 23:24:53.465581 2026] [security2:error] [pid 882519:tid 882550] [remote 209.133.204.250:34014] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 250.204.133.209.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxfpaL84xJUTmx6eO67XgAAtR4"]
[Sat Jul 18 23:24:53.537084 2026] [security2:error] [pid 882519:tid 882749] [client 190.245.146.99:56042] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfpaL84xJUTmx6eO67YwAAAOk"]
[Sat Jul 18 23:24:53.543041 2026] [security2:error] [pid 882519:tid 882749] [client 190.245.146.99:56042] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfpaL84xJUTmx6eO67YwAAAOk"]
[Sat Jul 18 23:24:53.661595 2026] [security2:error] [pid 882519:tid 882562] [remote 209.133.204.250:34014] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 250.204.133.209.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxfpaL84xJUTmx6eO67ZgAA5Co"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:24:54.254458 2026] [security2:error] [pid 882519:tid 882729] [client 113.160.97.242:60039] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxfpqL84xJUTmx6eO67fAAAANU"]
[Sat Jul 18 23:24:54.401773 2026] [security2:error] [pid 882519:tid 882660] [client 200.149.62.230:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "youpositive.co"] [uri "/index.php"] [unique_id "alxfo6L84xJUTmx6eO67EAAAAJA"]
[Sat Jul 18 23:24:54.481776 2026] [security2:error] [pid 882519:tid 882752] [client 27.34.68.67:12019] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfpqL84xJUTmx6eO67iQAAAOw"]
[Sat Jul 18 23:24:54.481893 2026] [security2:error] [pid 882519:tid 882752] [client 27.34.68.67:12019] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfpqL84xJUTmx6eO67iQAAAOw"]
[Sat Jul 18 23:24:54.777933 2026] [security2:error] [pid 882519:tid 882686] [client 223.185.61.63:11149] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfpqL84xJUTmx6eO67lwAAAKo"]
[Sat Jul 18 23:24:54.778040 2026] [security2:error] [pid 882519:tid 882686] [client 223.185.61.63:11149] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfpqL84xJUTmx6eO67lwAAAKo"]
[Sat Jul 18 23:24:55.153148 2026] [security2:error] [pid 881201:tid 881384] [client 74.208.214.194:46996] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxfpwWL-zKlchkVWS1dIQAAADQ"]
[Sat Jul 18 23:24:55.989428 2026] [security2:error] [pid 881201:tid 881421] [client 45.3.45.140:9805] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 140.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxfpwWL-zKlchkVWS1dKAAAAFk"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:24:56.006902 2026] [security2:error] [pid 882519:tid 882653] [client 171.4.232.110:53216] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.232.4.171.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfqKL84xJUTmx6eO67yQAAAIk"]
[Sat Jul 18 23:24:56.006997 2026] [security2:error] [pid 882519:tid 882653] [client 171.4.232.110:53216] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nicherealestate.co"] [uri "/xmlrpc.php"] [unique_id "alxfqKL84xJUTmx6eO67yQAAAIk"]
[Sat Jul 18 23:24:57.626177 2026] [security2:error] [pid 881201:tid 881452] [client 74.7.227.179:35652] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxfqQWL-zKlchkVWS1dSQAAeCs"], referer: https://tejasenvironmental.com/p=669186
[Sat Jul 18 23:24:59.631319 2026] [security2:error] [pid 881201:tid 881388] [client 119.154.81.234:55812] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfqwWL-zKlchkVWS1dcwAAADg"]
[Sat Jul 18 23:24:59.631427 2026] [security2:error] [pid 881201:tid 881388] [client 119.154.81.234:55812] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfqwWL-zKlchkVWS1dcwAAADg"]
[Sat Jul 18 23:24:59.865627 2026] [security2:error] [pid 882519:tid 882761] [client 106.222.249.209:33176] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfq6L84xJUTmx6eO68YwAAAPU"]
[Sat Jul 18 23:24:59.865808 2026] [security2:error] [pid 882519:tid 882761] [client 106.222.249.209:33176] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfq6L84xJUTmx6eO68YwAAAPU"]
[Sat Jul 18 23:25:00.348336 2026] [security2:error] [pid 882519:tid 882698] [client 223.228.182.224:49214] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxfrKL84xJUTmx6eO68fgAAALY"]
[Sat Jul 18 23:25:00.352472 2026] [security2:error] [pid 882519:tid 882698] [client 223.228.182.224:49214] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxfrKL84xJUTmx6eO68fgAAALY"]
[Sat Jul 18 23:25:01.167252 2026] [security2:error] [pid 881201:tid 881300] [remote 31.42.184.154:60456] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "alchemygroup.ca"] [uri "/wp-login.php"] [unique_id "alxfrQWL-zKlchkVWS1dhQAAVmE"]
[Sat Jul 18 23:25:01.401937 2026] [security2:error] [pid 881201:tid 881231] [remote 45.157.54.14:35790] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "kromosenergy.com"] [uri "/xmlrpc.php"] [unique_id "alxfrQWL-zKlchkVWS1diAAALRw"]
[Sat Jul 18 23:25:01.402184 2026] [security2:error] [pid 881201:tid 881377] [client 45.157.54.14:35790] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "kromosenergy.com"] [uri "/xmlrpc.php"] [unique_id "alxfrQWL-zKlchkVWS1diAAALRw"]
[Sat Jul 18 23:25:01.408417 2026] [security2:error] [pid 882519:tid 882593] [remote 45.157.54.14:35816] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "kromosenergy.com"] [uri "/xmlrpc.php"] [unique_id "alxfraL84xJUTmx6eO68pAABBEk"]
[Sat Jul 18 23:25:01.408628 2026] [security2:error] [pid 882519:tid 882776] [client 45.157.54.14:35816] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "kromosenergy.com"] [uri "/xmlrpc.php"] [unique_id "alxfraL84xJUTmx6eO68pAABBEk"]
[Sat Jul 18 23:25:01.431733 2026] [security2:error] [pid 881201:tid 881290] [remote 31.42.184.154:60456] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "alchemygroup.ca"] [uri "/wp-login.php"] [unique_id "alxfrQWL-zKlchkVWS1digAAElc"], referer: https://alchemygroup.ca/wp-login.php
[Sat Jul 18 23:25:02.316556 2026] [security2:error] [pid 881201:tid 881315] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "portkeytravelplanning.com"] [uri "/.git/HEAD"] [unique_id "alxfrgWL-zKlchkVWS1dmwAAaHA"]
[Sat Jul 18 23:25:02.316742 2026] [security2:error] [pid 881201:tid 881436] [client 35.220.217.177:52600] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "portkeytravelplanning.com"] [uri "/.git/HEAD"] [unique_id "alxfrgWL-zKlchkVWS1dmwAAaHA"]
[Sat Jul 18 23:25:02.411789 2026] [security2:error] [pid 881201:tid 881320] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "portkeytravelplanning.com"] [uri "/wp-json"] [unique_id "alxfrgWL-zKlchkVWS1dqwAACXU"]
[Sat Jul 18 23:25:02.411950 2026] [security2:error] [pid 881201:tid 881341] [client 35.220.217.177:52600] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "portkeytravelplanning.com"] [uri "/wp-json"] [unique_id "alxfrgWL-zKlchkVWS1dqwAACXU"]
[Sat Jul 18 23:25:02.455105 2026] [security2:error] [pid 881201:tid 881387] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfrgWL-zKlchkVWS1dogAAADc"]
[Sat Jul 18 23:25:02.475898 2026] [security2:error] [pid 881201:tid 881348] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfrgWL-zKlchkVWS1dpQAAABA"]
[Sat Jul 18 23:25:02.551302 2026] [security2:error] [pid 881201:tid 881226] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "portkeytravelplanning.com"] [uri "/.env"] [unique_id "alxfrgWL-zKlchkVWS1duQAACRc"]
[Sat Jul 18 23:25:02.557672 2026] [security2:error] [pid 882519:tid 882658] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfrqL84xJUTmx6eO680QAAAI4"]
[Sat Jul 18 23:25:02.558074 2026] [security2:error] [pid 882519:tid 882743] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfrqL84xJUTmx6eO680wAAAOM"]
[Sat Jul 18 23:25:02.558975 2026] [security2:error] [pid 882519:tid 882762] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfrqL84xJUTmx6eO680gAAAPY"]
[Sat Jul 18 23:25:02.561246 2026] [security2:error] [pid 882519:tid 882683] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfrqL84xJUTmx6eO680AAAAKc"]
[Sat Jul 18 23:25:02.561347 2026] [security2:error] [pid 882519:tid 882761] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfrqL84xJUTmx6eO68zwAAAPU"]
[Sat Jul 18 23:25:02.564478 2026] [security2:error] [pid 882519:tid 882669] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfrqL84xJUTmx6eO68zQAAAJk"]
[Sat Jul 18 23:25:02.565099 2026] [security2:error] [pid 882519:tid 882668] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfrqL84xJUTmx6eO68zgAAAJg"]
[Sat Jul 18 23:25:02.683339 2026] [security2:error] [pid 882519:tid 882663] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfrqL84xJUTmx6eO682AAAAJM"]
[Sat Jul 18 23:25:02.759630 2026] [security2:error] [pid 882519:tid 882612] [remote 45.157.54.14:37289] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "kromosenergy.faadenergy.com"] [uri "/xmlrpc.php"] [unique_id "alxfrqL84xJUTmx6eO684wAAilw"]
[Sat Jul 18 23:25:02.759743 2026] [security2:error] [pid 882519:tid 882654] [client 45.157.54.14:37289] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "kromosenergy.faadenergy.com"] [uri "/xmlrpc.php"] [unique_id "alxfrqL84xJUTmx6eO684wAAilw"]
[Sat Jul 18 23:25:02.806663 2026] [security2:error] [pid 881201:tid 881222] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "portkeytravelplanning.com"] [uri "/.env.production"] [unique_id "alxfrgWL-zKlchkVWS1dvAAAORM"]
[Sat Jul 18 23:25:02.809250 2026] [security2:error] [pid 881201:tid 881328] [remote 45.157.54.14:37337] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "kromosenergy.faadenergy.com"] [uri "/xmlrpc.php"] [unique_id "alxfrgWL-zKlchkVWS1dvQAADX0"]
[Sat Jul 18 23:25:02.809369 2026] [security2:error] [pid 881201:tid 881345] [client 45.157.54.14:37337] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "kromosenergy.faadenergy.com"] [uri "/xmlrpc.php"] [unique_id "alxfrgWL-zKlchkVWS1dvQAADX0"]
[Sat Jul 18 23:25:02.832723 2026] [security2:error] [pid 882519:tid 882711] [client 14.191.13.73:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "kingsafety.ca"] [uri "/index.php"] [unique_id "alxfrqL84xJUTmx6eO683AAAAMM"]
[Sat Jul 18 23:25:02.937644 2026] [security2:error] [pid 881201:tid 881203] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "portkeytravelplanning.com"] [uri "/api/.env"] [unique_id "alxfrgWL-zKlchkVWS1dwgAACAA"]
[Sat Jul 18 23:25:02.950729 2026] [security2:error] [pid 881201:tid 881313] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.old$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1263"] [id "390583"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .old)"] [severity "CRITICAL"] [hostname "portkeytravelplanning.com"] [uri "/.env.old"] [unique_id "alxfrgWL-zKlchkVWS1dwwAACG4"]
[Sat Jul 18 23:25:02.950733 2026] [security2:error] [pid 881201:tid 881230] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\.bak|\\\\.bak\\\\.php)$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1260"] [id "390582"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that nclude .bak)"] [severity "CRITICAL"] [hostname "portkeytravelplanning.com"] [uri "/.env.bak"] [unique_id "alxfrgWL-zKlchkVWS1dxAAACBs"]
[Sat Jul 18 23:25:02.950803 2026] [security2:error] [pid 881201:tid 881249] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.backup$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1279"] [id "390588"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .backup)"] [severity "CRITICAL"] [hostname "portkeytravelplanning.com"] [uri "/.env.backup"] [unique_id "alxfrgWL-zKlchkVWS1dxQAACC4"]
[Sat Jul 18 23:25:02.981842 2026] [security2:error] [pid 882519:tid 882695] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfrqL84xJUTmx6eO686QAAALM"]
[Sat Jul 18 23:25:03.121958 2026] [security2:error] [pid 881201:tid 881227] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "portkeytravelplanning.com"] [uri "/config/.env"] [unique_id "alxfrwWL-zKlchkVWS1dygAALhg"]
[Sat Jul 18 23:25:03.236511 2026] [security2:error] [pid 882519:tid 882767] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfr6L84xJUTmx6eO689AAAAPs"]
[Sat Jul 18 23:25:03.246921 2026] [security2:error] [pid 881201:tid 881276] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "portkeytravelplanning.com"] [uri "/backend/.env"] [unique_id "alxfrwWL-zKlchkVWS1dzQAALkk"]
[Sat Jul 18 23:25:03.337730 2026] [security2:error] [pid 882519:tid 882755] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfr6L84xJUTmx6eO68-QAAAO8"]
[Sat Jul 18 23:25:03.396001 2026] [security2:error] [pid 881201:tid 881319] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "portkeytravelplanning.com"] [uri "/graphql"] [unique_id "alxfrwWL-zKlchkVWS1d1wAALnQ"]
[Sat Jul 18 23:25:03.423195 2026] [security2:error] [pid 882519:tid 882727] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfr6L84xJUTmx6eO68_wAAANM"]
[Sat Jul 18 23:25:03.423240 2026] [security2:error] [pid 882519:tid 882736] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfr6L84xJUTmx6eO69AAAAANw"]
[Sat Jul 18 23:25:03.428248 2026] [security2:error] [pid 882519:tid 882752] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfr6L84xJUTmx6eO68_gAAAOw"]
[Sat Jul 18 23:25:03.511670 2026] [security2:error] [pid 881201:tid 881309] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "portkeytravelplanning.com"] [uri "/.htpasswd"] [unique_id "alxfrwWL-zKlchkVWS1d3gAADGo"]
[Sat Jul 18 23:25:03.574242 2026] [security2:error] [pid 881201:tid 881207] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "portkeytravelplanning.com"] [uri "/api/graphql"] [unique_id "alxfrwWL-zKlchkVWS1d5AAADAQ"]
[Sat Jul 18 23:25:03.575600 2026] [security2:error] [pid 881201:tid 881317] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "portkeytravelplanning.com"] [uri "/.ssh/id_rsa"] [unique_id "alxfrwWL-zKlchkVWS1d5QAADHI"]
[Sat Jul 18 23:25:03.575692 2026] [security2:error] [pid 881201:tid 881344] [client 35.220.217.177:52600] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "portkeytravelplanning.com"] [uri "/.ssh/id_rsa"] [unique_id "alxfrwWL-zKlchkVWS1d5QAADHI"]
[Sat Jul 18 23:25:03.577025 2026] [security2:error] [pid 881201:tid 881282] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "portkeytravelplanning.com"] [uri "/terraform.tfstate"] [unique_id "alxfrwWL-zKlchkVWS1d5wAADE8"]
[Sat Jul 18 23:25:03.641575 2026] [security2:error] [pid 881201:tid 881415] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfrwWL-zKlchkVWS1d4QAAAFM"]
[Sat Jul 18 23:25:03.709302 2026] [security2:error] [pid 882519:tid 882679] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfr6L84xJUTmx6eO69DAAAAKM"]
[Sat Jul 18 23:25:03.761543 2026] [security2:error] [pid 881201:tid 881254] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "portkeytravelplanning.com"] [uri "/.ssh/id_dsa"] [unique_id "alxfrwWL-zKlchkVWS1d6wAARTM"]
[Sat Jul 18 23:25:03.804075 2026] [security2:error] [pid 881201:tid 881225] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "portkeytravelplanning.com"] [uri "/.ssh/config"] [unique_id "alxfrwWL-zKlchkVWS1d7wAAPxY"]
[Sat Jul 18 23:25:03.804217 2026] [security2:error] [pid 881201:tid 881395] [client 35.220.217.177:52600] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "portkeytravelplanning.com"] [uri "/.ssh/config"] [unique_id "alxfrwWL-zKlchkVWS1d7wAAPxY"]
[Sat Jul 18 23:25:03.806180 2026] [security2:error] [pid 881201:tid 881233] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "portkeytravelplanning.com"] [uri "/id_rsa"] [unique_id "alxfrwWL-zKlchkVWS1d8gAAPx4"]
[Sat Jul 18 23:25:03.908342 2026] [security2:error] [pid 882519:tid 882762] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfr6L84xJUTmx6eO69GgAAAPY"]
[Sat Jul 18 23:25:03.910083 2026] [security2:error] [pid 882519:tid 882696] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfr6L84xJUTmx6eO69HAAAALQ"]
[Sat Jul 18 23:25:03.926070 2026] [security2:error] [pid 881201:tid 881386] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfrwWL-zKlchkVWS1d8wAAADY"]
[Sat Jul 18 23:25:03.929627 2026] [security2:error] [pid 882519:tid 882683] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfr6L84xJUTmx6eO69HgAAAKc"]
[Sat Jul 18 23:25:03.984340 2026] [security2:error] [pid 881201:tid 881263] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "portkeytravelplanning.com"] [uri "/v1/graphql"] [unique_id "alxfrwWL-zKlchkVWS1d-AAAWTw"]
[Sat Jul 18 23:25:04.066841 2026] [security2:error] [pid 882519:tid 882667] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfr6L84xJUTmx6eO69KAAAAJc"]
[Sat Jul 18 23:25:04.110860 2026] [security2:error] [pid 882519:tid 882766] [client 190.245.146.99:56567] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfsKL84xJUTmx6eO69LQAAAPo"]
[Sat Jul 18 23:25:04.110964 2026] [security2:error] [pid 882519:tid 882766] [client 190.245.146.99:56567] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfsKL84xJUTmx6eO69LQAAAPo"]
[Sat Jul 18 23:25:04.119242 2026] [security2:error] [pid 881201:tid 881324] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "portkeytravelplanning.com"] [uri "/privatekey.key"] [unique_id "alxfsAWL-zKlchkVWS1d_gAAXHk"]
[Sat Jul 18 23:25:04.162129 2026] [security2:error] [pid 881201:tid 881292] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "portkeytravelplanning.com"] [uri "/key.pem"] [unique_id "alxfsAWL-zKlchkVWS1eBQAAXFk"]
[Sat Jul 18 23:25:04.163093 2026] [security2:error] [pid 881201:tid 881296] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "portkeytravelplanning.com"] [uri "/id_dsa"] [unique_id "alxfsAWL-zKlchkVWS1eAwAAXF0"]
[Sat Jul 18 23:25:04.233012 2026] [security2:error] [pid 882519:tid 882654] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsKL84xJUTmx6eO69MgAAAIo"]
[Sat Jul 18 23:25:04.242498 2026] [security2:error] [pid 881201:tid 881348] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsAWL-zKlchkVWS1d_wAAABA"]
[Sat Jul 18 23:25:04.277188 2026] [security2:error] [pid 882519:tid 882718] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsKL84xJUTmx6eO69NgAAAMo"]
[Sat Jul 18 23:25:04.278165 2026] [security2:error] [pid 882519:tid 882716] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsKL84xJUTmx6eO69NQAAAMg"]
[Sat Jul 18 23:25:04.331073 2026] [security2:error] [pid 882519:tid 882748] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsKL84xJUTmx6eO69OgAAAOg"]
[Sat Jul 18 23:25:04.337213 2026] [security2:error] [pid 882519:tid 882674] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsKL84xJUTmx6eO69OwAAAJ4"]
[Sat Jul 18 23:25:04.337570 2026] [security2:error] [pid 882519:tid 882749] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsKL84xJUTmx6eO69PAAAAOk"]
[Sat Jul 18 23:25:04.511798 2026] [security2:error] [pid 881201:tid 881281] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "portkeytravelplanning.com"] [uri "/.openclaw/.env"] [unique_id "alxfsAWL-zKlchkVWS1eDwAADk4"]
[Sat Jul 18 23:25:04.511943 2026] [security2:error] [pid 881201:tid 881262] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "portkeytravelplanning.com"] [uri "/.cursor/mcp.json"] [unique_id "alxfsAWL-zKlchkVWS1eEQAADjs"]
[Sat Jul 18 23:25:04.561166 2026] [security2:error] [pid 881201:tid 881274] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "portkeytravelplanning.com"] [uri "/.hermes/.env"] [unique_id "alxfsAWL-zKlchkVWS1eFgAADkc"]
[Sat Jul 18 23:25:04.630899 2026] [security2:error] [pid 881201:tid 881432] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsAWL-zKlchkVWS1eFAAAAGQ"]
[Sat Jul 18 23:25:04.631250 2026] [security2:error] [pid 882519:tid 882770] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsKL84xJUTmx6eO69SgAAAP4"]
[Sat Jul 18 23:25:04.634080 2026] [security2:error] [pid 882519:tid 882709] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsKL84xJUTmx6eO69SQAAAME"]
[Sat Jul 18 23:25:04.849389 2026] [security2:error] [pid 881201:tid 881221] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "portkeytravelplanning.com"] [uri "/.zshrc"] [unique_id "alxfsAWL-zKlchkVWS1eIgAAaxI"]
[Sat Jul 18 23:25:04.868730 2026] [security2:error] [pid 881201:tid 881283] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "portkeytravelplanning.com"] [uri "/laravel/.env"] [unique_id "alxfsAWL-zKlchkVWS1eJAAAGVA"]
[Sat Jul 18 23:25:04.880683 2026] [security2:error] [pid 881201:tid 881260] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-config\\\\.php(?:\\\\W[a-z]*|bak)" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "300"] [id "900256"] [msg "Wp-Config Backup/edit file request"] [hostname "portkeytravelplanning.com"] [uri "/wp-config.php.old"] [unique_id "alxfsAWL-zKlchkVWS1eJwAAGTk"]
[Sat Jul 18 23:25:04.907847 2026] [security2:error] [pid 881201:tid 881266] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-config\\\\.php(?:\\\\W[a-z]*|bak)" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "300"] [id "900256"] [msg "Wp-Config Backup/edit file request"] [hostname "portkeytravelplanning.com"] [uri "/wp-config.php.bak"] [unique_id "alxfsAWL-zKlchkVWS1eKAAAGT8"]
[Sat Jul 18 23:25:04.960864 2026] [security2:error] [pid 881201:tid 881275] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "portkeytravelplanning.com"] [uri "/core/.env"] [unique_id "alxfsAWL-zKlchkVWS1eKwAAGUg"]
[Sat Jul 18 23:25:04.962116 2026] [security2:error] [pid 882519:tid 882665] [client 27.34.68.67:5449] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfsKL84xJUTmx6eO69WwAAAJU"]
[Sat Jul 18 23:25:04.962218 2026] [security2:error] [pid 882519:tid 882665] [client 27.34.68.67:5449] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfsKL84xJUTmx6eO69WwAAAJU"]
[Sat Jul 18 23:25:04.971582 2026] [security2:error] [pid 881201:tid 881318] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 177.217.220.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "portkeytravelplanning.com"] [uri "/.env.php.bak"] [unique_id "alxfsAWL-zKlchkVWS1eLAAAGXM"]
[Sat Jul 18 23:25:04.972459 2026] [security2:error] [pid 881201:tid 881297] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 177.217.220.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "portkeytravelplanning.com"] [uri "/config/.env.php"] [unique_id "alxfsAWL-zKlchkVWS1eLQAAGV4"]
[Sat Jul 18 23:25:04.989821 2026] [security2:error] [pid 882519:tid 882734] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsKL84xJUTmx6eO69VwAAANo"]
[Sat Jul 18 23:25:04.993999 2026] [security2:error] [pid 882519:tid 882651] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsKL84xJUTmx6eO69WAAAAIc"]
[Sat Jul 18 23:25:05.011261 2026] [security2:error] [pid 881201:tid 881357] [client 35.220.217.177:52600] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsAWL-zKlchkVWS1eKgAAGSM"]
[Sat Jul 18 23:25:05.033149 2026] [security2:error] [pid 882519:tid 882751] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsKL84xJUTmx6eO69WgAAAOs"]
[Sat Jul 18 23:25:05.044322 2026] [security2:error] [pid 881201:tid 881286] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "portkeytravelplanning.com"] [uri "/auth.json"] [unique_id "alxfsQWL-zKlchkVWS1eLwAATFM"]
[Sat Jul 18 23:25:05.044515 2026] [security2:error] [pid 881201:tid 881408] [client 35.220.217.177:52600] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "portkeytravelplanning.com"] [uri "/auth.json"] [unique_id "alxfsQWL-zKlchkVWS1eLwAATFM"]
[Sat Jul 18 23:25:05.152712 2026] [security2:error] [pid 881201:tid 881287] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 177.217.220.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "portkeytravelplanning.com"] [uri "/config.php.bak"] [unique_id "alxfsQWL-zKlchkVWS1eMwAAf1Q"]
[Sat Jul 18 23:25:05.152729 2026] [security2:error] [pid 881201:tid 881272] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 177.217.220.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "portkeytravelplanning.com"] [uri "/configuration.php.bak"] [unique_id "alxfsQWL-zKlchkVWS1eNAAAf0U"]
[Sat Jul 18 23:25:05.154578 2026] [security2:error] [pid 881201:tid 881306] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.sw[a-z]$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1275"] [id "390587"] [rev "5"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .sw)"] [severity "CRITICAL"] [hostname "portkeytravelplanning.com"] [uri "/.env.swp"] [unique_id "alxfsQWL-zKlchkVWS1eNQAAQ2c"]
[Sat Jul 18 23:25:05.156044 2026] [security2:error] [pid 881201:tid 881301] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "portkeytravelplanning.com"] [uri "/web/.env"] [unique_id "alxfsQWL-zKlchkVWS1eNwAAQ2I"]
[Sat Jul 18 23:25:05.171645 2026] [security2:error] [pid 881201:tid 881285] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "portkeytravelplanning.com"] [uri "/public/.env"] [unique_id "alxfsQWL-zKlchkVWS1eOgAAQ1I"]
[Sat Jul 18 23:25:05.267299 2026] [security2:error] [pid 881201:tid 881390] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsQWL-zKlchkVWS1ePQAAADo"]
[Sat Jul 18 23:25:05.303593 2026] [security2:error] [pid 881201:tid 881326] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "portkeytravelplanning.com"] [uri "/config.js"] [unique_id "alxfsQWL-zKlchkVWS1eQQAAQ3s"]
[Sat Jul 18 23:25:05.306022 2026] [security2:error] [pid 882519:tid 882717] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsaL84xJUTmx6eO69awAAAMk"]
[Sat Jul 18 23:25:05.385295 2026] [security2:error] [pid 882519:tid 882755] [client 223.185.61.63:27952] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfsaL84xJUTmx6eO69dgAAAO8"]
[Sat Jul 18 23:25:05.385415 2026] [security2:error] [pid 882519:tid 882755] [client 223.185.61.63:27952] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfsaL84xJUTmx6eO69dgAAAO8"]
[Sat Jul 18 23:25:05.423915 2026] [security2:error] [pid 882519:tid 882692] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsaL84xJUTmx6eO69cwAAALA"]
[Sat Jul 18 23:25:05.425085 2026] [security2:error] [pid 882519:tid 882699] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsaL84xJUTmx6eO69dAAAALc"]
[Sat Jul 18 23:25:05.457127 2026] [security2:error] [pid 881201:tid 881216] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "portkeytravelplanning.com"] [uri "/env.js"] [unique_id "alxfsQWL-zKlchkVWS1eRQAAPQ0"]
[Sat Jul 18 23:25:05.554879 2026] [security2:error] [pid 881201:tid 881298] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "portkeytravelplanning.com"] [uri "/api/v1/config"] [unique_id "alxfsQWL-zKlchkVWS1eSgAAPV8"]
[Sat Jul 18 23:25:05.568928 2026] [security2:error] [pid 882519:tid 882679] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsaL84xJUTmx6eO69eQAAAKM"]
[Sat Jul 18 23:25:05.703728 2026] [security2:error] [pid 881201:tid 881279] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "portkeytravelplanning.com"] [uri "/api/v2/config"] [unique_id "alxfsQWL-zKlchkVWS1eUQAAV0w"]
[Sat Jul 18 23:25:05.703890 2026] [security2:error] [pid 881201:tid 881419] [client 35.220.217.177:52600] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "portkeytravelplanning.com"] [uri "/api/v2/config"] [unique_id "alxfsQWL-zKlchkVWS1eUQAAV0w"]
[Sat Jul 18 23:25:05.832676 2026] [security2:error] [pid 882519:tid 882714] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsaL84xJUTmx6eO69igAAAMY"]
[Sat Jul 18 23:25:05.870802 2026] [security2:error] [pid 881201:tid 881419] [client 35.220.217.177:52600] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsQWL-zKlchkVWS1eVAAAVyk"]
[Sat Jul 18 23:25:05.896991 2026] [security2:error] [pid 881201:tid 881344] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsQWL-zKlchkVWS1eVgAAAAw"]
[Sat Jul 18 23:25:05.952203 2026] [security2:error] [pid 882519:tid 882768] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsaL84xJUTmx6eO69kwAAAPw"]
[Sat Jul 18 23:25:05.952460 2026] [security2:error] [pid 881201:tid 881409] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsQWL-zKlchkVWS1eXgAAAE0"]
[Sat Jul 18 23:25:05.954717 2026] [security2:error] [pid 882519:tid 882727] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsaL84xJUTmx6eO69lAAAANM"]
[Sat Jul 18 23:25:05.975115 2026] [security2:error] [pid 882519:tid 882759] [client 196.251.121.187:55564] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\w ?(?:user|and)(\\\\w+)char ?\\\\([0-9]| \\\\b(?:execute|convert) ?\\\\(|; ?\\\\bdelete\\\\b.{1,100}?; ?(?:insert|declare @|varchar) ?|\\\\bdrop\\\\b .{1,100} table |(?:declare|convert) .{1,100} varchar\\\\(|null ?, ?null ?, ?(?:accesslevel|user_?name) ?,|\\\\bconcat ..." at ARGS:requests.requests.body.requests.requests.path. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "395"] [id "340157"] [rev "38"] [msg "Atomicorp.com WAF Rules: Generic SQL inline command protection"] [data "union select ,ARGS:requests.requests.body.requests.requests.path"] [severity "CRITICAL"] [tag "SQLi"] [hostname "colinkeyphotography.com"] [uri "/"] [unique_id "alxfsaL84xJUTmx6eO69fAAAAPM"]
[Sat Jul 18 23:25:06.415792 2026] [security2:error] [pid 882519:tid 882660] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsqL84xJUTmx6eO69ngAAAJA"]
[Sat Jul 18 23:25:06.549370 2026] [security2:error] [pid 881201:tid 881451] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsgWL-zKlchkVWS1edAAAAHc"]
[Sat Jul 18 23:25:06.632818 2026] [security2:error] [pid 881201:tid 881312] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 177.217.220.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "portkeytravelplanning.com"] [uri "/phpinfo.php"] [unique_id "alxfsgWL-zKlchkVWS1ehgAAZ20"]
[Sat Jul 18 23:25:06.702694 2026] [security2:error] [pid 881201:tid 881413] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsgWL-zKlchkVWS1eggAAAFE"]
[Sat Jul 18 23:25:06.710588 2026] [security2:error] [pid 881201:tid 881345] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsgWL-zKlchkVWS1egwAAAA0"]
[Sat Jul 18 23:25:06.711335 2026] [security2:error] [pid 881201:tid 881373] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsgWL-zKlchkVWS1ehQAAACk"]
[Sat Jul 18 23:25:06.728461 2026] [security2:error] [pid 881201:tid 881455] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsgWL-zKlchkVWS1ehAAAAHs"]
[Sat Jul 18 23:25:06.735479 2026] [security2:error] [pid 881201:tid 881252] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "portkeytravelplanning.com"] [uri "/info.php"] [unique_id "alxfsgWL-zKlchkVWS1ejwAAZzE"]
[Sat Jul 18 23:25:06.747688 2026] [security2:error] [pid 882519:tid 882699] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsqL84xJUTmx6eO69rAAAALc"]
[Sat Jul 18 23:25:06.750830 2026] [security2:error] [pid 881201:tid 881422] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsgWL-zKlchkVWS1eigAAAFo"]
[Sat Jul 18 23:25:06.753666 2026] [security2:error] [pid 881201:tid 881322] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 177.217.220.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "portkeytravelplanning.com"] [uri "/test.php"] [unique_id "alxfsgWL-zKlchkVWS1ekAAAZ3c"]
[Sat Jul 18 23:25:06.817381 2026] [security2:error] [pid 881201:tid 881204] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 177.217.220.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "portkeytravelplanning.com"] [uri "/pi.php"] [unique_id "alxfsgWL-zKlchkVWS1ekwAAGQE"]
[Sat Jul 18 23:25:06.883333 2026] [security2:error] [pid 881201:tid 881210] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 177.217.220.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "portkeytravelplanning.com"] [uri "/i.php"] [unique_id "alxfsgWL-zKlchkVWS1elAAACgc"]
[Sat Jul 18 23:25:06.946444 2026] [security2:error] [pid 881201:tid 881309] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "portkeytravelplanning.com"] [uri "/elmah.axd"] [unique_id "alxfsgWL-zKlchkVWS1emAAAVGo"]
[Sat Jul 18 23:25:06.946656 2026] [security2:error] [pid 881201:tid 881416] [client 35.220.217.177:52600] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "portkeytravelplanning.com"] [uri "/elmah.axd"] [unique_id "alxfsgWL-zKlchkVWS1emAAAVGo"]
[Sat Jul 18 23:25:06.955724 2026] [security2:error] [pid 881201:tid 881248] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 177.217.220.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "portkeytravelplanning.com"] [uri "/app_dev.php"] [unique_id "alxfsgWL-zKlchkVWS1emQAAVC0"]
[Sat Jul 18 23:25:06.967011 2026] [security2:error] [pid 881201:tid 881207] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 177.217.220.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "portkeytravelplanning.com"] [uri "/app_dev.php/_profiler"] [unique_id "alxfsgWL-zKlchkVWS1emwAAVAQ"]
[Sat Jul 18 23:25:06.999160 2026] [security2:error] [pid 881201:tid 881377] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfsgWL-zKlchkVWS1elwAAAC0"]
[Sat Jul 18 23:25:07.015553 2026] [security2:error] [pid 881201:tid 881282] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "portkeytravelplanning.com"] [uri "/telescope/requests"] [unique_id "alxfswWL-zKlchkVWS1enwAAVE8"]
[Sat Jul 18 23:25:07.015686 2026] [security2:error] [pid 881201:tid 881416] [client 35.220.217.177:52600] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "portkeytravelplanning.com"] [uri "/telescope/requests"] [unique_id "alxfswWL-zKlchkVWS1enwAAVE8"]
[Sat Jul 18 23:25:07.106677 2026] [security2:error] [pid 882519:tid 882775] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfs6L84xJUTmx6eO69ugAAAQM"]
[Sat Jul 18 23:25:07.125693 2026] [security2:error] [pid 882519:tid 882681] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfs6L84xJUTmx6eO69wAAAAKU"]
[Sat Jul 18 23:25:07.125694 2026] [security2:error] [pid 882519:tid 882729] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfs6L84xJUTmx6eO69vwAAANU"]
[Sat Jul 18 23:25:07.126016 2026] [security2:error] [pid 882519:tid 882698] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfs6L84xJUTmx6eO69wQAAALY"]
[Sat Jul 18 23:25:07.126514 2026] [security2:error] [pid 882519:tid 882747] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfs6L84xJUTmx6eO69vgAAAOc"]
[Sat Jul 18 23:25:07.173082 2026] [security2:error] [pid 881201:tid 881225] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 2). Match of "ipMatch 127.0.0.1,::1" against "REMOTE_ADDR" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "724"] [id "340114"] [rev "2"] [msg "Atomicorp.com WAF Rules: Apache admin service access attempt"] [severity "CRITICAL"] [hostname "portkeytravelplanning.com"] [uri "/server-info"] [unique_id "alxfswWL-zKlchkVWS1epQAALBY"]
[Sat Jul 18 23:25:07.193124 2026] [security2:error] [pid 881201:tid 881233] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "portkeytravelplanning.com"] [uri "/nginx_status"] [unique_id "alxfswWL-zKlchkVWS1epgAALB4"]
[Sat Jul 18 23:25:07.209013 2026] [access_compat:error] [pid 881201:tid 881268] [remote 35.220.217.177:52600] AH01797: client denied by server configuration: proxy:https://127.0.0.1:8443/server-status
[Sat Jul 18 23:25:07.549422 2026] [security2:error] [pid 882519:tid 882528] [remote 209.42.21.221:33582] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 221.21.42.209.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory-com.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxfs6L84xJUTmx6eO691QAAhgg"]
[Sat Jul 18 23:25:07.549539 2026] [security2:error] [pid 882519:tid 882650] [client 209.42.21.221:33582] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory-com.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxfs6L84xJUTmx6eO691QAAhgg"]
[Sat Jul 18 23:25:08.433641 2026] [security2:error] [pid 882519:tid 882562] [remote 157.66.26.183:39130] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 183.26.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bruceledewitz.com"] [uri "/wp-login.php"] [unique_id "alxftKL84xJUTmx6eO6-AwAAuCo"]
[Sat Jul 18 23:25:08.881360 2026] [security2:error] [pid 882519:tid 882581] [remote 157.66.26.183:39130] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 183.26.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bruceledewitz.com"] [uri "/wp-login.php"] [unique_id "alxftKL84xJUTmx6eO6-EAAA9D0"], referer: https://bruceledewitz.com/wp-login.php
[Sat Jul 18 23:25:09.684288 2026] [lsapi:warn] [pid 881201:tid 881263] [remote 20.215.188.194:0] [host ali-alghanim.com] Backend log: PHP Warning:  getimagesize(https://aasgroup.online/wp-content/uploads/2021/09/1291810.jpg): Failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden\r\n in /home2/aasgroup/public_html/alialghanim/wp-content/plugins/litespeed-cache/src/media.cls.php on line 860\n
[Sat Jul 18 23:25:09.916788 2026] [security2:error] [pid 881201:tid 881357] [client 35.220.217.177:52600] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxftQWL-zKlchkVWS1e4QAAGRo"]
[Sat Jul 18 23:25:09.934676 2026] [security2:error] [pid 882519:tid 882698] [client 65.111.28.174:35973] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxftaL84xJUTmx6eO6-QAAAALY"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:25:10.361339 2026] [security2:error] [pid 882519:tid 882757] [client 124.29.246.106:60477] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxftqL84xJUTmx6eO6-VgAAAPE"]
[Sat Jul 18 23:25:10.361437 2026] [security2:error] [pid 882519:tid 882757] [client 124.29.246.106:60477] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxftqL84xJUTmx6eO6-VgAAAPE"]
[Sat Jul 18 23:25:10.455949 2026] [security2:error] [pid 882519:tid 882677] [client 119.154.81.234:56276] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxftqL84xJUTmx6eO6-XgAAAKE"]
[Sat Jul 18 23:25:10.456063 2026] [security2:error] [pid 882519:tid 882677] [client 119.154.81.234:56276] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxftqL84xJUTmx6eO6-XgAAAKE"]
[Sat Jul 18 23:25:10.523196 2026] [security2:error] [pid 882519:tid 882741] [client 106.222.249.209:9794] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxftqL84xJUTmx6eO6-YQAAAOE"]
[Sat Jul 18 23:25:10.523317 2026] [security2:error] [pid 882519:tid 882741] [client 106.222.249.209:9794] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxftqL84xJUTmx6eO6-YQAAAOE"]
[Sat Jul 18 23:25:11.071930 2026] [security2:error] [pid 882519:tid 882599] [remote 72.167.132.114:43228] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "claysharecon.com"] [uri "/wp-login.php"] [unique_id "alxft6L84xJUTmx6eO6-cQAA2E8"]
[Sat Jul 18 23:25:11.130408 2026] [security2:error] [pid 882519:tid 882729] [client 223.228.182.224:15594] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxft6L84xJUTmx6eO6-dwAAANU"]
[Sat Jul 18 23:25:11.130759 2026] [security2:error] [pid 882519:tid 882729] [client 223.228.182.224:15594] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxft6L84xJUTmx6eO6-dwAAANU"]
[Sat Jul 18 23:25:11.214673 2026] [security2:error] [pid 881201:tid 881343] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "alxftwWL-zKlchkVWS1e_wAAAAs"]
[Sat Jul 18 23:25:11.214840 2026] [security2:error] [pid 881201:tid 881343] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "alxftwWL-zKlchkVWS1e_wAAAAs"]
[Sat Jul 18 23:25:11.356449 2026] [security2:error] [pid 882519:tid 882713] [client 45.3.45.218:19629] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 218.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxft6L84xJUTmx6eO6-fQAAAMU"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:25:11.594814 2026] [security2:error] [pid 882519:tid 882703] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/this_is_a_new_hello_world.php"] [unique_id "alxft6L84xJUTmx6eO6-iAAAALs"]
[Sat Jul 18 23:25:11.594929 2026] [security2:error] [pid 882519:tid 882703] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/this_is_a_new_hello_world.php"] [unique_id "alxft6L84xJUTmx6eO6-iAAAALs"]
[Sat Jul 18 23:25:11.960476 2026] [security2:error] [pid 882519:tid 882754] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/media.php"] [unique_id "alxft6L84xJUTmx6eO6-lAAAAO4"]
[Sat Jul 18 23:25:11.960569 2026] [security2:error] [pid 882519:tid 882754] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/media.php"] [unique_id "alxft6L84xJUTmx6eO6-lAAAAO4"]
[Sat Jul 18 23:25:12.163005 2026] [security2:error] [pid 882519:tid 882622] [remote 72.167.132.114:43228] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "claysharecon.com"] [uri "/wp-login.php"] [unique_id "alxfuKL84xJUTmx6eO6-mQAA52Y"], referer: https://claysharecon.com/wp-login.php
[Sat Jul 18 23:25:12.315332 2026] [security2:error] [pid 882519:tid 882697] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/images.php"] [unique_id "alxfuKL84xJUTmx6eO6-nAAAALU"]
[Sat Jul 18 23:25:12.315416 2026] [security2:error] [pid 882519:tid 882697] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/images.php"] [unique_id "alxfuKL84xJUTmx6eO6-nAAAALU"]
[Sat Jul 18 23:25:12.682458 2026] [security2:error] [pid 882519:tid 882533] [remote 45.157.54.14:47788] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "website-20a04702.healthylifegourmet.org"] [uri "/xmlrpc.php"] [unique_id "alxfuKL84xJUTmx6eO6-qgAAzA0"]
[Sat Jul 18 23:25:12.682659 2026] [security2:error] [pid 882519:tid 882720] [client 45.157.54.14:47788] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "website-20a04702.healthylifegourmet.org"] [uri "/xmlrpc.php"] [unique_id "alxfuKL84xJUTmx6eO6-qgAAzA0"]
[Sat Jul 18 23:25:12.695414 2026] [security2:error] [pid 881201:tid 881381] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/adminner.php"] [unique_id "alxfuAWL-zKlchkVWS1fIAAAADE"]
[Sat Jul 18 23:25:12.695519 2026] [security2:error] [pid 881201:tid 881381] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/adminner.php"] [unique_id "alxfuAWL-zKlchkVWS1fIAAAADE"]
[Sat Jul 18 23:25:13.087420 2026] [security2:error] [pid 882519:tid 882745] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/3PJcpMFsD8B.php"] [unique_id "alxfuaL84xJUTmx6eO6-vgAAAOU"]
[Sat Jul 18 23:25:13.087506 2026] [security2:error] [pid 882519:tid 882745] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/3PJcpMFsD8B.php"] [unique_id "alxfuaL84xJUTmx6eO6-vgAAAOU"]
[Sat Jul 18 23:25:13.444919 2026] [security2:error] [pid 882519:tid 882775] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/admin.php"] [unique_id "alxfuaL84xJUTmx6eO6-yAAAAQM"]
[Sat Jul 18 23:25:13.445009 2026] [security2:error] [pid 882519:tid 882775] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/admin.php"] [unique_id "alxfuaL84xJUTmx6eO6-yAAAAQM"]
[Sat Jul 18 23:25:13.814621 2026] [security2:error] [pid 882519:tid 882732] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/k.php"] [unique_id "alxfuaL84xJUTmx6eO6-3gAAANg"]
[Sat Jul 18 23:25:13.814742 2026] [security2:error] [pid 882519:tid 882732] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/k.php"] [unique_id "alxfuaL84xJUTmx6eO6-3gAAANg"]
[Sat Jul 18 23:25:14.123669 2026] [security2:error] [pid 881201:tid 881387] [client 74.208.214.194:34446] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxfugWL-zKlchkVWS1fPgAAADc"]
[Sat Jul 18 23:25:14.178181 2026] [security2:error] [pid 881201:tid 881366] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/x.php"] [unique_id "alxfugWL-zKlchkVWS1fQQAAACI"]
[Sat Jul 18 23:25:14.178286 2026] [security2:error] [pid 881201:tid 881366] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/x.php"] [unique_id "alxfugWL-zKlchkVWS1fQQAAACI"]
[Sat Jul 18 23:25:14.572711 2026] [security2:error] [pid 882519:tid 882733] [client 190.245.146.99:57095] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfuqL84xJUTmx6eO6_DQAAANk"]
[Sat Jul 18 23:25:14.577144 2026] [security2:error] [pid 882519:tid 882721] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wss.php"] [unique_id "alxfuqL84xJUTmx6eO6_DgAAAM0"]
[Sat Jul 18 23:25:14.577287 2026] [security2:error] [pid 882519:tid 882721] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wss.php"] [unique_id "alxfuqL84xJUTmx6eO6_DgAAAM0"]
[Sat Jul 18 23:25:14.578568 2026] [security2:error] [pid 882519:tid 882733] [client 190.245.146.99:57095] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfuqL84xJUTmx6eO6_DQAAANk"]
[Sat Jul 18 23:25:15.393380 2026] [security2:error] [pid 881201:tid 881435] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/ty.php"] [unique_id "alxfuwWL-zKlchkVWS1fVwAAAGc"]
[Sat Jul 18 23:25:15.393519 2026] [security2:error] [pid 881201:tid 881435] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/ty.php"] [unique_id "alxfuwWL-zKlchkVWS1fVwAAAGc"]
[Sat Jul 18 23:25:15.540666 2026] [security2:error] [pid 882519:tid 882593] [remote 154.61.75.100:51168] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxfu6L84xJUTmx6eO6_TAAAsEk"]
[Sat Jul 18 23:25:15.571612 2026] [security2:error] [pid 882519:tid 882710] [client 27.34.68.67:11136] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfu6L84xJUTmx6eO6_UAAAAMI"]
[Sat Jul 18 23:25:15.571734 2026] [security2:error] [pid 882519:tid 882710] [client 27.34.68.67:11136] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfu6L84xJUTmx6eO6_UAAAAMI"]
[Sat Jul 18 23:25:15.763475 2026] [security2:error] [pid 882519:tid 882669] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/155.php"] [unique_id "alxfu6L84xJUTmx6eO6_cgAAAJk"]
[Sat Jul 18 23:25:15.763551 2026] [security2:error] [pid 882519:tid 882669] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/155.php"] [unique_id "alxfu6L84xJUTmx6eO6_cgAAAJk"]
[Sat Jul 18 23:25:16.098040 2026] [security2:error] [pid 882519:tid 882621] [remote 154.61.75.100:51168] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxfvKL84xJUTmx6eO6_fQAAnmU"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:25:16.106575 2026] [security2:error] [pid 881201:tid 881433] [client 223.185.61.63:6830] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfvAWL-zKlchkVWS1fYAAAAGU"]
[Sat Jul 18 23:25:16.106688 2026] [security2:error] [pid 881201:tid 881433] [client 223.185.61.63:6830] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfvAWL-zKlchkVWS1fYAAAAGU"]
[Sat Jul 18 23:25:16.142025 2026] [security2:error] [pid 881201:tid 881376] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/ops.php"] [unique_id "alxfvAWL-zKlchkVWS1fYgAAACw"]
[Sat Jul 18 23:25:16.142177 2026] [security2:error] [pid 881201:tid 881376] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/ops.php"] [unique_id "alxfvAWL-zKlchkVWS1fYgAAACw"]
[Sat Jul 18 23:25:16.161109 2026] [security2:error] [pid 882519:tid 882624] [remote 91.142.222.105:54446] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "healthylifegourmet.org"] [uri "/wp-login.php"] [unique_id "alxfvKL84xJUTmx6eO6_ggAAomg"]
[Sat Jul 18 23:25:16.514280 2026] [security2:error] [pid 882519:tid 882715] [client 34.210.88.185:33720] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.88.210.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxfvKL84xJUTmx6eO6_kgAAAMc"]
[Sat Jul 18 23:25:16.515107 2026] [security2:error] [pid 882519:tid 882760] [client 34.210.88.185:33714] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.88.210.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxfvKL84xJUTmx6eO6_kwAAAPQ"]
[Sat Jul 18 23:25:16.520469 2026] [security2:error] [pid 881201:tid 881363] [client 35.92.83.184:13790] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 184.83.92.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxfvAWL-zKlchkVWS1fbAAAAB8"]
[Sat Jul 18 23:25:16.520541 2026] [security2:error] [pid 882519:tid 882662] [client 35.92.83.184:13804] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 184.83.92.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxfvKL84xJUTmx6eO6_lAAAAJI"]
[Sat Jul 18 23:25:16.520917 2026] [security2:error] [pid 881201:tid 881343] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/ingfo.php"] [unique_id "alxfvAWL-zKlchkVWS1fbQAAAAs"]
[Sat Jul 18 23:25:16.521016 2026] [security2:error] [pid 881201:tid 881343] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/ingfo.php"] [unique_id "alxfvAWL-zKlchkVWS1fbQAAAAs"]
[Sat Jul 18 23:25:16.522600 2026] [security2:error] [pid 882519:tid 882724] [client 34.210.88.185:33734] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.88.210.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxfvKL84xJUTmx6eO6_lQAAANA"]
[Sat Jul 18 23:25:16.524255 2026] [security2:error] [pid 882519:tid 882676] [client 54.149.239.117:55130] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.239.149.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxfvKL84xJUTmx6eO6_lgAAAKA"]
[Sat Jul 18 23:25:16.524425 2026] [security2:error] [pid 882519:tid 882664] [client 54.149.239.117:55152] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.239.149.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxfvKL84xJUTmx6eO6_lwAAAJQ"]
[Sat Jul 18 23:25:16.528666 2026] [security2:error] [pid 882519:tid 882661] [client 54.149.239.117:55136] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.239.149.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxfvKL84xJUTmx6eO6_mAAAAJE"]
[Sat Jul 18 23:25:16.838020 2026] [security2:error] [pid 882519:tid 882704] [client 16.145.89.170:26578] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 170.89.145.16.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxfvKL84xJUTmx6eO6_rAAAALw"]
[Sat Jul 18 23:25:16.878217 2026] [security2:error] [pid 882519:tid 882692] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/error_log.php"] [unique_id "alxfvKL84xJUTmx6eO6_rwAAALA"]
[Sat Jul 18 23:25:16.878299 2026] [security2:error] [pid 882519:tid 882692] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/error_log.php"] [unique_id "alxfvKL84xJUTmx6eO6_rwAAALA"]
[Sat Jul 18 23:25:17.023955 2026] [security2:error] [pid 882519:tid 882679] [client 85.204.70.114:34616] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "elespecialista.mx"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "alxfvaL84xJUTmx6eO6_xwAAAKM"]
[Sat Jul 18 23:25:17.248745 2026] [security2:error] [pid 881201:tid 881389] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/ok.php"] [unique_id "alxfvQWL-zKlchkVWS1fgQAAADk"]
[Sat Jul 18 23:25:17.248874 2026] [security2:error] [pid 881201:tid 881389] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/ok.php"] [unique_id "alxfvQWL-zKlchkVWS1fgQAAADk"]
[Sat Jul 18 23:25:17.315192 2026] [security2:error] [pid 882519:tid 882653] [client 85.204.70.114:34618] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.70.204.85.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "elespecialista.mx"] [uri "/xmlrpc.php"] [unique_id "alxfvaL84xJUTmx6eO6_1QAAAIk"]
[Sat Jul 18 23:25:17.599403 2026] [security2:error] [pid 881201:tid 881450] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/mac.php"] [unique_id "alxfvQWL-zKlchkVWS1fiQAAAHY"]
[Sat Jul 18 23:25:17.599497 2026] [security2:error] [pid 881201:tid 881450] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/mac.php"] [unique_id "alxfvQWL-zKlchkVWS1fiQAAAHY"]
[Sat Jul 18 23:25:17.963238 2026] [security2:error] [pid 881201:tid 881381] [client 85.204.70.114:34632] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "elespecialista.mx"] [uri "/blog/wp-includes/wlwmanifest.xml"] [unique_id "alxfvQWL-zKlchkVWS1flAAAADE"]
[Sat Jul 18 23:25:18.059994 2026] [security2:error] [pid 881201:tid 881350] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wefile.php"] [unique_id "alxfvgWL-zKlchkVWS1flwAAABI"]
[Sat Jul 18 23:25:18.060095 2026] [security2:error] [pid 881201:tid 881350] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wefile.php"] [unique_id "alxfvgWL-zKlchkVWS1flwAAABI"]
[Sat Jul 18 23:25:18.232227 2026] [security2:error] [pid 881201:tid 881433] [client 85.204.70.114:47752] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "elespecialista.mx"] [uri "/web/wp-includes/wlwmanifest.xml"] [unique_id "alxfvgWL-zKlchkVWS1fmgAAAGU"]
[Sat Jul 18 23:25:18.365134 2026] [security2:error] [pid 882519:tid 882653] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfvqL84xJUTmx6eO7ADAAAAIk"]
[Sat Jul 18 23:25:18.391955 2026] [security2:error] [pid 882519:tid 882730] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfvqL84xJUTmx6eO7ACgAAANY"]
[Sat Jul 18 23:25:18.398784 2026] [security2:error] [pid 882519:tid 882755] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfvqL84xJUTmx6eO7ABwAAAO8"]
[Sat Jul 18 23:25:18.409821 2026] [security2:error] [pid 882519:tid 882691] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfvqL84xJUTmx6eO7ACwAAAK8"]
[Sat Jul 18 23:25:18.409999 2026] [security2:error] [pid 882519:tid 882667] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfvqL84xJUTmx6eO7ACAAAAJc"]
[Sat Jul 18 23:25:18.411134 2026] [security2:error] [pid 882519:tid 882698] [client 35.220.217.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "portkeytravelplanning.com"] [uri "/index.php"] [unique_id "alxfvqL84xJUTmx6eO7ADQAAALY"]
[Sat Jul 18 23:25:18.437799 2026] [security2:error] [pid 881201:tid 881395] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "alxfvgWL-zKlchkVWS1fqgAAAD8"]
[Sat Jul 18 23:25:18.437932 2026] [security2:error] [pid 881201:tid 881395] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "alxfvgWL-zKlchkVWS1fqgAAAD8"]
[Sat Jul 18 23:25:18.497785 2026] [security2:error] [pid 881201:tid 881436] [client 85.204.70.114:47754] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "elespecialista.mx"] [uri "/wordpress/wp-includes/wlwmanifest.xml"] [unique_id "alxfvgWL-zKlchkVWS1frAAAAGg"]
[Sat Jul 18 23:25:18.647186 2026] [security2:error] [pid 881201:tid 881281] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 177.217.220.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "portkeytravelplanning.com"] [uri "/wp-login.php"] [unique_id "alxfvgWL-zKlchkVWS1fsAAAFk4"], referer: https://portkeytravelplanning.com/login
[Sat Jul 18 23:25:18.762844 2026] [security2:error] [pid 882519:tid 882680] [client 85.204.70.114:47762] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "elespecialista.mx"] [uri "/website/wp-includes/wlwmanifest.xml"] [unique_id "alxfvqL84xJUTmx6eO7AIgAAAKQ"]
[Sat Jul 18 23:25:18.776146 2026] [security2:error] [pid 882519:tid 882623] [remote 41.76.213.235:37070] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "terrapro.marketing"] [uri "/wp-login.php"] [unique_id "alxfvqL84xJUTmx6eO7AIAAA2mc"]
[Sat Jul 18 23:25:18.809609 2026] [proxy:error] [pid 882519:tid 882754] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:18.809674 2026] [proxy_http:error] [pid 882519:tid 882754] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:18.810127 2026] [proxy:error] [pid 882519:tid 882754] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:18.810155 2026] [proxy_http:error] [pid 882519:tid 882754] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:18.810242 2026] [security2:error] [pid 882519:tid 882754] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxfvqL84xJUTmx6eO7AJgAAAO4"]
[Sat Jul 18 23:25:19.021441 2026] [security2:error] [pid 882519:tid 882700] [client 85.204.70.114:47766] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "elespecialista.mx"] [uri "/wp/wp-includes/wlwmanifest.xml"] [unique_id "alxfv6L84xJUTmx6eO7AMgAAALg"]
[Sat Jul 18 23:25:19.032483 2026] [security2:error] [pid 881201:tid 881265] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 177.217.220.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "portkeytravelplanning.com"] [uri "/wp-login.php"] [unique_id "alxfvwWL-zKlchkVWS1fuwAAUD4"], referer: https://portkeytravelplanning.com/wp-admin/
[Sat Jul 18 23:25:19.032504 2026] [security2:error] [pid 881201:tid 881262] [remote 35.220.217.177:52600] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 177.217.220.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "portkeytravelplanning.com"] [uri "/wp-login.php"] [unique_id "alxfvwWL-zKlchkVWS1fugAAUDs"], referer: https://portkeytravelplanning.com/wp-admin/
[Sat Jul 18 23:25:19.197452 2026] [security2:error] [pid 881201:tid 881251] [remote 72.167.132.114:40054] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "walkingandtalking.net"] [uri "/xmlrpc.php"] [unique_id "alxfvwWL-zKlchkVWS1fvAAAATA"]
[Sat Jul 18 23:25:19.197658 2026] [security2:error] [pid 881201:tid 881333] [client 72.167.132.114:40054] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "walkingandtalking.net"] [uri "/xmlrpc.php"] [unique_id "alxfvwWL-zKlchkVWS1fvAAAATA"]
[Sat Jul 18 23:25:19.207641 2026] [proxy:error] [pid 882519:tid 882675] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:19.207708 2026] [proxy_http:error] [pid 882519:tid 882675] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:19.208410 2026] [proxy:error] [pid 882519:tid 882675] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:19.208447 2026] [proxy_http:error] [pid 882519:tid 882675] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:19.208546 2026] [security2:error] [pid 882519:tid 882675] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxfv6L84xJUTmx6eO7ANgAAAJ8"]
[Sat Jul 18 23:25:19.290310 2026] [security2:error] [pid 882519:tid 882687] [client 85.204.70.114:47774] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "elespecialista.mx"] [uri "/news/wp-includes/wlwmanifest.xml"] [unique_id "alxfv6L84xJUTmx6eO7APAAAAKs"]
[Sat Jul 18 23:25:19.319527 2026] [security2:error] [pid 882519:tid 882619] [remote 41.76.213.235:37070] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "terrapro.marketing"] [uri "/wp-login.php"] [unique_id "alxfv6L84xJUTmx6eO7APQAAyWM"], referer: https://terrapro.marketing/wp-login.php
[Sat Jul 18 23:25:19.360303 2026] [security2:error] [pid 882519:tid 882697] [client 124.29.207.185:60919] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxfv6L84xJUTmx6eO7APwAAALU"]
[Sat Jul 18 23:25:19.360464 2026] [security2:error] [pid 882519:tid 882697] [client 124.29.207.185:60919] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxfv6L84xJUTmx6eO7APwAAALU"]
[Sat Jul 18 23:25:19.554939 2026] [security2:error] [pid 882519:tid 882651] [client 85.204.70.114:47788] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "elespecialista.mx"] [uri "/2018/wp-includes/wlwmanifest.xml"] [unique_id "alxfv6L84xJUTmx6eO7ATAAAAIc"]
[Sat Jul 18 23:25:19.592577 2026] [security2:error] [pid 882519:tid 882661] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-admin/css/colour.php"] [unique_id "alxfv6L84xJUTmx6eO7AUAAAAJE"]
[Sat Jul 18 23:25:19.592720 2026] [security2:error] [pid 882519:tid 882661] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-admin/css/colour.php"] [unique_id "alxfv6L84xJUTmx6eO7AUAAAAJE"]
[Sat Jul 18 23:25:19.775456 2026] [security2:error] [pid 881201:tid 881311] [remote 31.42.184.154:48396] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "avatrip.co"] [uri "/wp-login.php"] [unique_id "alxfvwWL-zKlchkVWS1f4AAAX2w"]
[Sat Jul 18 23:25:19.812501 2026] [security2:error] [pid 881201:tid 881377] [client 85.204.70.114:47800] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "elespecialista.mx"] [uri "/shop/wp-includes/wlwmanifest.xml"] [unique_id "alxfvwWL-zKlchkVWS1f5AAAAC0"]
[Sat Jul 18 23:25:19.980937 2026] [proxy:error] [pid 881201:tid 881350] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:19.981004 2026] [proxy_http:error] [pid 881201:tid 881350] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:19.981634 2026] [proxy:error] [pid 881201:tid 881350] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:19.981665 2026] [proxy_http:error] [pid 881201:tid 881350] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:19.981785 2026] [security2:error] [pid 881201:tid 881350] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxfvwWL-zKlchkVWS1f6AAAABI"]
[Sat Jul 18 23:25:20.001280 2026] [security2:error] [pid 881201:tid 881285] [remote 31.42.184.154:48396] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "avatrip.co"] [uri "/wp-login.php"] [unique_id "alxfwAWL-zKlchkVWS1f6gAAZVI"], referer: https://avatrip.co/wp-login.php
[Sat Jul 18 23:25:20.043278 2026] [security2:error] [pid 881201:tid 881388] [client 51.68.111.245:24531] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "americanbubbleball.com"] [uri "/robots.txt"] [unique_id "alxfwAWL-zKlchkVWS1f6wAAADg"]
[Sat Jul 18 23:25:20.043380 2026] [security2:error] [pid 881201:tid 881388] [client 51.68.111.245:24531] ModSecurity: Warning. Matched phrase "MJ12bot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "americanbubbleball.com"] [uri "/robots.txt"] [unique_id "alxfwAWL-zKlchkVWS1f6wAAADg"]
[Sat Jul 18 23:25:20.085654 2026] [security2:error] [pid 882519:tid 882764] [client 85.204.70.114:47804] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "elespecialista.mx"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "alxfwKL84xJUTmx6eO7AaQAAAPg"]
[Sat Jul 18 23:25:20.335407 2026] [security2:error] [pid 882519:tid 882732] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/like.php"] [unique_id "alxfwKL84xJUTmx6eO7AcAAAANg"]
[Sat Jul 18 23:25:20.335504 2026] [security2:error] [pid 882519:tid 882732] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/like.php"] [unique_id "alxfwKL84xJUTmx6eO7AcAAAANg"]
[Sat Jul 18 23:25:20.354514 2026] [security2:error] [pid 882519:tid 882656] [client 85.204.70.114:47814] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "elespecialista.mx"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "alxfwKL84xJUTmx6eO7AcwAAAIw"]
[Sat Jul 18 23:25:20.620026 2026] [security2:error] [pid 882519:tid 882664] [client 85.204.70.114:47818] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "elespecialista.mx"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "alxfwKL84xJUTmx6eO7AgAAAAJQ"]
[Sat Jul 18 23:25:20.695792 2026] [security2:error] [pid 881201:tid 881387] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/.well-known/about.php"] [unique_id "alxfwAWL-zKlchkVWS1f9gAAADc"]
[Sat Jul 18 23:25:20.695902 2026] [security2:error] [pid 881201:tid 881387] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/.well-known/about.php"] [unique_id "alxfwAWL-zKlchkVWS1f9gAAADc"]
[Sat Jul 18 23:25:20.886164 2026] [security2:error] [pid 882519:tid 882735] [client 85.204.70.114:47830] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "elespecialista.mx"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "alxfwKL84xJUTmx6eO7AjAAAANs"]
[Sat Jul 18 23:25:21.026280 2026] [security2:error] [pid 882519:tid 882751] [client 119.154.81.234:56738] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfwaL84xJUTmx6eO7AjwAAAOs"]
[Sat Jul 18 23:25:21.026387 2026] [security2:error] [pid 882519:tid 882751] [client 119.154.81.234:56738] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfwaL84xJUTmx6eO7AjwAAAOs"]
[Sat Jul 18 23:25:21.077607 2026] [security2:error] [pid 881201:tid 881360] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "alxfwQWL-zKlchkVWS1gAgAAABw"]
[Sat Jul 18 23:25:21.077724 2026] [security2:error] [pid 881201:tid 881360] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "alxfwQWL-zKlchkVWS1gAgAAABw"]
[Sat Jul 18 23:25:21.098881 2026] [security2:error] [pid 882519:tid 882683] [client 106.222.249.209:6976] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfwaL84xJUTmx6eO7AkQAAAKc"]
[Sat Jul 18 23:25:21.099099 2026] [security2:error] [pid 882519:tid 882683] [client 106.222.249.209:6976] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfwaL84xJUTmx6eO7AkQAAAKc"]
[Sat Jul 18 23:25:21.147789 2026] [security2:error] [pid 882519:tid 882718] [client 85.204.70.114:47846] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "elespecialista.mx"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "alxfwaL84xJUTmx6eO7AkwAAAMo"]
[Sat Jul 18 23:25:21.385174 2026] [security2:error] [pid 882519:tid 882604] [remote 62.210.185.4:53614] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 4.185.210.62.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "faadenergy.com"] [uri "/wp-login.php"] [unique_id "alxfwaL84xJUTmx6eO7AmwABBFQ"]
[Sat Jul 18 23:25:21.416056 2026] [security2:error] [pid 882519:tid 882652] [client 85.204.70.114:47862] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "elespecialista.mx"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "alxfwaL84xJUTmx6eO7AnQAAAIg"]
[Sat Jul 18 23:25:21.434068 2026] [proxy:error] [pid 882519:tid 882687] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:21.434116 2026] [proxy_http:error] [pid 882519:tid 882687] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:21.434548 2026] [proxy:error] [pid 882519:tid 882687] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:21.434573 2026] [proxy_http:error] [pid 882519:tid 882687] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:21.434651 2026] [security2:error] [pid 882519:tid 882687] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxfwaL84xJUTmx6eO7AngAAAKs"]
[Sat Jul 18 23:25:21.557195 2026] [security2:error] [pid 882519:tid 882624] [remote 62.210.185.4:53614] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 4.185.210.62.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "faadenergy.com"] [uri "/wp-login.php"] [unique_id "alxfwaL84xJUTmx6eO7ApgAA6Wg"], referer: https://faadenergy.com/wp-login.php
[Sat Jul 18 23:25:21.715708 2026] [security2:error] [pid 881201:tid 881427] [client 85.204.70.114:47874] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "elespecialista.mx"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "alxfwQWL-zKlchkVWS1gDQAAAF8"]
[Sat Jul 18 23:25:21.965804 2026] [security2:error] [pid 882519:tid 882727] [client 223.228.182.224:43206] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxfwaL84xJUTmx6eO7AtwAAANM"]
[Sat Jul 18 23:25:21.965922 2026] [security2:error] [pid 882519:tid 882727] [client 223.228.182.224:43206] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxfwaL84xJUTmx6eO7AtwAAANM"]
[Sat Jul 18 23:25:22.077141 2026] [proxy:error] [pid 882519:tid 882752] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:22.077203 2026] [proxy_http:error] [pid 882519:tid 882752] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:22.077884 2026] [proxy:error] [pid 882519:tid 882752] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:22.077914 2026] [proxy_http:error] [pid 882519:tid 882752] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:22.077998 2026] [security2:error] [pid 882519:tid 882752] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxfwqL84xJUTmx6eO7AvQAAAOw"]
[Sat Jul 18 23:25:22.457919 2026] [security2:error] [pid 881201:tid 881374] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/pucci.php"] [unique_id "alxfwgWL-zKlchkVWS1gGQAAACo"]
[Sat Jul 18 23:25:22.458021 2026] [security2:error] [pid 881201:tid 881374] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/pucci.php"] [unique_id "alxfwgWL-zKlchkVWS1gGQAAACo"]
[Sat Jul 18 23:25:22.818306 2026] [proxy:error] [pid 882519:tid 882749] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:22.818378 2026] [proxy_http:error] [pid 882519:tid 882749] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:22.818975 2026] [proxy:error] [pid 882519:tid 882749] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:22.819016 2026] [proxy_http:error] [pid 882519:tid 882749] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:22.819107 2026] [security2:error] [pid 882519:tid 882749] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxfwqL84xJUTmx6eO7A3wAAAOk"]
[Sat Jul 18 23:25:23.211300 2026] [proxy:error] [pid 882519:tid 882650] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:23.211363 2026] [proxy_http:error] [pid 882519:tid 882650] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:23.211940 2026] [proxy:error] [pid 882519:tid 882650] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:23.211967 2026] [proxy_http:error] [pid 882519:tid 882650] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:23.212048 2026] [security2:error] [pid 882519:tid 882650] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxfw6L84xJUTmx6eO7A9AAAAIY"]
[Sat Jul 18 23:25:23.360361 2026] [security2:error] [pid 882519:tid 882638] [remote 20.153.140.50:59928] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxfw6L84xJUTmx6eO7A-gAA3XY"]
[Sat Jul 18 23:25:23.414788 2026] [proxy:error] [pid 881201:tid 881371] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:23.414851 2026] [proxy_http:error] [pid 881201:tid 881371] [client 193.47.62.168:48450] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:23.415368 2026] [proxy:error] [pid 881201:tid 881371] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:23.415393 2026] [proxy_http:error] [pid 881201:tid 881371] [client 193.47.62.168:48450] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:23.560080 2026] [proxy:error] [pid 882519:tid 882718] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:23.560144 2026] [proxy_http:error] [pid 882519:tid 882718] [client 193.47.62.168:48466] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:23.560604 2026] [proxy:error] [pid 882519:tid 882718] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:23.560630 2026] [proxy_http:error] [pid 882519:tid 882718] [client 193.47.62.168:48466] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:23.585835 2026] [security2:error] [pid 881201:tid 881411] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-temp.php"] [unique_id "alxfwwWL-zKlchkVWS1gJgAAAE8"]
[Sat Jul 18 23:25:23.585944 2026] [security2:error] [pid 881201:tid 881411] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-temp.php"] [unique_id "alxfwwWL-zKlchkVWS1gJgAAAE8"]
[Sat Jul 18 23:25:23.776787 2026] [security2:error] [pid 882519:tid 882531] [remote 20.153.140.50:59928] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxfw6L84xJUTmx6eO7BEwAA6Qs"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:25:23.873692 2026] [security2:error] [pid 882519:tid 882627] [remote 113.160.142.119:34522] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxfw6L84xJUTmx6eO7BGAAA7ms"]
[Sat Jul 18 23:25:23.972660 2026] [security2:error] [pid 882519:tid 882645] [remote 68.178.160.25:41658] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/wp-login.php"] [unique_id "alxfw6L84xJUTmx6eO7BGgABAX0"]
[Sat Jul 18 23:25:23.974451 2026] [proxy:error] [pid 881201:tid 881435] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:23.974547 2026] [proxy_http:error] [pid 881201:tid 881435] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:23.976025 2026] [proxy:error] [pid 881201:tid 881435] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:23.976092 2026] [proxy_http:error] [pid 881201:tid 881435] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:23.976228 2026] [security2:error] [pid 881201:tid 881435] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxfwwWL-zKlchkVWS1gMAAAAGc"]
[Sat Jul 18 23:25:23.989859 2026] [security2:error] [pid 881201:tid 881224] [remote 72.167.132.114:40058] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfwwWL-zKlchkVWS1gMwAAcxU"]
[Sat Jul 18 23:25:24.192683 2026] [security2:error] [pid 882519:tid 882659] [client 20.226.60.151:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 151.60.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "packerjanitorial.com"] [uri "/.well-known/about.php"] [unique_id "alxfxKL84xJUTmx6eO7BJQAAAI8"]
[Sat Jul 18 23:25:24.192829 2026] [security2:error] [pid 882519:tid 882659] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "packerjanitorial.com"] [uri "/.well-known/about.php"] [unique_id "alxfxKL84xJUTmx6eO7BJQAAAI8"]
[Sat Jul 18 23:25:24.328899 2026] [security2:error] [pid 881201:tid 881366] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/xmu.php"] [unique_id "alxfxAWL-zKlchkVWS1gPAAAACI"]
[Sat Jul 18 23:25:24.329053 2026] [security2:error] [pid 881201:tid 881366] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/xmu.php"] [unique_id "alxfxAWL-zKlchkVWS1gPAAAACI"]
[Sat Jul 18 23:25:24.379316 2026] [security2:error] [pid 882519:tid 882596] [remote 113.160.142.119:34522] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxfxKL84xJUTmx6eO7BMAAAi0w"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:25:24.685165 2026] [security2:error] [pid 882519:tid 882728] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-admin/js/index.php"] [unique_id "alxfxKL84xJUTmx6eO7BPQAAANQ"]
[Sat Jul 18 23:25:24.685247 2026] [security2:error] [pid 882519:tid 882728] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-admin/js/index.php"] [unique_id "alxfxKL84xJUTmx6eO7BPQAAANQ"]
[Sat Jul 18 23:25:24.687431 2026] [security2:error] [pid 881201:tid 881230] [remote 72.167.132.114:40058] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfxAWL-zKlchkVWS1gRwAAQhs"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:25:24.943745 2026] [security2:error] [pid 881201:tid 881256] [remote 103.75.185.95:42662] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfxAWL-zKlchkVWS1gSQAACTU"]
[Sat Jul 18 23:25:25.031095 2026] [security2:error] [pid 882519:tid 882683] [client 190.245.146.99:57616] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfxaL84xJUTmx6eO7BSgAAAKc"]
[Sat Jul 18 23:25:25.031202 2026] [security2:error] [pid 882519:tid 882683] [client 190.245.146.99:57616] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfxaL84xJUTmx6eO7BSgAAAKc"]
[Sat Jul 18 23:25:25.057266 2026] [security2:error] [pid 881201:tid 881456] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/puc.php"] [unique_id "alxfxQWL-zKlchkVWS1gTQAAAHw"]
[Sat Jul 18 23:25:25.057377 2026] [security2:error] [pid 881201:tid 881456] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/puc.php"] [unique_id "alxfxQWL-zKlchkVWS1gTQAAAHw"]
[Sat Jul 18 23:25:25.408520 2026] [security2:error] [pid 881201:tid 881338] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/themes.php"] [unique_id "alxfxQWL-zKlchkVWS1gYwAAAAY"]
[Sat Jul 18 23:25:25.408616 2026] [security2:error] [pid 881201:tid 881338] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/themes.php"] [unique_id "alxfxQWL-zKlchkVWS1gYwAAAAY"]
[Sat Jul 18 23:25:25.414257 2026] [security2:error] [pid 881201:tid 881217] [remote 31.42.184.154:54296] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxfxQWL-zKlchkVWS1gZQAAXw4"]
[Sat Jul 18 23:25:25.532114 2026] [security2:error] [pid 881201:tid 881319] [remote 103.75.185.95:42662] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfxQWL-zKlchkVWS1gawAAA3Q"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:25:25.550561 2026] [security2:error] [pid 882519:tid 882552] [remote 68.178.160.25:41658] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/wp-login.php"] [unique_id "alxfxaL84xJUTmx6eO7BVgAA4SA"], referer: https://youpositive.co/wp-login.php
[Sat Jul 18 23:25:25.642707 2026] [security2:error] [pid 881201:tid 881235] [remote 31.42.184.154:54296] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxfxQWL-zKlchkVWS1gbQAAOCA"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:25:25.782930 2026] [proxy:error] [pid 882519:tid 882687] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:25.782988 2026] [proxy_http:error] [pid 882519:tid 882687] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:25.783531 2026] [proxy:error] [pid 882519:tid 882687] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:25.783555 2026] [proxy_http:error] [pid 882519:tid 882687] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:25.783622 2026] [security2:error] [pid 882519:tid 882687] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxfxaL84xJUTmx6eO7BXwAAAKs"]
[Sat Jul 18 23:25:25.914617 2026] [security2:error] [pid 882519:tid 882730] [client 34.123.137.137:37046] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "bandsir.com"] [uri "/wp-json/batch/v1"] [unique_id "alxfxaL84xJUTmx6eO7BYgAAANY"]
[Sat Jul 18 23:25:26.129403 2026] [security2:error] [pid 882519:tid 882728] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/8.php"] [unique_id "alxfxqL84xJUTmx6eO7BcAAAANQ"]
[Sat Jul 18 23:25:26.129495 2026] [security2:error] [pid 882519:tid 882728] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/8.php"] [unique_id "alxfxqL84xJUTmx6eO7BcAAAANQ"]
[Sat Jul 18 23:25:26.181122 2026] [security2:error] [pid 881201:tid 881411] [client 27.34.68.67:44388] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfxgWL-zKlchkVWS1gdwAAAE8"]
[Sat Jul 18 23:25:26.181242 2026] [security2:error] [pid 881201:tid 881411] [client 27.34.68.67:44388] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxfxgWL-zKlchkVWS1gdwAAAE8"]
[Sat Jul 18 23:25:26.264028 2026] [security2:error] [pid 882519:tid 882692] [client 34.123.137.137:37046] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "bandsir.com"] [uri "/"] [unique_id "alxfxqL84xJUTmx6eO7BdQAAALA"]
[Sat Jul 18 23:25:26.383027 2026] [security2:error] [pid 881201:tid 881354] [client 95.108.213.185:63330] ModSecurity: Access denied with code 429 (phase 2). Pattern match "Mozilla\\\\/5\\\\.0 \\\\(compatible; YandexBot\\\\/3\\\\.0; \\\\+http:\\\\/\\\\/yandex\\\\.com\\\\/bots\\\\)" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/othercrawler.conf"] [line "3"] [id "901008"] [msg "Yandex Crawler 429 ADDED BY MONITORING DO NOT WHITELIST"] [hostname "heroesoftomorrow.us"] [uri "/robots.txt"] [unique_id "alxfxgWL-zKlchkVWS1gfQAAABY"]
[Sat Jul 18 23:25:26.535827 2026] [security2:error] [pid 882519:tid 882685] [client 20.206.105.145:0] ModSecurity: Warning. Pattern match "/1\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1543"] [id "900921"] [msg "temporary TUW-72162 logging rule"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/1.php"] [unique_id "alxfxqL84xJUTmx6eO7BhAAAAKk"]
[Sat Jul 18 23:25:26.535925 2026] [security2:error] [pid 882519:tid 882685] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/1.php"] [unique_id "alxfxqL84xJUTmx6eO7BhAAAAKk"]
[Sat Jul 18 23:25:26.536029 2026] [security2:error] [pid 882519:tid 882685] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/1.php"] [unique_id "alxfxqL84xJUTmx6eO7BhAAAAKk"]
[Sat Jul 18 23:25:26.685513 2026] [security2:error] [pid 882519:tid 882699] [client 57.141.18.116:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxfxqL84xJUTmx6eO7BggAAALc"]
[Sat Jul 18 23:25:26.712598 2026] [security2:error] [pid 881201:tid 881423] [client 223.185.61.63:5927] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfxgWL-zKlchkVWS1ggwAAAFs"]
[Sat Jul 18 23:25:26.712694 2026] [security2:error] [pid 881201:tid 881423] [client 223.185.61.63:5927] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxfxgWL-zKlchkVWS1ggwAAAFs"]
[Sat Jul 18 23:25:26.886333 2026] [security2:error] [pid 882519:tid 882768] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/100.php"] [unique_id "alxfxqL84xJUTmx6eO7BkgAAAPw"]
[Sat Jul 18 23:25:26.886420 2026] [security2:error] [pid 882519:tid 882768] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/100.php"] [unique_id "alxfxqL84xJUTmx6eO7BkgAAAPw"]
[Sat Jul 18 23:25:27.238377 2026] [security2:error] [pid 881201:tid 881440] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/about.php"] [unique_id "alxfxwWL-zKlchkVWS1gjwAAAGw"]
[Sat Jul 18 23:25:27.238485 2026] [security2:error] [pid 881201:tid 881440] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/about.php"] [unique_id "alxfxwWL-zKlchkVWS1gjwAAAGw"]
[Sat Jul 18 23:25:27.318037 2026] [security2:error] [pid 882519:tid 882566] [remote 95.108.213.117:53992] ModSecurity: Access denied with code 429 (phase 2). Pattern match "Mozilla\\\\/5\\\\.0 \\\\(compatible; YandexBot\\\\/3\\\\.0; \\\\+http:\\\\/\\\\/yandex\\\\.com\\\\/bots\\\\)" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/othercrawler.conf"] [line "3"] [id "901008"] [msg "Yandex Crawler 429 ADDED BY MONITORING DO NOT WHITELIST"] [hostname "heroesoftomorrow.us"] [uri "/"] [unique_id "alxfx6L84xJUTmx6eO7BpwAAji4"]
[Sat Jul 18 23:25:27.597777 2026] [security2:error] [pid 882519:tid 882751] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/about.php"] [unique_id "alxfx6L84xJUTmx6eO7BrQAAAOs"]
[Sat Jul 18 23:25:27.597881 2026] [security2:error] [pid 882519:tid 882751] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/about.php"] [unique_id "alxfx6L84xJUTmx6eO7BrQAAAOs"]
[Sat Jul 18 23:25:27.708907 2026] [security2:error] [pid 882519:tid 882734] [client 34.123.137.137:52400] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "bandsir.com"] [uri "/wp-json/batch/v1"] [unique_id "alxfx6L84xJUTmx6eO7BsgAAANo"]
[Sat Jul 18 23:25:27.841470 2026] [security2:error] [pid 882519:tid 882774] [client 57.141.18.125:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "nextlevelpressurewashing.com"] [uri "/index.php"] [unique_id "alxfxqL84xJUTmx6eO7BfgAAAQI"]
[Sat Jul 18 23:25:27.943363 2026] [security2:error] [pid 882519:tid 882721] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/admin.php"] [unique_id "alxfx6L84xJUTmx6eO7ByAAAAM0"]
[Sat Jul 18 23:25:27.943448 2026] [security2:error] [pid 882519:tid 882721] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/admin.php"] [unique_id "alxfx6L84xJUTmx6eO7ByAAAAM0"]
[Sat Jul 18 23:25:28.325045 2026] [security2:error] [pid 882519:tid 882728] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/admin.php"] [unique_id "alxfyKL84xJUTmx6eO7B2QAAANQ"]
[Sat Jul 18 23:25:28.325163 2026] [security2:error] [pid 882519:tid 882728] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/admin.php"] [unique_id "alxfyKL84xJUTmx6eO7B2QAAANQ"]
[Sat Jul 18 23:25:28.514994 2026] [security2:error] [pid 882519:tid 882664] [client 34.123.137.137:52400] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "bandsir.com"] [uri "/"] [unique_id "alxfyKL84xJUTmx6eO7B3QAAAJQ"]
[Sat Jul 18 23:25:28.692941 2026] [security2:error] [pid 882519:tid 882754] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/edit.php"] [unique_id "alxfyKL84xJUTmx6eO7B5QAAAO4"]
[Sat Jul 18 23:25:28.693021 2026] [security2:error] [pid 882519:tid 882754] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/edit.php"] [unique_id "alxfyKL84xJUTmx6eO7B5QAAAO4"]
[Sat Jul 18 23:25:29.231799 2026] [security2:error] [pid 882519:tid 882650] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-content/admin.php"] [unique_id "alxfyaL84xJUTmx6eO7B-gAAAIY"]
[Sat Jul 18 23:25:29.231907 2026] [security2:error] [pid 882519:tid 882650] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-content/admin.php"] [unique_id "alxfyaL84xJUTmx6eO7B-gAAAIY"]
[Sat Jul 18 23:25:29.266065 2026] [security2:error] [pid 882519:tid 882686] [client 57.141.18.120:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxfyaL84xJUTmx6eO7B9gAAAKo"]
[Sat Jul 18 23:25:29.596541 2026] [security2:error] [pid 882519:tid 882718] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/f6.php"] [unique_id "alxfyaL84xJUTmx6eO7CEwAAAMo"]
[Sat Jul 18 23:25:29.596647 2026] [security2:error] [pid 882519:tid 882718] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/f6.php"] [unique_id "alxfyaL84xJUTmx6eO7CEwAAAMo"]
[Sat Jul 18 23:25:29.973801 2026] [security2:error] [pid 882519:tid 882746] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/inputs.php"] [unique_id "alxfyaL84xJUTmx6eO7CIQAAAOY"]
[Sat Jul 18 23:25:29.973950 2026] [security2:error] [pid 882519:tid 882746] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/inputs.php"] [unique_id "alxfyaL84xJUTmx6eO7CIQAAAOY"]
[Sat Jul 18 23:25:30.328854 2026] [security2:error] [pid 882519:tid 882697] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/inputs.php"] [unique_id "alxfyqL84xJUTmx6eO7CNAAAALU"]
[Sat Jul 18 23:25:30.328988 2026] [security2:error] [pid 882519:tid 882697] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/inputs.php"] [unique_id "alxfyqL84xJUTmx6eO7CNAAAALU"]
[Sat Jul 18 23:25:30.684172 2026] [security2:error] [pid 881201:tid 881391] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/av.php"] [unique_id "alxfygWL-zKlchkVWS1gwQAAADs"]
[Sat Jul 18 23:25:30.684275 2026] [security2:error] [pid 881201:tid 881391] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/av.php"] [unique_id "alxfygWL-zKlchkVWS1gwQAAADs"]
[Sat Jul 18 23:25:31.078100 2026] [security2:error] [pid 882519:tid 882679] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/classwithtostring.php"] [unique_id "alxfy6L84xJUTmx6eO7CUAAAAKM"]
[Sat Jul 18 23:25:31.078200 2026] [security2:error] [pid 882519:tid 882679] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/classwithtostring.php"] [unique_id "alxfy6L84xJUTmx6eO7CUAAAAKM"]
[Sat Jul 18 23:25:31.428691 2026] [security2:error] [pid 882519:tid 882697] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-content/themes/index.php"] [unique_id "alxfy6L84xJUTmx6eO7CawAAALU"]
[Sat Jul 18 23:25:31.428857 2026] [security2:error] [pid 882519:tid 882697] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-content/themes/index.php"] [unique_id "alxfy6L84xJUTmx6eO7CawAAALU"]
[Sat Jul 18 23:25:31.651695 2026] [security2:error] [pid 881201:tid 881426] [client 119.154.81.234:57198] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfywWL-zKlchkVWS1g0wAAAF4"]
[Sat Jul 18 23:25:31.651867 2026] [security2:error] [pid 881201:tid 881426] [client 119.154.81.234:57198] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxfywWL-zKlchkVWS1g0wAAAF4"]
[Sat Jul 18 23:25:31.701446 2026] [security2:error] [pid 881201:tid 881384] [client 106.222.249.209:29394] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfywWL-zKlchkVWS1g1QAAADQ"]
[Sat Jul 18 23:25:31.701651 2026] [security2:error] [pid 881201:tid 881384] [client 106.222.249.209:29394] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxfywWL-zKlchkVWS1g1QAAADQ"]
[Sat Jul 18 23:25:31.844726 2026] [security2:error] [pid 882519:tid 882687] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-blog.php"] [unique_id "alxfy6L84xJUTmx6eO7CdwAAAKs"]
[Sat Jul 18 23:25:31.844882 2026] [security2:error] [pid 882519:tid 882687] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-blog.php"] [unique_id "alxfy6L84xJUTmx6eO7CdwAAAKs"]
[Sat Jul 18 23:25:32.082847 2026] [security2:error] [pid 882519:tid 882675] [client 127.0.0.1:17530] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "400"] [hostname "127.0.0.1"] [uri "/cgi-sys/autodiscover.cgi"] [unique_id "alxfzKL84xJUTmx6eO7CfQAAAJ8"]
[Sat Jul 18 23:25:32.082859 2026] [security2:error] [pid 882519:tid 882726] [client 127.0.0.1:17514] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "400"] [hostname "autodiscover.msandreaadams.net"] [uri "/cgi-sys/autodiscover.cgi"] [unique_id "alxfzKL84xJUTmx6eO7CfAAAANI"]
[Sat Jul 18 23:25:32.082941 2026] [security2:error] [pid 882519:tid 882751] [client 74.7.228.32:53244] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "400"] [hostname "autodiscover.msandreaadams.net"] [uri "/robots.txt"] [unique_id "alxfzKL84xJUTmx6eO7CewAA6y8"]
[Sat Jul 18 23:25:32.084708 2026] [security2:error] [pid 882519:tid 882655] [client 127.0.0.1:17542] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "400"] [hostname "127.0.0.1"] [uri "/cgi-sys/autodiscover.cgi"] [unique_id "alxfzKL84xJUTmx6eO7CfwAAAIs"]
[Sat Jul 18 23:25:32.084776 2026] [security2:error] [pid 882519:tid 882768] [client 74.7.175.185:55322] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "400"] [hostname "autodiscover.entraalnuevomundo.com"] [uri "/robots.txt"] [unique_id "alxfzKL84xJUTmx6eO7CfgAA_CE"]
[Sat Jul 18 23:25:32.131428 2026] [security2:error] [pid 882519:tid 882718] [client 127.0.0.1:17546] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "400"] [hostname "127.0.0.1"] [uri "/cgi-sys/autodiscover.cgi"] [unique_id "alxfzKL84xJUTmx6eO7CgQAAAMo"]
[Sat Jul 18 23:25:32.131448 2026] [security2:error] [pid 882519:tid 882764] [client 74.7.175.141:33164] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "400"] [hostname "autodiscover.wgs.doq.mybluehost.me"] [uri "/robots.txt"] [unique_id "alxfzKL84xJUTmx6eO7CgAAA-CA"]
[Sat Jul 18 23:25:32.221858 2026] [proxy:error] [pid 882519:tid 882736] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:32.221915 2026] [proxy_http:error] [pid 882519:tid 882736] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:32.222323 2026] [proxy:error] [pid 882519:tid 882736] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:32.222351 2026] [proxy_http:error] [pid 882519:tid 882736] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:32.222430 2026] [security2:error] [pid 882519:tid 882736] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxfzKL84xJUTmx6eO7CjQAAANw"]
[Sat Jul 18 23:25:32.301849 2026] [security2:error] [pid 882519:tid 882664] [client 216.73.216.76:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "peoplestrategies.us"] [uri "/index.php"] [unique_id "alxfzKL84xJUTmx6eO7CjAAAAJQ"]
[Sat Jul 18 23:25:32.613603 2026] [security2:error] [pid 882519:tid 882772] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-content/admin.php"] [unique_id "alxfzKL84xJUTmx6eO7CoQAAAQA"]
[Sat Jul 18 23:25:32.613706 2026] [security2:error] [pid 882519:tid 882772] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-content/admin.php"] [unique_id "alxfzKL84xJUTmx6eO7CoQAAAQA"]
[Sat Jul 18 23:25:32.676670 2026] [security2:error] [pid 881201:tid 881353] [client 45.3.45.164:55745] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxfzAWL-zKlchkVWS1g4gAAABU"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:25:32.965797 2026] [security2:error] [pid 881201:tid 881350] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/adminfuns.php"] [unique_id "alxfzAWL-zKlchkVWS1g5gAAABI"]
[Sat Jul 18 23:25:32.965897 2026] [security2:error] [pid 881201:tid 881350] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/adminfuns.php"] [unique_id "alxfzAWL-zKlchkVWS1g5gAAABI"]
[Sat Jul 18 23:25:33.122309 2026] [ssl:error] [pid 882519:tid 882668] [client 13.219.121.241:35850] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname cpcontacts.jps.jiv.mybluehost.me provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:25:33.360726 2026] [security2:error] [pid 882519:tid 882709] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/goods.php"] [unique_id "alxfzaL84xJUTmx6eO7CxQAAAME"]
[Sat Jul 18 23:25:33.360848 2026] [security2:error] [pid 882519:tid 882709] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/goods.php"] [unique_id "alxfzaL84xJUTmx6eO7CxQAAAME"]
[Sat Jul 18 23:25:33.707654 2026] [security2:error] [pid 882519:tid 882660] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/ms-edit.php"] [unique_id "alxfzaL84xJUTmx6eO7CzAAAAJA"]
[Sat Jul 18 23:25:33.707746 2026] [security2:error] [pid 882519:tid 882660] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/ms-edit.php"] [unique_id "alxfzaL84xJUTmx6eO7CzAAAAJA"]
[Sat Jul 18 23:25:34.110389 2026] [security2:error] [pid 882519:tid 882772] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/222.php"] [unique_id "alxfzqL84xJUTmx6eO7C2wAAAQA"]
[Sat Jul 18 23:25:34.110457 2026] [security2:error] [pid 882519:tid 882772] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/222.php"] [unique_id "alxfzqL84xJUTmx6eO7C2wAAAQA"]
[Sat Jul 18 23:25:34.149504 2026] [security2:error] [pid 882519:tid 882605] [remote 31.42.184.154:35174] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfzqL84xJUTmx6eO7C3QAA3lU"]
[Sat Jul 18 23:25:34.384031 2026] [security2:error] [pid 882519:tid 882593] [remote 31.42.184.154:35174] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxfzqL84xJUTmx6eO7C5wAApEk"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:25:34.496119 2026] [security2:error] [pid 882519:tid 882687] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/cgi-bin/index.php"] [unique_id "alxfzqL84xJUTmx6eO7C6wAAAKs"]
[Sat Jul 18 23:25:34.496199 2026] [security2:error] [pid 882519:tid 882687] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/cgi-bin/index.php"] [unique_id "alxfzqL84xJUTmx6eO7C6wAAAKs"]
[Sat Jul 18 23:25:34.878645 2026] [proxy:error] [pid 882519:tid 882755] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:34.878705 2026] [proxy_http:error] [pid 882519:tid 882755] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:34.879359 2026] [proxy:error] [pid 882519:tid 882755] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:34.879387 2026] [proxy_http:error] [pid 882519:tid 882755] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:34.879471 2026] [security2:error] [pid 882519:tid 882755] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxfzqL84xJUTmx6eO7C-gAAAO8"]
[Sat Jul 18 23:25:35.115509 2026] [security2:error] [pid 882519:tid 882700] [client 74.208.214.194:46438] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxfz6L84xJUTmx6eO7DCAAAALg"]
[Sat Jul 18 23:25:35.230031 2026] [security2:error] [pid 882519:tid 882774] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/BDKR28WP.php"] [unique_id "alxfz6L84xJUTmx6eO7DCwAAAQI"]
[Sat Jul 18 23:25:35.230119 2026] [security2:error] [pid 882519:tid 882774] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/BDKR28WP.php"] [unique_id "alxfz6L84xJUTmx6eO7DCwAAAQI"]
[Sat Jul 18 23:25:35.614869 2026] [proxy:error] [pid 882519:tid 882739] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:35.614927 2026] [proxy_http:error] [pid 882519:tid 882739] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:35.615392 2026] [proxy:error] [pid 882519:tid 882739] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:35.615418 2026] [proxy_http:error] [pid 882519:tid 882739] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:35.615497 2026] [security2:error] [pid 882519:tid 882739] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxfz6L84xJUTmx6eO7DGQAAAN8"]
[Sat Jul 18 23:25:35.620680 2026] [security2:error] [pid 882519:tid 882682] [client 190.245.146.99:58141] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfz6L84xJUTmx6eO7DGgAAAKY"]
[Sat Jul 18 23:25:35.620774 2026] [security2:error] [pid 882519:tid 882682] [client 190.245.146.99:58141] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxfz6L84xJUTmx6eO7DGgAAAKY"]
[Sat Jul 18 23:25:35.714036 2026] [security2:error] [pid 882519:tid 882690] [client 45.3.45.2:57419] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 2.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxfz6L84xJUTmx6eO7DIQAAAK4"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:25:35.997286 2026] [proxy:error] [pid 881201:tid 881449] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:35.997360 2026] [proxy_http:error] [pid 881201:tid 881449] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:35.998055 2026] [proxy:error] [pid 881201:tid 881449] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:35.998099 2026] [proxy_http:error] [pid 881201:tid 881449] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:35.998193 2026] [security2:error] [pid 881201:tid 881449] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxfzwWL-zKlchkVWS1hHAAAAHU"]
[Sat Jul 18 23:25:36.310947 2026] [security2:error] [pid 882519:tid 882520] [remote 91.142.222.105:57470] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "healthylifegourmet.org"] [uri "/wp-login.php"] [unique_id "alxf0KL84xJUTmx6eO7DPQAA3QA"], referer: https://healthylifegourmet.org/wp-login.php
[Sat Jul 18 23:25:36.354430 2026] [security2:error] [pid 882519:tid 882719] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/raw.php"] [unique_id "alxf0KL84xJUTmx6eO7DPwAAAMs"]
[Sat Jul 18 23:25:36.354532 2026] [security2:error] [pid 882519:tid 882719] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/raw.php"] [unique_id "alxf0KL84xJUTmx6eO7DPwAAAMs"]
[Sat Jul 18 23:25:36.734536 2026] [security2:error] [pid 881201:tid 881447] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/abcd.php"] [unique_id "alxf0AWL-zKlchkVWS1hLgAAAHM"]
[Sat Jul 18 23:25:36.734628 2026] [security2:error] [pid 881201:tid 881447] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/abcd.php"] [unique_id "alxf0AWL-zKlchkVWS1hLgAAAHM"]
[Sat Jul 18 23:25:36.817932 2026] [security2:error] [pid 881201:tid 881382] [client 27.34.68.67:26592] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxf0AWL-zKlchkVWS1hMgAAADI"]
[Sat Jul 18 23:25:36.818040 2026] [security2:error] [pid 881201:tid 881382] [client 27.34.68.67:26592] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxf0AWL-zKlchkVWS1hMgAAADI"]
[Sat Jul 18 23:25:37.101803 2026] [security2:error] [pid 881201:tid 881436] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/a1.php"] [unique_id "alxf0QWL-zKlchkVWS1hOwAAAGg"]
[Sat Jul 18 23:25:37.101902 2026] [security2:error] [pid 881201:tid 881436] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/a1.php"] [unique_id "alxf0QWL-zKlchkVWS1hOwAAAGg"]
[Sat Jul 18 23:25:37.298834 2026] [security2:error] [pid 881201:tid 881348] [client 223.185.61.63:9102] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxf0QWL-zKlchkVWS1hQAAAABA"]
[Sat Jul 18 23:25:37.298946 2026] [security2:error] [pid 881201:tid 881348] [client 223.185.61.63:9102] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxf0QWL-zKlchkVWS1hQAAAABA"]
[Sat Jul 18 23:25:37.461144 2026] [security2:error] [pid 882519:tid 882727] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "alxf0aL84xJUTmx6eO7DeQAAANM"]
[Sat Jul 18 23:25:37.461250 2026] [security2:error] [pid 882519:tid 882727] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "alxf0aL84xJUTmx6eO7DeQAAANM"]
[Sat Jul 18 23:25:37.834987 2026] [security2:error] [pid 882519:tid 882685] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/cgi-bin/admin.php"] [unique_id "alxf0aL84xJUTmx6eO7DkgAAAKk"]
[Sat Jul 18 23:25:37.835090 2026] [security2:error] [pid 882519:tid 882685] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/cgi-bin/admin.php"] [unique_id "alxf0aL84xJUTmx6eO7DkgAAAKk"]
[Sat Jul 18 23:25:38.217577 2026] [security2:error] [pid 881201:tid 881356] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-content/BypassBest.php"] [unique_id "alxf0gWL-zKlchkVWS1hVAAAABg"]
[Sat Jul 18 23:25:38.217680 2026] [security2:error] [pid 881201:tid 881356] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-content/BypassBest.php"] [unique_id "alxf0gWL-zKlchkVWS1hVAAAABg"]
[Sat Jul 18 23:25:38.441264 2026] [security2:error] [pid 882519:tid 882692] [client 45.82.197.234:12352] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "lifeisbetterlakeside.com"] [uri "/index.php"] [unique_id "alxf0qL84xJUTmx6eO7DqgAAsC8"]
[Sat Jul 18 23:25:38.570649 2026] [proxy:error] [pid 881201:tid 881446] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:38.570713 2026] [proxy_http:error] [pid 881201:tid 881446] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:38.571322 2026] [proxy:error] [pid 881201:tid 881446] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:38.571357 2026] [proxy_http:error] [pid 881201:tid 881446] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:38.571444 2026] [security2:error] [pid 881201:tid 881446] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxf0gWL-zKlchkVWS1hXwAAAHI"]
[Sat Jul 18 23:25:38.649216 2026] [security2:error] [pid 882519:tid 882570] [remote 102.134.101.35:41110] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 35.101.134.102.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxf0qL84xJUTmx6eO7DuwAA3TI"]
[Sat Jul 18 23:25:38.649421 2026] [security2:error] [pid 882519:tid 882737] [client 102.134.101.35:41110] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxf0qL84xJUTmx6eO7DuwAA3TI"]
[Sat Jul 18 23:25:38.972963 2026] [security2:error] [pid 882519:tid 882656] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/simple.php"] [unique_id "alxf0qL84xJUTmx6eO7D0gAAAIw"]
[Sat Jul 18 23:25:38.973121 2026] [security2:error] [pid 882519:tid 882656] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/simple.php"] [unique_id "alxf0qL84xJUTmx6eO7D0gAAAIw"]
[Sat Jul 18 23:25:39.343710 2026] [security2:error] [pid 882519:tid 882768] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/xxx.php"] [unique_id "alxf06L84xJUTmx6eO7D3QAAAPw"]
[Sat Jul 18 23:25:39.343820 2026] [security2:error] [pid 882519:tid 882768] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/xxx.php"] [unique_id "alxf06L84xJUTmx6eO7D3QAAAPw"]
[Sat Jul 18 23:25:39.733162 2026] [security2:error] [pid 882519:tid 882756] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/hypo.php"] [unique_id "alxf06L84xJUTmx6eO7D9gAAAPA"]
[Sat Jul 18 23:25:39.733300 2026] [security2:error] [pid 882519:tid 882756] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/hypo.php"] [unique_id "alxf06L84xJUTmx6eO7D9gAAAPA"]
[Sat Jul 18 23:25:39.734008 2026] [security2:error] [pid 882519:tid 882665] [client 185.8.106.147:43004] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "cira.org"] [uri "/index.php"] [unique_id "alxf0aL84xJUTmx6eO7DigAAlRg"]
[Sat Jul 18 23:25:40.086682 2026] [proxy:error] [pid 882519:tid 882746] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:40.086758 2026] [proxy_http:error] [pid 882519:tid 882746] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:40.087181 2026] [proxy:error] [pid 882519:tid 882746] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:40.087211 2026] [proxy_http:error] [pid 882519:tid 882746] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:40.087285 2026] [security2:error] [pid 882519:tid 882746] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxf1KL84xJUTmx6eO7ECQAAAOY"]
[Sat Jul 18 23:25:40.330038 2026] [security2:error] [pid 882519:tid 882663] [client 124.29.246.106:46609] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxf1KL84xJUTmx6eO7EEgAAAJM"]
[Sat Jul 18 23:25:40.330247 2026] [security2:error] [pid 882519:tid 882663] [client 124.29.246.106:46609] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxf1KL84xJUTmx6eO7EEgAAAJM"]
[Sat Jul 18 23:25:40.446890 2026] [security2:error] [pid 882519:tid 882681] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/chosen.php"] [unique_id "alxf1KL84xJUTmx6eO7EGgAAAKU"]
[Sat Jul 18 23:25:40.446978 2026] [security2:error] [pid 882519:tid 882681] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/chosen.php"] [unique_id "alxf1KL84xJUTmx6eO7EGgAAAKU"]
[Sat Jul 18 23:25:40.544647 2026] [security2:error] [pid 882519:tid 882559] [remote 128.199.203.39:49594] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 39.203.199.128.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-login.php"] [unique_id "alxf1KL84xJUTmx6eO7EHQABACc"]
[Sat Jul 18 23:25:40.819293 2026] [proxy:error] [pid 882519:tid 882748] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:40.819361 2026] [proxy_http:error] [pid 882519:tid 882748] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:40.820180 2026] [proxy:error] [pid 882519:tid 882748] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:25:40.820219 2026] [proxy_http:error] [pid 882519:tid 882748] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:25:40.820324 2026] [security2:error] [pid 882519:tid 882748] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxf1KL84xJUTmx6eO7EKgAAAOg"]
[Sat Jul 18 23:25:40.925424 2026] [security2:error] [pid 882519:tid 882595] [remote 128.199.203.39:49594] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 39.203.199.128.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-login.php"] [unique_id "alxf1KL84xJUTmx6eO7ELQABBEs"], referer: https://samdothan.org/wp-login.php
[Sat Jul 18 23:25:41.448063 2026] [security2:error] [pid 881201:tid 881375] [client 185.192.71.201:58629] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/ms-themes.php"] [unique_id "alxf1QWL-zKlchkVWS1hnwAAACs"]
[Sat Jul 18 23:25:41.724139 2026] [security2:error] [pid 881201:tid 881305] [remote 31.42.184.154:39330] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxf1QWL-zKlchkVWS1hpgAAdmY"]
[Sat Jul 18 23:25:41.730001 2026] [security2:error] [pid 882519:tid 882728] [client 185.92.25.132:47461] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/chosen.php"] [unique_id "alxf1aL84xJUTmx6eO7ESwAAANQ"]
[Sat Jul 18 23:25:41.850547 2026] [security2:error] [pid 881201:tid 881386] [client 65.111.21.252:37865] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 252.21.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxf1QWL-zKlchkVWS1hqAAAADY"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:25:41.954263 2026] [security2:error] [pid 881201:tid 881228] [remote 31.42.184.154:39330] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxf1QWL-zKlchkVWS1hqQAAURk"], referer: https://sesamegreenbeans.com/wp-login.php
[Sat Jul 18 23:25:41.995804 2026] [security2:error] [pid 882519:tid 882629] [remote 68.178.160.25:35336] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "myspineworld.com"] [uri "/wp-login.php"] [unique_id "alxf1aL84xJUTmx6eO7EUwAAm20"]
[Sat Jul 18 23:25:42.150743 2026] [security2:error] [pid 881201:tid 881453] [client 119.154.81.234:57649] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxf1gWL-zKlchkVWS1hswAAAHk"]
[Sat Jul 18 23:25:42.150924 2026] [security2:error] [pid 881201:tid 881453] [client 119.154.81.234:57649] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxf1gWL-zKlchkVWS1hswAAAHk"]
[Sat Jul 18 23:25:42.417359 2026] [security2:error] [pid 881201:tid 881418] [client 106.222.249.209:18979] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxf1gWL-zKlchkVWS1huAAAAFY"]
[Sat Jul 18 23:25:42.417521 2026] [security2:error] [pid 881201:tid 881418] [client 106.222.249.209:18979] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxf1gWL-zKlchkVWS1huAAAAFY"]
[Sat Jul 18 23:25:42.451919 2026] [security2:error] [pid 881201:tid 881342] [client 104.207.49.134:45359] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 134.49.207.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxf1gWL-zKlchkVWS1huQAAAAo"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:25:43.043556 2026] [security2:error] [pid 882519:tid 882716] [client 45.3.45.207:33203] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 207.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxf16L84xJUTmx6eO7EbwAAAMg"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:25:43.087743 2026] [security2:error] [pid 882519:tid 882680] [client 91.230.225.147:61277] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/file.php"] [unique_id "alxf16L84xJUTmx6eO7EdAAAAKQ"]
[Sat Jul 18 23:25:43.373456 2026] [security2:error] [pid 882519:tid 882683] [client 185.192.71.198:40801] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/flower.php"] [unique_id "alxf16L84xJUTmx6eO7EggAAAKc"]
[Sat Jul 18 23:25:43.684558 2026] [security2:error] [pid 882519:tid 882721] [client 104.207.58.75:11119] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.58.207.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxf16L84xJUTmx6eO7EkQAAAM0"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:25:43.693886 2026] [security2:error] [pid 882519:tid 882734] [client 91.230.225.135:48623] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/gifclass.php"] [unique_id "alxf16L84xJUTmx6eO7EkgAAANo"]
[Sat Jul 18 23:25:43.981475 2026] [security2:error] [pid 881201:tid 881448] [client 185.192.71.186:39747] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/bless.php"] [unique_id "alxf1wWL-zKlchkVWS1h4AAAAHQ"]
[Sat Jul 18 23:25:44.205276 2026] [security2:error] [pid 882519:tid 882702] [client 18.195.15.81:29086] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 81.15.195.18.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxf2KL84xJUTmx6eO7EuAAAALo"]
[Sat Jul 18 23:25:44.265034 2026] [security2:error] [pid 882519:tid 882663] [client 185.192.71.198:32215] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/class-t.api.php"] [unique_id "alxf2KL84xJUTmx6eO7EuwAAAJM"]
[Sat Jul 18 23:25:44.315561 2026] [security2:error] [pid 882519:tid 882690] [client 65.111.28.179:51061] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 179.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxf2KL84xJUTmx6eO7EvQAAAK4"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:25:44.550336 2026] [security2:error] [pid 882519:tid 882667] [client 185.192.71.202:64155] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/blurbs.php"] [unique_id "alxf2KL84xJUTmx6eO7ExwAAAJc"]
[Sat Jul 18 23:25:44.780148 2026] [security2:error] [pid 882519:tid 882651] [client 163.61.1.17:59344] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxf2KL84xJUTmx6eO7E0gAAAIc"]
[Sat Jul 18 23:25:44.780349 2026] [security2:error] [pid 882519:tid 882651] [client 163.61.1.17:59344] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxf2KL84xJUTmx6eO7E0gAAAIc"]
[Sat Jul 18 23:25:44.821568 2026] [security2:error] [pid 882519:tid 882527] [remote 68.178.160.25:35336] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "myspineworld.com"] [uri "/wp-login.php"] [unique_id "alxf2KL84xJUTmx6eO7E2QAA0gc"], referer: https://myspineworld.com/wp-login.php
[Sat Jul 18 23:25:44.858432 2026] [security2:error] [pid 882519:tid 882662] [client 91.230.225.146:62147] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/akcc.php"] [unique_id "alxf2KL84xJUTmx6eO7E2gAAAJI"]
[Sat Jul 18 23:25:44.945977 2026] [security2:error] [pid 881201:tid 881407] [client 104.207.54.124:25343] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 124.54.207.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxf2AWL-zKlchkVWS1h_AAAAEs"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:25:44.998787 2026] [security2:error] [pid 881201:tid 881299] [remote 60.205.8.163:38082] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.8.205.60.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "wgs.doq.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxf2AWL-zKlchkVWS1h_QAAFWA"]
[Sat Jul 18 23:25:45.048515 2026] [security2:error] [pid 882519:tid 882740] [client 18.195.15.81:29096] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 81.15.195.18.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxf2aL84xJUTmx6eO7E4QAAAOA"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:25:45.150331 2026] [security2:error] [pid 882519:tid 882719] [client 185.92.25.69:37141] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/abcd.php"] [unique_id "alxf2aL84xJUTmx6eO7E5wAAAMs"]
[Sat Jul 18 23:25:45.386938 2026] [security2:error] [pid 882519:tid 882650] [client 3.109.49.224:56038] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "200"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxf16L84xJUTmx6eO7EnQAAAIY"]
[Sat Jul 18 23:25:45.432266 2026] [security2:error] [pid 882519:tid 882697] [client 185.92.25.75:47899] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/shelp.php"] [unique_id "alxf2aL84xJUTmx6eO7E7wAAALU"]
[Sat Jul 18 23:25:45.752383 2026] [security2:error] [pid 882519:tid 882703] [client 45.3.45.126:35685] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 126.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxf2aL84xJUTmx6eO7FAAAAALs"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:25:46.112536 2026] [security2:error] [pid 882519:tid 882660] [client 190.245.146.99:58663] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxf2qL84xJUTmx6eO7FCAAAAJA"]
[Sat Jul 18 23:25:46.112633 2026] [security2:error] [pid 882519:tid 882660] [client 190.245.146.99:58663] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxf2qL84xJUTmx6eO7FCAAAAJA"]
[Sat Jul 18 23:25:46.372272 2026] [security2:error] [pid 881201:tid 881440] [client 65.111.28.58:55783] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxf2gWL-zKlchkVWS1iRgAAAGw"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:25:46.489216 2026] [security2:error] [pid 881201:tid 881242] [remote 60.205.8.163:38082] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.8.205.60.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "wgs.doq.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxf2gWL-zKlchkVWS1iSQAATSc"], referer: https://wgs.doq.mybluehost.me/wp-login.php
[Sat Jul 18 23:25:46.612616 2026] [security2:error] [pid 882519:tid 882713] [client 65.111.28.188:45587] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 188.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxf2qL84xJUTmx6eO7FGQAAAMU"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:25:46.745562 2026] [security2:error] [pid 882519:tid 882767] [client 91.230.225.142:21629] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/cord.php"] [unique_id "alxf2qL84xJUTmx6eO7FIQAAAPs"]
[Sat Jul 18 23:25:46.762133 2026] [security2:error] [pid 881201:tid 881369] [client 57.141.18.121:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxf2gWL-zKlchkVWS1iUwAAACU"]
[Sat Jul 18 23:25:47.040855 2026] [security2:error] [pid 882519:tid 882671] [client 185.92.25.72:57233] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/dex.php"] [unique_id "alxf26L84xJUTmx6eO7FOAAAAJs"]
[Sat Jul 18 23:25:47.046670 2026] [security2:error] [pid 881201:tid 881404] [client 65.111.28.13:16089] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxf2wWL-zKlchkVWS1iWwAAAEg"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:25:47.262802 2026] [security2:error] [pid 882519:tid 882566] [remote 31.42.184.154:39346] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxf26L84xJUTmx6eO7FQAAA8i4"]
[Sat Jul 18 23:25:47.322524 2026] [security2:error] [pid 882519:tid 882691] [client 185.92.25.74:31867] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxf26L84xJUTmx6eO7FSwAAAK8"]
[Sat Jul 18 23:25:47.342842 2026] [security2:error] [pid 881201:tid 881386] [client 223.228.182.224:30664] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxf2wWL-zKlchkVWS1ibgAAADY"]
[Sat Jul 18 23:25:47.342930 2026] [security2:error] [pid 881201:tid 881386] [client 223.228.182.224:30664] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxf2wWL-zKlchkVWS1ibgAAADY"]
[Sat Jul 18 23:25:47.411080 2026] [security2:error] [pid 882519:tid 882728] [client 27.34.68.67:55729] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxf26L84xJUTmx6eO7FVAAAANQ"]
[Sat Jul 18 23:25:47.411197 2026] [security2:error] [pid 882519:tid 882728] [client 27.34.68.67:55729] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxf26L84xJUTmx6eO7FVAAAANQ"]
[Sat Jul 18 23:25:47.504966 2026] [security2:error] [pid 882519:tid 882579] [remote 31.42.184.154:39346] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxf26L84xJUTmx6eO7FVwAAvTs"], referer: https://sesamegreenbeans.com/wp-login.php
[Sat Jul 18 23:25:47.601110 2026] [security2:error] [pid 882519:tid 882708] [client 185.192.71.192:49751] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/zwso.php"] [unique_id "alxf26L84xJUTmx6eO7FXAAAAMA"]
[Sat Jul 18 23:25:47.882569 2026] [security2:error] [pid 882519:tid 882704] [client 185.192.71.193:38483] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxf26L84xJUTmx6eO7FagAAALw"]
[Sat Jul 18 23:25:47.954481 2026] [security2:error] [pid 882519:tid 882774] [client 142.111.150.140:37329] ModSecurity: Access denied with code 406 (phase 1). Pattern match "python-requests|python-urllib" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "1460"] [id "909111"] [msg "Python UA brute"] [hostname "mail.hfa.jru.mybluehost.me"] [uri "/"] [unique_id "alxf26L84xJUTmx6eO7FbgAAAQI"]
[Sat Jul 18 23:25:47.983057 2026] [security2:error] [pid 882519:tid 882735] [client 113.160.97.242:64267] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxf26L84xJUTmx6eO7FcgAAANs"]
[Sat Jul 18 23:25:48.008485 2026] [security2:error] [pid 882519:tid 882650] [client 223.185.61.63:6736] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxf3KL84xJUTmx6eO7FcwAAAIY"]
[Sat Jul 18 23:25:48.017873 2026] [security2:error] [pid 882519:tid 882650] [client 223.185.61.63:6736] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxf3KL84xJUTmx6eO7FcwAAAIY"]
[Sat Jul 18 23:25:48.242335 2026] [security2:error] [pid 881201:tid 881361] [client 185.92.25.64:64591] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/bolt.php"] [unique_id "alxf3AWL-zKlchkVWS1ifAAAAB0"]
[Sat Jul 18 23:25:48.572872 2026] [security2:error] [pid 882519:tid 882674] [client 185.92.25.78:46023] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/cjfuns.php"] [unique_id "alxf3KL84xJUTmx6eO7FiQAAAJ4"]
[Sat Jul 18 23:25:48.573426 2026] [security2:error] [pid 882519:tid 882772] [client 65.111.27.108:25917] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.27.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxf3KL84xJUTmx6eO7FhwAAAQA"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:25:48.860476 2026] [security2:error] [pid 881201:tid 881440] [client 185.192.71.195:24271] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/wp-admin/css/index.php"] [unique_id "alxf3AWL-zKlchkVWS1ijgAAAGw"]
[Sat Jul 18 23:25:49.011970 2026] [security2:error] [pid 882519:tid 882766] [client 85.204.70.92:37274] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "mail.maxenengineering.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "alxf3aL84xJUTmx6eO7FngAAAPo"]
[Sat Jul 18 23:25:49.150342 2026] [security2:error] [pid 882519:tid 882720] [client 91.230.225.146:34363] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/wp-content/plugins/index.php"] [unique_id "alxf3aL84xJUTmx6eO7FqQAAAMw"]
[Sat Jul 18 23:25:49.183145 2026] [security2:error] [pid 882519:tid 882676] [client 104.207.54.116:56257] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 116.54.207.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxf3aL84xJUTmx6eO7FqgAAAKA"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:25:49.473382 2026] [security2:error] [pid 882519:tid 882694] [client 91.230.225.138:30071] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/wp-content/index.php"] [unique_id "alxf3aL84xJUTmx6eO7FtwAAALI"]
[Sat Jul 18 23:25:49.548182 2026] [security2:error] [pid 882519:tid 882710] [client 85.204.70.112:43066] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "www.guidehunting.com"] [uri "/.well-knownold/"] [unique_id "alxf3aL84xJUTmx6eO7FuwAAAMI"]
[Sat Jul 18 23:25:49.755451 2026] [security2:error] [pid 882519:tid 882679] [client 185.192.71.186:35495] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/ioxi-o.php"] [unique_id "alxf3aL84xJUTmx6eO7FwgAAAKM"]
[Sat Jul 18 23:25:50.033949 2026] [security2:error] [pid 881201:tid 881378] [client 185.192.71.196:20741] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/insc.php"] [unique_id "alxf3gWL-zKlchkVWS1ipAAAAC4"]
[Sat Jul 18 23:25:50.239079 2026] [security2:error] [pid 882519:tid 882705] [client 85.204.70.92:37282] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.70.204.85.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.maxenengineering.com"] [uri "/xmlrpc.php"] [unique_id "alxf3qL84xJUTmx6eO7F2wAAAL0"]
[Sat Jul 18 23:25:50.340056 2026] [security2:error] [pid 881201:tid 881386] [client 91.230.225.149:34841] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/classwithtostring.php"] [unique_id "alxf3gWL-zKlchkVWS1iqgAAADY"]
[Sat Jul 18 23:25:50.691043 2026] [security2:error] [pid 882519:tid 882653] [client 185.92.25.75:30323] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/txets.php"] [unique_id "alxf3qL84xJUTmx6eO7F8QAAAIk"]
[Sat Jul 18 23:25:50.818213 2026] [security2:error] [pid 882519:tid 882686] [client 209.127.138.216:47561] ModSecurity: Access denied with code 406 (phase 1). Pattern match "python-requests|python-urllib" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "1460"] [id "909111"] [msg "Python UA brute"] [hostname "mail.hfa.jru.mybluehost.me"] [uri "/"] [unique_id "alxf3qL84xJUTmx6eO7F-QAAAKo"]
[Sat Jul 18 23:25:51.013607 2026] [security2:error] [pid 882519:tid 882662] [client 185.92.25.75:23753] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/wp-content/themes/txets.php"] [unique_id "alxf36L84xJUTmx6eO7GAwAAAJI"]
[Sat Jul 18 23:25:52.083576 2026] [security2:error] [pid 882519:tid 882765] [client 52.201.135.180:0] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "curlsnpearlsss.com"] [uri "/index.php"] [unique_id "alxf36L84xJUTmx6eO7GIgAAAPk"]
[Sat Jul 18 23:25:52.085152 2026] [security2:error] [pid 882519:tid 882755] [client 52.201.135.180:10394] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "curlsnpearlsss.com"] [uri "/category/food/dinners"] [unique_id "alxf36L84xJUTmx6eO7GHwAAAO8"]
[Sat Jul 18 23:25:52.161230 2026] [security2:error] [pid 882519:tid 882770] [client 3.108.60.216:12084] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxf4KL84xJUTmx6eO7GNQAAAP4"]
[Sat Jul 18 23:25:52.203907 2026] [security2:error] [pid 882519:tid 882651] [client 85.204.70.92:37298] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "mail.maxenengineering.com"] [uri "/blog/wp-includes/wlwmanifest.xml"] [unique_id "alxf4KL84xJUTmx6eO7GNwAAAIc"]
[Sat Jul 18 23:25:52.415604 2026] [security2:error] [pid 882519:tid 882724] [client 89.124.123.14:60260] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "suretybonds-california.com"] [uri "/wp-comments-post.php"] [unique_id "alxf4KL84xJUTmx6eO7GQQAAANA"], referer: http://suretybonds-california.com/esop-employee-stock-ownership-plan/
[Sat Jul 18 23:25:52.442184 2026] [security2:error] [pid 882519:tid 882699] [client 65.0.26.70:33708] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.26.0.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxf4KL84xJUTmx6eO7GRgAAALc"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:25:52.481852 2026] [security2:error] [pid 881201:tid 881419] [client 185.192.71.200:61497] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/wp-admin/txets.php"] [unique_id "alxf4AWL-zKlchkVWS1ixwAAAFc"]
[Sat Jul 18 23:25:52.568175 2026] [security2:error] [pid 882519:tid 882724] [client 89.124.123.14:60260] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "302"] [hostname "suretybonds-california.com"] [uri "/wp-comments-post.php"] [unique_id "alxf4KL84xJUTmx6eO7GQQAAANA"], referer: http://suretybonds-california.com/esop-employee-stock-ownership-plan/
[Sat Jul 18 23:25:52.568226 2026] [security2:error] [pid 882519:tid 882724] [client 89.124.123.14:60260] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "suretybonds-california.com"] [uri "/wp-comments-post.php"] [unique_id "alxf4KL84xJUTmx6eO7GQQAAANA"], referer: http://suretybonds-california.com/esop-employee-stock-ownership-plan/
[Sat Jul 18 23:25:52.761571 2026] [security2:error] [pid 882519:tid 882705] [client 185.92.25.72:57575] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/wp-includes/txets.php"] [unique_id "alxf4KL84xJUTmx6eO7GWwAAAL0"]
[Sat Jul 18 23:25:52.764213 2026] [security2:error] [pid 881201:tid 881397] [client 119.154.81.234:58105] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxf4AWL-zKlchkVWS1iywAAAEE"]
[Sat Jul 18 23:25:52.764311 2026] [security2:error] [pid 881201:tid 881397] [client 119.154.81.234:58105] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxf4AWL-zKlchkVWS1iywAAAEE"]
[Sat Jul 18 23:25:53.010013 2026] [security2:error] [pid 882519:tid 882703] [client 54.85.69.47:0] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "curlsnpearlsss.com"] [uri "/index.php"] [unique_id "alxf4KL84xJUTmx6eO7GPwAAALs"]
[Sat Jul 18 23:25:53.062344 2026] [security2:error] [pid 882519:tid 882722] [client 54.85.69.47:41546] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "curlsnpearlsss.com"] [uri "/category/food/dinners/"] [unique_id "alxf4KL84xJUTmx6eO7GPQAAAM4"]
[Sat Jul 18 23:25:53.094388 2026] [security2:error] [pid 881201:tid 881360] [client 185.92.25.78:36345] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/goods.php"] [unique_id "alxf4QWL-zKlchkVWS1izgAAABw"]
[Sat Jul 18 23:25:53.153223 2026] [security2:error] [pid 882519:tid 882698] [client 65.0.26.70:33716] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.26.0.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxf4aL84xJUTmx6eO7GagAAALY"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:25:53.157870 2026] [security2:error] [pid 882519:tid 882761] [client 106.222.249.209:29307] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxf4aL84xJUTmx6eO7GbAAAAPU"]
[Sat Jul 18 23:25:53.158285 2026] [security2:error] [pid 882519:tid 882761] [client 106.222.249.209:29307] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxf4aL84xJUTmx6eO7GbAAAAPU"]
[Sat Jul 18 23:25:53.402490 2026] [security2:error] [pid 882519:tid 882723] [client 185.92.25.132:40909] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/wp-editor.php"] [unique_id "alxf4aL84xJUTmx6eO7GeQAAAM8"]
[Sat Jul 18 23:25:53.649742 2026] [security2:error] [pid 882519:tid 882699] [client 220.181.108.147:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "mollycahill.com"] [uri "/index.php"] [unique_id "alxf4aL84xJUTmx6eO7GdQAAALc"]
[Sat Jul 18 23:25:53.745164 2026] [security2:error] [pid 882519:tid 882659] [client 85.204.70.92:37314] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "mail.maxenengineering.com"] [uri "/web/wp-includes/wlwmanifest.xml"] [unique_id "alxf4aL84xJUTmx6eO7GiwAAAI8"]
[Sat Jul 18 23:25:53.894872 2026] [security2:error] [pid 881201:tid 881423] [client 185.192.71.188:53527] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/lufix.php"] [unique_id "alxf4QWL-zKlchkVWS1i3AAAAFs"]
[Sat Jul 18 23:25:54.426189 2026] [security2:error] [pid 882519:tid 882732] [client 223.228.182.224:24654] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxf4qL84xJUTmx6eO7GowAAANg"]
[Sat Jul 18 23:25:54.430425 2026] [security2:error] [pid 882519:tid 882732] [client 223.228.182.224:24654] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxf4qL84xJUTmx6eO7GowAAANg"]
[Sat Jul 18 23:25:55.036990 2026] [security2:error] [pid 881201:tid 881452] [client 85.204.70.92:36640] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "mail.maxenengineering.com"] [uri "/website/wp-includes/wlwmanifest.xml"] [unique_id "alxf4wWL-zKlchkVWS1i9AAAAHg"]
[Sat Jul 18 23:25:55.067586 2026] [security2:error] [pid 882519:tid 882766] [client 163.61.1.17:59846] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxf46L84xJUTmx6eO7GugAAAPo"]
[Sat Jul 18 23:25:55.067691 2026] [security2:error] [pid 882519:tid 882766] [client 163.61.1.17:59846] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxf46L84xJUTmx6eO7GugAAAPo"]
[Sat Jul 18 23:25:55.278085 2026] [security2:error] [pid 881201:tid 881414] [client 185.92.25.65:23565] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lzk.wao.mybluehost.me"] [uri "/style.php"] [unique_id "alxf4wWL-zKlchkVWS1i-AAAAFI"]
[Sat Jul 18 23:25:55.502732 2026] [security2:error] [pid 882519:tid 882624] [remote 41.186.86.12:5453] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxf46L84xJUTmx6eO7GzQAAzWg"]
[Sat Jul 18 23:25:56.009267 2026] [security2:error] [pid 882519:tid 882615] [remote 41.186.86.12:5453] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxf5KL84xJUTmx6eO7G6gAAyF8"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:25:56.089876 2026] [security2:error] [pid 882519:tid 882746] [client 216.73.216.59:6701] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.vfcthomasville.org"] [uri "/index.php"] [unique_id "alxf46L84xJUTmx6eO7GvwAA5k8"]
[Sat Jul 18 23:25:56.235629 2026] [security2:error] [pid 882519:tid 882744] [client 85.204.70.92:36652] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "mail.maxenengineering.com"] [uri "/wp/wp-includes/wlwmanifest.xml"] [unique_id "alxf5KL84xJUTmx6eO7G9AAAAOQ"]
[Sat Jul 18 23:25:56.664297 2026] [security2:error] [pid 882519:tid 882667] [client 190.245.146.99:59187] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxf5KL84xJUTmx6eO7HEAAAAJc"]
[Sat Jul 18 23:25:56.669286 2026] [security2:error] [pid 882519:tid 882667] [client 190.245.146.99:59187] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxf5KL84xJUTmx6eO7HEAAAAJc"]
[Sat Jul 18 23:25:57.486087 2026] [security2:error] [pid 881201:tid 881208] [remote 31.42.184.154:35994] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.idf.ldc.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxf5QWL-zKlchkVWS1jJQAAIwU"]
[Sat Jul 18 23:25:57.508099 2026] [security2:error] [pid 881201:tid 881358] [client 85.204.70.92:36658] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "mail.maxenengineering.com"] [uri "/news/wp-includes/wlwmanifest.xml"] [unique_id "alxf5QWL-zKlchkVWS1jJgAAABo"]
[Sat Jul 18 23:25:57.681149 2026] [security2:error] [pid 881201:tid 881252] [remote 31.42.184.154:35988] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxf5QWL-zKlchkVWS1jKQAAYzE"]
[Sat Jul 18 23:25:57.704805 2026] [security2:error] [pid 881201:tid 881217] [remote 31.42.184.154:35994] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.idf.ldc.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxf5QWL-zKlchkVWS1jKgAAUw4"], referer: https://mail.idf.ldc.mybluehost.me/wp-login.php
[Sat Jul 18 23:25:57.956544 2026] [security2:error] [pid 881201:tid 881426] [client 45.3.45.198:36307] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 198.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxf5QWL-zKlchkVWS1jMAAAAF4"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:25:57.961624 2026] [security2:error] [pid 881201:tid 881276] [remote 31.42.184.154:35988] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxf5QWL-zKlchkVWS1jMQAAZ0k"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:25:57.970251 2026] [security2:error] [pid 882519:tid 882765] [client 27.34.68.67:4951] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxf5aL84xJUTmx6eO7HPQAAAPk"]
[Sat Jul 18 23:25:57.970346 2026] [security2:error] [pid 882519:tid 882765] [client 27.34.68.67:4951] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxf5aL84xJUTmx6eO7HPQAAAPk"]
[Sat Jul 18 23:25:58.553607 2026] [security2:error] [pid 882519:tid 882535] [remote 142.93.10.93:35534] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 93.10.93.142.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxf5qL84xJUTmx6eO7HTAAA1Q8"]
[Sat Jul 18 23:25:58.614087 2026] [security2:error] [pid 882519:tid 882756] [client 223.185.61.63:14570] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxf5qL84xJUTmx6eO7HTgAAAPA"]
[Sat Jul 18 23:25:58.614197 2026] [security2:error] [pid 882519:tid 882756] [client 223.185.61.63:14570] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxf5qL84xJUTmx6eO7HTgAAAPA"]
[Sat Jul 18 23:25:58.825111 2026] [security2:error] [pid 882519:tid 882762] [client 85.204.70.92:36668] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "mail.maxenengineering.com"] [uri "/2018/wp-includes/wlwmanifest.xml"] [unique_id "alxf5qL84xJUTmx6eO7HWwAAAPY"]
[Sat Jul 18 23:25:59.386493 2026] [security2:error] [pid 882519:tid 882681] [client 65.111.28.195:51623] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 195.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxf56L84xJUTmx6eO7HcwAAAKU"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:25:59.842180 2026] [security2:error] [pid 882519:tid 882726] [client 45.3.45.140:15191] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 140.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxf56L84xJUTmx6eO7HgwAAANI"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:26:00.105667 2026] [security2:error] [pid 882519:tid 882655] [client 85.204.70.92:36672] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "mail.maxenengineering.com"] [uri "/2019/wp-includes/wlwmanifest.xml"] [unique_id "alxf6KL84xJUTmx6eO7HlQAAAIs"]
[Sat Jul 18 23:26:00.508145 2026] [security2:error] [pid 882519:tid 882695] [client 104.207.61.248:44939] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.61.207.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxf6KL84xJUTmx6eO7HqwAAALM"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:26:00.923670 2026] [security2:error] [pid 882519:tid 882730] [client 5.77.203.70:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxf6KL84xJUTmx6eO7HsgAAANY"]
[Sat Jul 18 23:26:01.256013 2026] [security2:error] [pid 882519:tid 882675] [client 34.90.69.83:49152] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "www.thesoloceos.com"] [uri "/"] [unique_id "alxf6aL84xJUTmx6eO7HyQAAAJ8"], referer: https://soloceosummit.com/
[Sat Jul 18 23:26:01.256096 2026] [security2:error] [pid 882519:tid 882675] [client 34.90.69.83:49152] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "www.thesoloceos.com"] [uri "/"] [unique_id "alxf6aL84xJUTmx6eO7HyQAAAJ8"], referer: https://soloceosummit.com/
[Sat Jul 18 23:26:01.414745 2026] [security2:error] [pid 882519:tid 882759] [client 85.204.70.92:36678] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "mail.maxenengineering.com"] [uri "/shop/wp-includes/wlwmanifest.xml"] [unique_id "alxf6aL84xJUTmx6eO7H1AAAAPM"]
[Sat Jul 18 23:26:01.904151 2026] [security2:error] [pid 882519:tid 882709] [client 74.7.227.179:55048] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxf6aL84xJUTmx6eO7H7AAAwRc"], referer: https://tejasenvironmental.com/p=445429
[Sat Jul 18 23:26:02.186146 2026] [security2:error] [pid 882519:tid 882583] [remote 142.93.10.93:35534] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 93.10.93.142.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxf6qL84xJUTmx6eO7ICAAA2j8"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:26:02.719623 2026] [security2:error] [pid 882519:tid 882743] [client 85.204.70.92:36694] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "mail.maxenengineering.com"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "alxf6qL84xJUTmx6eO7IGwAAAOM"]
[Sat Jul 18 23:26:02.956493 2026] [security2:error] [pid 882519:tid 882665] [client 74.7.244.31:0] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "302"] [hostname "russianlanguagetutor.com"] [uri "/robots.txt"] [unique_id "alxf6qL84xJUTmx6eO7IJAAAAJU"]
[Sat Jul 18 23:26:02.959467 2026] [security2:error] [pid 881201:tid 881363] [client 74.7.244.31:58172] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "302"] [hostname "russianlanguagetutor.com"] [uri "/robots.txt"] [unique_id "alxf6gWL-zKlchkVWS1jfwAAH04"]
[Sat Jul 18 23:26:03.085408 2026] [security2:error] [pid 882519:tid 882721] [client 74.7.244.31:0] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "russianlanguagetutor.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxf66L84xJUTmx6eO7IKAAAAM0"], referer: https://russianlanguagetutor.com/robots.txt
[Sat Jul 18 23:26:03.088151 2026] [security2:error] [pid 881201:tid 881370] [client 74.7.244.31:58172] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "russianlanguagetutor.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxf6wWL-zKlchkVWS1jggAAJmY"], referer: https://russianlanguagetutor.com/robots.txt
[Sat Jul 18 23:26:03.179118 2026] [security2:error] [pid 882519:tid 882597] [remote 102.134.101.35:36128] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 35.101.134.102.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sk-financial.com"] [uri "/wp-login.php"] [unique_id "alxf66L84xJUTmx6eO7IMwABBE0"]
[Sat Jul 18 23:26:03.322030 2026] [security2:error] [pid 882519:tid 882775] [client 119.154.81.234:58556] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxf66L84xJUTmx6eO7IOwAAAQM"]
[Sat Jul 18 23:26:03.322130 2026] [security2:error] [pid 882519:tid 882775] [client 119.154.81.234:58556] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxf66L84xJUTmx6eO7IOwAAAQM"]
[Sat Jul 18 23:26:03.654062 2026] [security2:error] [pid 882519:tid 882521] [remote 102.134.101.35:36128] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 35.101.134.102.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sk-financial.com"] [uri "/wp-login.php"] [unique_id "alxf66L84xJUTmx6eO7IVgAAywE"], referer: https://sk-financial.com/wp-login.php
[Sat Jul 18 23:26:03.721196 2026] [security2:error] [pid 881201:tid 881218] [remote 68.178.160.25:51454] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxf6wWL-zKlchkVWS1jjAAAMg8"]
[Sat Jul 18 23:26:03.721876 2026] [security2:error] [pid 882519:tid 882625] [remote 74.235.96.117:48620] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.235.74.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxf66L84xJUTmx6eO7IWwAAimk"]
[Sat Jul 18 23:26:03.767208 2026] [security2:error] [pid 882519:tid 882690] [client 106.222.249.209:14828] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxf66L84xJUTmx6eO7IXQAAAK4"]
[Sat Jul 18 23:26:03.767318 2026] [security2:error] [pid 882519:tid 882690] [client 106.222.249.209:14828] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxf66L84xJUTmx6eO7IXQAAAK4"]
[Sat Jul 18 23:26:03.818390 2026] [security2:error] [pid 882519:tid 882740] [client 85.204.70.92:36696] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "mail.maxenengineering.com"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "alxf66L84xJUTmx6eO7IXwAAAOA"]
[Sat Jul 18 23:26:03.897125 2026] [security2:error] [pid 882519:tid 882524] [remote 74.235.96.117:48620] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.235.74.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxf66L84xJUTmx6eO7IZAAA2QQ"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:26:05.024896 2026] [security2:error] [pid 882519:tid 882749] [client 85.204.70.92:44804] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "mail.maxenengineering.com"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "alxf7aL84xJUTmx6eO7ImAAAAOk"]
[Sat Jul 18 23:26:05.106276 2026] [security2:error] [pid 882519:tid 882676] [client 223.228.182.224:52516] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxf7aL84xJUTmx6eO7ImgAAAKA"]
[Sat Jul 18 23:26:05.106376 2026] [security2:error] [pid 882519:tid 882676] [client 223.228.182.224:52516] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxf7aL84xJUTmx6eO7ImgAAAKA"]
[Sat Jul 18 23:26:05.649373 2026] [security2:error] [pid 882519:tid 882698] [client 163.61.1.17:60456] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxf7aL84xJUTmx6eO7ItwAAALY"]
[Sat Jul 18 23:26:05.649523 2026] [security2:error] [pid 882519:tid 882698] [client 163.61.1.17:60456] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxf7aL84xJUTmx6eO7ItwAAALY"]
[Sat Jul 18 23:26:06.103570 2026] [security2:error] [pid 882519:tid 882706] [client 85.204.70.92:44810] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "mail.maxenengineering.com"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "alxf7qL84xJUTmx6eO7I0AAAAL4"]
[Sat Jul 18 23:26:06.313722 2026] [security2:error] [pid 882519:tid 882708] [client 57.141.18.34:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxf7qL84xJUTmx6eO7I0gAAAMA"]
[Sat Jul 18 23:26:07.013168 2026] [security2:error] [pid 882519:tid 882617] [remote 39.97.110.217:52554] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 217.110.97.39.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxf7qL84xJUTmx6eO7I_wAAtGE"]
[Sat Jul 18 23:26:07.159557 2026] [security2:error] [pid 881201:tid 881454] [client 190.245.146.99:59709] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxf7wWL-zKlchkVWS1jtwAAAHo"]
[Sat Jul 18 23:26:07.165894 2026] [security2:error] [pid 881201:tid 881454] [client 190.245.146.99:59709] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxf7wWL-zKlchkVWS1jtwAAAHo"]
[Sat Jul 18 23:26:07.228100 2026] [security2:error] [pid 882519:tid 882662] [client 85.204.70.92:44814] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "mail.maxenengineering.com"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "alxf76L84xJUTmx6eO7JBwAAAJI"]
[Sat Jul 18 23:26:07.309792 2026] [security2:error] [pid 882519:tid 882580] [remote 4.205.168.44:60344] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "oswegooperatheater.com"] [uri "/wp-login.php"] [unique_id "alxf76L84xJUTmx6eO7JDAAAoDw"]
[Sat Jul 18 23:26:07.454511 2026] [security2:error] [pid 882519:tid 882563] [remote 39.97.110.217:52554] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 217.110.97.39.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxf76L84xJUTmx6eO7JEwABAys"], referer: https://sesamegreenbeans.com/wp-login.php
[Sat Jul 18 23:26:07.456303 2026] [security2:error] [pid 882519:tid 882592] [remote 20.153.140.50:46880] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "test.koaconsultants.com"] [uri "/wp-login.php"] [unique_id "alxf76L84xJUTmx6eO7JFAAAqUg"]
[Sat Jul 18 23:26:07.627146 2026] [security2:error] [pid 882519:tid 882576] [remote 4.205.168.44:60344] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "oswegooperatheater.com"] [uri "/wp-login.php"] [unique_id "alxf76L84xJUTmx6eO7JGgAAmDg"], referer: https://oswegooperatheater.com/wp-login.php
[Sat Jul 18 23:26:07.765251 2026] [security2:error] [pid 881201:tid 881231] [remote 68.178.160.25:51454] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxf7wWL-zKlchkVWS1jyQAAABw"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:26:07.857462 2026] [security2:error] [pid 882519:tid 882633] [remote 20.153.140.50:46880] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "test.koaconsultants.com"] [uri "/wp-login.php"] [unique_id "alxf76L84xJUTmx6eO7JIQAAv3E"], referer: https://test.koaconsultants.com/wp-login.php
[Sat Jul 18 23:26:07.946283 2026] [security2:error] [pid 882519:tid 882717] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/file.php"] [unique_id "alxf76L84xJUTmx6eO7JJQAAAMk"]
[Sat Jul 18 23:26:07.946381 2026] [security2:error] [pid 882519:tid 882717] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/file.php"] [unique_id "alxf76L84xJUTmx6eO7JJQAAAMk"]
[Sat Jul 18 23:26:08.203192 2026] [security2:error] [pid 882519:tid 882745] [client 85.204.70.92:44828] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "mail.maxenengineering.com"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "alxf8KL84xJUTmx6eO7JKwAAAOU"]
[Sat Jul 18 23:26:08.301884 2026] [security2:error] [pid 881201:tid 881284] [remote 41.76.213.235:40380] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "taskidsvirginia.com"] [uri "/wp-login.php"] [unique_id "alxf8AWL-zKlchkVWS1j1QAAeFE"]
[Sat Jul 18 23:26:08.305664 2026] [security2:error] [pid 881201:tid 881391] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/aa2.php"] [unique_id "alxf8AWL-zKlchkVWS1j1gAAADs"]
[Sat Jul 18 23:26:08.305802 2026] [security2:error] [pid 881201:tid 881391] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/aa2.php"] [unique_id "alxf8AWL-zKlchkVWS1j1gAAADs"]
[Sat Jul 18 23:26:08.317661 2026] [security2:error] [pid 882519:tid 882595] [remote 31.42.184.154:55226] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "fbvrealtors.com"] [uri "/wp-login.php"] [unique_id "alxf8KL84xJUTmx6eO7JMAAAjEs"]
[Sat Jul 18 23:26:08.548479 2026] [security2:error] [pid 882519:tid 882750] [client 27.34.68.67:60426] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxf8KL84xJUTmx6eO7JOAAAAOo"]
[Sat Jul 18 23:26:08.548588 2026] [security2:error] [pid 882519:tid 882750] [client 27.34.68.67:60426] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxf8KL84xJUTmx6eO7JOAAAAOo"]
[Sat Jul 18 23:26:08.609247 2026] [security2:error] [pid 882519:tid 882598] [remote 31.42.184.154:55226] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "fbvrealtors.com"] [uri "/wp-login.php"] [unique_id "alxf8KL84xJUTmx6eO7JPAAA004"], referer: https://fbvrealtors.com/wp-login.php
[Sat Jul 18 23:26:08.660120 2026] [security2:error] [pid 881201:tid 881448] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/ccou.php"] [unique_id "alxf8AWL-zKlchkVWS1j5QAAAHQ"]
[Sat Jul 18 23:26:08.660249 2026] [security2:error] [pid 881201:tid 881448] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/ccou.php"] [unique_id "alxf8AWL-zKlchkVWS1j5QAAAHQ"]
[Sat Jul 18 23:26:08.782150 2026] [security2:error] [pid 881201:tid 881440] [client 57.141.18.54:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxf8AWL-zKlchkVWS1j4gAAAGw"]
[Sat Jul 18 23:26:08.837286 2026] [security2:error] [pid 881201:tid 881226] [remote 41.76.213.235:40380] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "taskidsvirginia.com"] [uri "/wp-login.php"] [unique_id "alxf8AWL-zKlchkVWS1j6QAAYRc"], referer: https://taskidsvirginia.com/wp-login.php
[Sat Jul 18 23:26:08.841807 2026] [security2:error] [pid 882519:tid 882624] [remote 91.142.222.105:50178] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxf8KL84xJUTmx6eO7JQgAA8Gg"]
[Sat Jul 18 23:26:09.023182 2026] [security2:error] [pid 881201:tid 881417] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/dr.php"] [unique_id "alxf8QWL-zKlchkVWS1j7QAAAFU"]
[Sat Jul 18 23:26:09.023294 2026] [security2:error] [pid 881201:tid 881417] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/dr.php"] [unique_id "alxf8QWL-zKlchkVWS1j7QAAAFU"]
[Sat Jul 18 23:26:09.193675 2026] [security2:error] [pid 881201:tid 881333] [client 223.185.61.63:3574] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxf8QWL-zKlchkVWS1j8gAAAAE"]
[Sat Jul 18 23:26:09.198401 2026] [security2:error] [pid 881201:tid 881333] [client 223.185.61.63:3574] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxf8QWL-zKlchkVWS1j8gAAAAE"]
[Sat Jul 18 23:26:09.242784 2026] [security2:error] [pid 882519:tid 882706] [client 23.230.213.46:34360] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.koaconsultants.com"] [uri "/index.php"] [unique_id "alxf76L84xJUTmx6eO7JGAAAAL4"]
[Sat Jul 18 23:26:09.433460 2026] [security2:error] [pid 882519:tid 882722] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/file31.php"] [unique_id "alxf8aL84xJUTmx6eO7JWgAAAM4"]
[Sat Jul 18 23:26:09.433573 2026] [security2:error] [pid 882519:tid 882722] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/file31.php"] [unique_id "alxf8aL84xJUTmx6eO7JWgAAAM4"]
[Sat Jul 18 23:26:09.434585 2026] [security2:error] [pid 881201:tid 881409] [client 85.204.70.92:44844] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "mail.maxenengineering.com"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "alxf8QWL-zKlchkVWS1j9QAAAE0"]
[Sat Jul 18 23:26:09.629865 2026] [security2:error] [pid 882519:tid 882599] [remote 199.189.225.167:31767] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.225.189.199.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxf8aL84xJUTmx6eO7JYQAAo08"]
[Sat Jul 18 23:26:09.787429 2026] [security2:error] [pid 882519:tid 882659] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/file6.php"] [unique_id "alxf8aL84xJUTmx6eO7JagAAAI8"]
[Sat Jul 18 23:26:09.787510 2026] [security2:error] [pid 882519:tid 882659] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/file6.php"] [unique_id "alxf8aL84xJUTmx6eO7JagAAAI8"]
[Sat Jul 18 23:26:09.923557 2026] [security2:error] [pid 882519:tid 882542] [remote 91.142.222.105:50178] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxf8aL84xJUTmx6eO7JbQAAphY"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:26:10.154194 2026] [security2:error] [pid 881201:tid 881256] [remote 68.178.160.25:50556] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mobilesurvsolutions.com"] [uri "/wp-login.php"] [unique_id "alxf8gWL-zKlchkVWS1kBQAACDU"]
[Sat Jul 18 23:26:10.195383 2026] [security2:error] [pid 882519:tid 882727] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/file15.php"] [unique_id "alxf8qL84xJUTmx6eO7JfAAAANM"]
[Sat Jul 18 23:26:10.195476 2026] [security2:error] [pid 882519:tid 882727] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/file15.php"] [unique_id "alxf8qL84xJUTmx6eO7JfAAAANM"]
[Sat Jul 18 23:26:10.227099 2026] [security2:error] [pid 882519:tid 882628] [remote 199.189.225.167:31767] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.225.189.199.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxf8qL84xJUTmx6eO7JfwAA5Gw"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:26:10.567799 2026] [security2:error] [pid 882519:tid 882693] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/jp.php"] [unique_id "alxf8qL84xJUTmx6eO7JiAAAALE"]
[Sat Jul 18 23:26:10.567895 2026] [security2:error] [pid 882519:tid 882693] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/jp.php"] [unique_id "alxf8qL84xJUTmx6eO7JiAAAALE"]
[Sat Jul 18 23:26:10.678265 2026] [security2:error] [pid 882519:tid 882773] [client 45.3.45.143:28967] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxf8qL84xJUTmx6eO7JjwAAAQE"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:26:10.919373 2026] [security2:error] [pid 881201:tid 881434] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/f35.php"] [unique_id "alxf8gWL-zKlchkVWS1kDgAAAGY"]
[Sat Jul 18 23:26:10.919467 2026] [security2:error] [pid 881201:tid 881434] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/f35.php"] [unique_id "alxf8gWL-zKlchkVWS1kDgAAAGY"]
[Sat Jul 18 23:26:11.247857 2026] [security2:error] [pid 881201:tid 881280] [remote 68.178.160.25:50556] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mobilesurvsolutions.com"] [uri "/wp-login.php"] [unique_id "alxf8wWL-zKlchkVWS1kJAAAbE0"], referer: https://mobilesurvsolutions.com/wp-login.php
[Sat Jul 18 23:26:11.266989 2026] [security2:error] [pid 882519:tid 882718] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-load.php"] [unique_id "alxf86L84xJUTmx6eO7JpAAAAMo"]
[Sat Jul 18 23:26:11.267097 2026] [security2:error] [pid 882519:tid 882718] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-load.php"] [unique_id "alxf86L84xJUTmx6eO7JpAAAAMo"]
[Sat Jul 18 23:26:11.280888 2026] [security2:error] [pid 882519:tid 882654] [client 45.3.45.94:37607] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 94.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxf86L84xJUTmx6eO7JowAAAIo"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:26:11.289296 2026] [security2:error] [pid 882519:tid 882709] [client 152.42.242.202:62361] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "hilltopnurseryinc.com"] [uri "/"] [unique_id "alxf86L84xJUTmx6eO7JpQAAAME"]
[Sat Jul 18 23:26:11.642857 2026] [proxy:error] [pid 881201:tid 881404] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:26:11.642927 2026] [proxy_http:error] [pid 881201:tid 881404] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:26:11.643578 2026] [proxy:error] [pid 881201:tid 881404] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:26:11.643617 2026] [proxy_http:error] [pid 881201:tid 881404] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:26:11.643716 2026] [security2:error] [pid 881201:tid 881404] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxf8wWL-zKlchkVWS1kMQAAAEg"]
[Sat Jul 18 23:26:11.667225 2026] [security2:error] [pid 882519:tid 882695] [client 194.146.92.69:23553] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "bundleofjoyandpoop.com"] [uri "/wp-json/batch/v1"] [unique_id "alxf86L84xJUTmx6eO7JvQAAALM"]
[Sat Jul 18 23:26:12.005745 2026] [proxy:error] [pid 882519:tid 882759] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:26:12.005832 2026] [proxy_http:error] [pid 882519:tid 882759] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:26:12.006263 2026] [proxy:error] [pid 882519:tid 882759] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:26:12.006291 2026] [proxy_http:error] [pid 882519:tid 882759] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:26:12.006372 2026] [security2:error] [pid 882519:tid 882759] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxf9KL84xJUTmx6eO7JywAAAPM"]
[Sat Jul 18 23:26:12.322997 2026] [security2:error] [pid 882519:tid 882693] [client 124.29.207.185:63386] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxf9KL84xJUTmx6eO7J3QAAALE"]
[Sat Jul 18 23:26:12.323126 2026] [security2:error] [pid 882519:tid 882693] [client 124.29.207.185:63386] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxf9KL84xJUTmx6eO7J3QAAALE"]
[Sat Jul 18 23:26:12.357834 2026] [security2:error] [pid 882519:tid 882749] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "alxf9KL84xJUTmx6eO7J3gAAAOk"]
[Sat Jul 18 23:26:12.357957 2026] [security2:error] [pid 882519:tid 882749] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "alxf9KL84xJUTmx6eO7J3gAAAOk"]
[Sat Jul 18 23:26:12.359928 2026] [security2:error] [pid 881201:tid 881380] [client 104.210.56.226:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "earle-brown.org"] [uri "/index.php"] [unique_id "alxf9AWL-zKlchkVWS1kPAAAMCA"]
[Sat Jul 18 23:26:12.705435 2026] [security2:error] [pid 882519:tid 882703] [client 45.3.45.160:44907] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxf9KL84xJUTmx6eO7J6gAAALs"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:26:12.732051 2026] [security2:error] [pid 882519:tid 882653] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-links.php"] [unique_id "alxf9KL84xJUTmx6eO7J7wAAAIk"]
[Sat Jul 18 23:26:12.732164 2026] [security2:error] [pid 882519:tid 882653] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-links.php"] [unique_id "alxf9KL84xJUTmx6eO7J7wAAAIk"]
[Sat Jul 18 23:26:13.112140 2026] [security2:error] [pid 882519:tid 882740] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/solo1.php"] [unique_id "alxf9aL84xJUTmx6eO7KAQAAAOA"]
[Sat Jul 18 23:26:13.112264 2026] [security2:error] [pid 882519:tid 882740] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/solo1.php"] [unique_id "alxf9aL84xJUTmx6eO7KAQAAAOA"]
[Sat Jul 18 23:26:13.485813 2026] [security2:error] [pid 882519:tid 882765] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/sixxis.php"] [unique_id "alxf9aL84xJUTmx6eO7KEQAAAPk"]
[Sat Jul 18 23:26:13.485998 2026] [security2:error] [pid 882519:tid 882765] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/sixxis.php"] [unique_id "alxf9aL84xJUTmx6eO7KEQAAAPk"]
[Sat Jul 18 23:26:13.834242 2026] [security2:error] [pid 882519:tid 882702] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/2P.update.php"] [unique_id "alxf9aL84xJUTmx6eO7KKAAAALo"]
[Sat Jul 18 23:26:13.834340 2026] [security2:error] [pid 882519:tid 882702] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/2P.update.php"] [unique_id "alxf9aL84xJUTmx6eO7KKAAAALo"]
[Sat Jul 18 23:26:13.867587 2026] [security2:error] [pid 882519:tid 882706] [client 119.154.81.234:59021] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxf9aL84xJUTmx6eO7KKwAAAL4"]
[Sat Jul 18 23:26:13.867705 2026] [security2:error] [pid 882519:tid 882706] [client 119.154.81.234:59021] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxf9aL84xJUTmx6eO7KKwAAAL4"]
[Sat Jul 18 23:26:14.106043 2026] [security2:error] [pid 881201:tid 881220] [remote 68.178.160.25:51732] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "secoaches.co"] [uri "/wp-login.php"] [unique_id "alxf9gWL-zKlchkVWS1kVgAAChE"]
[Sat Jul 18 23:26:14.218461 2026] [security2:error] [pid 882519:tid 882721] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/a.php"] [unique_id "alxf9qL84xJUTmx6eO7KWwAAAM0"]
[Sat Jul 18 23:26:14.218586 2026] [security2:error] [pid 882519:tid 882721] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/a.php"] [unique_id "alxf9qL84xJUTmx6eO7KWwAAAM0"]
[Sat Jul 18 23:26:14.239358 2026] [security2:error] [pid 882519:tid 882753] [client 172.252.26.142:49310] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "koaconsultants.com"] [uri "/index.php"] [unique_id "alxf9aL84xJUTmx6eO7KJAAAAO0"]
[Sat Jul 18 23:26:14.447974 2026] [security2:error] [pid 882519:tid 882727] [client 106.222.249.209:10545] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxf9qL84xJUTmx6eO7KfQAAANM"]
[Sat Jul 18 23:26:14.448104 2026] [security2:error] [pid 882519:tid 882727] [client 106.222.249.209:10545] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxf9qL84xJUTmx6eO7KfQAAANM"]
[Sat Jul 18 23:26:14.570958 2026] [security2:error] [pid 882519:tid 882707] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/k.php"] [unique_id "alxf9qL84xJUTmx6eO7KhQAAAL8"]
[Sat Jul 18 23:26:14.571065 2026] [security2:error] [pid 882519:tid 882707] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/k.php"] [unique_id "alxf9qL84xJUTmx6eO7KhQAAAL8"]
[Sat Jul 18 23:26:14.934899 2026] [security2:error] [pid 881201:tid 881430] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/w.php"] [unique_id "alxf9gWL-zKlchkVWS1kYgAAAGI"]
[Sat Jul 18 23:26:14.935041 2026] [security2:error] [pid 881201:tid 881430] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/w.php"] [unique_id "alxf9gWL-zKlchkVWS1kYgAAAGI"]
[Sat Jul 18 23:26:15.285052 2026] [security2:error] [pid 882519:tid 882675] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/insc.php"] [unique_id "alxf96L84xJUTmx6eO7KrwAAAJ8"]
[Sat Jul 18 23:26:15.285144 2026] [security2:error] [pid 882519:tid 882675] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/insc.php"] [unique_id "alxf96L84xJUTmx6eO7KrwAAAJ8"]
[Sat Jul 18 23:26:15.464326 2026] [security2:error] [pid 882519:tid 882530] [remote 68.178.160.25:50564] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxf96L84xJUTmx6eO7KsQAA2Ao"]
[Sat Jul 18 23:26:15.464488 2026] [security2:error] [pid 882519:tid 882732] [client 68.178.160.25:50564] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxf96L84xJUTmx6eO7KsQAA2Ao"]
[Sat Jul 18 23:26:15.657682 2026] [security2:error] [pid 882519:tid 882756] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/4PJcpMFsD8B.php"] [unique_id "alxf96L84xJUTmx6eO7KuAAAAPA"]
[Sat Jul 18 23:26:15.657805 2026] [security2:error] [pid 882519:tid 882756] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/4PJcpMFsD8B.php"] [unique_id "alxf96L84xJUTmx6eO7KuAAAAPA"]
[Sat Jul 18 23:26:15.728817 2026] [security2:error] [pid 881201:tid 881239] [remote 68.178.160.25:51732] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "secoaches.co"] [uri "/wp-login.php"] [unique_id "alxf9wWL-zKlchkVWS1kbwAAciQ"], referer: https://secoaches.co/wp-login.php
[Sat Jul 18 23:26:16.005115 2026] [security2:error] [pid 882519:tid 882652] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/u.php"] [unique_id "alxf-KL84xJUTmx6eO7K1wAAAIg"]
[Sat Jul 18 23:26:16.005232 2026] [security2:error] [pid 882519:tid 882652] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/u.php"] [unique_id "alxf-KL84xJUTmx6eO7K1wAAAIg"]
[Sat Jul 18 23:26:16.051852 2026] [security2:error] [pid 882519:tid 882765] [client 163.61.1.17:60880] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxf-KL84xJUTmx6eO7K3QAAAPk"]
[Sat Jul 18 23:26:16.055356 2026] [security2:error] [pid 882519:tid 882765] [client 163.61.1.17:60880] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxf-KL84xJUTmx6eO7K3QAAAPk"]
[Sat Jul 18 23:26:16.399743 2026] [security2:error] [pid 882519:tid 882692] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/sss.php"] [unique_id "alxf-KL84xJUTmx6eO7K8wAAALA"]
[Sat Jul 18 23:26:16.399845 2026] [security2:error] [pid 882519:tid 882692] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/sss.php"] [unique_id "alxf-KL84xJUTmx6eO7K8wAAALA"]
[Sat Jul 18 23:26:16.546667 2026] [security2:error] [pid 882519:tid 882627] [remote 45.157.54.14:59584] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "secretkeynumerology.com"] [uri "/xmlrpc.php"] [unique_id "alxf-KL84xJUTmx6eO7K_AAA32s"]
[Sat Jul 18 23:26:16.546858 2026] [security2:error] [pid 882519:tid 882739] [client 45.157.54.14:59584] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "secretkeynumerology.com"] [uri "/xmlrpc.php"] [unique_id "alxf-KL84xJUTmx6eO7K_AAA32s"]
[Sat Jul 18 23:26:16.813584 2026] [security2:error] [pid 882519:tid 882722] [client 223.228.182.224:34392] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxf-KL84xJUTmx6eO7LAQAAAM4"]
[Sat Jul 18 23:26:16.823607 2026] [security2:error] [pid 882519:tid 882722] [client 223.228.182.224:34392] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxf-KL84xJUTmx6eO7LAQAAAM4"]
[Sat Jul 18 23:26:16.985159 2026] [security2:error] [pid 882519:tid 882553] [remote 31.42.184.154:46066] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxf-KL84xJUTmx6eO7LAwABBCE"]
[Sat Jul 18 23:26:17.108883 2026] [security2:error] [pid 881201:tid 881246] [remote 31.42.184.154:36262] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxf-QWL-zKlchkVWS1kigAAXis"]
[Sat Jul 18 23:26:17.232341 2026] [security2:error] [pid 882519:tid 882526] [remote 31.42.184.154:46066] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxf-aL84xJUTmx6eO7LDgAAmQY"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:26:17.345920 2026] [security2:error] [pid 881201:tid 881262] [remote 31.42.184.154:36262] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxf-QWL-zKlchkVWS1kjQAAczs"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:26:17.640881 2026] [security2:error] [pid 882519:tid 882742] [client 190.245.146.99:60231] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxf-aL84xJUTmx6eO7LIQAAAOI"]
[Sat Jul 18 23:26:17.641012 2026] [security2:error] [pid 882519:tid 882742] [client 190.245.146.99:60231] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxf-aL84xJUTmx6eO7LIQAAAOI"]
[Sat Jul 18 23:26:17.811975 2026] [security2:error] [pid 882519:tid 882671] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/sss.php"] [unique_id "alxf-aL84xJUTmx6eO7LKQAAAJs"]
[Sat Jul 18 23:26:17.812115 2026] [security2:error] [pid 882519:tid 882671] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/sss.php"] [unique_id "alxf-aL84xJUTmx6eO7LKQAAAJs"]
[Sat Jul 18 23:26:18.193672 2026] [security2:error] [pid 882519:tid 882730] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/c.php"] [unique_id "alxf-qL84xJUTmx6eO7LSgAAANY"]
[Sat Jul 18 23:26:18.193773 2026] [security2:error] [pid 882519:tid 882730] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/c.php"] [unique_id "alxf-qL84xJUTmx6eO7LSgAAANY"]
[Sat Jul 18 23:26:18.545338 2026] [security2:error] [pid 882519:tid 882761] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/aa.php"] [unique_id "alxf-qL84xJUTmx6eO7LWgAAAPU"]
[Sat Jul 18 23:26:18.545490 2026] [security2:error] [pid 882519:tid 882761] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/aa.php"] [unique_id "alxf-qL84xJUTmx6eO7LWgAAAPU"]
[Sat Jul 18 23:26:18.553411 2026] [security2:error] [pid 882519:tid 882774] [client 74.7.244.57:0] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "kiakahaconstruction.com"] [uri "/index.php"] [unique_id "alxf-qL84xJUTmx6eO7LRgAAAQI"]
[Sat Jul 18 23:26:18.595172 2026] [security2:error] [pid 882519:tid 882666] [client 74.7.244.57:48292] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "kiakahaconstruction.com"] [uri "/robots.txt"] [unique_id "alxf-qL84xJUTmx6eO7LQQAAllY"]
[Sat Jul 18 23:26:18.949566 2026] [security2:error] [pid 882519:tid 882693] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/100.php"] [unique_id "alxf-qL84xJUTmx6eO7LbAAAALE"]
[Sat Jul 18 23:26:18.949695 2026] [security2:error] [pid 882519:tid 882693] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/100.php"] [unique_id "alxf-qL84xJUTmx6eO7LbAAAALE"]
[Sat Jul 18 23:26:19.101683 2026] [security2:error] [pid 882519:tid 882711] [client 27.34.68.67:25633] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxf-6L84xJUTmx6eO7LcQAAAMM"]
[Sat Jul 18 23:26:19.101819 2026] [security2:error] [pid 882519:tid 882711] [client 27.34.68.67:25633] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxf-6L84xJUTmx6eO7LcQAAAMM"]
[Sat Jul 18 23:26:19.305620 2026] [security2:error] [pid 882519:tid 882660] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/footer.php"] [unique_id "alxf-6L84xJUTmx6eO7LeQAAAJA"]
[Sat Jul 18 23:26:19.305719 2026] [security2:error] [pid 882519:tid 882660] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/footer.php"] [unique_id "alxf-6L84xJUTmx6eO7LeQAAAJA"]
[Sat Jul 18 23:26:19.695192 2026] [security2:error] [pid 882519:tid 882739] [client 223.185.61.63:10856] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxf-6L84xJUTmx6eO7LkwAAAN8"]
[Sat Jul 18 23:26:19.705149 2026] [security2:error] [pid 882519:tid 882739] [client 223.185.61.63:10856] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxf-6L84xJUTmx6eO7LkwAAAN8"]
[Sat Jul 18 23:26:19.829779 2026] [security2:error] [pid 882519:tid 882698] [client 45.3.44.22:12373] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 22.44.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxf-6L84xJUTmx6eO7LmwAAALY"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:26:19.931622 2026] [security2:error] [pid 882519:tid 882735] [client 66.249.73.166:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.dollpassionista.com"] [uri "/index.php"] [unique_id "alxf96L84xJUTmx6eO7KyQAAANs"]
[Sat Jul 18 23:26:20.541211 2026] [security2:error] [pid 881201:tid 881278] [remote 68.178.160.25:49636] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxf_AWL-zKlchkVWS1kuwAAYks"]
[Sat Jul 18 23:26:21.156949 2026] [security2:error] [pid 882519:tid 882758] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/users.php"] [unique_id "alxf_aL84xJUTmx6eO7LzgAAAPI"]
[Sat Jul 18 23:26:21.157049 2026] [security2:error] [pid 882519:tid 882758] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/users.php"] [unique_id "alxf_aL84xJUTmx6eO7LzgAAAPI"]
[Sat Jul 18 23:26:21.529368 2026] [security2:error] [pid 882519:tid 882671] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/177.php"] [unique_id "alxf_aL84xJUTmx6eO7L3QAAAJs"]
[Sat Jul 18 23:26:21.529448 2026] [security2:error] [pid 882519:tid 882671] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/177.php"] [unique_id "alxf_aL84xJUTmx6eO7L3QAAAJs"]
[Sat Jul 18 23:26:21.669815 2026] [security2:error] [pid 882519:tid 882663] [client 74.208.214.194:36340] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxf_aL84xJUTmx6eO7L5QAAAJM"]
[Sat Jul 18 23:26:21.738984 2026] [security2:error] [pid 882519:tid 882537] [remote 103.75.185.95:37628] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxf_aL84xJUTmx6eO7L6AAAoxE"]
[Sat Jul 18 23:26:21.739137 2026] [security2:error] [pid 882519:tid 882679] [client 103.75.185.95:37628] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxf_aL84xJUTmx6eO7L6AAAoxE"]
[Sat Jul 18 23:26:21.984665 2026] [security2:error] [pid 881201:tid 881345] [client 45.3.45.112:62173] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "155"] [id "900406"] [msg "wp-login POST logging"] [data "200"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxf_QWL-zKlchkVWS1kyQAAAA0"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:26:22.384592 2026] [security2:error] [pid 882519:tid 882572] [remote 45.157.54.14:10188] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "secretkeynumerology.com"] [uri "/xmlrpc.php"] [unique_id "alxf_qL84xJUTmx6eO7MBQAA8TQ"]
[Sat Jul 18 23:26:22.384732 2026] [security2:error] [pid 882519:tid 882757] [client 45.157.54.14:10188] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "secretkeynumerology.com"] [uri "/xmlrpc.php"] [unique_id "alxf_qL84xJUTmx6eO7MBQAA8TQ"]
[Sat Jul 18 23:26:22.427852 2026] [security2:error] [pid 882519:tid 882762] [client 124.29.246.106:63953] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxf_qL84xJUTmx6eO7MCAAAAPY"]
[Sat Jul 18 23:26:22.427954 2026] [security2:error] [pid 882519:tid 882762] [client 124.29.246.106:63953] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxf_qL84xJUTmx6eO7MCAAAAPY"]
[Sat Jul 18 23:26:22.857609 2026] [security2:error] [pid 882519:tid 882696] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/config.php"] [unique_id "alxf_qL84xJUTmx6eO7MGQAAALQ"]
[Sat Jul 18 23:26:22.857704 2026] [security2:error] [pid 882519:tid 882696] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/config.php"] [unique_id "alxf_qL84xJUTmx6eO7MGQAAALQ"]
[Sat Jul 18 23:26:23.125653 2026] [security2:error] [pid 881201:tid 881330] [remote 68.178.160.25:49636] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxf_wWL-zKlchkVWS1k6gAAAn8"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:26:23.232906 2026] [security2:error] [pid 881201:tid 881395] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/gettest.php"] [unique_id "alxf_wWL-zKlchkVWS1k7wAAAD8"]
[Sat Jul 18 23:26:23.233043 2026] [security2:error] [pid 881201:tid 881395] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/gettest.php"] [unique_id "alxf_wWL-zKlchkVWS1k7wAAAD8"]
[Sat Jul 18 23:26:23.444363 2026] [security2:error] [pid 881201:tid 881379] [client 34.90.238.78:16384] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "autodiscover.zop.dxp.mybluehost.me"] [uri "/"] [unique_id "alxf_wWL-zKlchkVWS1k9AAAAC8"]
[Sat Jul 18 23:26:23.444439 2026] [security2:error] [pid 881201:tid 881379] [client 34.90.238.78:16384] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "autodiscover.zop.dxp.mybluehost.me"] [uri "/"] [unique_id "alxf_wWL-zKlchkVWS1k9AAAAC8"]
[Sat Jul 18 23:26:23.604840 2026] [security2:error] [pid 882519:tid 882651] [client 65.111.28.57:60615] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 57.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxf_6L84xJUTmx6eO7MNAAAAIc"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:26:23.633424 2026] [security2:error] [pid 882519:tid 882683] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/min.php"] [unique_id "alxf_6L84xJUTmx6eO7MOQAAAKc"]
[Sat Jul 18 23:26:23.633498 2026] [security2:error] [pid 882519:tid 882683] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/min.php"] [unique_id "alxf_6L84xJUTmx6eO7MOQAAAKc"]
[Sat Jul 18 23:26:23.993230 2026] [security2:error] [pid 881201:tid 881430] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/edorxrr.php"] [unique_id "alxf_wWL-zKlchkVWS1lAgAAAGI"]
[Sat Jul 18 23:26:23.993372 2026] [security2:error] [pid 881201:tid 881430] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/edorxrr.php"] [unique_id "alxf_wWL-zKlchkVWS1lAgAAAGI"]
[Sat Jul 18 23:26:24.330827 2026] [security2:error] [pid 882519:tid 882764] [client 169.224.20.3:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "packerjanitorial.com"] [uri "/index.php"] [unique_id "alxf_6L84xJUTmx6eO7MRAAA-B4"], referer: https://packerjanitorial.com
[Sat Jul 18 23:26:24.338278 2026] [security2:error] [pid 882519:tid 882766] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/hur.php"] [unique_id "alxgAKL84xJUTmx6eO7MWAAAAPo"]
[Sat Jul 18 23:26:24.338373 2026] [security2:error] [pid 882519:tid 882766] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/hur.php"] [unique_id "alxgAKL84xJUTmx6eO7MWAAAAPo"]
[Sat Jul 18 23:26:24.529427 2026] [security2:error] [pid 882519:tid 882747] [client 119.154.81.234:59486] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgAKL84xJUTmx6eO7MXgAAAOc"]
[Sat Jul 18 23:26:24.529545 2026] [security2:error] [pid 882519:tid 882747] [client 119.154.81.234:59486] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgAKL84xJUTmx6eO7MXgAAAOc"]
[Sat Jul 18 23:26:24.704714 2026] [security2:error] [pid 882519:tid 882711] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/zoro.php"] [unique_id "alxgAKL84xJUTmx6eO7MaQAAAMM"]
[Sat Jul 18 23:26:24.704826 2026] [security2:error] [pid 882519:tid 882711] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/zoro.php"] [unique_id "alxgAKL84xJUTmx6eO7MaQAAAMM"]
[Sat Jul 18 23:26:25.099464 2026] [security2:error] [pid 881201:tid 881387] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/coffexium.php"] [unique_id "alxgAQWL-zKlchkVWS1lGAAAADc"]
[Sat Jul 18 23:26:25.099573 2026] [security2:error] [pid 881201:tid 881387] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/coffexium.php"] [unique_id "alxgAQWL-zKlchkVWS1lGAAAADc"]
[Sat Jul 18 23:26:25.283159 2026] [security2:error] [pid 882519:tid 882680] [client 106.222.249.209:29979] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgAaL84xJUTmx6eO7MhAAAAKQ"]
[Sat Jul 18 23:26:25.283289 2026] [security2:error] [pid 882519:tid 882680] [client 106.222.249.209:29979] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgAaL84xJUTmx6eO7MhAAAAKQ"]
[Sat Jul 18 23:26:25.488886 2026] [security2:error] [pid 882519:tid 882714] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/app.php"] [unique_id "alxgAaL84xJUTmx6eO7MjQAAAMY"]
[Sat Jul 18 23:26:25.488962 2026] [security2:error] [pid 882519:tid 882714] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/app.php"] [unique_id "alxgAaL84xJUTmx6eO7MjQAAAMY"]
[Sat Jul 18 23:26:25.859297 2026] [security2:error] [pid 882519:tid 882675] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/core.php"] [unique_id "alxgAaL84xJUTmx6eO7MnQAAAJ8"]
[Sat Jul 18 23:26:25.859411 2026] [security2:error] [pid 882519:tid 882675] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/core.php"] [unique_id "alxgAaL84xJUTmx6eO7MnQAAAJ8"]
[Sat Jul 18 23:26:26.011051 2026] [security2:error] [pid 882519:tid 882695] [client 57.141.18.56:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxgAaL84xJUTmx6eO7MmwAAALM"]
[Sat Jul 18 23:26:26.133556 2026] [security2:error] [pid 882519:tid 882621] [remote 199.189.225.167:45377] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.225.189.199.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxgAqL84xJUTmx6eO7MqAAA2GU"]
[Sat Jul 18 23:26:26.241300 2026] [security2:error] [pid 882519:tid 882775] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/main.php"] [unique_id "alxgAqL84xJUTmx6eO7MrwAAAQM"]
[Sat Jul 18 23:26:26.241422 2026] [security2:error] [pid 882519:tid 882775] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/main.php"] [unique_id "alxgAqL84xJUTmx6eO7MrwAAAQM"]
[Sat Jul 18 23:26:26.356323 2026] [security2:error] [pid 882519:tid 882609] [remote 199.189.225.167:45377] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.225.189.199.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxgAqL84xJUTmx6eO7MtgAA4Fk"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:26:26.527119 2026] [security2:error] [pid 881201:tid 881359] [client 65.111.28.96:38241] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "155"] [id "900406"] [msg "wp-login POST logging"] [data "200"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxgAQWL-zKlchkVWS1lFwAAABs"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:26:26.613470 2026] [security2:error] [pid 882519:tid 882662] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/init.php"] [unique_id "alxgAqL84xJUTmx6eO7MwwAAAJI"]
[Sat Jul 18 23:26:26.613614 2026] [security2:error] [pid 882519:tid 882662] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/init.php"] [unique_id "alxgAqL84xJUTmx6eO7MwwAAAJI"]
[Sat Jul 18 23:26:26.614314 2026] [security2:error] [pid 881201:tid 881402] [client 163.61.1.17:61285] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgAgWL-zKlchkVWS1lKgAAAEY"]
[Sat Jul 18 23:26:26.615966 2026] [security2:error] [pid 881201:tid 881402] [client 163.61.1.17:61285] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgAgWL-zKlchkVWS1lKgAAAEY"]
[Sat Jul 18 23:26:26.658279 2026] [security2:error] [pid 881201:tid 881456] [client 223.228.182.224:35408] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxgAgWL-zKlchkVWS1lLAAAAHw"]
[Sat Jul 18 23:26:26.662393 2026] [security2:error] [pid 881201:tid 881456] [client 223.228.182.224:35408] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxgAgWL-zKlchkVWS1lLAAAAHw"]
[Sat Jul 18 23:26:27.362898 2026] [security2:error] [pid 882519:tid 882625] [remote 71.25.173.17:50606] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.173.25.71.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgA6L84xJUTmx6eO7M4QAA32k"]
[Sat Jul 18 23:26:27.363114 2026] [security2:error] [pid 882519:tid 882739] [client 71.25.173.17:50606] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgA6L84xJUTmx6eO7M4QAA32k"]
[Sat Jul 18 23:26:27.515390 2026] [security2:error] [pid 882519:tid 882709] [client 74.7.244.43:35254] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "entraalnuevomundo.com"] [uri "/robots.txt"] [unique_id "alxgA6L84xJUTmx6eO7M6wAAwQ0"]
[Sat Jul 18 23:26:27.643738 2026] [security2:error] [pid 882519:tid 882730] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/prekel.php"] [unique_id "alxgA6L84xJUTmx6eO7M9AAAANY"]
[Sat Jul 18 23:26:27.643873 2026] [security2:error] [pid 882519:tid 882730] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/prekel.php"] [unique_id "alxgA6L84xJUTmx6eO7M9AAAANY"]
[Sat Jul 18 23:26:27.842690 2026] [security2:error] [pid 882519:tid 882691] [client 34.90.238.78:16384] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "mail.demnetworks.com"] [uri "/"] [unique_id "alxgA6L84xJUTmx6eO7M-gAAAK8"]
[Sat Jul 18 23:26:27.842792 2026] [security2:error] [pid 882519:tid 882691] [client 34.90.238.78:16384] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "mail.demnetworks.com"] [uri "/"] [unique_id "alxgA6L84xJUTmx6eO7M-gAAAK8"]
[Sat Jul 18 23:26:28.004981 2026] [security2:error] [pid 882519:tid 882723] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/0.php"] [unique_id "alxgBKL84xJUTmx6eO7NAQAAAM8"]
[Sat Jul 18 23:26:28.005066 2026] [security2:error] [pid 882519:tid 882723] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/0.php"] [unique_id "alxgBKL84xJUTmx6eO7NAQAAAM8"]
[Sat Jul 18 23:26:28.015009 2026] [security2:error] [pid 881201:tid 881408] [client 37.114.178.117:1775] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.thewelloiledlife.com"] [uri "/index.php"] [unique_id "alxgAwWL-zKlchkVWS1lPAAAAEw"]
[Sat Jul 18 23:26:28.023325 2026] [security2:error] [pid 882519:tid 882635] [remote 68.178.160.25:49652] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "oldracelimited.com"] [uri "/wp-login.php"] [unique_id "alxgBKL84xJUTmx6eO7NAgAA23M"]
[Sat Jul 18 23:26:28.164381 2026] [security2:error] [pid 882519:tid 882658] [client 190.245.146.99:60750] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgBKL84xJUTmx6eO7NCgAAAI4"]
[Sat Jul 18 23:26:28.164491 2026] [security2:error] [pid 882519:tid 882658] [client 190.245.146.99:60750] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgBKL84xJUTmx6eO7NCgAAAI4"]
[Sat Jul 18 23:26:28.364405 2026] [security2:error] [pid 882519:tid 882766] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/BDKR28.php"] [unique_id "alxgBKL84xJUTmx6eO7NEwAAAPo"]
[Sat Jul 18 23:26:28.364564 2026] [security2:error] [pid 882519:tid 882766] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/BDKR28.php"] [unique_id "alxgBKL84xJUTmx6eO7NEwAAAPo"]
[Sat Jul 18 23:26:28.718111 2026] [security2:error] [pid 882519:tid 882674] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/f35.update.php"] [unique_id "alxgBKL84xJUTmx6eO7NJAAAAJ4"]
[Sat Jul 18 23:26:28.718222 2026] [security2:error] [pid 882519:tid 882674] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/f35.update.php"] [unique_id "alxgBKL84xJUTmx6eO7NJAAAAJ4"]
[Sat Jul 18 23:26:29.081314 2026] [security2:error] [pid 882519:tid 882654] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/f900.php"] [unique_id "alxgBaL84xJUTmx6eO7NMwAAAIo"]
[Sat Jul 18 23:26:29.081417 2026] [security2:error] [pid 882519:tid 882654] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/f900.php"] [unique_id "alxgBaL84xJUTmx6eO7NMwAAAIo"]
[Sat Jul 18 23:26:29.178495 2026] [security2:error] [pid 882519:tid 882572] [remote 31.42.184.154:54470] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgBaL84xJUTmx6eO7NNwAA9jQ"]
[Sat Jul 18 23:26:29.178666 2026] [security2:error] [pid 882519:tid 882762] [client 31.42.184.154:54470] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgBaL84xJUTmx6eO7NNwAA9jQ"]
[Sat Jul 18 23:26:29.461902 2026] [security2:error] [pid 882519:tid 882734] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/xmrl.php"] [unique_id "alxgBaL84xJUTmx6eO7NQwAAANo"]
[Sat Jul 18 23:26:29.461981 2026] [security2:error] [pid 882519:tid 882734] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/xmrl.php"] [unique_id "alxgBaL84xJUTmx6eO7NQwAAANo"]
[Sat Jul 18 23:26:29.588877 2026] [security2:error] [pid 882519:tid 882556] [remote 68.178.160.25:49652] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "oldracelimited.com"] [uri "/wp-login.php"] [unique_id "alxgBaL84xJUTmx6eO7NRwAA0yQ"], referer: https://oldracelimited.com/wp-login.php
[Sat Jul 18 23:26:29.688256 2026] [security2:error] [pid 882519:tid 882759] [client 27.34.68.67:3515] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgBaL84xJUTmx6eO7NTAAAAPM"]
[Sat Jul 18 23:26:29.688461 2026] [security2:error] [pid 882519:tid 882759] [client 27.34.68.67:3515] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgBaL84xJUTmx6eO7NTAAAAPM"]
[Sat Jul 18 23:26:29.844328 2026] [security2:error] [pid 882519:tid 882767] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/memberfuns.php"] [unique_id "alxgBaL84xJUTmx6eO7NVAAAAPs"]
[Sat Jul 18 23:26:29.844431 2026] [security2:error] [pid 882519:tid 882767] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/memberfuns.php"] [unique_id "alxgBaL84xJUTmx6eO7NVAAAAPs"]
[Sat Jul 18 23:26:30.215866 2026] [security2:error] [pid 882519:tid 882680] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/ms.php"] [unique_id "alxgBqL84xJUTmx6eO7NaQAAAKQ"]
[Sat Jul 18 23:26:30.215975 2026] [security2:error] [pid 882519:tid 882680] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/ms.php"] [unique_id "alxgBqL84xJUTmx6eO7NaQAAAKQ"]
[Sat Jul 18 23:26:30.390576 2026] [security2:error] [pid 881201:tid 881382] [client 223.185.61.63:9328] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxgBgWL-zKlchkVWS1lYgAAADI"]
[Sat Jul 18 23:26:30.390705 2026] [security2:error] [pid 881201:tid 881382] [client 223.185.61.63:9328] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxgBgWL-zKlchkVWS1lYgAAADI"]
[Sat Jul 18 23:26:30.586870 2026] [security2:error] [pid 882519:tid 882726] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/zz.php"] [unique_id "alxgBqL84xJUTmx6eO7NgQAAANI"]
[Sat Jul 18 23:26:30.587014 2026] [security2:error] [pid 882519:tid 882726] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/zz.php"] [unique_id "alxgBqL84xJUTmx6eO7NgQAAANI"]
[Sat Jul 18 23:26:30.641289 2026] [security2:error] [pid 882519:tid 882623] [remote 217.113.60.80:47064] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.60.113.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxgBqL84xJUTmx6eO7NhgAAlWc"]
[Sat Jul 18 23:26:30.890199 2026] [security2:error] [pid 882519:tid 882575] [remote 217.113.60.80:47064] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.60.113.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxgBqL84xJUTmx6eO7NkAAA8zc"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:26:30.953902 2026] [security2:error] [pid 881201:tid 881402] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/for.php"] [unique_id "alxgBgWL-zKlchkVWS1lagAAAEY"]
[Sat Jul 18 23:26:30.954025 2026] [security2:error] [pid 881201:tid 881402] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/for.php"] [unique_id "alxgBgWL-zKlchkVWS1lagAAAEY"]
[Sat Jul 18 23:26:31.692698 2026] [security2:error] [pid 882519:tid 882756] [client 74.208.214.194:45922] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxgB6L84xJUTmx6eO7NsgAAAPA"]
[Sat Jul 18 23:26:31.829796 2026] [security2:error] [pid 881201:tid 881401] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/yup.php"] [unique_id "alxgBwWL-zKlchkVWS1ldwAAAEU"]
[Sat Jul 18 23:26:31.829897 2026] [security2:error] [pid 881201:tid 881401] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/yup.php"] [unique_id "alxgBwWL-zKlchkVWS1ldwAAAEU"]
[Sat Jul 18 23:26:32.184809 2026] [security2:error] [pid 882519:tid 882767] [client 34.91.213.89:49152] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "mail.toddnielsen.com"] [uri "/"] [unique_id "alxgCKL84xJUTmx6eO7NzQAAAPs"]
[Sat Jul 18 23:26:32.184890 2026] [security2:error] [pid 882519:tid 882767] [client 34.91.213.89:49152] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "mail.toddnielsen.com"] [uri "/"] [unique_id "alxgCKL84xJUTmx6eO7NzQAAAPs"]
[Sat Jul 18 23:26:32.185080 2026] [security2:error] [pid 882519:tid 882678] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wpxml.php"] [unique_id "alxgCKL84xJUTmx6eO7NzAAAAKI"]
[Sat Jul 18 23:26:32.185178 2026] [security2:error] [pid 882519:tid 882678] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wpxml.php"] [unique_id "alxgCKL84xJUTmx6eO7NzAAAAKI"]
[Sat Jul 18 23:26:32.543124 2026] [security2:error] [pid 882519:tid 882758] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/fffm.php"] [unique_id "alxgCKL84xJUTmx6eO7N1gAAAPI"]
[Sat Jul 18 23:26:32.543222 2026] [security2:error] [pid 882519:tid 882758] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/fffm.php"] [unique_id "alxgCKL84xJUTmx6eO7N1gAAAPI"]
[Sat Jul 18 23:26:32.898759 2026] [security2:error] [pid 882519:tid 882764] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/gecko.php"] [unique_id "alxgCKL84xJUTmx6eO7N5QAAAPg"]
[Sat Jul 18 23:26:32.898875 2026] [security2:error] [pid 882519:tid 882764] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/gecko.php"] [unique_id "alxgCKL84xJUTmx6eO7N5QAAAPg"]
[Sat Jul 18 23:26:33.066192 2026] [security2:error] [pid 881201:tid 881439] [client 114.119.153.245:28313] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "christiancountytrumpet.com"] [uri "/state-rep-now-laid-up-in-wheelchair-for-time-being/"] [unique_id "alxgCQWL-zKlchkVWS1ljwAAAGs"], referer: https://christiancountytrumpet.com/category/news/page/2/
[Sat Jul 18 23:26:33.798093 2026] [security2:error] [pid 882519:tid 882670] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/a1.php"] [unique_id "alxgCaL84xJUTmx6eO7OBwAAAJo"]
[Sat Jul 18 23:26:33.798172 2026] [security2:error] [pid 882519:tid 882670] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/a1.php"] [unique_id "alxgCaL84xJUTmx6eO7OBwAAAJo"]
[Sat Jul 18 23:26:34.162020 2026] [security2:error] [pid 881201:tid 881382] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/k2.php"] [unique_id "alxgCgWL-zKlchkVWS1lpQAAADI"]
[Sat Jul 18 23:26:34.162158 2026] [security2:error] [pid 881201:tid 881382] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/k2.php"] [unique_id "alxgCgWL-zKlchkVWS1lpQAAADI"]
[Sat Jul 18 23:26:34.547177 2026] [security2:error] [pid 881201:tid 881458] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/82.php"] [unique_id "alxgCgWL-zKlchkVWS1ltwAAAH4"]
[Sat Jul 18 23:26:34.547283 2026] [security2:error] [pid 881201:tid 881458] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/82.php"] [unique_id "alxgCgWL-zKlchkVWS1ltwAAAH4"]
[Sat Jul 18 23:26:34.902977 2026] [security2:error] [pid 882519:tid 882767] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/config.json.php"] [unique_id "alxgCqL84xJUTmx6eO7OMQAAAPs"]
[Sat Jul 18 23:26:34.903065 2026] [security2:error] [pid 882519:tid 882767] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/config.json.php"] [unique_id "alxgCqL84xJUTmx6eO7OMQAAAPs"]
[Sat Jul 18 23:26:35.142764 2026] [security2:error] [pid 881201:tid 881334] [client 119.154.81.234:59939] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgCwWL-zKlchkVWS1lwAAAAAI"]
[Sat Jul 18 23:26:35.142959 2026] [security2:error] [pid 881201:tid 881334] [client 119.154.81.234:59939] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgCwWL-zKlchkVWS1lwAAAAAI"]
[Sat Jul 18 23:26:35.260232 2026] [security2:error] [pid 882519:tid 882719] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/fpwch.php"] [unique_id "alxgC6L84xJUTmx6eO7OQAAAAMs"]
[Sat Jul 18 23:26:35.260370 2026] [security2:error] [pid 882519:tid 882719] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/fpwch.php"] [unique_id "alxgC6L84xJUTmx6eO7OQAAAAMs"]
[Sat Jul 18 23:26:35.525993 2026] [security2:error] [pid 882519:tid 882522] [remote 163.227.186.27:45478] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxgC6L84xJUTmx6eO7OUAAAyAI"]
[Sat Jul 18 23:26:35.724443 2026] [security2:error] [pid 881201:tid 881287] [remote 69.163.181.218:55308] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 218.181.163.69.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "vyx.sbv.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxgCwWL-zKlchkVWS1l0gAAJVQ"]
[Sat Jul 18 23:26:35.934875 2026] [security2:error] [pid 881201:tid 881380] [client 106.222.249.209:6563] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgCwWL-zKlchkVWS1l4wAAADA"]
[Sat Jul 18 23:26:35.936003 2026] [security2:error] [pid 881201:tid 881380] [client 106.222.249.209:6563] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgCwWL-zKlchkVWS1l4wAAADA"]
[Sat Jul 18 23:26:35.989580 2026] [security2:error] [pid 881201:tid 881299] [remote 69.163.181.218:55308] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 218.181.163.69.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "vyx.sbv.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxgCwWL-zKlchkVWS1l5QAAdGA"], referer: https://vyx.sbv.mybluehost.me/wp-login.php
[Sat Jul 18 23:26:36.010454 2026] [security2:error] [pid 882519:tid 882535] [remote 163.227.186.27:45478] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxgDKL84xJUTmx6eO7ObQAAwA8"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:26:36.946847 2026] [security2:error] [pid 882519:tid 882694] [client 4.194.24.143:17404] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/nine2code.php"] [unique_id "alxgDKL84xJUTmx6eO7OkQAAALI"]
[Sat Jul 18 23:26:37.091906 2026] [security2:error] [pid 882519:tid 882651] [client 45.3.45.76:22449] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 76.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxgDaL84xJUTmx6eO7OmgAAAIc"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:26:37.146723 2026] [security2:error] [pid 882519:tid 882776] [client 163.61.1.17:61702] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgDaL84xJUTmx6eO7OnAAAAQQ"]
[Sat Jul 18 23:26:37.152518 2026] [security2:error] [pid 882519:tid 882776] [client 163.61.1.17:61702] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgDaL84xJUTmx6eO7OnAAAAQQ"]
[Sat Jul 18 23:26:37.514701 2026] [security2:error] [pid 881201:tid 881421] [client 4.194.24.143:30341] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/num.php"] [unique_id "alxgDQWL-zKlchkVWS1l_wAAAFk"]
[Sat Jul 18 23:26:37.648165 2026] [security2:error] [pid 881201:tid 881452] [client 223.228.182.224:51362] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxgDQWL-zKlchkVWS1mBgAAAHg"]
[Sat Jul 18 23:26:37.648313 2026] [security2:error] [pid 881201:tid 881452] [client 223.228.182.224:51362] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxgDQWL-zKlchkVWS1mBgAAAHg"]
[Sat Jul 18 23:26:37.655647 2026] [security2:error] [pid 882519:tid 882742] [client 65.111.28.8:15821] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "155"] [id "900406"] [msg "wp-login POST logging"] [data "200"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxgDaL84xJUTmx6eO7OrAAAAOI"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:26:38.084161 2026] [security2:error] [pid 882519:tid 882694] [client 4.194.24.143:17359] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/odf7udtspqtpxzyxmw2rccdefault.php"] [unique_id "alxgDqL84xJUTmx6eO7OwwAAALI"]
[Sat Jul 18 23:26:38.234004 2026] [security2:error] [pid 881201:tid 881375] [client 220.181.108.90:24698] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "thierry-henry.fr"] [uri "/index.php"] [unique_id "alxgDgWL-zKlchkVWS1mCwAAKwM"]
[Sat Jul 18 23:26:38.632524 2026] [security2:error] [pid 882519:tid 882749] [client 4.194.24.143:17233] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/option.php"] [unique_id "alxgDqL84xJUTmx6eO7O1QAAAOk"]
[Sat Jul 18 23:26:38.632744 2026] [security2:error] [pid 882519:tid 882726] [client 190.245.146.99:61274] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgDqL84xJUTmx6eO7O1gAAANI"]
[Sat Jul 18 23:26:38.639558 2026] [security2:error] [pid 882519:tid 882726] [client 190.245.146.99:61274] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgDqL84xJUTmx6eO7O1gAAANI"]
[Sat Jul 18 23:26:39.083725 2026] [security2:error] [pid 881201:tid 881400] [client 45.3.45.200:45609] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 200.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxgDwWL-zKlchkVWS1mKgAAAEQ"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:26:39.106494 2026] [security2:error] [pid 881201:tid 881402] [client 74.7.230.27:54238] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "astoryunwritten.com"] [uri "/robots.txt"] [unique_id "alxgDwWL-zKlchkVWS1mLQAAAEY"]
[Sat Jul 18 23:26:39.188025 2026] [security2:error] [pid 881201:tid 881414] [client 4.194.24.143:29514] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/p.php"] [unique_id "alxgDwWL-zKlchkVWS1mMwAAAFI"]
[Sat Jul 18 23:26:39.425308 2026] [security2:error] [pid 882519:tid 882723] [client 31.171.130.24:61463] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/ms-themes.php"] [unique_id "alxgD6L84xJUTmx6eO7O7QAAAM8"]
[Sat Jul 18 23:26:39.466764 2026] [security2:error] [pid 882519:tid 882747] [client 31.171.130.14:37825] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/ms-themes.php"] [unique_id "alxgD6L84xJUTmx6eO7O7wAAAOc"]
[Sat Jul 18 23:26:39.538594 2026] [security2:error] [pid 881201:tid 881425] [client 31.171.130.18:33161] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/ms-themes.php"] [unique_id "alxgDwWL-zKlchkVWS1mOgAAAF0"]
[Sat Jul 18 23:26:39.656305 2026] [security2:error] [pid 882519:tid 882693] [client 31.171.130.46:54295] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/ms-themes.php"] [unique_id "alxgD6L84xJUTmx6eO7O-wAAALE"]
[Sat Jul 18 23:26:39.753625 2026] [security2:error] [pid 882519:tid 882688] [client 4.194.24.143:29566] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/past.php"] [unique_id "alxgD6L84xJUTmx6eO7PAAAAAKw"]
[Sat Jul 18 23:26:39.901224 2026] [security2:error] [pid 881201:tid 881409] [client 31.171.130.14:23121] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/ms-themes.php"] [unique_id "alxgDwWL-zKlchkVWS1mRgAAAE0"]
[Sat Jul 18 23:26:39.945179 2026] [security2:error] [pid 881201:tid 881418] [client 31.171.130.36:32557] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/ms-themes.php"] [unique_id "alxgDwWL-zKlchkVWS1mSAAAAFY"]
[Sat Jul 18 23:26:40.098765 2026] [security2:error] [pid 881201:tid 881383] [client 31.171.130.13:36123] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/chosen.php"] [unique_id "alxgEAWL-zKlchkVWS1mSwAAADM"]
[Sat Jul 18 23:26:40.139600 2026] [security2:error] [pid 881201:tid 881397] [client 27.34.68.67:60728] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgEAWL-zKlchkVWS1mTQAAAEE"]
[Sat Jul 18 23:26:40.139689 2026] [security2:error] [pid 881201:tid 881397] [client 27.34.68.67:60728] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgEAWL-zKlchkVWS1mTQAAAEE"]
[Sat Jul 18 23:26:40.311188 2026] [security2:error] [pid 882519:tid 882719] [client 4.194.24.143:34538] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/php.php"] [unique_id "alxgEKL84xJUTmx6eO7PDgAAAMs"]
[Sat Jul 18 23:26:40.431498 2026] [security2:error] [pid 882519:tid 882774] [client 31.171.130.3:45681] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/chosen.php"] [unique_id "alxgEKL84xJUTmx6eO7PDwAAAQI"]
[Sat Jul 18 23:26:40.449373 2026] [security2:error] [pid 882519:tid 882675] [client 31.171.130.2:47387] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/chosen.php"] [unique_id "alxgEKL84xJUTmx6eO7PEAAAAJ8"]
[Sat Jul 18 23:26:40.539610 2026] [security2:error] [pid 881201:tid 881368] [client 31.171.130.7:29687] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/ms-themes.php"] [unique_id "alxgEAWL-zKlchkVWS1mWQAAACQ"]
[Sat Jul 18 23:26:40.698957 2026] [security2:error] [pid 881201:tid 881342] [client 31.171.130.11:31361] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/ms-themes.php"] [unique_id "alxgEAWL-zKlchkVWS1mZwAAAAo"]
[Sat Jul 18 23:26:40.701734 2026] [security2:error] [pid 882519:tid 882592] [remote 157.66.26.183:58618] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 183.26.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxgEKL84xJUTmx6eO7PEgAA6kg"]
[Sat Jul 18 23:26:40.824582 2026] [security2:error] [pid 881201:tid 881394] [client 114.119.136.160:20517] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "latiendadejorge.com.gt"] [uri "/product/kit-detox-infusor-de-te/"] [unique_id "alxgEAWL-zKlchkVWS1magAAAD4"], referer: https://latiendadejorge.com.gt/product/teami-skinny/
[Sat Jul 18 23:26:40.906076 2026] [security2:error] [pid 881201:tid 881456] [client 4.194.24.143:29515] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/php8.php"] [unique_id "alxgEAWL-zKlchkVWS1mcgAAAHw"]
[Sat Jul 18 23:26:40.915183 2026] [security2:error] [pid 881201:tid 881354] [client 31.171.130.8:50191] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/file.php"] [unique_id "alxgEAWL-zKlchkVWS1mcwAAABY"]
[Sat Jul 18 23:26:40.945183 2026] [security2:error] [pid 881201:tid 881415] [client 31.171.130.33:48639] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/file.php"] [unique_id "alxgEAWL-zKlchkVWS1mdAAAAFM"]
[Sat Jul 18 23:26:41.021759 2026] [security2:error] [pid 881201:tid 881375] [client 223.185.61.63:5738] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxgEQWL-zKlchkVWS1mfQAAACs"]
[Sat Jul 18 23:26:41.021858 2026] [security2:error] [pid 881201:tid 881375] [client 223.185.61.63:5738] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxgEQWL-zKlchkVWS1mfQAAACs"]
[Sat Jul 18 23:26:41.054205 2026] [security2:error] [pid 881201:tid 881424] [client 31.171.130.40:24327] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/chosen.php"] [unique_id "alxgEQWL-zKlchkVWS1mgAAAAFw"]
[Sat Jul 18 23:26:41.177725 2026] [security2:error] [pid 881201:tid 881452] [client 31.171.130.21:33855] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/chosen.php"] [unique_id "alxgEQWL-zKlchkVWS1mkQAAAHg"]
[Sat Jul 18 23:26:41.190327 2026] [security2:error] [pid 881201:tid 881458] [client 31.171.130.42:63305] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/chosen.php"] [unique_id "alxgEQWL-zKlchkVWS1mkwAAAH4"]
[Sat Jul 18 23:26:41.190397 2026] [security2:error] [pid 881201:tid 881407] [client 31.171.130.30:44087] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/chosen.php"] [unique_id "alxgEQWL-zKlchkVWS1mkgAAAEs"]
[Sat Jul 18 23:26:41.196477 2026] [security2:error] [pid 881201:tid 881406] [client 31.171.130.23:20099] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/chosen.php"] [unique_id "alxgEQWL-zKlchkVWS1mlQAAAEo"]
[Sat Jul 18 23:26:41.309963 2026] [security2:error] [pid 881201:tid 881421] [client 57.141.18.4:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxgEQWL-zKlchkVWS1mhgAAAFk"]
[Sat Jul 18 23:26:41.450256 2026] [security2:error] [pid 881201:tid 881427] [client 4.194.24.143:17200] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/phpinfo.php"] [unique_id "alxgEQWL-zKlchkVWS1mngAAAF8"]
[Sat Jul 18 23:26:41.683091 2026] [security2:error] [pid 881201:tid 881420] [client 145.239.10.137:57290] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 137.10.239.145.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/lapa.php"] [unique_id "alxgEQWL-zKlchkVWS1mqwAAAFg"], referer: http://lizrichter.com.au/lapa.php
[Sat Jul 18 23:26:41.781390 2026] [security2:error] [pid 881201:tid 881434] [client 31.171.130.7:32889] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/flower.php"] [unique_id "alxgEQWL-zKlchkVWS1msAAAAGY"]
[Sat Jul 18 23:26:41.784826 2026] [security2:error] [pid 881201:tid 881443] [client 31.171.130.45:54617] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/file.php"] [unique_id "alxgEQWL-zKlchkVWS1msgAAAG8"]
[Sat Jul 18 23:26:41.799155 2026] [security2:error] [pid 882519:tid 882601] [remote 124.156.212.23:44533] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 23.212.156.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mourgroup.com"] [uri "/wp-login.php"] [unique_id "alxgEaL84xJUTmx6eO7PFAAAuFE"]
[Sat Jul 18 23:26:41.923424 2026] [security2:error] [pid 881201:tid 881432] [client 31.171.130.42:29177] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/file.php"] [unique_id "alxgEQWL-zKlchkVWS1mvAAAAGQ"]
[Sat Jul 18 23:26:41.932290 2026] [security2:error] [pid 881201:tid 881265] [remote 157.66.26.183:58634] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 183.26.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxgEQWL-zKlchkVWS1mvQAATz4"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:26:41.967172 2026] [security2:error] [pid 881201:tid 881261] [remote 72.167.132.114:34178] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "villa-m-medjugorje.com"] [uri "/wp-login.php"] [unique_id "alxgEQWL-zKlchkVWS1mvwAAMDo"]
[Sat Jul 18 23:26:42.304455 2026] [security2:error] [pid 881201:tid 881355] [client 47.130.151.169:35802] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 169.151.130.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxgEgWL-zKlchkVWS1m3AAAABc"]
[Sat Jul 18 23:26:42.319881 2026] [security2:error] [pid 881201:tid 881289] [remote 72.167.132.114:34178] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "villa-m-medjugorje.com"] [uri "/wp-login.php"] [unique_id "alxgEgWL-zKlchkVWS1m3gAAAVY"], referer: https://villa-m-medjugorje.com/wp-login.php
[Sat Jul 18 23:26:42.420553 2026] [security2:error] [pid 881201:tid 881362] [client 31.171.130.21:30013] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/file.php"] [unique_id "alxgEgWL-zKlchkVWS1m5gAAAB4"]
[Sat Jul 18 23:26:42.420609 2026] [security2:error] [pid 881201:tid 881382] [client 31.171.130.4:59547] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/file.php"] [unique_id "alxgEgWL-zKlchkVWS1m5wAAADI"]
[Sat Jul 18 23:26:42.421496 2026] [security2:error] [pid 881201:tid 881348] [client 31.171.130.5:29931] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/file.php"] [unique_id "alxgEgWL-zKlchkVWS1m6AAAABA"]
[Sat Jul 18 23:26:42.428141 2026] [security2:error] [pid 881201:tid 881455] [client 31.171.130.23:51907] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/flower.php"] [unique_id "alxgEgWL-zKlchkVWS1m6wAAAHs"]
[Sat Jul 18 23:26:42.428862 2026] [proxy:error] [pid 881201:tid 881440] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:26:42.428950 2026] [proxy_http:error] [pid 881201:tid 881440] [client 193.47.62.168:38872] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:26:42.429625 2026] [proxy:error] [pid 881201:tid 881440] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:26:42.429673 2026] [proxy_http:error] [pid 881201:tid 881440] [client 193.47.62.168:38872] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:26:42.593169 2026] [security2:error] [pid 881201:tid 881398] [client 31.171.130.36:28919] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/flower.php"] [unique_id "alxgEgWL-zKlchkVWS1m8AAAAEI"]
[Sat Jul 18 23:26:42.593504 2026] [security2:error] [pid 881201:tid 881395] [client 31.171.130.47:39205] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/gifclass.php"] [unique_id "alxgEgWL-zKlchkVWS1m8gAAAD8"]
[Sat Jul 18 23:26:42.593635 2026] [security2:error] [pid 881201:tid 881332] [client 31.171.130.12:41577] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/flower.php"] [unique_id "alxgEgWL-zKlchkVWS1m8QAAAAA"]
[Sat Jul 18 23:26:42.915106 2026] [security2:error] [pid 881201:tid 881376] [client 31.171.130.40:42577] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/flower.php"] [unique_id "alxgEgWL-zKlchkVWS1nCAAAACw"]
[Sat Jul 18 23:26:42.925019 2026] [security2:error] [pid 881201:tid 881366] [client 31.171.130.50:43823] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/flower.php"] [unique_id "alxgEgWL-zKlchkVWS1nCgAAACI"]
[Sat Jul 18 23:26:42.925781 2026] [security2:error] [pid 881201:tid 881354] [client 31.171.130.27:22563] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/flower.php"] [unique_id "alxgEgWL-zKlchkVWS1nCwAAABY"]
[Sat Jul 18 23:26:43.208381 2026] [security2:error] [pid 881201:tid 881451] [client 31.171.130.51:55921] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/gifclass.php"] [unique_id "alxgEwWL-zKlchkVWS1nGwAAAHc"]
[Sat Jul 18 23:26:43.274380 2026] [security2:error] [pid 881201:tid 881445] [client 104.210.56.226:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "mezzacraft.com"] [uri "/index.php"] [unique_id "alxgEwWL-zKlchkVWS1nEgAAAHE"]
[Sat Jul 18 23:26:43.300723 2026] [security2:error] [pid 881201:tid 881355] [client 13.250.107.25:58892] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.107.250.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxgEwWL-zKlchkVWS1nIAAAABc"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:26:43.439307 2026] [security2:error] [pid 881201:tid 881449] [client 195.170.172.102:41346] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 102.172.170.195.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lifetalkswithkay.com"] [uri "/index.php"] [unique_id "alxgEwWL-zKlchkVWS1nMwAAAHU"]
[Sat Jul 18 23:26:43.489253 2026] [security2:error] [pid 881201:tid 881396] [client 31.171.130.22:23185] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/gifclass.php"] [unique_id "alxgEwWL-zKlchkVWS1nOQAAAEA"]
[Sat Jul 18 23:26:43.490715 2026] [security2:error] [pid 881201:tid 881423] [client 31.171.130.1:21499] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/gifclass.php"] [unique_id "alxgEwWL-zKlchkVWS1nOgAAAFs"]
[Sat Jul 18 23:26:43.491609 2026] [security2:error] [pid 881201:tid 881432] [client 31.171.130.21:27137] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/gifclass.php"] [unique_id "alxgEwWL-zKlchkVWS1nOwAAAGQ"]
[Sat Jul 18 23:26:43.562059 2026] [security2:error] [pid 881201:tid 881428] [client 62.45.36.212:40333] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxgEwWL-zKlchkVWS1nLgAAAGA"]
[Sat Jul 18 23:26:43.627968 2026] [security2:error] [pid 881201:tid 881444] [client 124.29.246.106:64851] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxgEwWL-zKlchkVWS1nRAAAAHA"]
[Sat Jul 18 23:26:43.628118 2026] [security2:error] [pid 881201:tid 881444] [client 124.29.246.106:64851] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxgEwWL-zKlchkVWS1nRAAAAHA"]
[Sat Jul 18 23:26:43.662103 2026] [security2:error] [pid 881201:tid 881450] [client 31.171.130.10:46223] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/file.php"] [unique_id "alxgEwWL-zKlchkVWS1nSAAAAHY"]
[Sat Jul 18 23:26:43.751050 2026] [security2:error] [pid 881201:tid 881377] [client 31.171.130.11:47401] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/bless.php"] [unique_id "alxgEwWL-zKlchkVWS1nTwAAAC0"]
[Sat Jul 18 23:26:43.764150 2026] [security2:error] [pid 881201:tid 881431] [client 195.170.172.102:41350] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "lifetalkswithkay.com"] [uri "/wp-content/themes/twentytwentyone/style.css"] [unique_id "alxgEwWL-zKlchkVWS1nUAAAAGM"]
[Sat Jul 18 23:26:43.764250 2026] [security2:error] [pid 881201:tid 881431] [client 195.170.172.102:41350] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "lifetalkswithkay.com"] [uri "/wp-content/themes/twentytwentyone/style.css"] [unique_id "alxgEwWL-zKlchkVWS1nUAAAAGM"]
[Sat Jul 18 23:26:44.005045 2026] [security2:error] [pid 881201:tid 881390] [client 195.170.172.102:41328] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 102.172.170.195.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lifetalkswithkay.com"] [uri "/xmlrpc.php"] [unique_id "alxgEwWL-zKlchkVWS1nWwAAADo"]
[Sat Jul 18 23:26:44.135688 2026] [security2:error] [pid 881201:tid 881452] [client 31.171.130.15:42449] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/bless.php"] [unique_id "alxgFAWL-zKlchkVWS1naQAAAHg"]
[Sat Jul 18 23:26:44.139276 2026] [security2:error] [pid 881201:tid 881441] [client 31.171.130.23:56345] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/bless.php"] [unique_id "alxgFAWL-zKlchkVWS1nawAAAG0"]
[Sat Jul 18 23:26:44.140887 2026] [security2:error] [pid 881201:tid 881449] [client 31.171.130.47:55397] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/gifclass.php"] [unique_id "alxgFAWL-zKlchkVWS1nbAAAAHU"]
[Sat Jul 18 23:26:44.222825 2026] [security2:error] [pid 881201:tid 881435] [client 31.171.130.40:60721] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/gifclass.php"] [unique_id "alxgFAWL-zKlchkVWS1ndQAAAGc"]
[Sat Jul 18 23:26:44.328448 2026] [security2:error] [pid 881201:tid 881359] [client 31.171.130.21:29789] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/flower.php"] [unique_id "alxgFAWL-zKlchkVWS1nfQAAABs"]
[Sat Jul 18 23:26:44.377379 2026] [security2:error] [pid 881201:tid 881406] [client 31.171.130.10:54591] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/bless.php"] [unique_id "alxgFAWL-zKlchkVWS1nfwAAAEo"]
[Sat Jul 18 23:26:44.413436 2026] [security2:error] [pid 881201:tid 881340] [client 31.171.130.30:48737] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/class-t.api.php"] [unique_id "alxgFAWL-zKlchkVWS1nggAAAAg"]
[Sat Jul 18 23:26:44.802273 2026] [security2:error] [pid 881201:tid 881332] [client 31.171.130.8:49365] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/bless.php"] [unique_id "alxgFAWL-zKlchkVWS1nmQAAAAA"]
[Sat Jul 18 23:26:44.842636 2026] [security2:error] [pid 881201:tid 881371] [client 31.171.130.31:22007] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/class-t.api.php"] [unique_id "alxgFAWL-zKlchkVWS1nnAAAACc"]
[Sat Jul 18 23:26:44.844027 2026] [security2:error] [pid 881201:tid 881355] [client 31.171.130.18:20105] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/class-t.api.php"] [unique_id "alxgFAWL-zKlchkVWS1nnQAAABc"]
[Sat Jul 18 23:26:44.984225 2026] [security2:error] [pid 881201:tid 881342] [client 31.171.130.38:51215] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/class-t.api.php"] [unique_id "alxgFAWL-zKlchkVWS1nqwAAAAo"]
[Sat Jul 18 23:26:45.079013 2026] [security2:error] [pid 881201:tid 881411] [client 31.171.130.29:47637] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/bless.php"] [unique_id "alxgFQWL-zKlchkVWS1nrQAAAE8"]
[Sat Jul 18 23:26:45.199036 2026] [security2:error] [pid 881201:tid 881214] [remote 124.156.212.23:31383] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 23.212.156.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mourgroup.com"] [uri "/wp-login.php"] [unique_id "alxgFQWL-zKlchkVWS1ntAAAYws"], referer: https://mourgroup.com/wp-login.php
[Sat Jul 18 23:26:45.502368 2026] [security2:error] [pid 881201:tid 881456] [client 31.171.130.30:50903] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/class-t.api.php"] [unique_id "alxgFQWL-zKlchkVWS1nyAAAAHw"]
[Sat Jul 18 23:26:45.514269 2026] [security2:error] [pid 881201:tid 881430] [client 31.171.130.21:46565] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/blurbs.php"] [unique_id "alxgFQWL-zKlchkVWS1nyQAAAGI"]
[Sat Jul 18 23:26:45.517121 2026] [security2:error] [pid 881201:tid 881443] [client 31.171.130.17:43553] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/blurbs.php"] [unique_id "alxgFQWL-zKlchkVWS1nygAAAG8"]
[Sat Jul 18 23:26:45.588124 2026] [security2:error] [pid 881201:tid 881454] [client 31.171.130.21:40373] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/blurbs.php"] [unique_id "alxgFQWL-zKlchkVWS1nzgAAAHo"]
[Sat Jul 18 23:26:45.654189 2026] [security2:error] [pid 881201:tid 881418] [client 31.171.130.23:59647] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/class-t.api.php"] [unique_id "alxgFQWL-zKlchkVWS1n0AAAAFY"]
[Sat Jul 18 23:26:45.742718 2026] [security2:error] [pid 881201:tid 881334] [client 119.154.81.234:60398] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgFQWL-zKlchkVWS1n1wAAAAI"]
[Sat Jul 18 23:26:45.742848 2026] [security2:error] [pid 881201:tid 881334] [client 119.154.81.234:60398] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgFQWL-zKlchkVWS1n1wAAAAI"]
[Sat Jul 18 23:26:46.077184 2026] [security2:error] [pid 881201:tid 881416] [client 31.171.130.18:34919] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/blurbs.php"] [unique_id "alxgFgWL-zKlchkVWS1n8gAAAFQ"]
[Sat Jul 18 23:26:46.081670 2026] [security2:error] [pid 881201:tid 881359] [client 31.171.130.20:25305] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/bless.php"] [unique_id "alxgFgWL-zKlchkVWS1n8wAAABs"]
[Sat Jul 18 23:26:46.087526 2026] [security2:error] [pid 881201:tid 881408] [client 31.171.130.10:57345] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/gifclass.php"] [unique_id "alxgFgWL-zKlchkVWS1n9AAAAEw"]
[Sat Jul 18 23:26:46.220903 2026] [security2:error] [pid 881201:tid 881398] [client 31.171.130.28:37927] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/blurbs.php"] [unique_id "alxgFgWL-zKlchkVWS1n-gAAAEI"]
[Sat Jul 18 23:26:46.227684 2026] [security2:error] [pid 881201:tid 881456] [client 31.171.130.36:34173] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/akcc.php"] [unique_id "alxgFgWL-zKlchkVWS1n-wAAAHw"]
[Sat Jul 18 23:26:46.577235 2026] [security2:error] [pid 881201:tid 881332] [client 31.171.130.15:60671] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/blurbs.php"] [unique_id "alxgFgWL-zKlchkVWS1oGwAAAAA"]
[Sat Jul 18 23:26:46.582029 2026] [security2:error] [pid 881201:tid 881400] [client 31.171.130.41:64959] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/akcc.php"] [unique_id "alxgFgWL-zKlchkVWS1oHgAAAEQ"]
[Sat Jul 18 23:26:46.582812 2026] [security2:error] [pid 881201:tid 881434] [client 31.171.130.18:42081] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/akcc.php"] [unique_id "alxgFgWL-zKlchkVWS1oIAAAAGY"]
[Sat Jul 18 23:26:46.651482 2026] [security2:error] [pid 881201:tid 881362] [client 31.171.130.47:24183] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/akcc.php"] [unique_id "alxgFgWL-zKlchkVWS1oJgAAAB4"]
[Sat Jul 18 23:26:46.744617 2026] [security2:error] [pid 881201:tid 881374] [client 106.222.249.209:17544] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgFgWL-zKlchkVWS1oKAAAACo"]
[Sat Jul 18 23:26:46.744721 2026] [security2:error] [pid 881201:tid 881374] [client 106.222.249.209:17544] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgFgWL-zKlchkVWS1oKAAAACo"]
[Sat Jul 18 23:26:46.766427 2026] [security2:error] [pid 881201:tid 881339] [client 31.171.130.46:55553] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/bless.php"] [unique_id "alxgFgWL-zKlchkVWS1oKwAAAAc"]
[Sat Jul 18 23:26:46.774413 2026] [security2:error] [pid 881201:tid 881438] [client 31.171.130.8:35315] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/class-t.api.php"] [unique_id "alxgFgWL-zKlchkVWS1oLAAAAGo"]
[Sat Jul 18 23:26:46.807650 2026] [security2:error] [pid 881201:tid 881376] [client 31.171.130.35:64801] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/abcd.php"] [unique_id "alxgFgWL-zKlchkVWS1oLgAAACw"]
[Sat Jul 18 23:26:46.807713 2026] [security2:error] [pid 881201:tid 881446] [client 31.171.130.39:48607] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/akcc.php"] [unique_id "alxgFgWL-zKlchkVWS1oLwAAAHI"]
[Sat Jul 18 23:26:47.177357 2026] [security2:error] [pid 881201:tid 881354] [client 31.171.130.49:21807] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/akcc.php"] [unique_id "alxgFwWL-zKlchkVWS1oSgAAABY"]
[Sat Jul 18 23:26:47.221486 2026] [security2:error] [pid 881201:tid 881439] [client 31.171.130.27:52413] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/abcd.php"] [unique_id "alxgFwWL-zKlchkVWS1oSwAAAGs"]
[Sat Jul 18 23:26:47.258381 2026] [security2:error] [pid 881201:tid 881367] [client 152.237.29.235:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "healthylifegourmet.org"] [uri "/index.php"] [unique_id "alxgFgWL-zKlchkVWS1oLQAAACM"]
[Sat Jul 18 23:26:47.272645 2026] [security2:error] [pid 881201:tid 881390] [client 31.171.130.31:44139] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/abcd.php"] [unique_id "alxgFwWL-zKlchkVWS1oUAAAADo"]
[Sat Jul 18 23:26:47.464726 2026] [security2:error] [pid 881201:tid 881343] [client 31.171.130.9:49791] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/blurbs.php"] [unique_id "alxgFwWL-zKlchkVWS1oXgAAAAs"]
[Sat Jul 18 23:26:47.464839 2026] [security2:error] [pid 881201:tid 881356] [client 31.171.130.40:44009] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/class-t.api.php"] [unique_id "alxgFwWL-zKlchkVWS1oXwAAABg"]
[Sat Jul 18 23:26:47.495131 2026] [security2:error] [pid 881201:tid 881364] [client 31.171.130.51:37713] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/shelp.php"] [unique_id "alxgFwWL-zKlchkVWS1oYQAAACA"]
[Sat Jul 18 23:26:47.744529 2026] [security2:error] [pid 881201:tid 881369] [client 45.3.55.9:40057] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.55.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxgFwWL-zKlchkVWS1ocAAAACU"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:26:47.745678 2026] [security2:error] [pid 881201:tid 881448] [client 31.171.130.51:33333] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/abcd.php"] [unique_id "alxgFwWL-zKlchkVWS1ocQAAAHQ"]
[Sat Jul 18 23:26:47.750904 2026] [security2:error] [pid 881201:tid 881391] [client 163.61.1.17:62129] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgFwWL-zKlchkVWS1ocgAAADs"]
[Sat Jul 18 23:26:47.751001 2026] [security2:error] [pid 881201:tid 881391] [client 163.61.1.17:62129] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgFwWL-zKlchkVWS1ocgAAADs"]
[Sat Jul 18 23:26:47.882335 2026] [security2:error] [pid 881201:tid 881441] [client 31.171.130.34:42495] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/shelp.php"] [unique_id "alxgFwWL-zKlchkVWS1oewAAAG0"]
[Sat Jul 18 23:26:47.883438 2026] [security2:error] [pid 881201:tid 881402] [client 34.73.232.127:57800] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "jhavoctattoos.com"] [uri "/"] [unique_id "alxgFwWL-zKlchkVWS1oeQAAAEY"]
[Sat Jul 18 23:26:47.977822 2026] [security2:error] [pid 881201:tid 881351] [client 45.3.45.97:52579] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 97.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxgFwWL-zKlchkVWS1ofAAAABM"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:26:47.981685 2026] [security2:error] [pid 881201:tid 881388] [client 31.171.130.30:55831] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/akcc.php"] [unique_id "alxgFwWL-zKlchkVWS1ohwAAADg"]
[Sat Jul 18 23:26:48.015854 2026] [security2:error] [pid 881201:tid 881347] [client 31.171.130.4:22221] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/shelp.php"] [unique_id "alxgGAWL-zKlchkVWS1oiQAAAA8"]
[Sat Jul 18 23:26:48.016837 2026] [security2:error] [pid 881201:tid 881359] [client 31.171.130.20:40297] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/cord.php"] [unique_id "alxgGAWL-zKlchkVWS1ojAAAABs"]
[Sat Jul 18 23:26:48.396554 2026] [security2:error] [pid 881201:tid 881370] [client 217.181.90.104:52385] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.90.181.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxgGAWL-zKlchkVWS1oqQAAACY"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:26:48.421211 2026] [security2:error] [pid 881201:tid 881449] [client 223.228.182.224:53147] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxgGAWL-zKlchkVWS1oqwAAAHU"]
[Sat Jul 18 23:26:48.421351 2026] [security2:error] [pid 881201:tid 881449] [client 223.228.182.224:53147] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxgGAWL-zKlchkVWS1oqwAAAHU"]
[Sat Jul 18 23:26:48.523669 2026] [security2:error] [pid 881201:tid 881405] [client 31.171.130.23:61895] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/abcd.php"] [unique_id "alxgGAWL-zKlchkVWS1orQAAAEk"]
[Sat Jul 18 23:26:48.546170 2026] [security2:error] [pid 881201:tid 881391] [client 31.171.130.7:25381] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/abcd.php"] [unique_id "alxgGAWL-zKlchkVWS1osAAAADs"]
[Sat Jul 18 23:26:48.555824 2026] [security2:error] [pid 881201:tid 881418] [client 31.171.130.26:50019] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/shelp.php"] [unique_id "alxgGAWL-zKlchkVWS1otAAAAFY"]
[Sat Jul 18 23:26:48.643456 2026] [security2:error] [pid 881201:tid 881414] [client 4.194.24.143:29554] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "bigwormfishing.com"] [uri "/index.php"] [unique_id "alxgEgWL-zKlchkVWS1myAAAAFI"]
[Sat Jul 18 23:26:48.714251 2026] [security2:error] [pid 881201:tid 881347] [client 31.171.130.1:62367] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/cord.php"] [unique_id "alxgGAWL-zKlchkVWS1ovwAAAA8"]
[Sat Jul 18 23:26:48.757735 2026] [security2:error] [pid 881201:tid 881424] [client 31.171.130.7:26217] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/abcd.php"] [unique_id "alxgGAWL-zKlchkVWS1owgAAAFw"]
[Sat Jul 18 23:26:48.758587 2026] [security2:error] [pid 881201:tid 881385] [client 31.171.130.3:23055] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/cord.php"] [unique_id "alxgGAWL-zKlchkVWS1owwAAADU"]
[Sat Jul 18 23:26:48.823134 2026] [security2:error] [pid 881201:tid 881366] [client 4.194.24.143:29554] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/post.php"] [unique_id "alxgGAWL-zKlchkVWS1oyQAAACI"]
[Sat Jul 18 23:26:49.038946 2026] [security2:error] [pid 881201:tid 881375] [client 65.111.27.193:18791] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.27.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxgGQWL-zKlchkVWS1o3AAAACs"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:26:49.142780 2026] [security2:error] [pid 881201:tid 881451] [client 190.245.146.99:61796] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgGQWL-zKlchkVWS1o6wAAAHc"]
[Sat Jul 18 23:26:49.149096 2026] [security2:error] [pid 881201:tid 881451] [client 190.245.146.99:61796] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgGQWL-zKlchkVWS1o6wAAAHc"]
[Sat Jul 18 23:26:49.158227 2026] [security2:error] [pid 881201:tid 881428] [client 31.171.130.42:43059] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/blurbs.php"] [unique_id "alxgGQWL-zKlchkVWS1o7QAAAGA"]
[Sat Jul 18 23:26:49.167796 2026] [security2:error] [pid 881201:tid 881354] [client 31.171.130.31:63161] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/shelp.php"] [unique_id "alxgGQWL-zKlchkVWS1o8AAAABY"]
[Sat Jul 18 23:26:49.176831 2026] [security2:error] [pid 881201:tid 881397] [client 31.171.130.41:51931] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/shelp.php"] [unique_id "alxgGQWL-zKlchkVWS1o8QAAAEE"]
[Sat Jul 18 23:26:49.225152 2026] [security2:error] [pid 881201:tid 881419] [client 45.145.214.59:60280] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.sesamegreenbeans.com"] [uri "/index.php"] [unique_id "alxgFwWL-zKlchkVWS1oWQAAVzw"]
[Sat Jul 18 23:26:49.417351 2026] [security2:error] [pid 881201:tid 881439] [client 4.194.24.143:34496] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/public/assets/design_1/css/parts/course_cards/grid_card_1.min.php"] [unique_id "alxgGQWL-zKlchkVWS1o_gAAAGs"]
[Sat Jul 18 23:26:49.419998 2026] [security2:error] [pid 881201:tid 881389] [client 31.171.130.52:31741] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/dex.php"] [unique_id "alxgGQWL-zKlchkVWS1o_wAAADk"]
[Sat Jul 18 23:26:49.495923 2026] [security2:error] [pid 881201:tid 881381] [client 31.171.130.41:37887] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/dex.php"] [unique_id "alxgGQWL-zKlchkVWS1pBQAAADE"]
[Sat Jul 18 23:26:49.499882 2026] [security2:error] [pid 881201:tid 881398] [client 31.171.130.3:38311] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/shelp.php"] [unique_id "alxgGQWL-zKlchkVWS1pBgAAAEI"]
[Sat Jul 18 23:26:49.585565 2026] [security2:error] [pid 881201:tid 881335] [client 45.3.45.68:30589] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 68.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxgGQWL-zKlchkVWS1pCAAAAAM"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:26:49.793039 2026] [security2:error] [pid 881201:tid 881334] [client 31.171.130.4:27747] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/cord.php"] [unique_id "alxgGQWL-zKlchkVWS1pGQAAAAI"]
[Sat Jul 18 23:26:49.802955 2026] [security2:error] [pid 881201:tid 881406] [client 31.171.130.41:58403] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/akcc.php"] [unique_id "alxgGQWL-zKlchkVWS1pGwAAAEo"]
[Sat Jul 18 23:26:49.834538 2026] [security2:error] [pid 881201:tid 881453] [client 31.171.130.9:46053] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/dex.php"] [unique_id "alxgGQWL-zKlchkVWS1pHgAAAHk"]
[Sat Jul 18 23:26:49.874699 2026] [security2:error] [pid 881201:tid 881258] [remote 97.74.93.24:52390] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxgGQWL-zKlchkVWS1pIgAARDc"]
[Sat Jul 18 23:26:49.940277 2026] [security2:error] [pid 881201:tid 881376] [client 45.3.45.168:18703] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 168.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxgGQWL-zKlchkVWS1pJAAAACw"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:26:49.990473 2026] [security2:error] [pid 881201:tid 881364] [client 4.194.24.143:17226] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/public/css.php"] [unique_id "alxgGQWL-zKlchkVWS1pLQAAACA"]
[Sat Jul 18 23:26:50.098155 2026] [security2:error] [pid 881201:tid 881396] [client 31.171.130.25:54557] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxgGgWL-zKlchkVWS1pNAAAAEA"]
[Sat Jul 18 23:26:50.098156 2026] [security2:error] [pid 881201:tid 881379] [client 31.171.130.35:45599] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/cord.php"] [unique_id "alxgGgWL-zKlchkVWS1pMwAAAC8"]
[Sat Jul 18 23:26:50.141162 2026] [security2:error] [pid 881201:tid 881393] [client 65.0.26.70:34668] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.26.0.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxgGgWL-zKlchkVWS1pOgAAAD0"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:26:50.282900 2026] [security2:error] [pid 881201:tid 881271] [remote 97.74.93.24:52390] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxgGgWL-zKlchkVWS1pRQAAaUQ"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:26:50.371954 2026] [security2:error] [pid 881201:tid 881361] [client 31.171.130.41:58349] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/dex.php"] [unique_id "alxgGgWL-zKlchkVWS1pSwAAAB0"]
[Sat Jul 18 23:26:50.380936 2026] [security2:error] [pid 881201:tid 881406] [client 31.171.130.3:46033] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/cord.php"] [unique_id "alxgGgWL-zKlchkVWS1pTgAAAEo"]
[Sat Jul 18 23:26:50.392219 2026] [security2:error] [pid 881201:tid 881418] [client 31.171.130.3:34883] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/abcd.php"] [unique_id "alxgGgWL-zKlchkVWS1pTwAAAFY"]
[Sat Jul 18 23:26:50.392555 2026] [security2:error] [pid 881201:tid 881438] [client 31.171.130.18:28963] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxgGgWL-zKlchkVWS1pUAAAAGo"]
[Sat Jul 18 23:26:50.506457 2026] [security2:error] [pid 881201:tid 881412] [client 57.141.18.89:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "falconarrowshop.com"] [uri "/index.php"] [unique_id "alxgGAWL-zKlchkVWS1ojwAAAFA"]
[Sat Jul 18 23:26:50.533390 2026] [security2:error] [pid 881201:tid 881455] [client 4.194.24.143:17163] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/r.php"] [unique_id "alxgGgWL-zKlchkVWS1paQAAAHs"]
[Sat Jul 18 23:26:50.683090 2026] [security2:error] [pid 881201:tid 881420] [client 31.171.130.5:57981] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/zwso.php"] [unique_id "alxgGgWL-zKlchkVWS1pfAAAAFg"]
[Sat Jul 18 23:26:50.683092 2026] [security2:error] [pid 881201:tid 881336] [client 31.171.130.19:62479] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/dex.php"] [unique_id "alxgGgWL-zKlchkVWS1pewAAAAQ"]
[Sat Jul 18 23:26:50.685302 2026] [security2:error] [pid 881201:tid 881381] [client 31.171.130.52:40001] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/cord.php"] [unique_id "alxgGgWL-zKlchkVWS1pfQAAADE"]
[Sat Jul 18 23:26:50.733410 2026] [security2:error] [pid 881201:tid 881371] [client 27.34.68.67:34200] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgGgWL-zKlchkVWS1pfwAAACc"]
[Sat Jul 18 23:26:50.733515 2026] [security2:error] [pid 881201:tid 881371] [client 27.34.68.67:34200] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgGgWL-zKlchkVWS1pfwAAACc"]
[Sat Jul 18 23:26:50.890841 2026] [security2:error] [pid 881201:tid 881356] [client 14.168.193.72:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.maxenengineering.com"] [uri "/maxenengineering/index.php"] [unique_id "alxgGAWL-zKlchkVWS1oyAAAABg"]
[Sat Jul 18 23:26:51.017979 2026] [security2:error] [pid 881201:tid 881451] [client 31.171.130.41:50447] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxgGwWL-zKlchkVWS1piQAAAHc"]
[Sat Jul 18 23:26:51.017982 2026] [security2:error] [pid 881201:tid 881418] [client 31.171.130.32:58471] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxgGwWL-zKlchkVWS1pigAAAFY"]
[Sat Jul 18 23:26:51.018958 2026] [security2:error] [pid 881201:tid 881438] [client 31.171.130.9:36403] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/shelp.php"] [unique_id "alxgGwWL-zKlchkVWS1piwAAAGo"]
[Sat Jul 18 23:26:51.024079 2026] [security2:error] [pid 881201:tid 881419] [client 31.171.130.32:35665] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/zwso.php"] [unique_id "alxgGwWL-zKlchkVWS1pjAAAAFc"]
[Sat Jul 18 23:26:51.028602 2026] [security2:error] [pid 881201:tid 881357] [client 31.171.130.13:40089] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/dex.php"] [unique_id "alxgGwWL-zKlchkVWS1pjgAAABk"]
[Sat Jul 18 23:26:51.083146 2026] [security2:error] [pid 881201:tid 881437] [client 4.194.24.143:17372] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/radio.php"] [unique_id "alxgGwWL-zKlchkVWS1pkwAAAGk"]
[Sat Jul 18 23:26:51.283214 2026] [security2:error] [pid 881201:tid 881381] [client 31.171.130.52:57379] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxgGwWL-zKlchkVWS1poQAAADE"]
[Sat Jul 18 23:26:51.300035 2026] [security2:error] [pid 881201:tid 881344] [client 31.171.130.2:31105] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxgGwWL-zKlchkVWS1powAAAAw"]
[Sat Jul 18 23:26:51.301085 2026] [security2:error] [pid 881201:tid 881421] [client 31.171.130.38:52885] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/dex.php"] [unique_id "alxgGwWL-zKlchkVWS1ppAAAAFk"]
[Sat Jul 18 23:26:51.378914 2026] [security2:error] [pid 881201:tid 881363] [client 65.111.28.154:34633] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxgGwWL-zKlchkVWS1pqQAAAB8"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:26:51.398656 2026] [security2:error] [pid 881201:tid 881355] [client 13.232.206.133:27296] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.206.232.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxgGwWL-zKlchkVWS1pqAAAABc"]
[Sat Jul 18 23:26:51.398736 2026] [security2:error] [pid 881201:tid 881355] [client 13.232.206.133:27296] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxgGwWL-zKlchkVWS1pqAAAABc"]
[Sat Jul 18 23:26:51.499781 2026] [security2:error] [pid 881201:tid 881436] [client 50.116.65.227:50388] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxgGwWL-zKlchkVWS1prgAAAGg"]
[Sat Jul 18 23:26:51.503995 2026] [security2:error] [pid 881201:tid 881430] [client 4.194.24.143:49728] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/nine2code.php"] [unique_id "alxgGwWL-zKlchkVWS1prwAAAGI"]
[Sat Jul 18 23:26:51.513823 2026] [security2:error] [pid 881201:tid 881342] [client 50.116.65.227:31066] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxgGwWL-zKlchkVWS1psQAAAAo"]
[Sat Jul 18 23:26:51.579443 2026] [security2:error] [pid 881201:tid 881357] [client 31.171.130.40:29107] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/cord.php"] [unique_id "alxgGwWL-zKlchkVWS1pswAAABk"]
[Sat Jul 18 23:26:51.580095 2026] [security2:error] [pid 881201:tid 881347] [client 31.171.130.11:38787] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/zwso.php"] [unique_id "alxgGwWL-zKlchkVWS1ptAAAAA8"]
[Sat Jul 18 23:26:51.582235 2026] [security2:error] [pid 881201:tid 881367] [client 31.171.130.6:49253] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxgGwWL-zKlchkVWS1ptQAAACM"]
[Sat Jul 18 23:26:51.582859 2026] [security2:error] [pid 881201:tid 881459] [client 31.171.130.47:60273] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxgGwWL-zKlchkVWS1ptgAAAH8"]
[Sat Jul 18 23:26:51.608788 2026] [security2:error] [pid 881201:tid 881351] [client 223.185.61.63:13541] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxgGwWL-zKlchkVWS1pvAAAABM"]
[Sat Jul 18 23:26:51.617989 2026] [security2:error] [pid 881201:tid 881351] [client 223.185.61.63:13541] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxgGwWL-zKlchkVWS1pvAAAABM"]
[Sat Jul 18 23:26:51.691508 2026] [security2:error] [pid 881201:tid 881349] [client 4.194.24.143:34502] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/randkeyword.php7"] [unique_id "alxgGwWL-zKlchkVWS1pxQAAABE"]
[Sat Jul 18 23:26:51.907566 2026] [security2:error] [pid 881201:tid 881378] [client 31.171.130.18:54257] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxgGwWL-zKlchkVWS1p0gAAAC4"]
[Sat Jul 18 23:26:51.931346 2026] [security2:error] [pid 881201:tid 881436] [client 31.171.130.41:24311] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/zwso.php"] [unique_id "alxgGwWL-zKlchkVWS1p0wAAAGg"]
[Sat Jul 18 23:26:51.995011 2026] [security2:error] [pid 881201:tid 881333] [client 31.171.130.28:30651] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/bolt.php"] [unique_id "alxgGwWL-zKlchkVWS1p1AAAAAE"]
[Sat Jul 18 23:26:52.192217 2026] [security2:error] [pid 881201:tid 881390] [client 31.171.130.42:29101] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/dex.php"] [unique_id "alxgHAWL-zKlchkVWS1p4QAAADo"]
[Sat Jul 18 23:26:52.223464 2026] [security2:error] [pid 881201:tid 881393] [client 31.171.130.1:44709] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxgHAWL-zKlchkVWS1p4gAAAD0"]
[Sat Jul 18 23:26:52.235348 2026] [security2:error] [pid 881201:tid 881412] [client 31.171.130.37:59931] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/bolt.php"] [unique_id "alxgHAWL-zKlchkVWS1p4wAAAFA"]
[Sat Jul 18 23:26:52.237597 2026] [security2:error] [pid 881201:tid 881365] [client 4.194.24.143:49742] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/num.php"] [unique_id "alxgHAWL-zKlchkVWS1p5AAAACE"]
[Sat Jul 18 23:26:52.254249 2026] [security2:error] [pid 881201:tid 881347] [client 4.194.24.143:30343] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/readme.php"] [unique_id "alxgHAWL-zKlchkVWS1p5wAAAA8"]
[Sat Jul 18 23:26:52.665673 2026] [security2:error] [pid 881201:tid 881404] [client 31.171.130.32:34075] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/zwso.php"] [unique_id "alxgHAWL-zKlchkVWS1qAQAAAEg"]
[Sat Jul 18 23:26:52.679244 2026] [security2:error] [pid 881201:tid 881392] [client 31.171.130.12:21685] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxgHAWL-zKlchkVWS1qBgAAADw"]
[Sat Jul 18 23:26:52.681200 2026] [security2:error] [pid 881201:tid 881357] [client 31.171.130.50:30475] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/zwso.php"] [unique_id "alxgHAWL-zKlchkVWS1qCAAAABk"]
[Sat Jul 18 23:26:52.686066 2026] [security2:error] [pid 881201:tid 881376] [client 31.171.130.45:52803] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/cjfuns.php"] [unique_id "alxgHAWL-zKlchkVWS1qCQAAACw"]
[Sat Jul 18 23:26:52.740237 2026] [security2:error] [pid 881201:tid 881382] [client 31.171.130.47:38263] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxgHAWL-zKlchkVWS1qDgAAADI"]
[Sat Jul 18 23:26:52.794436 2026] [security2:error] [pid 881201:tid 881451] [client 4.194.24.143:32706] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/reze.php"] [unique_id "alxgHAWL-zKlchkVWS1qFAAAAHc"]
[Sat Jul 18 23:26:52.805485 2026] [security2:error] [pid 881201:tid 881366] [client 31.171.130.24:36433] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/cjfuns.php"] [unique_id "alxgHAWL-zKlchkVWS1qFQAAACI"]
[Sat Jul 18 23:26:52.962492 2026] [security2:error] [pid 881201:tid 881431] [client 4.194.24.143:34433] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/odf7udtspqtpxzyxmw2rccdefault.php"] [unique_id "alxgHAWL-zKlchkVWS1qGwAAAGM"]
[Sat Jul 18 23:26:53.173028 2026] [security2:error] [pid 881201:tid 881430] [client 31.171.130.2:37981] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/zwso.php"] [unique_id "alxgHQWL-zKlchkVWS1qJgAAAGI"]
[Sat Jul 18 23:26:53.234518 2026] [security2:error] [pid 881201:tid 881387] [client 31.171.130.8:44549] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxgHQWL-zKlchkVWS1qKwAAADc"]
[Sat Jul 18 23:26:53.316257 2026] [security2:error] [pid 881201:tid 881393] [client 31.171.130.28:43219] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxgHQWL-zKlchkVWS1qLwAAAD0"]
[Sat Jul 18 23:26:53.340373 2026] [security2:error] [pid 881201:tid 881347] [client 31.171.130.8:53299] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/zwso.php"] [unique_id "alxgHQWL-zKlchkVWS1qMwAAAA8"]
[Sat Jul 18 23:26:53.344603 2026] [security2:error] [pid 881201:tid 881429] [client 4.194.24.143:21052] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/rh.php"] [unique_id "alxgHQWL-zKlchkVWS1qNQAAAGE"]
[Sat Jul 18 23:26:53.349599 2026] [security2:error] [pid 881201:tid 881391] [client 31.171.130.29:32659] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/bolt.php"] [unique_id "alxgHQWL-zKlchkVWS1qNgAAADs"]
[Sat Jul 18 23:26:53.355661 2026] [security2:error] [pid 881201:tid 881451] [client 31.171.130.20:22199] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxgHQWL-zKlchkVWS1qOAAAAHc"]
[Sat Jul 18 23:26:53.414715 2026] [security2:error] [pid 881201:tid 881249] [remote 134.209.147.209:55604] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.147.209.134.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/wp-login.php"] [unique_id "alxgHQWL-zKlchkVWS1qOwAAGC4"]
[Sat Jul 18 23:26:53.742295 2026] [security2:error] [pid 881201:tid 881416] [client 31.171.130.18:41333] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxgHQWL-zKlchkVWS1qTgAAAFQ"]
[Sat Jul 18 23:26:53.815955 2026] [security2:error] [pid 881201:tid 881210] [remote 134.209.147.209:55604] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.147.209.134.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/wp-login.php"] [unique_id "alxgHQWL-zKlchkVWS1qUwAAOgc"], referer: https://securingmemories.com/wp-login.php
[Sat Jul 18 23:26:53.850179 2026] [security2:error] [pid 881201:tid 881366] [client 31.171.130.50:59875] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/bolt.php"] [unique_id "alxgHQWL-zKlchkVWS1qVwAAACI"]
[Sat Jul 18 23:26:53.893421 2026] [security2:error] [pid 881201:tid 881347] [client 4.194.24.143:34522] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/rip.php"] [unique_id "alxgHQWL-zKlchkVWS1qWQAAAA8"]
[Sat Jul 18 23:26:53.924959 2026] [security2:error] [pid 881201:tid 881362] [client 31.171.130.35:45665] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/cjfuns.php"] [unique_id "alxgHQWL-zKlchkVWS1qXgAAAB4"]
[Sat Jul 18 23:26:53.925330 2026] [security2:error] [pid 881201:tid 881374] [client 31.171.130.5:54059] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/bolt.php"] [unique_id "alxgHQWL-zKlchkVWS1qXwAAACo"]
[Sat Jul 18 23:26:53.942870 2026] [security2:error] [pid 881201:tid 881379] [client 31.171.130.7:27851] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxgHQWL-zKlchkVWS1qYAAAAC8"]
[Sat Jul 18 23:26:53.973532 2026] [security2:error] [pid 881201:tid 881341] [client 31.171.130.36:44631] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxgHQWL-zKlchkVWS1qZQAAAAk"]
[Sat Jul 18 23:26:53.974176 2026] [security2:error] [pid 881201:tid 881424] [client 31.171.130.9:53685] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxgHQWL-zKlchkVWS1qZgAAAFw"]
[Sat Jul 18 23:26:54.056791 2026] [security2:error] [pid 881201:tid 881404] [client 4.194.24.143:56825] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/option.php"] [unique_id "alxgHgWL-zKlchkVWS1qbgAAAEg"]
[Sat Jul 18 23:26:54.185357 2026] [security2:error] [pid 881201:tid 881402] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxgHgWL-zKlchkVWS1qbAAAAEY"]
[Sat Jul 18 23:26:54.193483 2026] [http2:info] [pid 890058:tid 890058] h2_workers: created with min=128 max=192 idle_ms=600000
[Sat Jul 18 23:26:54.273893 2026] [security2:error] [pid 890058:tid 890188] [client 31.171.130.3:21153] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/bolt.php"] [unique_id "alxgHnzbEu1Ap1Mwpo-foQAAAQo"]
[Sat Jul 18 23:26:54.404832 2026] [security2:error] [pid 881201:tid 881359] [client 31.171.130.8:51905] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/wp-admin/css/index.php"] [unique_id "alxgHgWL-zKlchkVWS1qfgAAABs"]
[Sat Jul 18 23:26:54.434325 2026] [security2:error] [pid 881201:tid 881367] [client 4.194.24.143:21049] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/root.php"] [unique_id "alxgHgWL-zKlchkVWS1qhAAAACM"]
[Sat Jul 18 23:26:54.438013 2026] [security2:error] [pid 881201:tid 881392] [client 31.171.130.33:52317] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/cjfuns.php"] [unique_id "alxgHgWL-zKlchkVWS1qhQAAADw"]
[Sat Jul 18 23:26:54.440223 2026] [security2:error] [pid 881201:tid 881268] [remote 20.153.140.50:45014] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "roguedragonstudio.com"] [uri "/wp-login.php"] [unique_id "alxgHgWL-zKlchkVWS1qggAAMEE"]
[Sat Jul 18 23:26:54.450635 2026] [security2:error] [pid 881201:tid 881402] [client 50.116.65.227:50398] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxgHgWL-zKlchkVWS1qhgAAAEY"]
[Sat Jul 18 23:26:54.452162 2026] [security2:error] [pid 890058:tid 890194] [client 31.171.130.4:29787] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxgHnzbEu1Ap1Mwpo-fpAAAARA"]
[Sat Jul 18 23:26:54.453182 2026] [security2:error] [pid 890058:tid 890194] [client 31.171.130.27:42477] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/wp-content/index.php"] [unique_id "alxgHnzbEu1Ap1Mwpo-fpQAAARA"]
[Sat Jul 18 23:26:54.453198 2026] [security2:error] [pid 881201:tid 881429] [client 31.171.130.21:28057] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/wp-content/index.php"] [unique_id "alxgHgWL-zKlchkVWS1qhwAAAGE"]
[Sat Jul 18 23:26:54.462098 2026] [security2:error] [pid 890058:tid 890196] [client 31.171.130.20:43733] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/bolt.php"] [unique_id "alxgHnzbEu1Ap1Mwpo-fpgAAARI"]
[Sat Jul 18 23:26:54.463485 2026] [security2:error] [pid 881201:tid 881336] [client 50.116.65.227:31086] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxgHgWL-zKlchkVWS1qiAAAAAQ"]
[Sat Jul 18 23:26:54.635094 2026] [security2:error] [pid 881201:tid 881405] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxgHgWL-zKlchkVWS1qgwAAAEk"]
[Sat Jul 18 23:26:54.726261 2026] [security2:error] [pid 881201:tid 881241] [remote 72.167.132.114:50780] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxgHgWL-zKlchkVWS1qkAAANyY"]
[Sat Jul 18 23:26:54.853443 2026] [security2:error] [pid 881201:tid 881269] [remote 20.153.140.50:45014] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "roguedragonstudio.com"] [uri "/wp-login.php"] [unique_id "alxgHgWL-zKlchkVWS1qlwAAZkI"], referer: https://roguedragonstudio.com/wp-login.php
[Sat Jul 18 23:26:54.872242 2026] [security2:error] [pid 890058:tid 890216] [client 34.73.232.127:61086] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "jhavoctattoos.com"] [uri "/"] [unique_id "alxgHnzbEu1Ap1Mwpo-fsQAAASY"]
[Sat Jul 18 23:26:54.951376 2026] [security2:error] [pid 881201:tid 881423] [client 31.171.130.37:45997] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/wp-content/plugins/index.php"] [unique_id "alxgHgWL-zKlchkVWS1qngAAAFs"]
[Sat Jul 18 23:26:54.978041 2026] [security2:error] [pid 890058:tid 890212] [client 4.194.24.143:17349] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/s.php"] [unique_id "alxgHnzbEu1Ap1Mwpo-ftQAAASI"]
[Sat Jul 18 23:26:54.990580 2026] [security2:error] [pid 890058:tid 890203] [client 4.194.24.143:22934] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/p.php"] [unique_id "alxgHnzbEu1Ap1Mwpo-ftgAAARk"]
[Sat Jul 18 23:26:55.050299 2026] [security2:error] [pid 890058:tid 890227] [client 74.7.228.58:43944] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "404"] [hostname "mail.entraalnuevomundo.com"] [uri "/robots.txt"] [unique_id "alxgH3zbEu1Ap1Mwpo-fuAABMQI"]
[Sat Jul 18 23:26:55.074400 2026] [security2:error] [pid 890058:tid 890231] [client 31.171.130.34:32753] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/ioxi-o.php"] [unique_id "alxgH3zbEu1Ap1Mwpo-fuwAAATU"]
[Sat Jul 18 23:26:55.121867 2026] [security2:error] [pid 890058:tid 890239] [client 31.171.130.8:41413] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/bolt.php"] [unique_id "alxgH3zbEu1Ap1Mwpo-fvQAAAT0"]
[Sat Jul 18 23:26:55.122467 2026] [security2:error] [pid 890058:tid 890240] [client 31.171.130.35:61089] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/ioxi-o.php"] [unique_id "alxgH3zbEu1Ap1Mwpo-fvgAAAT4"]
[Sat Jul 18 23:26:55.152462 2026] [security2:error] [pid 890058:tid 890243] [client 31.171.130.28:34579] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxgH3zbEu1Ap1Mwpo-fwAAAAUE"]
[Sat Jul 18 23:26:55.491272 2026] [security2:error] [pid 890058:tid 890260] [client 31.171.130.22:42383] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/cjfuns.php"] [unique_id "alxgH3zbEu1Ap1Mwpo-fxAAAAVI"]
[Sat Jul 18 23:26:55.542901 2026] [security2:error] [pid 881201:tid 881351] [client 4.194.24.143:29560] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/sang.php"] [unique_id "alxgHwWL-zKlchkVWS1qsQAAABM"]
[Sat Jul 18 23:26:55.640762 2026] [security2:error] [pid 881201:tid 881283] [remote 72.167.132.114:50780] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxgHwWL-zKlchkVWS1qtQAAB1A"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:26:55.826012 2026] [security2:error] [pid 881201:tid 881452] [client 31.171.130.22:23001] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/insc.php"] [unique_id "alxgHwWL-zKlchkVWS1qvQAAAHg"]
[Sat Jul 18 23:26:55.826733 2026] [security2:error] [pid 890058:tid 890275] [client 31.171.130.49:54905] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/wp-content/index.php"] [unique_id "alxgH3zbEu1Ap1Mwpo-fywAAAWE"]
[Sat Jul 18 23:26:55.835726 2026] [security2:error] [pid 890058:tid 890276] [client 31.171.130.8:45859] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/cjfuns.php"] [unique_id "alxgH3zbEu1Ap1Mwpo-fzAAAAWI"]
[Sat Jul 18 23:26:55.890657 2026] [security2:error] [pid 890058:tid 890280] [client 31.171.130.20:64221] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxgH3zbEu1Ap1Mwpo-fzwAAAWY"]
[Sat Jul 18 23:26:55.985131 2026] [security2:error] [pid 890058:tid 890290] [client 31.171.130.49:33497] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/insc.php"] [unique_id "alxgH3zbEu1Ap1Mwpo-f1QAAAXA"]
[Sat Jul 18 23:26:55.985234 2026] [security2:error] [pid 890058:tid 890289] [client 31.171.130.52:47695] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/cjfuns.php"] [unique_id "alxgH3zbEu1Ap1Mwpo-f1AAAAW8"]
[Sat Jul 18 23:26:56.037643 2026] [security2:error] [pid 881201:tid 881433] [client 31.171.130.10:33595] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxgIAWL-zKlchkVWS1qxQAAAGU"]
[Sat Jul 18 23:26:56.067400 2026] [security2:error] [pid 890058:tid 890297] [client 18.195.15.81:34250] ModSecurity: Warning. Matched phrase "ADmantX" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "curlsnpearlsss.com"] [uri "/puerto-rican-beans-habichuelas-guisadas"] [unique_id "alxgIHzbEu1Ap1Mwpo-f1wAAAXc"]
[Sat Jul 18 23:26:56.117904 2026] [security2:error] [pid 890058:tid 890282] [client 4.194.24.143:17160] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/scxy.php"] [unique_id "alxgIHzbEu1Ap1Mwpo-f2AAAAWg"]
[Sat Jul 18 23:26:56.131721 2026] [security2:error] [pid 890058:tid 890303] [client 31.171.130.6:47733] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/cjfuns.php"] [unique_id "alxgIHzbEu1Ap1Mwpo-f2gAAAX0"]
[Sat Jul 18 23:26:56.157144 2026] [security2:error] [pid 890058:tid 890279] [client 4.194.24.143:22924] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/past.php"] [unique_id "alxgIHzbEu1Ap1Mwpo-f2wAAAWU"]
[Sat Jul 18 23:26:56.356074 2026] [security2:error] [pid 881201:tid 881405] [client 119.154.81.234:60848] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgIAWL-zKlchkVWS1qzgAAAEk"]
[Sat Jul 18 23:26:56.356215 2026] [security2:error] [pid 881201:tid 881405] [client 119.154.81.234:60848] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgIAWL-zKlchkVWS1qzgAAAEk"]
[Sat Jul 18 23:26:56.425080 2026] [security2:error] [pid 890058:tid 890195] [client 31.171.130.45:24137] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/classwithtostring.php"] [unique_id "alxgIHzbEu1Ap1Mwpo-f4wAAARE"]
[Sat Jul 18 23:26:56.434544 2026] [security2:error] [pid 881201:tid 881424] [client 31.171.130.50:32957] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/wp-content/index.php"] [unique_id "alxgIAWL-zKlchkVWS1qzwAAAFw"]
[Sat Jul 18 23:26:56.440346 2026] [security2:error] [pid 881201:tid 881356] [client 31.171.130.50:52669] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/ioxi-o.php"] [unique_id "alxgIAWL-zKlchkVWS1q0QAAABg"]
[Sat Jul 18 23:26:56.450682 2026] [security2:error] [pid 890058:tid 890196] [client 31.171.130.33:55493] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxgIHzbEu1Ap1Mwpo-f5gAAARI"]
[Sat Jul 18 23:26:56.531234 2026] [security2:error] [pid 890058:tid 890202] [client 31.171.130.44:36873] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/classwithtostring.php"] [unique_id "alxgIHzbEu1Ap1Mwpo-f7QAAARg"]
[Sat Jul 18 23:26:56.633764 2026] [security2:error] [pid 890058:tid 890234] [client 31.171.130.2:50623] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxgIHzbEu1Ap1Mwpo-f9QAAATg"]
[Sat Jul 18 23:26:56.662257 2026] [security2:error] [pid 890058:tid 890205] [client 4.194.24.143:29537] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/sd.php"] [unique_id "alxgIHzbEu1Ap1Mwpo-f9gAAARs"]
[Sat Jul 18 23:26:56.911112 2026] [security2:error] [pid 890058:tid 890213] [client 31.171.130.13:45655] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/txets.php"] [unique_id "alxgIHzbEu1Ap1Mwpo-f_wAAASM"]
[Sat Jul 18 23:26:56.922986 2026] [security2:error] [pid 881201:tid 881420] [client 31.171.130.45:35527] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/ioxi-o.php"] [unique_id "alxgIAWL-zKlchkVWS1q4AAAAFg"]
[Sat Jul 18 23:26:56.933894 2026] [security2:error] [pid 890058:tid 890252] [client 31.171.130.16:25113] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/insc.php"] [unique_id "alxgIHzbEu1Ap1Mwpo-gAAAAAUo"]
[Sat Jul 18 23:26:56.937174 2026] [security2:error] [pid 890058:tid 890253] [client 31.171.130.45:24371] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxgIHzbEu1Ap1Mwpo-gAQAAAUs"]
[Sat Jul 18 23:26:57.022107 2026] [security2:error] [pid 881201:tid 881381] [client 31.171.130.27:48219] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/txets.php"] [unique_id "alxgIQWL-zKlchkVWS1q5AAAADE"]
[Sat Jul 18 23:26:57.037051 2026] [security2:error] [pid 890058:tid 890225] [client 3.64.55.230:0] ModSecurity: Warning. Matched phrase "ADmantX" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "curlsnpearlsss.com"] [uri "/index.php"] [unique_id "alxgIHzbEu1Ap1Mwpo-f8wAAAS8"]
[Sat Jul 18 23:26:57.039322 2026] [security2:error] [pid 890058:tid 890192] [client 3.64.55.230:47472] ModSecurity: Warning. Matched phrase "ADmantX" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "curlsnpearlsss.com"] [uri "/puerto-rican-beans-habichuelas-guisadas"] [unique_id "alxgIHzbEu1Ap1Mwpo-f8AAAAQ4"]
[Sat Jul 18 23:26:57.119097 2026] [security2:error] [pid 890058:tid 890269] [client 31.171.130.5:25077] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxgIXzbEu1Ap1Mwpo-gBwAAAVs"]
[Sat Jul 18 23:26:57.237574 2026] [security2:error] [pid 881201:tid 881447] [client 4.194.24.143:29536] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/sf.php"] [unique_id "alxgIQWL-zKlchkVWS1q6wAAAHM"]
[Sat Jul 18 23:26:57.390370 2026] [security2:error] [pid 881201:tid 881395] [client 31.171.130.35:21155] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxgIQWL-zKlchkVWS1q8AAAAD8"]
[Sat Jul 18 23:26:57.407663 2026] [security2:error] [pid 881201:tid 881450] [client 31.171.130.47:59197] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/classwithtostring.php"] [unique_id "alxgIQWL-zKlchkVWS1q8QAAAHY"]
[Sat Jul 18 23:26:57.418055 2026] [security2:error] [pid 890058:tid 890293] [client 31.171.130.33:50733] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/wp-content/index.php"] [unique_id "alxgIXzbEu1Ap1Mwpo-gCwAAAXM"]
[Sat Jul 18 23:26:57.433090 2026] [security2:error] [pid 881201:tid 881339] [client 31.171.130.47:22171] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/insc.php"] [unique_id "alxgIQWL-zKlchkVWS1q8gAAAAc"]
[Sat Jul 18 23:26:57.495394 2026] [security2:error] [pid 881201:tid 881364] [client 106.222.249.209:9249] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgIQWL-zKlchkVWS1q-AAAACA"]
[Sat Jul 18 23:26:57.495669 2026] [security2:error] [pid 881201:tid 881364] [client 106.222.249.209:9249] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgIQWL-zKlchkVWS1q-AAAACA"]
[Sat Jul 18 23:26:57.529001 2026] [security2:error] [pid 890058:tid 890296] [client 31.171.130.9:46099] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxgIXzbEu1Ap1Mwpo-gDwAAAXY"]
[Sat Jul 18 23:26:57.593586 2026] [security2:error] [pid 890058:tid 890300] [client 31.171.130.40:24621] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxgIXzbEu1Ap1Mwpo-gEgAAAXo"]
[Sat Jul 18 23:26:57.594509 2026] [security2:error] [pid 890058:tid 890301] [client 31.171.130.49:61611] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/wp-content/index.php"] [unique_id "alxgIXzbEu1Ap1Mwpo-gEwAAAXs"]
[Sat Jul 18 23:26:57.594974 2026] [security2:error] [pid 881201:tid 881445] [client 31.171.130.20:55841] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxgIQWL-zKlchkVWS1q-wAAAHE"]
[Sat Jul 18 23:26:57.794473 2026] [security2:error] [pid 881201:tid 881428] [client 4.194.24.143:21018] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/shell.php"] [unique_id "alxgIQWL-zKlchkVWS1rAwAAAGA"]
[Sat Jul 18 23:26:57.864255 2026] [security2:error] [pid 881201:tid 881374] [client 31.171.130.16:25515] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/wp-admin/txets.php"] [unique_id "alxgIQWL-zKlchkVWS1rCAAAACo"]
[Sat Jul 18 23:26:57.884410 2026] [security2:error] [pid 881201:tid 881421] [client 31.171.130.7:63407] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/txets.php"] [unique_id "alxgIQWL-zKlchkVWS1rCgAAAFk"]
[Sat Jul 18 23:26:57.909580 2026] [security2:error] [pid 881201:tid 881453] [client 31.171.130.12:65165] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/classwithtostring.php"] [unique_id "alxgIQWL-zKlchkVWS1rCwAAAHk"]
[Sat Jul 18 23:26:58.003527 2026] [security2:error] [pid 881201:tid 881414] [client 31.171.130.36:30483] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/wp-admin/txets.php"] [unique_id "alxgIgWL-zKlchkVWS1rDQAAAFI"]
[Sat Jul 18 23:26:58.061302 2026] [security2:error] [pid 881201:tid 881393] [client 4.194.24.143:59475] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/php.php"] [unique_id "alxgIgWL-zKlchkVWS1rEwAAAD0"]
[Sat Jul 18 23:26:58.085185 2026] [security2:error] [pid 881201:tid 881401] [client 31.171.130.39:53641] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/ioxi-o.php"] [unique_id "alxgIgWL-zKlchkVWS1rFQAAAEU"]
[Sat Jul 18 23:26:58.085643 2026] [security2:error] [pid 890058:tid 890195] [client 31.171.130.11:47249] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/wp-content/index.php"] [unique_id "alxgInzbEu1Ap1Mwpo-gGQAAARE"]
[Sat Jul 18 23:26:58.212497 2026] [security2:error] [pid 890058:tid 890297] [client 3.64.55.230:0] ModSecurity: Warning. Matched phrase "ADmantX" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "curlsnpearlsss.com"] [uri "/index.php"] [unique_id "alxgIXzbEu1Ap1Mwpo-gDQAAAXc"]
[Sat Jul 18 23:26:58.243662 2026] [security2:error] [pid 881201:tid 881456] [client 3.64.55.230:47478] ModSecurity: Warning. Matched phrase "ADmantX" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "curlsnpearlsss.com"] [uri "/puerto-rican-beans-habichuelas-guisadas/"] [unique_id "alxgIQWL-zKlchkVWS1q9gAAAHw"]
[Sat Jul 18 23:26:58.278030 2026] [security2:error] [pid 890058:tid 890278] [client 163.61.1.17:62559] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgInzbEu1Ap1Mwpo-gHwAAAWQ"]
[Sat Jul 18 23:26:58.278166 2026] [security2:error] [pid 890058:tid 890278] [client 163.61.1.17:62559] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgInzbEu1Ap1Mwpo-gHwAAAWQ"]
[Sat Jul 18 23:26:58.354677 2026] [security2:error] [pid 890058:tid 890222] [client 31.171.130.22:51267] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/wp-includes/txets.php"] [unique_id "alxgInzbEu1Ap1Mwpo-gIgAAASw"]
[Sat Jul 18 23:26:58.404263 2026] [security2:error] [pid 890058:tid 890226] [client 31.171.130.34:35447] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/wp-content/themes/txets.php"] [unique_id "alxgInzbEu1Ap1Mwpo-gKAAAATA"]
[Sat Jul 18 23:26:58.487355 2026] [security2:error] [pid 890058:tid 890232] [client 31.171.130.10:33843] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/wp-includes/txets.php"] [unique_id "alxgInzbEu1Ap1Mwpo-gLgAAATY"]
[Sat Jul 18 23:26:58.489306 2026] [security2:error] [pid 881201:tid 881386] [client 4.194.24.143:30955] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "bigwormfishing.com"] [uri "/index.php"] [unique_id "alxgIgWL-zKlchkVWS1rGwAAADY"]
[Sat Jul 18 23:26:58.587007 2026] [security2:error] [pid 881201:tid 881436] [client 31.171.130.49:46669] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/ioxi-o.php"] [unique_id "alxgIgWL-zKlchkVWS1rJAAAAGg"]
[Sat Jul 18 23:26:58.603922 2026] [security2:error] [pid 890058:tid 890238] [client 31.171.130.24:54923] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/insc.php"] [unique_id "alxgInzbEu1Ap1Mwpo-gMAAAATw"]
[Sat Jul 18 23:26:58.667844 2026] [security2:error] [pid 881201:tid 881359] [client 4.194.24.143:30955] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/sid3.php"] [unique_id "alxgIgWL-zKlchkVWS1rKQAAABs"]
[Sat Jul 18 23:26:58.680643 2026] [security2:error] [pid 890058:tid 890205] [client 45.3.45.198:10629] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 198.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxgInzbEu1Ap1Mwpo-gMwAAARs"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:26:58.846969 2026] [security2:error] [pid 890058:tid 890270] [client 31.171.130.52:31201] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/goods.php"] [unique_id "alxgInzbEu1Ap1Mwpo-gNwAAAVw"]
[Sat Jul 18 23:26:58.986510 2026] [security2:error] [pid 890058:tid 890296] [client 31.171.130.10:34425] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/wp-admin/txets.php"] [unique_id "alxgInzbEu1Ap1Mwpo-gRAAAAXY"]
[Sat Jul 18 23:26:59.029293 2026] [security2:error] [pid 890058:tid 890282] [client 31.171.130.47:21619] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/goods.php"] [unique_id "alxgI3zbEu1Ap1Mwpo-gSAAAAWg"]
[Sat Jul 18 23:26:59.116006 2026] [security2:error] [pid 890058:tid 890307] [client 31.171.130.23:61105] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/insc.php"] [unique_id "alxgI3zbEu1Ap1Mwpo-gSQAAAYE"]
[Sat Jul 18 23:26:59.140788 2026] [security2:error] [pid 881201:tid 881425] [client 31.171.130.1:27637] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/ioxi-o.php"] [unique_id "alxgIwWL-zKlchkVWS1rNgAAAF0"]
[Sat Jul 18 23:26:59.158270 2026] [security2:error] [pid 890058:tid 890312] [client 31.171.130.43:20279] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/classwithtostring.php"] [unique_id "alxgI3zbEu1Ap1Mwpo-gTAAAAYY"]
[Sat Jul 18 23:26:59.166186 2026] [security2:error] [pid 890058:tid 890190] [client 223.228.182.224:35394] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxgI3zbEu1Ap1Mwpo-gTQAAAQw"]
[Sat Jul 18 23:26:59.170338 2026] [security2:error] [pid 890058:tid 890190] [client 223.228.182.224:35394] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxgI3zbEu1Ap1Mwpo-gTQAAAQw"]
[Sat Jul 18 23:26:59.187621 2026] [security2:error] [pid 890058:tid 890313] [client 31.171.130.35:57347] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxgI3zbEu1Ap1Mwpo-gTwAAAYc"]
[Sat Jul 18 23:26:59.222953 2026] [security2:error] [pid 890058:tid 890302] [client 4.194.24.143:34555] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/simple.php"] [unique_id "alxgI3zbEu1Ap1Mwpo-gUQAAAXw"]
[Sat Jul 18 23:26:59.301931 2026] [security2:error] [pid 890058:tid 890279] [client 65.111.20.210:20905] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 210.20.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxgI3zbEu1Ap1Mwpo-gUgAAAWU"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:26:59.343258 2026] [security2:error] [pid 890058:tid 890194] [client 31.171.130.19:47551] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/wp-editor.php"] [unique_id "alxgI3zbEu1Ap1Mwpo-gUwAAARA"]
[Sat Jul 18 23:26:59.408474 2026] [security2:error] [pid 881201:tid 881400] [client 31.171.130.40:60675] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/txets.php"] [unique_id "alxgIwWL-zKlchkVWS1rPAAAAEQ"]
[Sat Jul 18 23:26:59.470546 2026] [security2:error] [pid 881201:tid 881440] [client 31.171.130.52:54991] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/wp-includes/txets.php"] [unique_id "alxgIwWL-zKlchkVWS1rPgAAAGw"]
[Sat Jul 18 23:26:59.504758 2026] [security2:error] [pid 890058:tid 890220] [client 31.171.130.48:53379] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/wp-editor.php"] [unique_id "alxgI3zbEu1Ap1Mwpo-gWAAAASo"]
[Sat Jul 18 23:26:59.592166 2026] [security2:error] [pid 890058:tid 890206] [client 31.171.130.26:34083] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/classwithtostring.php"] [unique_id "alxgI3zbEu1Ap1Mwpo-gXAAAARw"]
[Sat Jul 18 23:26:59.602444 2026] [security2:error] [pid 881201:tid 881347] [client 4.194.24.143:22965] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/php8.php"] [unique_id "alxgIwWL-zKlchkVWS1rRQAAAA8"]
[Sat Jul 18 23:26:59.617367 2026] [security2:error] [pid 890058:tid 890189] [client 31.171.130.34:37563] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/insc.php"] [unique_id "alxgI3zbEu1Ap1Mwpo-gXgAAAQs"]
[Sat Jul 18 23:26:59.631484 2026] [security2:error] [pid 881201:tid 881374] [client 31.171.130.29:25029] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/txets.php"] [unique_id "alxgIwWL-zKlchkVWS1rRgAAACo"]
[Sat Jul 18 23:26:59.656359 2026] [security2:error] [pid 890058:tid 890191] [client 190.245.146.99:62316] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgI3zbEu1Ap1Mwpo-gXwAAAQ0"]
[Sat Jul 18 23:26:59.662203 2026] [security2:error] [pid 890058:tid 890191] [client 190.245.146.99:62316] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgI3zbEu1Ap1Mwpo-gXwAAAQ0"]
[Sat Jul 18 23:26:59.663160 2026] [security2:error] [pid 890058:tid 890230] [client 31.171.130.15:50037] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/wp-content/index.php"] [unique_id "alxgI3zbEu1Ap1Mwpo-gYAAAATQ"]
[Sat Jul 18 23:26:59.767735 2026] [security2:error] [pid 881201:tid 881419] [client 4.194.24.143:29565] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/sitemap.php"] [unique_id "alxgIwWL-zKlchkVWS1rSgAAAFc"]
[Sat Jul 18 23:26:59.901081 2026] [security2:error] [pid 890058:tid 890213] [client 104.207.51.154:62853] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.51.207.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxgI3zbEu1Ap1Mwpo-gaAAAASM"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:26:59.967397 2026] [security2:error] [pid 881201:tid 881396] [client 31.171.130.16:59321] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/goods.php"] [unique_id "alxgIwWL-zKlchkVWS1rUQAAAEA"]
[Sat Jul 18 23:26:59.988528 2026] [security2:error] [pid 890058:tid 890228] [client 31.171.130.50:63747] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/lufix.php"] [unique_id "alxgI3zbEu1Ap1Mwpo-gbAAAATI"]
[Sat Jul 18 23:27:00.112995 2026] [security2:error] [pid 881201:tid 881452] [client 31.171.130.35:39355] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/txets.php"] [unique_id "alxgJAWL-zKlchkVWS1rWwAAAHg"]
[Sat Jul 18 23:27:00.114526 2026] [security2:error] [pid 881201:tid 881437] [client 197.250.101.13:10000] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.101.250.197.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "varmath.com"] [uri "/xmlrpc.php"] [unique_id "alxgJAWL-zKlchkVWS1rVwAAAGk"]
[Sat Jul 18 23:27:00.114663 2026] [security2:error] [pid 881201:tid 881437] [client 197.250.101.13:10000] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "varmath.com"] [uri "/xmlrpc.php"] [unique_id "alxgJAWL-zKlchkVWS1rVwAAAGk"]
[Sat Jul 18 23:27:00.133496 2026] [security2:error] [pid 881201:tid 881404] [client 31.171.130.50:51903] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxgJAWL-zKlchkVWS1rXQAAAEg"]
[Sat Jul 18 23:27:00.146562 2026] [security2:error] [pid 890058:tid 890275] [client 31.171.130.24:65393] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/classwithtostring.php"] [unique_id "alxgJHzbEu1Ap1Mwpo-gcwAAAWE"]
[Sat Jul 18 23:27:00.150041 2026] [security2:error] [pid 881201:tid 881343] [client 31.171.130.22:22971] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/ioxi-o.php"] [unique_id "alxgJAWL-zKlchkVWS1rXwAAAAs"]
[Sat Jul 18 23:27:00.326278 2026] [security2:error] [pid 890058:tid 890244] [client 4.194.24.143:30388] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/size.php"] [unique_id "alxgJHzbEu1Ap1Mwpo-gdgAAAUI"]
[Sat Jul 18 23:27:00.449025 2026] [security2:error] [pid 881201:tid 881381] [client 31.171.130.38:48509] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/wp-editor.php"] [unique_id "alxgJAWL-zKlchkVWS1rZgAAADE"]
[Sat Jul 18 23:27:00.594863 2026] [security2:error] [pid 890058:tid 890284] [client 31.171.130.26:45513] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxgJHzbEu1Ap1Mwpo-ggQAAAWo"]
[Sat Jul 18 23:27:00.595745 2026] [security2:error] [pid 890058:tid 890298] [client 4.194.24.143:33844] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/phpinfo.php"] [unique_id "alxgJHzbEu1Ap1Mwpo-gggAAAXg"]
[Sat Jul 18 23:27:00.632444 2026] [security2:error] [pid 890058:tid 890207] [client 31.171.130.1:39283] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/txets.php"] [unique_id "alxgJHzbEu1Ap1Mwpo-ghgAAAR0"]
[Sat Jul 18 23:27:00.640909 2026] [security2:error] [pid 890058:tid 890199] [client 31.171.130.30:54191] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/insc.php"] [unique_id "alxgJHzbEu1Ap1Mwpo-giQAAARU"]
[Sat Jul 18 23:27:00.714299 2026] [security2:error] [pid 881201:tid 881241] [remote 217.182.128.41:34474] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.128.182.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxgJAWL-zKlchkVWS1rbgAAaiY"]
[Sat Jul 18 23:27:00.870633 2026] [security2:error] [pid 881201:tid 881416] [client 4.194.24.143:30373] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/sm.php"] [unique_id "alxgJAWL-zKlchkVWS1rdAAAAFQ"]
[Sat Jul 18 23:27:00.926401 2026] [security2:error] [pid 881201:tid 881269] [remote 217.182.128.41:34474] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.128.182.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxgJAWL-zKlchkVWS1reAAAP0I"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:27:01.103230 2026] [security2:error] [pid 881201:tid 881451] [client 31.171.130.50:43835] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/lufix.php"] [unique_id "alxgJQWL-zKlchkVWS1rfwAAAHc"]
[Sat Jul 18 23:27:01.103897 2026] [security2:error] [pid 890058:tid 890246] [client 31.171.130.27:35701] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxgJXzbEu1Ap1Mwpo-glQAAAUQ"]
[Sat Jul 18 23:27:01.149000 2026] [security2:error] [pid 881201:tid 881441] [client 31.171.130.31:20275] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/lufix.php"] [unique_id "alxgJQWL-zKlchkVWS1rgwAAAG0"]
[Sat Jul 18 23:27:01.408304 2026] [security2:error] [pid 881201:tid 881447] [client 27.34.68.67:27617] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgJQWL-zKlchkVWS1rjQAAAHM"]
[Sat Jul 18 23:27:01.408441 2026] [security2:error] [pid 881201:tid 881447] [client 27.34.68.67:27617] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgJQWL-zKlchkVWS1rjQAAAHM"]
[Sat Jul 18 23:27:01.431565 2026] [security2:error] [pid 890058:tid 890273] [client 4.194.24.143:29535] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/sql.php"] [unique_id "alxgJXzbEu1Ap1Mwpo-gmwAAAV8"]
[Sat Jul 18 23:27:01.436321 2026] [security2:error] [pid 881201:tid 881376] [client 4.194.24.143:33800] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/post.php"] [unique_id "alxgJQWL-zKlchkVWS1rjwAAACw"]
[Sat Jul 18 23:27:01.617763 2026] [security2:error] [pid 890058:tid 890259] [client 31.171.130.38:51207] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.pricecuthomes.com"] [uri "/style.php"] [unique_id "alxgJXzbEu1Ap1Mwpo-goQAAAVE"]
[Sat Jul 18 23:27:01.699710 2026] [security2:error] [pid 890058:tid 890237] [client 31.171.130.16:37797] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/wp-admin/txets.php"] [unique_id "alxgJXzbEu1Ap1Mwpo-gpAAAATs"]
[Sat Jul 18 23:27:01.770800 2026] [security2:error] [pid 881201:tid 881375] [client 31.171.130.30:62583] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/classwithtostring.php"] [unique_id "alxgJQWL-zKlchkVWS1rmQAAACs"]
[Sat Jul 18 23:27:01.770875 2026] [security2:error] [pid 890058:tid 890256] [client 31.171.130.22:48705] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "website-27c0eea6.iwv.oao.mybluehost.me"] [uri "/style.php"] [unique_id "alxgJXzbEu1Ap1Mwpo-grAAAAU4"]
[Sat Jul 18 23:27:01.770975 2026] [security2:error] [pid 890058:tid 890289] [client 31.171.130.22:49487] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxgJXzbEu1Ap1Mwpo-grQAAAW8"]
[Sat Jul 18 23:27:01.791421 2026] [security2:error] [pid 890058:tid 890282] [client 31.171.130.36:41369] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/wp-admin/txets.php"] [unique_id "alxgJXzbEu1Ap1Mwpo-grgAAAWg"]
[Sat Jul 18 23:27:01.863604 2026] [security2:error] [pid 881201:tid 881366] [client 31.171.130.5:32907] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.pricecuthomes.com"] [uri "/style.php"] [unique_id "alxgJQWL-zKlchkVWS1rngAAACI"]
[Sat Jul 18 23:27:01.881482 2026] [security2:error] [pid 890058:tid 890305] [client 31.171.130.2:52513] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/wp-admin/txets.php"] [unique_id "alxgJXzbEu1Ap1Mwpo-gsQAAAX8"]
[Sat Jul 18 23:27:01.938932 2026] [security2:error] [pid 890058:tid 890241] [client 57.141.18.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxgJXzbEu1Ap1Mwpo-gqwAAAT8"]
[Sat Jul 18 23:27:01.986708 2026] [security2:error] [pid 890058:tid 890288] [client 4.194.24.143:30975] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/ss.php"] [unique_id "alxgJXzbEu1Ap1Mwpo-gtQAAAW4"]
[Sat Jul 18 23:27:02.191298 2026] [security2:error] [pid 890058:tid 890239] [client 223.185.61.63:6570] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxgJnzbEu1Ap1Mwpo-guwAAAT0"]
[Sat Jul 18 23:27:02.191427 2026] [security2:error] [pid 890058:tid 890239] [client 223.185.61.63:6570] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxgJnzbEu1Ap1Mwpo-guwAAAT0"]
[Sat Jul 18 23:27:02.226366 2026] [security2:error] [pid 890058:tid 890306] [client 31.171.130.49:52873] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/wp-includes/txets.php"] [unique_id "alxgJnzbEu1Ap1Mwpo-gvAAAAYA"]
[Sat Jul 18 23:27:02.322891 2026] [security2:error] [pid 881201:tid 881398] [client 4.194.24.143:22947] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/public/assets/design_1/css/parts/course_cards/grid_card_1.min.php"] [unique_id "alxgJgWL-zKlchkVWS1rsAAAAEI"]
[Sat Jul 18 23:27:02.546480 2026] [security2:error] [pid 890058:tid 890212] [client 4.194.24.143:17166] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/stats.php"] [unique_id "alxgJnzbEu1Ap1Mwpo-gyQAAASI"]
[Sat Jul 18 23:27:02.584067 2026] [security2:error] [pid 890058:tid 890198] [client 31.171.130.31:35639] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/wp-includes/txets.php"] [unique_id "alxgJnzbEu1Ap1Mwpo-gygAAARQ"]
[Sat Jul 18 23:27:02.587888 2026] [security2:error] [pid 890058:tid 890238] [client 31.171.130.11:56439] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/txets.php"] [unique_id "alxgJnzbEu1Ap1Mwpo-gywAAATw"]
[Sat Jul 18 23:27:02.659209 2026] [security2:error] [pid 881201:tid 881360] [client 31.171.130.37:52339] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/wp-includes/txets.php"] [unique_id "alxgJgWL-zKlchkVWS1ruQAAABw"]
[Sat Jul 18 23:27:02.734083 2026] [security2:error] [pid 890058:tid 890218] [client 31.171.130.46:20337] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/goods.php"] [unique_id "alxgJnzbEu1Ap1Mwpo-gzgAAASg"]
[Sat Jul 18 23:27:02.928410 2026] [security2:error] [pid 890058:tid 890255] [client 4.194.24.143:33840] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/public/css.php"] [unique_id "alxgJnzbEu1Ap1Mwpo-g1AAAAU0"]
[Sat Jul 18 23:27:03.096687 2026] [security2:error] [pid 890058:tid 890257] [client 4.194.24.143:29550] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/sump1.php"] [unique_id "alxgJ3zbEu1Ap1Mwpo-g2AAAAU8"]
[Sat Jul 18 23:27:03.101310 2026] [security2:error] [pid 890058:tid 890217] [client 31.171.130.21:24589] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxgJ3zbEu1Ap1Mwpo-g2QAAASc"]
[Sat Jul 18 23:27:03.102106 2026] [security2:error] [pid 890058:tid 890213] [client 31.171.130.37:61557] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/goods.php"] [unique_id "alxgJ3zbEu1Ap1Mwpo-g2gAAASM"]
[Sat Jul 18 23:27:03.148929 2026] [security2:error] [pid 881201:tid 881444] [client 31.171.130.43:20165] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/goods.php"] [unique_id "alxgJwWL-zKlchkVWS1ryAAAAHA"]
[Sat Jul 18 23:27:03.207959 2026] [security2:error] [pid 881201:tid 881347] [client 31.171.130.41:57797] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/wp-editor.php"] [unique_id "alxgJwWL-zKlchkVWS1rzwAAAA8"]
[Sat Jul 18 23:27:03.395431 2026] [security2:error] [pid 890058:tid 890293] [client 31.171.130.10:56349] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/wp-admin/txets.php"] [unique_id "alxgJ3zbEu1Ap1Mwpo-g4AAAAXM"]
[Sat Jul 18 23:27:03.597502 2026] [security2:error] [pid 890058:tid 890264] [client 31.171.130.24:52697] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/wp-admin/txets.php"] [unique_id "alxgJ3zbEu1Ap1Mwpo-g6QAAAVY"]
[Sat Jul 18 23:27:03.597603 2026] [security2:error] [pid 890058:tid 890281] [client 31.171.130.8:58889] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/wp-editor.php"] [unique_id "alxgJ3zbEu1Ap1Mwpo-g6AAAAWc"]
[Sat Jul 18 23:27:03.643525 2026] [security2:error] [pid 890058:tid 890256] [client 4.194.24.143:30344] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/system.php"] [unique_id "alxgJ3zbEu1Ap1Mwpo-g6wAAAU4"]
[Sat Jul 18 23:27:03.662819 2026] [security2:error] [pid 881201:tid 881376] [client 4.194.24.143:51470] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/r.php"] [unique_id "alxgJwWL-zKlchkVWS1r3QAAACw"]
[Sat Jul 18 23:27:03.672070 2026] [security2:error] [pid 890058:tid 890271] [client 142.147.192.219:44078] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.sesamegreenbeans.com"] [uri "/index.php"] [unique_id "alxgJ3zbEu1Ap1Mwpo-g4wABXTE"]
[Sat Jul 18 23:27:03.683420 2026] [security2:error] [pid 890058:tid 890251] [client 74.7.227.179:35626] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxgJ3zbEu1Ap1Mwpo-g5QABSTI"], referer: https://tejasenvironmental.com/p=5435
[Sat Jul 18 23:27:03.783712 2026] [security2:error] [pid 890058:tid 890280] [client 31.171.130.23:52923] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/lufix.php"] [unique_id "alxgJ3zbEu1Ap1Mwpo-g7gAAAWY"]
[Sat Jul 18 23:27:03.784138 2026] [security2:error] [pid 881201:tid 881363] [client 31.171.130.42:38469] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/wp-editor.php"] [unique_id "alxgJwWL-zKlchkVWS1r3wAAAB8"]
[Sat Jul 18 23:27:04.155930 2026] [security2:error] [pid 890058:tid 890189] [client 31.171.130.25:40783] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/wp-includes/txets.php"] [unique_id "alxgKHzbEu1Ap1Mwpo-g9AAAAQs"]
[Sat Jul 18 23:27:04.216692 2026] [security2:error] [pid 890058:tid 890204] [client 4.194.24.143:28449] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/system/03n1hob7p03r2npdefault.php"] [unique_id "alxgKHzbEu1Ap1Mwpo-g-AAAARo"]
[Sat Jul 18 23:27:04.308321 2026] [security2:error] [pid 881201:tid 881343] [client 4.194.24.143:22933] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/radio.php"] [unique_id "alxgKAWL-zKlchkVWS1r8gAAAAs"]
[Sat Jul 18 23:27:04.487469 2026] [security2:error] [pid 890058:tid 890278] [client 31.171.130.2:39401] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/wp-includes/txets.php"] [unique_id "alxgKHzbEu1Ap1Mwpo-g_wAAAWQ"]
[Sat Jul 18 23:27:04.487579 2026] [security2:error] [pid 890058:tid 890229] [client 31.171.130.42:25945] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/lufix.php"] [unique_id "alxgKHzbEu1Ap1Mwpo-hAAAAATM"]
[Sat Jul 18 23:27:04.492392 2026] [security2:error] [pid 890058:tid 890268] [client 31.171.130.49:55715] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/lufix.php"] [unique_id "alxgKHzbEu1Ap1Mwpo-hAQAAAVo"]
[Sat Jul 18 23:27:04.501415 2026] [security2:error] [pid 881201:tid 881369] [client 31.171.130.12:59327] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.pricecuthomes.com"] [uri "/style.php"] [unique_id "alxgKAWL-zKlchkVWS1r-wAAACU"]
[Sat Jul 18 23:27:04.661226 2026] [security2:error] [pid 890058:tid 890202] [client 114.119.137.91:44045] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "overloadcomedy.com"] [uri "/product/promo-power-packages/"] [unique_id "alxgKHzbEu1Ap1Mwpo-hCAAAARg"], referer: https://overloadcomedy.com/
[Sat Jul 18 23:27:04.798992 2026] [security2:error] [pid 881201:tid 881417] [client 4.194.24.143:30947] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/system/cj5ha2rah8lyiqqdefault.php"] [unique_id "alxgKAWL-zKlchkVWS1sBAAAAFU"]
[Sat Jul 18 23:27:04.998544 2026] [security2:error] [pid 890058:tid 890276] [client 50.116.65.227:41682] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxgKHzbEu1Ap1Mwpo-hDwAAAWI"]
[Sat Jul 18 23:27:05.014303 2026] [security2:error] [pid 890058:tid 890287] [client 50.116.65.227:11672] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxgKXzbEu1Ap1Mwpo-hEAAAAW0"]
[Sat Jul 18 23:27:05.015578 2026] [security2:error] [pid 890058:tid 890233] [client 4.194.24.143:33855] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/randkeyword.php7"] [unique_id "alxgKXzbEu1Ap1Mwpo-hEQAAATc"]
[Sat Jul 18 23:27:05.060906 2026] [security2:error] [pid 881201:tid 881421] [client 31.171.130.4:20563] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.pricecuthomes.com"] [uri "/style.php"] [unique_id "alxgKQWL-zKlchkVWS1sEwAAAFk"]
[Sat Jul 18 23:27:05.084180 2026] [security2:error] [pid 881201:tid 881453] [client 31.171.130.21:37369] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.pricecuthomes.com"] [uri "/style.php"] [unique_id "alxgKQWL-zKlchkVWS1sFAAAAHk"]
[Sat Jul 18 23:27:05.188150 2026] [security2:error] [pid 881201:tid 881454] [client 31.171.130.39:22505] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/goods.php"] [unique_id "alxgKQWL-zKlchkVWS1sGQAAAHo"]
[Sat Jul 18 23:27:05.351914 2026] [security2:error] [pid 890058:tid 890296] [client 4.194.24.143:30936] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/system_log.php"] [unique_id "alxgKXzbEu1Ap1Mwpo-hHAAAAXY"]
[Sat Jul 18 23:27:05.468460 2026] [ssl:error] [pid 881201:tid 881339] [client 18.235.110.182:39205] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname webmail.friendlyspreadsheet.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:27:05.724559 2026] [security2:error] [pid 890058:tid 890306] [client 4.194.24.143:49734] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/readme.php"] [unique_id "alxgKXzbEu1Ap1Mwpo-hJAAAAYA"]
[Sat Jul 18 23:27:05.795080 2026] [security2:error] [pid 890058:tid 890188] [client 31.171.130.39:22953] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/goods.php"] [unique_id "alxgKXzbEu1Ap1Mwpo-hLAAAAQo"]
[Sat Jul 18 23:27:05.832538 2026] [security2:error] [pid 890058:tid 890309] [client 82.39.206.158:40268] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "autodiscover.lifeisbetterlakeside.com"] [uri "/.env"] [unique_id "alxgKXzbEu1Ap1Mwpo-hLgAAAYM"]
[Sat Jul 18 23:27:05.907000 2026] [security2:error] [pid 890058:tid 890232] [client 4.194.24.143:17376] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/t.php"] [unique_id "alxgKXzbEu1Ap1Mwpo-hNAAAATY"]
[Sat Jul 18 23:27:06.360148 2026] [security2:error] [pid 890058:tid 890202] [client 65.111.28.187:27023] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 187.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxgKnzbEu1Ap1Mwpo-hQgAAARg"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:27:06.427260 2026] [security2:error] [pid 890058:tid 890241] [client 31.171.130.19:53077] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/wp-editor.php"] [unique_id "alxgKnzbEu1Ap1Mwpo-hRQAAAT8"]
[Sat Jul 18 23:27:06.448619 2026] [security2:error] [pid 890058:tid 890242] [client 4.194.24.143:21024] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/term.php"] [unique_id "alxgKnzbEu1Ap1Mwpo-hRwAAAUA"]
[Sat Jul 18 23:27:06.483018 2026] [security2:error] [pid 890058:tid 890209] [client 4.194.24.143:59497] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/reze.php"] [unique_id "alxgKnzbEu1Ap1Mwpo-hSAAAAR8"]
[Sat Jul 18 23:27:06.765261 2026] [security2:error] [pid 890058:tid 890300] [client 82.39.206.158:40332] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "autodiscover.lifeisbetterlakeside.com"] [uri "/api/.env"] [unique_id "alxgKnzbEu1Ap1Mwpo-hVwAAAXo"]
[Sat Jul 18 23:27:06.931240 2026] [security2:error] [pid 890058:tid 890220] [client 31.171.130.13:26829] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/wp-editor.php"] [unique_id "alxgKnzbEu1Ap1Mwpo-hXwAAASo"]
[Sat Jul 18 23:27:06.942949 2026] [security2:error] [pid 881201:tid 881381] [client 82.39.206.158:40324] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "autodiscover.lifeisbetterlakeside.com"] [uri "/backend/.env"] [unique_id "alxgKgWL-zKlchkVWS1sSwAAADE"]
[Sat Jul 18 23:27:06.948309 2026] [security2:error] [pid 890058:tid 890244] [client 119.154.81.234:61293] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgKnzbEu1Ap1Mwpo-hYAAAAUI"]
[Sat Jul 18 23:27:06.948411 2026] [security2:error] [pid 890058:tid 890244] [client 119.154.81.234:61293] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgKnzbEu1Ap1Mwpo-hYAAAAUI"]
[Sat Jul 18 23:27:07.021690 2026] [security2:error] [pid 890058:tid 890306] [client 4.194.24.143:28472] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/test.php"] [unique_id "alxgK3zbEu1Ap1Mwpo-hZAAAAYA"]
[Sat Jul 18 23:27:07.027639 2026] [security2:error] [pid 890058:tid 890231] [client 31.171.130.43:25895] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/lufix.php"] [unique_id "alxgK3zbEu1Ap1Mwpo-hZQAAATU"]
[Sat Jul 18 23:27:07.031838 2026] [security2:error] [pid 890058:tid 890240] [client 4.194.24.143:31597] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/rh.php"] [unique_id "alxgK3zbEu1Ap1Mwpo-hZgAAAT4"]
[Sat Jul 18 23:27:07.452244 2026] [security2:error] [pid 890058:tid 890276] [client 31.171.130.20:23835] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/lufix.php"] [unique_id "alxgK3zbEu1Ap1Mwpo-hcQAAAWI"]
[Sat Jul 18 23:27:07.495439 2026] [security2:error] [pid 881201:tid 881415] [client 78.147.38.52:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxgKwWL-zKlchkVWS1sUgAAU10"]
[Sat Jul 18 23:27:07.564769 2026] [security2:error] [pid 890058:tid 890285] [client 31.171.130.24:48547] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.pricecuthomes.com"] [uri "/style.php"] [unique_id "alxgK3zbEu1Ap1Mwpo-hdQAAAWs"]
[Sat Jul 18 23:27:07.566539 2026] [security2:error] [pid 881201:tid 881345] [client 4.194.24.143:29530] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/test1.php"] [unique_id "alxgKwWL-zKlchkVWS1sXQAAAA0"]
[Sat Jul 18 23:27:07.581019 2026] [security2:error] [pid 881201:tid 881446] [client 4.194.24.143:59468] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/rip.php"] [unique_id "alxgKwWL-zKlchkVWS1sXgAAAHI"]
[Sat Jul 18 23:27:07.753853 2026] [ssl:error] [pid 890058:tid 890282] [client 98.84.1.175:50394] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname spencersadventures.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:27:07.783943 2026] [security2:error] [pid 881201:tid 881444] [client 45.3.45.218:26729] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 218.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "primests.com"] [uri "/wp-login.php"] [unique_id "alxgKwWL-zKlchkVWS1sbQAAAHA"], referer: https://primests.com/wp-login.php
[Sat Jul 18 23:27:07.937268 2026] [security2:error] [pid 890058:tid 890291] [client 185.8.106.147:50452] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "cira.org"] [uri "/index.php"] [unique_id "alxgK3zbEu1Ap1Mwpo-hdgAAAXE"]
[Sat Jul 18 23:27:07.957953 2026] [security2:error] [pid 890058:tid 890269] [client 31.171.130.27:54643] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.pricecuthomes.com"] [uri "/style.php"] [unique_id "alxgK3zbEu1Ap1Mwpo-hjAAAAVs"]
[Sat Jul 18 23:27:08.049689 2026] [security2:error] [pid 881201:tid 881412] [client 106.222.249.209:16169] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgLAWL-zKlchkVWS1sdAAAAFA"]
[Sat Jul 18 23:27:08.049919 2026] [security2:error] [pid 881201:tid 881412] [client 106.222.249.209:16169] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgLAWL-zKlchkVWS1sdAAAAFA"]
[Sat Jul 18 23:27:08.137848 2026] [security2:error] [pid 881201:tid 881449] [client 4.194.24.143:29535] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/tfm.php"] [unique_id "alxgLAWL-zKlchkVWS1seAAAAHU"]
[Sat Jul 18 23:27:08.228309 2026] [security2:error] [pid 890058:tid 890251] [client 4.194.24.143:49761] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/root.php"] [unique_id "alxgLHzbEu1Ap1Mwpo-hlAAAAUk"]
[Sat Jul 18 23:27:08.615650 2026] [security2:error] [pid 881201:tid 881283] [remote 91.142.222.105:52916] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "daseighty.net"] [uri "/xmlrpc.php"] [unique_id "alxgLAWL-zKlchkVWS1shAAAR1A"]
[Sat Jul 18 23:27:08.615815 2026] [security2:error] [pid 881201:tid 881403] [client 91.142.222.105:52916] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "daseighty.net"] [uri "/xmlrpc.php"] [unique_id "alxgLAWL-zKlchkVWS1shAAAR1A"]
[Sat Jul 18 23:27:08.679393 2026] [security2:error] [pid 890058:tid 890191] [client 4.194.24.143:17047] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/thebe.php"] [unique_id "alxgLHzbEu1Ap1Mwpo-hoAAAAQ0"]
[Sat Jul 18 23:27:08.908299 2026] [security2:error] [pid 890058:tid 890193] [client 163.61.1.17:62988] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgLHzbEu1Ap1Mwpo-hqwAAAQ8"]
[Sat Jul 18 23:27:08.911248 2026] [security2:error] [pid 890058:tid 890193] [client 163.61.1.17:62988] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgLHzbEu1Ap1Mwpo-hqwAAAQ8"]
[Sat Jul 18 23:27:09.157424 2026] [security2:error] [pid 881201:tid 881450] [client 50.116.65.227:57144] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxgLQWL-zKlchkVWS1skwAAAHY"]
[Sat Jul 18 23:27:09.173917 2026] [security2:error] [pid 890058:tid 890281] [client 50.116.65.227:24548] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxgLXzbEu1Ap1Mwpo-htAAAAWc"]
[Sat Jul 18 23:27:09.259857 2026] [security2:error] [pid 890058:tid 890305] [client 4.194.24.143:28445] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/themes.php"] [unique_id "alxgLXzbEu1Ap1Mwpo-huQAAAX8"]
[Sat Jul 18 23:27:09.361423 2026] [security2:error] [pid 890058:tid 890139] [remote 85.208.96.202:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "lelandmc.org"] [uri "/calendar/"] [unique_id "alxgLXzbEu1Ap1Mwpo-hxQABPVA"]
[Sat Jul 18 23:27:09.361588 2026] [security2:error] [pid 890058:tid 890239] [client 85.208.96.202:0] ModSecurity: Warning. Matched phrase "Semrush" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "lelandmc.org"] [uri "/calendar/"] [unique_id "alxgLXzbEu1Ap1Mwpo-hxQABPVA"]
[Sat Jul 18 23:27:09.596020 2026] [security2:error] [pid 890058:tid 890309] [client 104.207.49.134:49501] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 134.49.207.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxgLXzbEu1Ap1Mwpo-hzwAAAYM"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:27:09.784889 2026] [security2:error] [pid 890058:tid 890228] [client 4.194.24.143:48462] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/s.php"] [unique_id "alxgLXzbEu1Ap1Mwpo-h1wAAATI"]
[Sat Jul 18 23:27:09.802279 2026] [security2:error] [pid 890058:tid 890310] [client 4.194.24.143:30339] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/tiny.php"] [unique_id "alxgLXzbEu1Ap1Mwpo-h2AAAAYQ"]
[Sat Jul 18 23:27:10.040656 2026] [security2:error] [pid 890058:tid 890286] [client 223.228.182.224:24912] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxgLnzbEu1Ap1Mwpo-h3wAAAWw"]
[Sat Jul 18 23:27:10.040791 2026] [security2:error] [pid 890058:tid 890286] [client 223.228.182.224:24912] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxgLnzbEu1Ap1Mwpo-h3wAAAWw"]
[Sat Jul 18 23:27:10.155076 2026] [security2:error] [pid 890058:tid 890258] [client 190.245.146.99:62838] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgLnzbEu1Ap1Mwpo-h5QAAAVA"]
[Sat Jul 18 23:27:10.155198 2026] [security2:error] [pid 890058:tid 890258] [client 190.245.146.99:62838] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgLnzbEu1Ap1Mwpo-h5QAAAVA"]
[Sat Jul 18 23:27:10.241992 2026] [security2:error] [pid 890058:tid 890234] [client 45.3.45.111:30977] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxgLnzbEu1Ap1Mwpo-h7QAAATg"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:27:10.410055 2026] [security2:error] [pid 890058:tid 890231] [client 4.194.24.143:30958] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bigwormfishing.com"] [uri "/tmp/byp.php"] [unique_id "alxgLnzbEu1Ap1Mwpo-h8gAAATU"]
[Sat Jul 18 23:27:10.447458 2026] [security2:error] [pid 881201:tid 881365] [client 3.64.55.230:12292] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.55.64.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxgLgWL-zKlchkVWS1svQAAACE"]
[Sat Jul 18 23:27:11.015974 2026] [security2:error] [pid 881201:tid 881394] [client 63.179.105.113:24118] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.105.179.63.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxgLwWL-zKlchkVWS1szwAAAD4"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:27:11.311832 2026] [security2:error] [pid 890058:tid 890247] [client 4.194.24.143:49777] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/sang.php"] [unique_id "alxgL3zbEu1Ap1Mwpo-iBQAAAUU"]
[Sat Jul 18 23:27:12.028096 2026] [security2:error] [pid 881201:tid 881427] [client 27.34.68.67:28853] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgMAWL-zKlchkVWS1s7QAAAF8"]
[Sat Jul 18 23:27:12.028201 2026] [security2:error] [pid 881201:tid 881427] [client 27.34.68.67:28853] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgMAWL-zKlchkVWS1s7QAAAF8"]
[Sat Jul 18 23:27:12.588032 2026] [security2:error] [pid 890058:tid 890273] [client 4.194.24.143:33772] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/scxy.php"] [unique_id "alxgMHzbEu1Ap1Mwpo-iMQAAAV8"]
[Sat Jul 18 23:27:12.845236 2026] [security2:error] [pid 890058:tid 890278] [client 223.185.61.63:26963] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxgMHzbEu1Ap1Mwpo-iOAAAAWQ"]
[Sat Jul 18 23:27:12.845371 2026] [security2:error] [pid 890058:tid 890278] [client 223.185.61.63:26963] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxgMHzbEu1Ap1Mwpo-iOAAAAWQ"]
[Sat Jul 18 23:27:13.902008 2026] [security2:error] [pid 881201:tid 881361] [client 4.194.24.143:33835] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/sd.php"] [unique_id "alxgMQWL-zKlchkVWS1tGwAAAB0"]
[Sat Jul 18 23:27:14.192065 2026] [security2:error] [pid 890058:tid 890210] [client 103.59.160.164:53182] ModSecurity: Access denied with code 406 (phase 1). Pattern match "^POST$" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "187"] [id "900401"] [msg "PHP Spam Botnet"] [hostname "webdisk.supportinghands22.org"] [uri "/index.php"] [unique_id "alxgMnzbEu1Ap1Mwpo-iXwAAASA"]
[Sat Jul 18 23:27:14.623116 2026] [security2:error] [pid 881201:tid 881376] [client 4.194.24.143:52982] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/sf.php"] [unique_id "alxgMgWL-zKlchkVWS1tLQAAACw"]
[Sat Jul 18 23:27:15.263466 2026] [security2:error] [pid 890058:tid 890191] [client 4.194.24.143:33815] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/shell.php"] [unique_id "alxgM3zbEu1Ap1Mwpo-ihwAAAQ0"]
[Sat Jul 18 23:27:15.323284 2026] [security2:error] [pid 890058:tid 890186] [remote 31.42.184.154:51928] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.narv.co"] [uri "/wp-login.php"] [unique_id "alxgM3zbEu1Ap1Mwpo-ijAABEX8"]
[Sat Jul 18 23:27:15.571969 2026] [security2:error] [pid 890058:tid 890059] [remote 31.42.184.154:51928] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.narv.co"] [uri "/wp-login.php"] [unique_id "alxgM3zbEu1Ap1Mwpo-ilAABTgA"], referer: https://www.narv.co/wp-login.php
[Sat Jul 18 23:27:15.636096 2026] [security2:error] [pid 881201:tid 881338] [client 124.29.207.185:61675] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxgMwWL-zKlchkVWS1tRwAAAAY"]
[Sat Jul 18 23:27:15.636206 2026] [security2:error] [pid 881201:tid 881338] [client 124.29.207.185:61675] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxgMwWL-zKlchkVWS1tRwAAAAY"]
[Sat Jul 18 23:27:15.791445 2026] [security2:error] [pid 890058:tid 890295] [client 57.141.18.105:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxgM3zbEu1Ap1Mwpo-imAAAAXU"]
[Sat Jul 18 23:27:16.098085 2026] [security2:error] [pid 890058:tid 890067] [remote 31.42.184.154:51932] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgNHzbEu1Ap1Mwpo-iqQABcgg"]
[Sat Jul 18 23:27:16.098298 2026] [security2:error] [pid 890058:tid 890292] [client 31.42.184.154:51932] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgNHzbEu1Ap1Mwpo-iqQABcgg"]
[Sat Jul 18 23:27:16.174895 2026] [security2:error] [pid 890058:tid 890286] [client 4.194.24.143:33797] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/sid3.php"] [unique_id "alxgNHzbEu1Ap1Mwpo-iqwAAAWw"]
[Sat Jul 18 23:27:16.814341 2026] [security2:error] [pid 890058:tid 890195] [client 4.194.24.143:52974] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/simple.php"] [unique_id "alxgNHzbEu1Ap1Mwpo-iwQAAARE"]
[Sat Jul 18 23:27:16.969079 2026] [security2:error] [pid 890058:tid 890073] [remote 68.183.22.192:58756] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 192.22.183.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.talknutritionwithlesley.com"] [uri "/wp-login.php"] [unique_id "alxgNHzbEu1Ap1Mwpo-iwwABFQ4"]
[Sat Jul 18 23:27:17.030131 2026] [security2:error] [pid 890058:tid 890266] [client 35.92.83.184:17904] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 184.83.92.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxgNXzbEu1Ap1Mwpo-ixgAAAVg"]
[Sat Jul 18 23:27:17.187886 2026] [security2:error] [pid 890058:tid 890074] [remote 68.183.22.192:58756] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 192.22.183.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.talknutritionwithlesley.com"] [uri "/wp-login.php"] [unique_id "alxgNXzbEu1Ap1Mwpo-iyQABHA8"], referer: https://mail.talknutritionwithlesley.com/wp-login.php
[Sat Jul 18 23:27:17.404134 2026] [security2:error] [pid 890058:tid 890075] [remote 152.228.213.32:38372] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "saudalsubaie.com"] [uri "/wp-login.php"] [unique_id "alxgNXzbEu1Ap1Mwpo-izAABiBA"]
[Sat Jul 18 23:27:17.593244 2026] [security2:error] [pid 890058:tid 890219] [client 119.154.81.234:61748] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgNXzbEu1Ap1Mwpo-i2AAAASk"]
[Sat Jul 18 23:27:17.593333 2026] [security2:error] [pid 890058:tid 890219] [client 119.154.81.234:61748] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgNXzbEu1Ap1Mwpo-i2AAAASk"]
[Sat Jul 18 23:27:17.599454 2026] [security2:error] [pid 890058:tid 890276] [client 4.194.24.143:48451] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/sitemap.php"] [unique_id "alxgNXzbEu1Ap1Mwpo-i2QAAAWI"]
[Sat Jul 18 23:27:17.623955 2026] [security2:error] [pid 890058:tid 890076] [remote 152.228.213.32:38372] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "saudalsubaie.com"] [uri "/wp-login.php"] [unique_id "alxgNXzbEu1Ap1Mwpo-i2gABaxE"], referer: https://saudalsubaie.com/wp-login.php
[Sat Jul 18 23:27:17.763998 2026] [security2:error] [pid 890058:tid 890262] [client 114.119.146.185:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.sergnotes.com"] [uri "/wp-login.php"] [unique_id "alxgNXzbEu1Ap1Mwpo-i3AAAAVQ"], referer: https://www.sergnotes.com/notes-gary-v-interview-ray-dalio?share=linkedin
[Sat Jul 18 23:27:17.930634 2026] [proxy:error] [pid 890058:tid 890200] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:27:17.930676 2026] [proxy_http:error] [pid 890058:tid 890200] [client 185.247.137.208:47409] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:27:17.931228 2026] [proxy:error] [pid 890058:tid 890200] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:27:17.931253 2026] [proxy_http:error] [pid 890058:tid 890200] [client 185.247.137.208:47409] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:27:18.703897 2026] [security2:error] [pid 890058:tid 890083] [remote 20.84.23.222:7555] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 222.23.84.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "eframiproperties.com"] [uri "/wp-login.php"] [unique_id "alxgNnzbEu1Ap1Mwpo-i_wABgxg"]
[Sat Jul 18 23:27:18.710374 2026] [security2:error] [pid 881201:tid 881227] [remote 152.228.213.32:38386] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxgNgWL-zKlchkVWS1tlwAALxg"]
[Sat Jul 18 23:27:18.711260 2026] [security2:error] [pid 890058:tid 890238] [client 106.222.249.209:22390] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgNnzbEu1Ap1Mwpo-jAAAAATw"]
[Sat Jul 18 23:27:18.711340 2026] [security2:error] [pid 890058:tid 890238] [client 106.222.249.209:22390] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgNnzbEu1Ap1Mwpo-jAAAAATw"]
[Sat Jul 18 23:27:18.723219 2026] [security2:error] [pid 881201:tid 881406] [client 4.194.24.143:33817] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/size.php"] [unique_id "alxgNgWL-zKlchkVWS1tmAAAAEo"]
[Sat Jul 18 23:27:18.905724 2026] [security2:error] [pid 890058:tid 890084] [remote 20.84.23.222:7555] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 222.23.84.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "eframiproperties.com"] [uri "/wp-login.php"] [unique_id "alxgNnzbEu1Ap1Mwpo-jBQABOhk"], referer: https://eframiproperties.com/wp-login.php
[Sat Jul 18 23:27:18.911786 2026] [security2:error] [pid 881201:tid 881217] [remote 152.228.213.32:38386] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxgNgWL-zKlchkVWS1tnwAAMA4"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:27:18.971897 2026] [security2:error] [pid 881201:tid 881248] [remote 74.235.96.117:41036] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.235.74.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "retzkolonglogistics.com"] [uri "/wp-login.php"] [unique_id "alxgNgWL-zKlchkVWS1togAAAS0"]
[Sat Jul 18 23:27:18.975940 2026] [security2:error] [pid 890058:tid 890089] [remote 168.138.197.172:50358] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 172.197.138.168.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/wp-login.php"] [unique_id "alxgNnzbEu1Ap1Mwpo-jCwABVx4"]
[Sat Jul 18 23:27:19.130585 2026] [security2:error] [pid 881201:tid 881356] [client 103.59.161.175:61903] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "cosanluis.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxgNwWL-zKlchkVWS1tpgAAABg"]
[Sat Jul 18 23:27:19.183431 2026] [security2:error] [pid 881201:tid 881302] [remote 74.235.96.117:41036] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.235.74.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "retzkolonglogistics.com"] [uri "/wp-login.php"] [unique_id "alxgNwWL-zKlchkVWS1tqAAAeGM"], referer: https://retzkolonglogistics.com/wp-login.php
[Sat Jul 18 23:27:19.364143 2026] [security2:error] [pid 890058:tid 890091] [remote 168.138.197.172:50358] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 172.197.138.168.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/wp-login.php"] [unique_id "alxgN3zbEu1Ap1Mwpo-jFQABJSA"], referer: https://nevelow.com/wp-login.php
[Sat Jul 18 23:27:19.384031 2026] [security2:error] [pid 890058:tid 890251] [client 163.61.1.17:63427] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgN3zbEu1Ap1Mwpo-jFwAAAUk"]
[Sat Jul 18 23:27:19.385782 2026] [security2:error] [pid 890058:tid 890251] [client 163.61.1.17:63427] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgN3zbEu1Ap1Mwpo-jFwAAAUk"]
[Sat Jul 18 23:27:19.788591 2026] [security2:error] [pid 890058:tid 890288] [client 4.194.24.143:52941] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/sm.php"] [unique_id "alxgN3zbEu1Ap1Mwpo-jJQAAAW4"]
[Sat Jul 18 23:27:19.885688 2026] [security2:error] [pid 890058:tid 890204] [client 45.3.42.199:60197] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.42.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxgN3zbEu1Ap1Mwpo-jKwAAARo"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:27:20.228682 2026] [security2:error] [pid 890058:tid 890277] [client 103.59.161.175:62044] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cosanluis.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxgOHzbEu1Ap1Mwpo-jNgAAAWM"]
[Sat Jul 18 23:27:20.477744 2026] [security2:error] [pid 890058:tid 890312] [client 45.3.55.196:50679] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 196.55.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxgOHzbEu1Ap1Mwpo-jPwAAAYY"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:27:20.681889 2026] [security2:error] [pid 890058:tid 890247] [client 190.245.146.99:63354] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgOHzbEu1Ap1Mwpo-jSAAAAUU"]
[Sat Jul 18 23:27:20.682034 2026] [security2:error] [pid 890058:tid 890247] [client 190.245.146.99:63354] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgOHzbEu1Ap1Mwpo-jSAAAAUU"]
[Sat Jul 18 23:27:20.884600 2026] [security2:error] [pid 890058:tid 890250] [client 223.228.182.224:34389] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxgOHzbEu1Ap1Mwpo-jXgAAAUg"]
[Sat Jul 18 23:27:20.888602 2026] [security2:error] [pid 890058:tid 890250] [client 223.228.182.224:34389] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxgOHzbEu1Ap1Mwpo-jXgAAAUg"]
[Sat Jul 18 23:27:21.306587 2026] [security2:error] [pid 890058:tid 890288] [client 4.194.24.143:49786] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/sql.php"] [unique_id "alxgOXzbEu1Ap1Mwpo-jcwAAAW4"]
[Sat Jul 18 23:27:21.707174 2026] [security2:error] [pid 881201:tid 881352] [client 45.3.43.21:27205] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 21.43.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxgOQWL-zKlchkVWS1uBQAAABQ"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:27:21.927518 2026] [security2:error] [pid 890058:tid 890226] [client 34.90.191.83:32768] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "sih.bgd.mybluehost.me"] [uri "/"] [unique_id "alxgOXzbEu1Ap1Mwpo-jhwAAATA"]
[Sat Jul 18 23:27:21.927590 2026] [security2:error] [pid 890058:tid 890226] [client 34.90.191.83:32768] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "sih.bgd.mybluehost.me"] [uri "/"] [unique_id "alxgOXzbEu1Ap1Mwpo-jhwAAATA"]
[Sat Jul 18 23:27:22.288835 2026] [security2:error] [pid 881201:tid 881351] [client 103.59.161.175:62433] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cosanluis.com"] [uri "/"] [unique_id "alxgOgWL-zKlchkVWS1uHQAAABM"]
[Sat Jul 18 23:27:22.350225 2026] [security2:error] [pid 890058:tid 890315] [client 65.111.31.241:48561] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 241.31.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxgOnzbEu1Ap1Mwpo-jkgAAAYk"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:27:22.358301 2026] [security2:error] [pid 881201:tid 881355] [client 50.116.65.227:43838] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxgOgWL-zKlchkVWS1uIQAAABc"]
[Sat Jul 18 23:27:22.373568 2026] [security2:error] [pid 881201:tid 881345] [client 50.116.65.227:56942] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxgOgWL-zKlchkVWS1uIgAAAA0"]
[Sat Jul 18 23:27:22.465295 2026] [security2:error] [pid 881201:tid 881459] [client 27.34.68.67:28600] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgOgWL-zKlchkVWS1uJQAAAH8"]
[Sat Jul 18 23:27:22.465392 2026] [security2:error] [pid 881201:tid 881459] [client 27.34.68.67:28600] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgOgWL-zKlchkVWS1uJQAAAH8"]
[Sat Jul 18 23:27:22.787396 2026] [security2:error] [pid 881201:tid 881449] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxgOgWL-zKlchkVWS1uMAAAAHU"]
[Sat Jul 18 23:27:22.821620 2026] [security2:error] [pid 890058:tid 890196] [client 57.141.18.4:57716] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "techtradeinc.com"] [uri "/index.php"] [unique_id "alxgOXzbEu1Ap1Mwpo-jiAABEjQ"]
[Sat Jul 18 23:27:22.938161 2026] [security2:error] [pid 881201:tid 881409] [client 4.194.24.143:48486] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/ss.php"] [unique_id "alxgOgWL-zKlchkVWS1uPwAAAE0"]
[Sat Jul 18 23:27:22.990626 2026] [security2:error] [pid 881201:tid 881399] [client 65.111.21.103:55741] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.21.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxgOgWL-zKlchkVWS1uQAAAAEM"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:27:23.214309 2026] [security2:error] [pid 890058:tid 890286] [client 103.59.161.175:62717] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "cosanluis.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxgO3zbEu1Ap1Mwpo-jpwAAAWw"]
[Sat Jul 18 23:27:23.295647 2026] [security2:error] [pid 890058:tid 890312] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxgO3zbEu1Ap1Mwpo-jowAAAYY"]
[Sat Jul 18 23:27:23.479990 2026] [security2:error] [pid 881201:tid 881392] [client 223.185.61.63:31194] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxgOwWL-zKlchkVWS1uUwAAADw"]
[Sat Jul 18 23:27:23.480169 2026] [security2:error] [pid 881201:tid 881392] [client 223.185.61.63:31194] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxgOwWL-zKlchkVWS1uUwAAADw"]
[Sat Jul 18 23:27:23.622283 2026] [security2:error] [pid 890058:tid 890212] [client 65.111.23.208:51431] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 208.23.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxgO3zbEu1Ap1Mwpo-jsgAAASI"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:27:23.857252 2026] [security2:error] [pid 890058:tid 890261] [client 4.194.24.143:49748] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/stats.php"] [unique_id "alxgO3zbEu1Ap1Mwpo-juQAAAVM"]
[Sat Jul 18 23:27:23.860310 2026] [security2:error] [pid 881201:tid 881264] [remote 124.156.212.23:37815] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 23.212.156.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tee.qtw.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgOwWL-zKlchkVWS1uYwAAPT0"]
[Sat Jul 18 23:27:23.860523 2026] [security2:error] [pid 881201:tid 881393] [client 124.156.212.23:37815] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "tee.qtw.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgOwWL-zKlchkVWS1uYwAAPT0"]
[Sat Jul 18 23:27:24.296802 2026] [security2:error] [pid 890058:tid 890119] [remote 57.141.18.21:35836] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 21.18.141.57.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/product/5417502"] [unique_id "alxgPHzbEu1Ap1Mwpo-jwwABEjw"]
[Sat Jul 18 23:27:24.317874 2026] [security2:error] [pid 881201:tid 881380] [client 103.59.161.175:62834] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cosanluis.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxgPAWL-zKlchkVWS1ucgAAADA"]
[Sat Jul 18 23:27:24.516384 2026] [security2:error] [pid 881201:tid 881436] [client 4.194.24.143:52949] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/sump1.php"] [unique_id "alxgPAWL-zKlchkVWS1udgAAAGg"]
[Sat Jul 18 23:27:24.769848 2026] [security2:error] [pid 890058:tid 890205] [client 23.160.60.91:21073] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "gertoger.org"] [uri "/index.php"] [unique_id "alxgO3zbEu1Ap1Mwpo-jqgAAARs"]
[Sat Jul 18 23:27:25.116918 2026] [security2:error] [pid 890058:tid 890255] [client 4.194.24.143:33841] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/system.php"] [unique_id "alxgPXzbEu1Ap1Mwpo-j4AAAAU0"]
[Sat Jul 18 23:27:25.417944 2026] [security2:error] [pid 890058:tid 890236] [client 124.29.246.106:50309] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxgPXzbEu1Ap1Mwpo-j7QAAATo"]
[Sat Jul 18 23:27:25.418039 2026] [security2:error] [pid 890058:tid 890236] [client 124.29.246.106:50309] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxgPXzbEu1Ap1Mwpo-j7QAAATo"]
[Sat Jul 18 23:27:25.605938 2026] [security2:error] [pid 890058:tid 890240] [client 82.156.39.136:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxgPXzbEu1Ap1Mwpo-j8AABPkk"]
[Sat Jul 18 23:27:25.687706 2026] [security2:error] [pid 890058:tid 890220] [client 4.194.24.143:49768] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/system/03n1hob7p03r2npdefault.php"] [unique_id "alxgPXzbEu1Ap1Mwpo-j_QAAASo"]
[Sat Jul 18 23:27:26.228727 2026] [security2:error] [pid 881201:tid 881428] [client 4.194.24.143:49787] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/system/cj5ha2rah8lyiqqdefault.php"] [unique_id "alxgPgWL-zKlchkVWS1uqQAAAGA"]
[Sat Jul 18 23:27:26.395611 2026] [security2:error] [pid 881201:tid 881374] [client 103.59.161.175:63109] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cosanluis.com"] [uri "/"] [unique_id "alxgPgWL-zKlchkVWS1urgAAACo"]
[Sat Jul 18 23:27:26.779204 2026] [security2:error] [pid 881201:tid 881405] [client 4.194.24.143:48497] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/system_log.php"] [unique_id "alxgPgWL-zKlchkVWS1uvAAAAEk"]
[Sat Jul 18 23:27:27.000867 2026] [security2:error] [pid 890058:tid 890231] [client 87.250.224.234:45834] ModSecurity: Access denied with code 429 (phase 2). Pattern match "Mozilla\\\\/5\\\\.0 \\\\(compatible; YandexBot\\\\/3\\\\.0; \\\\+http:\\\\/\\\\/yandex\\\\.com\\\\/bots\\\\)" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/othercrawler.conf"] [line "3"] [id "901008"] [msg "Yandex Crawler 429 ADDED BY MONITORING DO NOT WHITELIST"] [hostname "heroesoftomorrow.us"] [uri "/robots.txt"] [unique_id "alxgPnzbEu1Ap1Mwpo-kGQAAATU"]
[Sat Jul 18 23:27:27.036326 2026] [security2:error] [pid 890058:tid 890142] [remote 31.42.184.154:58578] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "adambergeron.com"] [uri "/wp-login.php"] [unique_id "alxgP3zbEu1Ap1Mwpo-kHQABNlM"]
[Sat Jul 18 23:27:27.116937 2026] [security2:error] [pid 890058:tid 890210] [client 103.59.161.175:63338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "cosanluis.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxgP3zbEu1Ap1Mwpo-kIwAAASA"]
[Sat Jul 18 23:27:27.331306 2026] [security2:error] [pid 890058:tid 890204] [client 4.194.24.143:52951] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/t.php"] [unique_id "alxgP3zbEu1Ap1Mwpo-kKgAAARo"]
[Sat Jul 18 23:27:27.334945 2026] [security2:error] [pid 890058:tid 890149] [remote 31.42.184.154:58578] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "adambergeron.com"] [uri "/wp-login.php"] [unique_id "alxgP3zbEu1Ap1Mwpo-kKwABRlo"], referer: https://adambergeron.com/wp-login.php
[Sat Jul 18 23:27:27.873301 2026] [security2:error] [pid 890058:tid 890222] [client 4.194.24.143:22943] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/term.php"] [unique_id "alxgP3zbEu1Ap1Mwpo-kNwAAASw"]
[Sat Jul 18 23:27:28.010743 2026] [security2:error] [pid 890058:tid 890209] [client 103.59.161.175:63493] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cosanluis.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxgQHzbEu1Ap1Mwpo-kPgAAAR8"]
[Sat Jul 18 23:27:28.083171 2026] [security2:error] [pid 881201:tid 881361] [client 85.204.70.98:46210] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "careysheatingandcooling.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "alxgQAWL-zKlchkVWS1u5gAAAB0"]
[Sat Jul 18 23:27:28.204050 2026] [security2:error] [pid 881201:tid 881368] [client 119.154.81.234:62201] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgQAWL-zKlchkVWS1u6QAAACQ"]
[Sat Jul 18 23:27:28.204275 2026] [security2:error] [pid 881201:tid 881368] [client 119.154.81.234:62201] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgQAWL-zKlchkVWS1u6QAAACQ"]
[Sat Jul 18 23:27:28.414457 2026] [security2:error] [pid 881201:tid 881428] [client 4.194.24.143:52935] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/test.php"] [unique_id "alxgQAWL-zKlchkVWS1u8QAAAGA"]
[Sat Jul 18 23:27:28.619375 2026] [security2:error] [pid 890058:tid 890156] [remote 97.74.93.24:50050] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "goyalsatyam.com"] [uri "/wp-login.php"] [unique_id "alxgQHzbEu1Ap1Mwpo-kUQABJGE"]
[Sat Jul 18 23:27:28.992590 2026] [security2:error] [pid 890058:tid 890220] [client 4.194.24.143:48478] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/test1.php"] [unique_id "alxgQHzbEu1Ap1Mwpo-kYwAAASo"]
[Sat Jul 18 23:27:29.049548 2026] [security2:error] [pid 890058:tid 890157] [remote 97.74.93.24:50050] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "goyalsatyam.com"] [uri "/wp-login.php"] [unique_id "alxgQXzbEu1Ap1Mwpo-kZAABYmI"], referer: https://goyalsatyam.com/wp-login.php
[Sat Jul 18 23:27:29.463393 2026] [security2:error] [pid 890058:tid 890279] [client 106.222.249.209:22641] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgQXzbEu1Ap1Mwpo-kcQAAAWU"]
[Sat Jul 18 23:27:29.463517 2026] [security2:error] [pid 890058:tid 890279] [client 106.222.249.209:22641] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgQXzbEu1Ap1Mwpo-kcQAAAWU"]
[Sat Jul 18 23:27:29.565769 2026] [security2:error] [pid 890058:tid 890222] [client 4.194.24.143:48471] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/tfm.php"] [unique_id "alxgQXzbEu1Ap1Mwpo-keAAAASw"]
[Sat Jul 18 23:27:29.878339 2026] [security2:error] [pid 890058:tid 890194] [client 163.61.1.17:63865] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgQXzbEu1Ap1Mwpo-khAAAARA"]
[Sat Jul 18 23:27:29.878439 2026] [security2:error] [pid 890058:tid 890194] [client 163.61.1.17:63865] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgQXzbEu1Ap1Mwpo-khAAAARA"]
[Sat Jul 18 23:27:30.190959 2026] [security2:error] [pid 890058:tid 890269] [client 4.194.24.143:48467] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/thebe.php"] [unique_id "alxgQnzbEu1Ap1Mwpo-klQAAAVs"]
[Sat Jul 18 23:27:30.454495 2026] [security2:error] [pid 881201:tid 881316] [remote 91.142.222.105:59400] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/wp-login.php"] [unique_id "alxgQgWL-zKlchkVWS1vHwAAAXE"]
[Sat Jul 18 23:27:30.525167 2026] [security2:error] [pid 890058:tid 890258] [client 103.59.161.175:63809] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cosanluis.com"] [uri "/"] [unique_id "alxgQnzbEu1Ap1Mwpo-knQAAAVA"]
[Sat Jul 18 23:27:30.790674 2026] [security2:error] [pid 881201:tid 881354] [client 4.194.24.143:33833] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/themes.php"] [unique_id "alxgQgWL-zKlchkVWS1vMwAAABY"]
[Sat Jul 18 23:27:31.070719 2026] [security2:error] [pid 890058:tid 890224] [client 85.204.70.98:50392] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 98.70.204.85.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "careysheatingandcooling.com"] [uri "/xmlrpc.php"] [unique_id "alxgQ3zbEu1Ap1Mwpo-krgAAAS4"]
[Sat Jul 18 23:27:31.070846 2026] [security2:error] [pid 890058:tid 890224] [client 85.204.70.98:50392] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "careysheatingandcooling.com"] [uri "/xmlrpc.php"] [unique_id "alxgQ3zbEu1Ap1Mwpo-krgAAAS4"]
[Sat Jul 18 23:27:31.179697 2026] [security2:error] [pid 881201:tid 881428] [client 190.245.146.99:64067] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgQwWL-zKlchkVWS1vOAAAAGA"]
[Sat Jul 18 23:27:31.179821 2026] [security2:error] [pid 881201:tid 881428] [client 190.245.146.99:64067] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgQwWL-zKlchkVWS1vOAAAAGA"]
[Sat Jul 18 23:27:31.243568 2026] [security2:error] [pid 890058:tid 890189] [client 103.59.161.175:64163] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "cosanluis.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxgQ3zbEu1Ap1Mwpo-ktAAAAQs"]
[Sat Jul 18 23:27:31.466936 2026] [security2:error] [pid 890058:tid 890298] [client 4.194.24.143:33795] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/tiny.php"] [unique_id "alxgQ3zbEu1Ap1Mwpo-kvwAAAXg"]
[Sat Jul 18 23:27:31.750767 2026] [security2:error] [pid 890058:tid 890236] [client 65.111.28.212:50919] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 212.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxgQ3zbEu1Ap1Mwpo-kygAAATo"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:27:31.816885 2026] [security2:error] [pid 890058:tid 890238] [client 223.228.182.224:11241] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxgQ3zbEu1Ap1Mwpo-kzQAAATw"]
[Sat Jul 18 23:27:31.817001 2026] [security2:error] [pid 890058:tid 890238] [client 223.228.182.224:11241] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxgQ3zbEu1Ap1Mwpo-kzQAAATw"]
[Sat Jul 18 23:27:32.113307 2026] [security2:error] [pid 881201:tid 881414] [client 103.59.161.175:64272] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cosanluis.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxgRAWL-zKlchkVWS1vRwAAAFI"]
[Sat Jul 18 23:27:32.447531 2026] [security2:error] [pid 881201:tid 881328] [remote 91.142.222.105:59400] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/wp-login.php"] [unique_id "alxgRAWL-zKlchkVWS1vSwAAH30"], referer: https://adultdaycarereno.com/wp-login.php
[Sat Jul 18 23:27:32.553532 2026] [security2:error] [pid 890058:tid 890198] [client 4.194.24.143:41708] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "candlelitchapters.com"] [uri "/tmp/byp.php"] [unique_id "alxgRHzbEu1Ap1Mwpo-k9gAAARQ"]
[Sat Jul 18 23:27:33.000886 2026] [security2:error] [pid 890058:tid 890193] [client 27.34.68.67:12358] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgRXzbEu1Ap1Mwpo-lHAAAAQ8"]
[Sat Jul 18 23:27:33.000988 2026] [security2:error] [pid 890058:tid 890193] [client 27.34.68.67:12358] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgRXzbEu1Ap1Mwpo-lHAAAAQ8"]
[Sat Jul 18 23:27:33.077914 2026] [security2:error] [pid 881201:tid 881203] [remote 72.167.132.114:43936] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxgRQWL-zKlchkVWS1vawAADwA"]
[Sat Jul 18 23:27:33.195558 2026] [security2:error] [pid 890058:tid 890216] [client 65.111.28.199:10413] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 199.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxgRXzbEu1Ap1Mwpo-lIwAAASY"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:27:33.488348 2026] [security2:error] [pid 890058:tid 890245] [client 34.90.69.83:49153] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "cpcalendars.bep.par.mybluehost.me"] [uri "/"] [unique_id "alxgRXzbEu1Ap1Mwpo-lNAAAAUM"]
[Sat Jul 18 23:27:33.488506 2026] [security2:error] [pid 890058:tid 890245] [client 34.90.69.83:49153] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "cpcalendars.bep.par.mybluehost.me"] [uri "/"] [unique_id "alxgRXzbEu1Ap1Mwpo-lNAAAAUM"]
[Sat Jul 18 23:27:33.611169 2026] [security2:error] [pid 881201:tid 881319] [remote 72.167.132.114:43936] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxgRQWL-zKlchkVWS1vdAAAQXQ"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:27:33.612836 2026] [security2:error] [pid 890058:tid 890205] [client 103.59.161.175:64563] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cosanluis.com"] [uri "/"] [unique_id "alxgRXzbEu1Ap1Mwpo-lPQAAARs"]
[Sat Jul 18 23:27:33.783649 2026] [security2:error] [pid 890058:tid 890250] [client 74.208.214.194:36830] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxgRXzbEu1Ap1Mwpo-lQQAAAUg"]
[Sat Jul 18 23:27:34.049396 2026] [security2:error] [pid 881201:tid 881395] [client 223.185.61.63:18559] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxgRgWL-zKlchkVWS1vewAAAD8"]
[Sat Jul 18 23:27:34.053706 2026] [security2:error] [pid 881201:tid 881395] [client 223.185.61.63:18559] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxgRgWL-zKlchkVWS1vewAAAD8"]
[Sat Jul 18 23:27:34.488259 2026] [security2:error] [pid 890058:tid 890312] [client 74.208.214.194:36840] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxgRnzbEu1Ap1Mwpo-lWgAAAYY"]
[Sat Jul 18 23:27:34.638011 2026] [security2:error] [pid 881201:tid 881335] [client 45.3.45.37:23581] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 37.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxgRgWL-zKlchkVWS1vgwAAAAM"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:27:34.930146 2026] [security2:error] [pid 890058:tid 890241] [client 17.241.219.236:48012] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.vfcthomasville.org"] [uri "/index.php"] [unique_id "alxgRnzbEu1Ap1Mwpo-lbAABP0E"]
[Sat Jul 18 23:27:35.073924 2026] [security2:error] [pid 881201:tid 881367] [client 113.160.97.242:63718] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxgRwWL-zKlchkVWS1viwAAACM"]
[Sat Jul 18 23:27:36.643449 2026] [security2:error] [pid 881201:tid 881211] [remote 31.42.184.154:43008] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "39ishlife.com"] [uri "/wp-login.php"] [unique_id "alxgSAWL-zKlchkVWS1vrgAAMgg"]
[Sat Jul 18 23:27:36.888304 2026] [security2:error] [pid 881201:tid 881258] [remote 31.42.184.154:43008] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "39ishlife.com"] [uri "/wp-login.php"] [unique_id "alxgSAWL-zKlchkVWS1vtwAAeDc"], referer: https://39ishlife.com/wp-login.php
[Sat Jul 18 23:27:37.425838 2026] [security2:error] [pid 890058:tid 890171] [remote 49.13.1.223:52092] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.1.13.49.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "travelbyfire.com"] [uri "/wp-login.php"] [unique_id "alxgSXzbEu1Ap1Mwpo-l3QABRHA"]
[Sat Jul 18 23:27:37.501060 2026] [security2:error] [pid 890058:tid 890177] [remote 31.42.184.154:43010] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgSXzbEu1Ap1Mwpo-l4QABP3Y"]
[Sat Jul 18 23:27:37.501223 2026] [security2:error] [pid 890058:tid 890241] [client 31.42.184.154:43010] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgSXzbEu1Ap1Mwpo-l4QABP3Y"]
[Sat Jul 18 23:27:37.541319 2026] [security2:error] [pid 890058:tid 890257] [client 124.29.246.106:50747] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxgSXzbEu1Ap1Mwpo-l5AAAAU8"]
[Sat Jul 18 23:27:37.541425 2026] [security2:error] [pid 890058:tid 890257] [client 124.29.246.106:50747] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxgSXzbEu1Ap1Mwpo-l5AAAAU8"]
[Sat Jul 18 23:27:37.718715 2026] [security2:error] [pid 890058:tid 890181] [remote 49.13.1.223:52092] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.1.13.49.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "travelbyfire.com"] [uri "/wp-login.php"] [unique_id "alxgSXzbEu1Ap1Mwpo-l6gABcXo"], referer: https://travelbyfire.com/wp-login.php
[Sat Jul 18 23:27:37.946766 2026] [security2:error] [pid 890058:tid 890184] [remote 117.0.21.154:46450] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nomorewetsheets.net"] [uri "/xmlrpc.php"] [unique_id "alxgSXzbEu1Ap1Mwpo-l9QABbn0"]
[Sat Jul 18 23:27:37.946934 2026] [security2:error] [pid 890058:tid 890288] [client 117.0.21.154:46450] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nomorewetsheets.net"] [uri "/xmlrpc.php"] [unique_id "alxgSXzbEu1Ap1Mwpo-l9QABbn0"]
[Sat Jul 18 23:27:38.786302 2026] [security2:error] [pid 890058:tid 890212] [client 119.154.81.234:62650] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgSnzbEu1Ap1Mwpo-mGgAAASI"]
[Sat Jul 18 23:27:38.786398 2026] [security2:error] [pid 890058:tid 890212] [client 119.154.81.234:62650] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgSnzbEu1Ap1Mwpo-mGgAAASI"]
[Sat Jul 18 23:27:39.278310 2026] [security2:error] [pid 881201:tid 881339] [client 66.249.73.130:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.littleaosta.nz"] [uri "/index.php"] [unique_id "alxgSwWL-zKlchkVWS1v0wAAAAc"]
[Sat Jul 18 23:27:39.512682 2026] [security2:error] [pid 890058:tid 890258] [client 138.252.89.100:60357] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxgS3zbEu1Ap1Mwpo-mOQAAAVA"]
[Sat Jul 18 23:27:39.512850 2026] [security2:error] [pid 890058:tid 890258] [client 138.252.89.100:60357] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxgS3zbEu1Ap1Mwpo-mOQAAAVA"]
[Sat Jul 18 23:27:39.843177 2026] [security2:error] [pid 881201:tid 881262] [remote 163.227.186.27:54256] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxgSwWL-zKlchkVWS1v4AAANzs"]
[Sat Jul 18 23:27:39.923109 2026] [security2:error] [pid 881201:tid 881285] [remote 72.167.132.114:52244] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sarakety.com"] [uri "/wp-login.php"] [unique_id "alxgSwWL-zKlchkVWS1v4gAAMlI"]
[Sat Jul 18 23:27:40.034304 2026] [security2:error] [pid 890058:tid 890242] [client 106.222.249.209:3165] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgTHzbEu1Ap1Mwpo-mVgAAAUA"]
[Sat Jul 18 23:27:40.034650 2026] [security2:error] [pid 890058:tid 890242] [client 106.222.249.209:3165] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgTHzbEu1Ap1Mwpo-mVgAAAUA"]
[Sat Jul 18 23:27:40.186512 2026] [security2:error] [pid 881201:tid 881223] [remote 72.167.132.114:52244] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sarakety.com"] [uri "/wp-login.php"] [unique_id "alxgTAWL-zKlchkVWS1v5AAAaRQ"], referer: https://sarakety.com/wp-login.php
[Sat Jul 18 23:27:40.318140 2026] [security2:error] [pid 881201:tid 881306] [remote 163.227.186.27:54256] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxgTAWL-zKlchkVWS1v5wAAGWc"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:27:40.537079 2026] [security2:error] [pid 890058:tid 890306] [client 163.61.1.17:64303] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgTHzbEu1Ap1Mwpo-mbQAAAYA"]
[Sat Jul 18 23:27:40.538724 2026] [security2:error] [pid 890058:tid 890306] [client 163.61.1.17:64303] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgTHzbEu1Ap1Mwpo-mbQAAAYA"]
[Sat Jul 18 23:27:41.675877 2026] [security2:error] [pid 881201:tid 881336] [client 190.245.146.99:64749] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgTQWL-zKlchkVWS1v-gAAAAQ"]
[Sat Jul 18 23:27:41.675983 2026] [security2:error] [pid 881201:tid 881336] [client 190.245.146.99:64749] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgTQWL-zKlchkVWS1v-gAAAAQ"]
[Sat Jul 18 23:27:41.758123 2026] [security2:error] [pid 881201:tid 881396] [client 57.141.18.120:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "falconarrowshop.com"] [uri "/index.php"] [unique_id "alxgTQWL-zKlchkVWS1v-QAAAEA"]
[Sat Jul 18 23:27:41.872523 2026] [security2:error] [pid 890058:tid 890224] [client 87.199.196.181:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "secretkeynumerology.com"] [uri "/index.php"] [unique_id "alxgTHzbEu1Ap1Mwpo-mYQAAAS4"], referer: https://secretkeynumerology.com/the-trilogy/
[Sat Jul 18 23:27:42.568372 2026] [security2:error] [pid 890058:tid 890225] [client 65.111.27.13:42289] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.27.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxgTnzbEu1Ap1Mwpo-mzAAAAS8"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:27:42.591822 2026] [security2:error] [pid 890058:tid 890219] [client 223.228.182.224:58497] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxgTnzbEu1Ap1Mwpo-m0gAAASk"]
[Sat Jul 18 23:27:42.596618 2026] [security2:error] [pid 890058:tid 890219] [client 223.228.182.224:58497] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxgTnzbEu1Ap1Mwpo-m0gAAASk"]
[Sat Jul 18 23:27:42.649493 2026] [security2:error] [pid 881201:tid 881422] [client 50.116.65.227:11246] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "lifeisbetterlakeside.com"] [uri "/wp-content/uploads/2025/02/IMG_9124.jpeg"] [unique_id "alxgTgWL-zKlchkVWS1wEAAAACE"]
[Sat Jul 18 23:27:42.731048 2026] [security2:error] [pid 890058:tid 890194] [client 18.116.205.62:2934] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "windowtx.com"] [uri "/index.php"] [unique_id "alxgTnzbEu1Ap1Mwpo-mvAAAARA"], referer: https://windowtx.com
[Sat Jul 18 23:27:43.037552 2026] [security2:error] [pid 890058:tid 890285] [client 98.94.174.49:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxgTnzbEu1Ap1Mwpo-m3QABa1k"]
[Sat Jul 18 23:27:43.615208 2026] [security2:error] [pid 890058:tid 890218] [client 27.34.68.67:37759] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgT3zbEu1Ap1Mwpo-nBAAAASg"]
[Sat Jul 18 23:27:43.615308 2026] [security2:error] [pid 890058:tid 890218] [client 27.34.68.67:37759] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgT3zbEu1Ap1Mwpo-nBAAAASg"]
[Sat Jul 18 23:27:43.857234 2026] [security2:error] [pid 881201:tid 881366] [client 87.199.196.181:55013] ModSecurity: Access denied with code 406 (phase 1). IPmatchFromFile: "87.199.196.181" matched at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1090"] [id "999022"] [msg "Blacklisted IP Address for POST data StopForumSpam List"] [hostname "www.secretkeynumerology.com"] [uri "/wp-comments-post.php"] [unique_id "alxgTwWL-zKlchkVWS1wIQAAACI"], referer: https://www.secretkeynumerology.com/the-trilogy/
[Sat Jul 18 23:27:43.857340 2026] [security2:error] [pid 881201:tid 881366] [client 87.199.196.181:55013] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "406"] [hostname "www.secretkeynumerology.com"] [uri "/wp-comments-post.php"] [unique_id "alxgTwWL-zKlchkVWS1wIQAAACI"], referer: https://www.secretkeynumerology.com/the-trilogy/
[Sat Jul 18 23:27:44.037614 2026] [security2:error] [pid 890058:tid 890205] [client 47.82.11.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "slutilities.com"] [uri "/index.php"] [unique_id "alxgT3zbEu1Ap1Mwpo-nFQAAARs"]
[Sat Jul 18 23:27:44.142386 2026] [security2:error] [pid 890058:tid 890189] [client 18.181.190.12:20529] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "suretybonds-california.com"] [uri "/wp-comments-post.php"] [unique_id "alxgUHzbEu1Ap1Mwpo-nHQAAAQs"]
[Sat Jul 18 23:27:44.220943 2026] [security2:error] [pid 890058:tid 890281] [client 65.111.31.179:26251] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 179.31.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxgUHzbEu1Ap1Mwpo-nJAAAAWc"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:27:44.272815 2026] [security2:error] [pid 890058:tid 890189] [client 18.181.190.12:20529] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "500"] [hostname "suretybonds-california.com"] [uri "/wp-comments-post.php"] [unique_id "alxgUHzbEu1Ap1Mwpo-nHQAAAQs"]
[Sat Jul 18 23:27:44.460889 2026] [security2:error] [pid 890058:tid 890235] [client 62.133.62.3:46408] ModSecurity: Access denied with code 406 (phase 1). IPmatchFromFile: "62.133.62.3" matched at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1090"] [id "999022"] [msg "Blacklisted IP Address for POST data StopForumSpam List"] [hostname "www.secretkeynumerology.com"] [uri "/wp-comments-post.php"] [unique_id "alxgUHzbEu1Ap1Mwpo-nMwAAATk"], referer: https://www.secretkeynumerology.com/the-trilogy/
[Sat Jul 18 23:27:44.461000 2026] [security2:error] [pid 890058:tid 890235] [client 62.133.62.3:46408] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "406"] [hostname "www.secretkeynumerology.com"] [uri "/wp-comments-post.php"] [unique_id "alxgUHzbEu1Ap1Mwpo-nMwAAATk"], referer: https://www.secretkeynumerology.com/the-trilogy/
[Sat Jul 18 23:27:44.581054 2026] [security2:error] [pid 890058:tid 890213] [client 223.185.61.63:21196] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxgUHzbEu1Ap1Mwpo-nOwAAASM"]
[Sat Jul 18 23:27:44.581154 2026] [security2:error] [pid 890058:tid 890213] [client 223.185.61.63:21196] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxgUHzbEu1Ap1Mwpo-nOwAAASM"]
[Sat Jul 18 23:27:44.601839 2026] [security2:error] [pid 881201:tid 881377] [client 34.171.169.105:21264] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "amalia-capital.com"] [uri "/index.php"] [unique_id "alxgTgWL-zKlchkVWS1wEQAAAC0"], referer: http://amalia-capital.com/wp-json/batch/v1
[Sat Jul 18 23:27:44.643002 2026] [security2:error] [pid 890058:tid 890062] [remote 97.74.93.24:39844] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "north-woods-engineering.com"] [uri "/wp-login.php"] [unique_id "alxgUHzbEu1Ap1Mwpo-nRgABDgM"]
[Sat Jul 18 23:27:44.929766 2026] [security2:error] [pid 890058:tid 890295] [client 65.111.26.179:40387] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 179.26.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxgUHzbEu1Ap1Mwpo-nTwAAAXU"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:27:45.052243 2026] [security2:error] [pid 890058:tid 890069] [remote 97.74.93.24:39844] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "north-woods-engineering.com"] [uri "/wp-login.php"] [unique_id "alxgUXzbEu1Ap1Mwpo-nVAABRgo"], referer: https://north-woods-engineering.com/wp-login.php
[Sat Jul 18 23:27:45.362848 2026] [security2:error] [pid 881201:tid 881316] [remote 31.42.184.154:37052] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.yok.mqz.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgUQWL-zKlchkVWS1wPAAAE3E"]
[Sat Jul 18 23:27:45.362966 2026] [security2:error] [pid 881201:tid 881351] [client 31.42.184.154:37052] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "mail.yok.mqz.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgUQWL-zKlchkVWS1wPAAAE3E"]
[Sat Jul 18 23:27:45.568645 2026] [security2:error] [pid 881201:tid 881417] [client 65.111.28.72:36741] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 72.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxgUQWL-zKlchkVWS1wQQAAAFU"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:27:45.813830 2026] [security2:error] [pid 890058:tid 890301] [client 18.181.190.12:34331] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "suretybonds-california.com"] [uri "/wp-comments-post.php"] [unique_id "alxgUXzbEu1Ap1Mwpo-newAAAXs"]
[Sat Jul 18 23:27:45.946507 2026] [security2:error] [pid 890058:tid 890301] [client 18.181.190.12:34331] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "500"] [hostname "suretybonds-california.com"] [uri "/wp-comments-post.php"] [unique_id "alxgUXzbEu1Ap1Mwpo-newAAAXs"]
[Sat Jul 18 23:27:46.040215 2026] [security2:error] [pid 890058:tid 890237] [client 114.119.138.185:34655] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.tmsteamer.com"] [uri "/overview/trailermounted/"] [unique_id "alxgUnzbEu1Ap1Mwpo-ngAAAATs"], referer: https://www.tmsteamer.com/
[Sat Jul 18 23:27:46.127793 2026] [security2:error] [pid 881201:tid 881264] [remote 160.187.68.132:50800] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.68.187.160.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxgUgWL-zKlchkVWS1wTgAALz0"]
[Sat Jul 18 23:27:46.656939 2026] [security2:error] [pid 881201:tid 881252] [remote 160.187.68.132:50800] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.68.187.160.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxgUgWL-zKlchkVWS1wVwAAPzE"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:27:46.721090 2026] [security2:error] [pid 890058:tid 890267] [client 124.29.246.106:51188] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxgUnzbEu1Ap1Mwpo-noAAAAVk"]
[Sat Jul 18 23:27:46.721302 2026] [security2:error] [pid 890058:tid 890267] [client 124.29.246.106:51188] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxgUnzbEu1Ap1Mwpo-noAAAAVk"]
[Sat Jul 18 23:27:47.335911 2026] [security2:error] [pid 890058:tid 890115] [remote 205.196.217.58:57556] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.217.196.205.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgU3zbEu1Ap1Mwpo-nwgABYTg"]
[Sat Jul 18 23:27:47.336074 2026] [security2:error] [pid 890058:tid 890275] [client 205.196.217.58:57556] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgU3zbEu1Ap1Mwpo-nwgABYTg"]
[Sat Jul 18 23:27:47.351893 2026] [security2:error] [pid 890058:tid 890224] [client 18.181.190.12:34473] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "suretybonds-california.com"] [uri "/wp-comments-post.php"] [unique_id "alxgU3zbEu1Ap1Mwpo-nxAAAAS4"]
[Sat Jul 18 23:27:47.410624 2026] [security2:error] [pid 890058:tid 890298] [client 107.161.92.6:46530] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "mail.myspineworld.com"] [uri "/.env"] [unique_id "alxgU3zbEu1Ap1Mwpo-nzAAAAXg"]
[Sat Jul 18 23:27:47.488708 2026] [security2:error] [pid 890058:tid 890224] [client 18.181.190.12:34473] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "500"] [hostname "suretybonds-california.com"] [uri "/wp-comments-post.php"] [unique_id "alxgU3zbEu1Ap1Mwpo-nxAAAAS4"]
[Sat Jul 18 23:27:47.632310 2026] [security2:error] [pid 890058:tid 890121] [remote 154.61.75.100:46180] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgU3zbEu1Ap1Mwpo-n0gABSD4"]
[Sat Jul 18 23:27:47.632442 2026] [security2:error] [pid 890058:tid 890250] [client 154.61.75.100:46180] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgU3zbEu1Ap1Mwpo-n0gABSD4"]
[Sat Jul 18 23:27:47.750069 2026] [security2:error] [pid 881201:tid 881212] [remote 152.228.213.32:59626] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxgUwWL-zKlchkVWS1wdQAANgk"]
[Sat Jul 18 23:27:47.955070 2026] [security2:error] [pid 881201:tid 881203] [remote 152.228.213.32:59626] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxgUwWL-zKlchkVWS1wegAAWAA"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:27:47.974304 2026] [security2:error] [pid 890058:tid 890282] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mail.myspineworld.com"] [uri "/index.php"] [unique_id "alxgU3zbEu1Ap1Mwpo-n2wAAAWg"]
[Sat Jul 18 23:27:48.376361 2026] [security2:error] [pid 890058:tid 890140] [remote 154.61.75.100:39246] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxgVHzbEu1Ap1Mwpo-n_AABTFE"]
[Sat Jul 18 23:27:48.441117 2026] [security2:error] [pid 890058:tid 890290] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mail.myspineworld.com"] [uri "/index.php"] [unique_id "alxgVHzbEu1Ap1Mwpo-n9AAAAXA"]
[Sat Jul 18 23:27:48.781088 2026] [security2:error] [pid 890058:tid 890309] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "alxgVHzbEu1Ap1Mwpo-oJgAAAYM"]
[Sat Jul 18 23:27:48.781189 2026] [security2:error] [pid 890058:tid 890309] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "alxgVHzbEu1Ap1Mwpo-oJgAAAYM"]
[Sat Jul 18 23:27:48.819338 2026] [security2:error] [pid 890058:tid 890234] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mail.myspineworld.com"] [uri "/index.php"] [unique_id "alxgVHzbEu1Ap1Mwpo-oHQAAATg"]
[Sat Jul 18 23:27:48.919108 2026] [security2:error] [pid 890058:tid 890150] [remote 154.61.75.100:39246] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxgVHzbEu1Ap1Mwpo-oLAABV1s"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:27:48.928216 2026] [security2:error] [pid 881201:tid 881378] [client 18.181.190.12:24493] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "suretybonds-california.com"] [uri "/wp-comments-post.php"] [unique_id "alxgVAWL-zKlchkVWS1wkwAAAC4"]
[Sat Jul 18 23:27:49.058497 2026] [security2:error] [pid 881201:tid 881378] [client 18.181.190.12:24493] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "500"] [hostname "suretybonds-california.com"] [uri "/wp-comments-post.php"] [unique_id "alxgVAWL-zKlchkVWS1wkwAAAC4"]
[Sat Jul 18 23:27:49.118964 2026] [security2:error] [pid 890058:tid 890254] [client 107.161.92.6:46566] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\.bak|\\\\.bak\\\\.php)$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1260"] [id "390582"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that nclude .bak)"] [severity "CRITICAL"] [hostname "mail.myspineworld.com"] [uri "/.env.bak"] [unique_id "alxgVXzbEu1Ap1Mwpo-oNAAAAUw"]
[Sat Jul 18 23:27:49.144497 2026] [security2:error] [pid 881201:tid 881361] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/this_is_a_new_hello_world.php"] [unique_id "alxgVQWL-zKlchkVWS1wmQAAAB0"]
[Sat Jul 18 23:27:49.144611 2026] [security2:error] [pid 881201:tid 881361] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/this_is_a_new_hello_world.php"] [unique_id "alxgVQWL-zKlchkVWS1wmQAAAB0"]
[Sat Jul 18 23:27:49.378107 2026] [security2:error] [pid 890058:tid 890282] [client 119.154.81.234:63111] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgVXzbEu1Ap1Mwpo-oOwAAAWg"]
[Sat Jul 18 23:27:49.378247 2026] [security2:error] [pid 890058:tid 890282] [client 119.154.81.234:63111] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgVXzbEu1Ap1Mwpo-oOwAAAWg"]
[Sat Jul 18 23:27:49.431089 2026] [security2:error] [pid 890058:tid 890300] [client 107.161.92.6:46566] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.backup$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1279"] [id "390588"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .backup)"] [severity "CRITICAL"] [hostname "mail.myspineworld.com"] [uri "/.env.backup"] [unique_id "alxgVXzbEu1Ap1Mwpo-oQAAAAXo"]
[Sat Jul 18 23:27:49.494543 2026] [security2:error] [pid 890058:tid 890250] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/media.php"] [unique_id "alxgVXzbEu1Ap1Mwpo-oRAAAAUg"]
[Sat Jul 18 23:27:49.494633 2026] [security2:error] [pid 890058:tid 890250] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/media.php"] [unique_id "alxgVXzbEu1Ap1Mwpo-oRAAAAUg"]
[Sat Jul 18 23:27:49.862378 2026] [security2:error] [pid 890058:tid 890235] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/images.php"] [unique_id "alxgVXzbEu1Ap1Mwpo-oWgAAATk"]
[Sat Jul 18 23:27:49.862478 2026] [security2:error] [pid 890058:tid 890235] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/images.php"] [unique_id "alxgVXzbEu1Ap1Mwpo-oWgAAATk"]
[Sat Jul 18 23:27:49.864493 2026] [security2:error] [pid 890058:tid 890163] [remote 103.90.233.75:51064] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.233.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgVXzbEu1Ap1Mwpo-oWAABUGg"]
[Sat Jul 18 23:27:49.864645 2026] [security2:error] [pid 890058:tid 890258] [client 103.90.233.75:51064] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgVXzbEu1Ap1Mwpo-oWAABUGg"]
[Sat Jul 18 23:27:50.006812 2026] [security2:error] [pid 890058:tid 890196] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mail.myspineworld.com"] [uri "/index.php"] [unique_id "alxgVXzbEu1Ap1Mwpo-oWQAAARI"]
[Sat Jul 18 23:27:50.264172 2026] [security2:error] [pid 881201:tid 881451] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/adminner.php"] [unique_id "alxgVgWL-zKlchkVWS1wswAAAHc"]
[Sat Jul 18 23:27:50.264318 2026] [security2:error] [pid 881201:tid 881451] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/adminner.php"] [unique_id "alxgVgWL-zKlchkVWS1wswAAAHc"]
[Sat Jul 18 23:27:50.265232 2026] [security2:error] [pid 890058:tid 890174] [remote 47.128.121.88:58938] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "lifeisbetterlakeside.com"] [uri "/robots.txt"] [unique_id "alxgVnzbEu1Ap1Mwpo-obAABSHM"]
[Sat Jul 18 23:27:50.371481 2026] [security2:error] [pid 890058:tid 890282] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mail.myspineworld.com"] [uri "/index.php"] [unique_id "alxgVnzbEu1Ap1Mwpo-oagAAAWg"]
[Sat Jul 18 23:27:50.420234 2026] [security2:error] [pid 890058:tid 890216] [client 57.141.18.2:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "weifangsmefarm.com"] [uri "/index.php"] [unique_id "alxgVXzbEu1Ap1Mwpo-oYgAAASY"]
[Sat Jul 18 23:27:50.446788 2026] [security2:error] [pid 890058:tid 890232] [client 18.181.190.12:26411] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "suretybonds-california.com"] [uri "/wp-comments-post.php"] [unique_id "alxgVnzbEu1Ap1Mwpo-oeAAAATY"]
[Sat Jul 18 23:27:50.484567 2026] [security2:error] [pid 890058:tid 890203] [client 143.198.85.218:56730] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "jhavoctattoos.com"] [uri "/wp-comments-post.php"] [unique_id "alxgVnzbEu1Ap1Mwpo-ocQAAARk"]
[Sat Jul 18 23:27:50.583006 2026] [security2:error] [pid 890058:tid 890232] [client 18.181.190.12:26411] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "500"] [hostname "suretybonds-california.com"] [uri "/wp-comments-post.php"] [unique_id "alxgVnzbEu1Ap1Mwpo-oeAAAATY"]
[Sat Jul 18 23:27:50.585647 2026] [security2:error] [pid 890058:tid 890203] [client 143.198.85.218:56730] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "403"] [hostname "jhavoctattoos.com"] [uri "/wp-comments-post.php"] [unique_id "alxgVnzbEu1Ap1Mwpo-ocQAAARk"]
[Sat Jul 18 23:27:50.642935 2026] [security2:error] [pid 890058:tid 890303] [client 106.222.249.209:7934] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgVnzbEu1Ap1Mwpo-ohgAAAX0"]
[Sat Jul 18 23:27:50.643071 2026] [security2:error] [pid 890058:tid 890303] [client 106.222.249.209:7934] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgVnzbEu1Ap1Mwpo-ohgAAAX0"]
[Sat Jul 18 23:27:50.652323 2026] [security2:error] [pid 890058:tid 890253] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/3PJcpMFsD8B.php"] [unique_id "alxgVnzbEu1Ap1Mwpo-ohwAAAUs"]
[Sat Jul 18 23:27:50.652452 2026] [security2:error] [pid 890058:tid 890253] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/3PJcpMFsD8B.php"] [unique_id "alxgVnzbEu1Ap1Mwpo-ohwAAAUs"]
[Sat Jul 18 23:27:50.662237 2026] [security2:error] [pid 881201:tid 881444] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mail.myspineworld.com"] [uri "/index.php"] [unique_id "alxgVgWL-zKlchkVWS1wvAAAAHA"]
[Sat Jul 18 23:27:50.870090 2026] [security2:error] [pid 890058:tid 890300] [client 163.61.1.17:64751] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgVnzbEu1Ap1Mwpo-okgAAAXo"]
[Sat Jul 18 23:27:50.873868 2026] [security2:error] [pid 890058:tid 890300] [client 163.61.1.17:64751] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgVnzbEu1Ap1Mwpo-okgAAAXo"]
[Sat Jul 18 23:27:50.937625 2026] [security2:error] [pid 890058:tid 890217] [client 138.252.89.100:50172] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxgVnzbEu1Ap1Mwpo-olAAAASc"]
[Sat Jul 18 23:27:50.938277 2026] [security2:error] [pid 890058:tid 890217] [client 138.252.89.100:50172] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxgVnzbEu1Ap1Mwpo-olAAAASc"]
[Sat Jul 18 23:27:50.971169 2026] [security2:error] [pid 881201:tid 881421] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mail.myspineworld.com"] [uri "/index.php"] [unique_id "alxgVgWL-zKlchkVWS1wwQAAAFk"]
[Sat Jul 18 23:27:51.032341 2026] [security2:error] [pid 890058:tid 890210] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/admin.php"] [unique_id "alxgV3zbEu1Ap1Mwpo-omgAAASA"]
[Sat Jul 18 23:27:51.032445 2026] [security2:error] [pid 890058:tid 890210] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/admin.php"] [unique_id "alxgV3zbEu1Ap1Mwpo-omgAAASA"]
[Sat Jul 18 23:27:51.298343 2026] [security2:error] [pid 890058:tid 890274] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mail.myspineworld.com"] [uri "/index.php"] [unique_id "alxgV3zbEu1Ap1Mwpo-ongAAAWA"]
[Sat Jul 18 23:27:51.321132 2026] [security2:error] [pid 890058:tid 890239] [client 107.161.92.6:46618] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "mail.myspineworld.com"] [uri "/.ssh/id_rsa"] [unique_id "alxgV3zbEu1Ap1Mwpo-opgAAAT0"]
[Sat Jul 18 23:27:51.384914 2026] [security2:error] [pid 890058:tid 890242] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/k.php"] [unique_id "alxgV3zbEu1Ap1Mwpo-oqwAAAUA"]
[Sat Jul 18 23:27:51.385015 2026] [security2:error] [pid 890058:tid 890242] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/k.php"] [unique_id "alxgV3zbEu1Ap1Mwpo-oqwAAAUA"]
[Sat Jul 18 23:27:51.537259 2026] [security2:error] [pid 890058:tid 890256] [client 107.161.92.6:46618] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "mail.myspineworld.com"] [uri "/.ssh/id_dsa"] [unique_id "alxgV3zbEu1Ap1Mwpo-orwAAAU4"]
[Sat Jul 18 23:27:51.742081 2026] [security2:error] [pid 890058:tid 890251] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/x.php"] [unique_id "alxgV3zbEu1Ap1Mwpo-otwAAAUk"]
[Sat Jul 18 23:27:51.742192 2026] [security2:error] [pid 890058:tid 890251] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/x.php"] [unique_id "alxgV3zbEu1Ap1Mwpo-otwAAAUk"]
[Sat Jul 18 23:27:51.837316 2026] [security2:error] [pid 890058:tid 890216] [client 107.161.92.6:46618] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "mail.myspineworld.com"] [uri "/.ssh/id_ed25519"] [unique_id "alxgV3zbEu1Ap1Mwpo-ouwAAASY"]
[Sat Jul 18 23:27:51.837408 2026] [security2:error] [pid 890058:tid 890216] [client 107.161.92.6:46618] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "mail.myspineworld.com"] [uri "/.ssh/id_ed25519"] [unique_id "alxgV3zbEu1Ap1Mwpo-ouwAAASY"]
[Sat Jul 18 23:27:51.900524 2026] [security2:error] [pid 890058:tid 890065] [remote 47.86.33.52:15906] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxgV3zbEu1Ap1Mwpo-ovQABSAY"]
[Sat Jul 18 23:27:51.966535 2026] [security2:error] [pid 890058:tid 890224] [client 18.181.190.12:11787] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "suretybonds-california.com"] [uri "/wp-comments-post.php"] [unique_id "alxgV3zbEu1Ap1Mwpo-ovgAAAS4"]
[Sat Jul 18 23:27:52.063681 2026] [security2:error] [pid 890058:tid 890300] [client 143.198.85.218:56736] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "jhavoctattoos.com"] [uri "/wp-comments-post.php"] [unique_id "alxgWHzbEu1Ap1Mwpo-oxAAAAXo"]
[Sat Jul 18 23:27:52.095936 2026] [security2:error] [pid 890058:tid 890224] [client 18.181.190.12:11787] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "500"] [hostname "suretybonds-california.com"] [uri "/wp-comments-post.php"] [unique_id "alxgV3zbEu1Ap1Mwpo-ovgAAAS4"]
[Sat Jul 18 23:27:52.126685 2026] [security2:error] [pid 890058:tid 890209] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wss.php"] [unique_id "alxgWHzbEu1Ap1Mwpo-oyQAAAR8"]
[Sat Jul 18 23:27:52.126834 2026] [security2:error] [pid 890058:tid 890209] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wss.php"] [unique_id "alxgWHzbEu1Ap1Mwpo-oyQAAAR8"]
[Sat Jul 18 23:27:52.157502 2026] [security2:error] [pid 881201:tid 881367] [client 107.161.92.6:45074] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "mail.myspineworld.com"] [uri "/env.js"] [unique_id "alxgWAWL-zKlchkVWS1w2gAAACM"]
[Sat Jul 18 23:27:52.157618 2026] [security2:error] [pid 881201:tid 881367] [client 107.161.92.6:45074] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "mail.myspineworld.com"] [uri "/env.js"] [unique_id "alxgWAWL-zKlchkVWS1w2gAAACM"]
[Sat Jul 18 23:27:52.188578 2026] [security2:error] [pid 890058:tid 890300] [client 143.198.85.218:56736] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "403"] [hostname "jhavoctattoos.com"] [uri "/wp-comments-post.php"] [unique_id "alxgWHzbEu1Ap1Mwpo-oxAAAAXo"]
[Sat Jul 18 23:27:52.199521 2026] [security2:error] [pid 890058:tid 890298] [client 190.245.146.99:65309] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgWHzbEu1Ap1Mwpo-ozQAAAXg"]
[Sat Jul 18 23:27:52.205007 2026] [security2:error] [pid 890058:tid 890298] [client 190.245.146.99:65309] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgWHzbEu1Ap1Mwpo-ozQAAAXg"]
[Sat Jul 18 23:27:52.234277 2026] [security2:error] [pid 881201:tid 881436] [client 74.7.175.189:45292] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "404"] [hostname "website-1f5ca1d0.zyi.feb.mybluehost.me"] [uri "/robots.txt"] [unique_id "alxgWAWL-zKlchkVWS1w2wAAaBY"]
[Sat Jul 18 23:27:52.504502 2026] [security2:error] [pid 890058:tid 890259] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/ty.php"] [unique_id "alxgWHzbEu1Ap1Mwpo-o1AAAAVE"]
[Sat Jul 18 23:27:52.504581 2026] [security2:error] [pid 890058:tid 890259] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/ty.php"] [unique_id "alxgWHzbEu1Ap1Mwpo-o1AAAAVE"]
[Sat Jul 18 23:27:52.590984 2026] [security2:error] [pid 890058:tid 890078] [remote 47.86.33.52:15906] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxgWHzbEu1Ap1Mwpo-o3AABSRM"], referer: https://mezzacraft.com/wp-login.php
[Sat Jul 18 23:27:52.832649 2026] [security2:error] [pid 890058:tid 890240] [client 18.192.166.72:7156] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "mtlegnews.gov"] [uri "/index.php"] [unique_id "alxgWHzbEu1Ap1Mwpo-o2QAAAT4"], referer: https://mtlegnews.gov/
[Sat Jul 18 23:27:52.874307 2026] [security2:error] [pid 890058:tid 890203] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mail.myspineworld.com"] [uri "/index.php"] [unique_id "alxgWHzbEu1Ap1Mwpo-o5gAAARk"]
[Sat Jul 18 23:27:52.893893 2026] [security2:error] [pid 890058:tid 890298] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/155.php"] [unique_id "alxgWHzbEu1Ap1Mwpo-o8QAAAXg"]
[Sat Jul 18 23:27:52.893985 2026] [security2:error] [pid 890058:tid 890298] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/155.php"] [unique_id "alxgWHzbEu1Ap1Mwpo-o8QAAAXg"]
[Sat Jul 18 23:27:53.155569 2026] [security2:error] [pid 881201:tid 881416] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mail.myspineworld.com"] [uri "/index.php"] [unique_id "alxgWAWL-zKlchkVWS1w6QAAAFQ"]
[Sat Jul 18 23:27:53.238063 2026] [security2:error] [pid 890058:tid 890222] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/ops.php"] [unique_id "alxgWXzbEu1Ap1Mwpo-pCAAAASw"]
[Sat Jul 18 23:27:53.238200 2026] [security2:error] [pid 890058:tid 890222] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/ops.php"] [unique_id "alxgWXzbEu1Ap1Mwpo-pCAAAASw"]
[Sat Jul 18 23:27:53.521572 2026] [security2:error] [pid 890058:tid 890267] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mail.myspineworld.com"] [uri "/index.php"] [unique_id "alxgWXzbEu1Ap1Mwpo-pDAAAAVk"]
[Sat Jul 18 23:27:53.560033 2026] [security2:error] [pid 890058:tid 890245] [client 18.181.190.12:17889] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "suretybonds-california.com"] [uri "/wp-comments-post.php"] [unique_id "alxgWXzbEu1Ap1Mwpo-pFgAAAUM"]
[Sat Jul 18 23:27:53.569397 2026] [security2:error] [pid 890058:tid 890251] [client 45.61.115.196:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "mollycahill.com"] [uri "/index.php"] [unique_id "alxgWXzbEu1Ap1Mwpo-pBwAAAUk"]
[Sat Jul 18 23:27:53.591946 2026] [security2:error] [pid 890058:tid 890232] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/ingfo.php"] [unique_id "alxgWXzbEu1Ap1Mwpo-pGAAAATY"]
[Sat Jul 18 23:27:53.592069 2026] [security2:error] [pid 890058:tid 890232] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/ingfo.php"] [unique_id "alxgWXzbEu1Ap1Mwpo-pGAAAATY"]
[Sat Jul 18 23:27:53.614078 2026] [security2:error] [pid 890058:tid 890214] [client 107.161.92.6:45108] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "mail.myspineworld.com"] [uri "/web.config"] [unique_id "alxgWXzbEu1Ap1Mwpo-pGQAAASQ"]
[Sat Jul 18 23:27:53.688405 2026] [security2:error] [pid 890058:tid 890245] [client 18.181.190.12:17889] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "500"] [hostname "suretybonds-california.com"] [uri "/wp-comments-post.php"] [unique_id "alxgWXzbEu1Ap1Mwpo-pFgAAAUM"]
[Sat Jul 18 23:27:53.745837 2026] [security2:error] [pid 881201:tid 881351] [client 143.198.85.218:56746] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "jhavoctattoos.com"] [uri "/wp-comments-post.php"] [unique_id "alxgWQWL-zKlchkVWS1w8gAAABM"]
[Sat Jul 18 23:27:53.846652 2026] [security2:error] [pid 881201:tid 881351] [client 143.198.85.218:56746] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "403"] [hostname "jhavoctattoos.com"] [uri "/wp-comments-post.php"] [unique_id "alxgWQWL-zKlchkVWS1w8gAAABM"]
[Sat Jul 18 23:27:53.972657 2026] [security2:error] [pid 890058:tid 890218] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/error_log.php"] [unique_id "alxgWXzbEu1Ap1Mwpo-pMAAAASg"]
[Sat Jul 18 23:27:53.972803 2026] [security2:error] [pid 890058:tid 890218] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/error_log.php"] [unique_id "alxgWXzbEu1Ap1Mwpo-pMAAAASg"]
[Sat Jul 18 23:27:54.096224 2026] [security2:error] [pid 881201:tid 881456] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mail.myspineworld.com"] [uri "/index.php"] [unique_id "alxgWQWL-zKlchkVWS1w-QAAAHw"]
[Sat Jul 18 23:27:54.136063 2026] [security2:error] [pid 881201:tid 881391] [client 27.34.68.67:53361] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgWgWL-zKlchkVWS1w_gAAADs"]
[Sat Jul 18 23:27:54.136170 2026] [security2:error] [pid 881201:tid 881391] [client 27.34.68.67:53361] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgWgWL-zKlchkVWS1w_gAAADs"]
[Sat Jul 18 23:27:54.326712 2026] [security2:error] [pid 890058:tid 890217] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/ok.php"] [unique_id "alxgWnzbEu1Ap1Mwpo-pQwAAASc"]
[Sat Jul 18 23:27:54.326826 2026] [security2:error] [pid 890058:tid 890217] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/ok.php"] [unique_id "alxgWnzbEu1Ap1Mwpo-pQwAAASc"]
[Sat Jul 18 23:27:54.652675 2026] [security2:error] [pid 890058:tid 890206] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mail.myspineworld.com"] [uri "/index.php"] [unique_id "alxgWnzbEu1Ap1Mwpo-pSwAAARw"]
[Sat Jul 18 23:27:54.707240 2026] [security2:error] [pid 881201:tid 881357] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/mac.php"] [unique_id "alxgWgWL-zKlchkVWS1xCwAAABk"]
[Sat Jul 18 23:27:54.707315 2026] [security2:error] [pid 881201:tid 881357] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/mac.php"] [unique_id "alxgWgWL-zKlchkVWS1xCwAAABk"]
[Sat Jul 18 23:27:54.870686 2026] [security2:error] [pid 890058:tid 890196] [client 107.161.92.6:45130] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 6.92.161.107.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.myspineworld.com"] [uri "/phpinfo.php"] [unique_id "alxgWnzbEu1Ap1Mwpo-pWQAAARI"]
[Sat Jul 18 23:27:55.078358 2026] [security2:error] [pid 890058:tid 890207] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wefile.php"] [unique_id "alxgW3zbEu1Ap1Mwpo-pYQAAAR0"]
[Sat Jul 18 23:27:55.078436 2026] [security2:error] [pid 890058:tid 890207] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wefile.php"] [unique_id "alxgW3zbEu1Ap1Mwpo-pYQAAAR0"]
[Sat Jul 18 23:27:55.079495 2026] [security2:error] [pid 881201:tid 881361] [client 18.181.190.12:37175] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "suretybonds-california.com"] [uri "/wp-comments-post.php"] [unique_id "alxgWwWL-zKlchkVWS1xDwAAAB0"]
[Sat Jul 18 23:27:55.169086 2026] [security2:error] [pid 881201:tid 881353] [client 107.161.92.6:45146] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 6.92.161.107.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.myspineworld.com"] [uri "/info.php"] [unique_id "alxgWwWL-zKlchkVWS1xEgAAABU"]
[Sat Jul 18 23:27:55.197611 2026] [security2:error] [pid 881201:tid 881378] [client 223.185.61.63:9525] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxgWwWL-zKlchkVWS1xEwAAAC4"]
[Sat Jul 18 23:27:55.197722 2026] [security2:error] [pid 881201:tid 881378] [client 223.185.61.63:9525] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxgWwWL-zKlchkVWS1xEwAAAC4"]
[Sat Jul 18 23:27:55.211029 2026] [security2:error] [pid 881201:tid 881361] [client 18.181.190.12:37175] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "500"] [hostname "suretybonds-california.com"] [uri "/wp-comments-post.php"] [unique_id "alxgWwWL-zKlchkVWS1xDwAAAB0"]
[Sat Jul 18 23:27:55.328249 2026] [security2:error] [pid 890058:tid 890219] [client 34.90.238.78:16385] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "cpcontacts.cofigua.com"] [uri "/"] [unique_id "alxgW3zbEu1Ap1Mwpo-pbQAAASk"]
[Sat Jul 18 23:27:55.328335 2026] [security2:error] [pid 890058:tid 890219] [client 34.90.238.78:16385] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "cpcontacts.cofigua.com"] [uri "/"] [unique_id "alxgW3zbEu1Ap1Mwpo-pbQAAASk"]
[Sat Jul 18 23:27:55.391991 2026] [security2:error] [pid 890058:tid 890291] [client 2a03:2880:f800:28:::0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.benbayly.co.nz"] [uri "/index.php"] [unique_id "alxgWnzbEu1Ap1Mwpo-pVwABcSE"]
[Sat Jul 18 23:27:55.424219 2026] [security2:error] [pid 890058:tid 890194] [client 143.198.85.218:56750] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "jhavoctattoos.com"] [uri "/wp-comments-post.php"] [unique_id "alxgW3zbEu1Ap1Mwpo-pdgAAARA"]
[Sat Jul 18 23:27:55.454042 2026] [security2:error] [pid 890058:tid 890284] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "alxgW3zbEu1Ap1Mwpo-pdwAAAWo"]
[Sat Jul 18 23:27:55.454162 2026] [security2:error] [pid 890058:tid 890284] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "alxgW3zbEu1Ap1Mwpo-pdwAAAWo"]
[Sat Jul 18 23:27:55.516200 2026] [security2:error] [pid 881201:tid 881311] [remote 102.134.101.35:57912] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 35.101.134.102.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.botanicapatterndesigns.com"] [uri "/wp-login.php"] [unique_id "alxgWwWL-zKlchkVWS1xFwAAfmw"]
[Sat Jul 18 23:27:55.520169 2026] [security2:error] [pid 890058:tid 890194] [client 143.198.85.218:56750] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "403"] [hostname "jhavoctattoos.com"] [uri "/wp-comments-post.php"] [unique_id "alxgW3zbEu1Ap1Mwpo-pdgAAARA"]
[Sat Jul 18 23:27:55.520678 2026] [security2:error] [pid 890058:tid 890234] [client 107.161.92.6:45152] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 6.92.161.107.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.myspineworld.com"] [uri "/test.php"] [unique_id "alxgW3zbEu1Ap1Mwpo-pegAAATg"]
[Sat Jul 18 23:27:55.686555 2026] [proxy:error] [pid 890058:tid 890236] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:27:55.686623 2026] [proxy_http:error] [pid 890058:tid 890236] [client 173.211.35.28:12870] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:27:55.687131 2026] [proxy:error] [pid 890058:tid 890236] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:27:55.687161 2026] [proxy_http:error] [pid 890058:tid 890236] [client 173.211.35.28:12870] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:27:55.824958 2026] [security2:error] [pid 881201:tid 881414] [client 217.181.90.162:35305] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.90.181.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxgWwWL-zKlchkVWS1xHgAAAFI"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:27:55.860617 2026] [proxy:error] [pid 881201:tid 881429] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:27:55.860680 2026] [proxy_http:error] [pid 881201:tid 881429] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:27:55.861300 2026] [proxy:error] [pid 881201:tid 881429] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:27:55.861328 2026] [proxy_http:error] [pid 881201:tid 881429] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:27:55.861415 2026] [security2:error] [pid 881201:tid 881429] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxgWwWL-zKlchkVWS1xHwAAAGE"]
[Sat Jul 18 23:27:55.955713 2026] [security2:error] [pid 881201:tid 881253] [remote 102.134.101.35:57912] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 35.101.134.102.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.botanicapatterndesigns.com"] [uri "/wp-login.php"] [unique_id "alxgWwWL-zKlchkVWS1xIwAAHzI"], referer: https://mail.botanicapatterndesigns.com/wp-login.php
[Sat Jul 18 23:27:56.018957 2026] [security2:error] [pid 890058:tid 890272] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mail.myspineworld.com"] [uri "/index.php"] [unique_id "alxgW3zbEu1Ap1Mwpo-pjwAAAV4"]
[Sat Jul 18 23:27:56.255067 2026] [proxy:error] [pid 890058:tid 890260] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:27:56.255147 2026] [proxy_http:error] [pid 890058:tid 890260] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:27:56.255811 2026] [proxy:error] [pid 890058:tid 890260] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:27:56.255845 2026] [proxy_http:error] [pid 890058:tid 890260] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:27:56.255949 2026] [security2:error] [pid 890058:tid 890260] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxgXHzbEu1Ap1Mwpo-ppAAAAVI"]
[Sat Jul 18 23:27:56.308003 2026] [security2:error] [pid 890058:tid 890315] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mail.myspineworld.com"] [uri "/index.php"] [unique_id "alxgXHzbEu1Ap1Mwpo-poQAAAYk"]
[Sat Jul 18 23:27:56.489393 2026] [security2:error] [pid 890058:tid 890242] [client 50.116.65.227:18162] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Jin-Wee-Feature-Image.jpg"] [unique_id "alxgXHzbEu1Ap1Mwpo-ptwAAAUA"]
[Sat Jul 18 23:27:56.502937 2026] [security2:error] [pid 890058:tid 890236] [client 50.116.65.227:15708] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Jin-Wee-Feature-Image.jpg"] [unique_id "alxgXHzbEu1Ap1Mwpo-puAAAAUs"]
[Sat Jul 18 23:27:56.617055 2026] [security2:error] [pid 890058:tid 890267] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mail.myspineworld.com"] [uri "/index.php"] [unique_id "alxgXHzbEu1Ap1Mwpo-ptQAAAVk"]
[Sat Jul 18 23:27:56.621999 2026] [security2:error] [pid 890058:tid 890301] [client 18.181.190.12:14461] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "suretybonds-california.com"] [uri "/wp-comments-post.php"] [unique_id "alxgXHzbEu1Ap1Mwpo-pxAAAAXs"]
[Sat Jul 18 23:27:56.633127 2026] [security2:error] [pid 890058:tid 890264] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-admin/css/colour.php"] [unique_id "alxgXHzbEu1Ap1Mwpo-pxQAAAVY"]
[Sat Jul 18 23:27:56.633237 2026] [security2:error] [pid 890058:tid 890264] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-admin/css/colour.php"] [unique_id "alxgXHzbEu1Ap1Mwpo-pxQAAAVY"]
[Sat Jul 18 23:27:56.757408 2026] [security2:error] [pid 890058:tid 890301] [client 18.181.190.12:14461] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "500"] [hostname "suretybonds-california.com"] [uri "/wp-comments-post.php"] [unique_id "alxgXHzbEu1Ap1Mwpo-pxAAAAXs"]
[Sat Jul 18 23:27:57.021387 2026] [proxy:error] [pid 881201:tid 881457] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:27:57.021448 2026] [proxy_http:error] [pid 881201:tid 881457] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:27:57.022025 2026] [proxy:error] [pid 881201:tid 881457] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:27:57.022055 2026] [proxy_http:error] [pid 881201:tid 881457] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:27:57.022141 2026] [security2:error] [pid 881201:tid 881457] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxgXQWL-zKlchkVWS1xNAAAAH0"]
[Sat Jul 18 23:27:57.074879 2026] [security2:error] [pid 890058:tid 890201] [client 143.198.85.218:56762] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "jhavoctattoos.com"] [uri "/wp-comments-post.php"] [unique_id "alxgXXzbEu1Ap1Mwpo-p1gAAARc"]
[Sat Jul 18 23:27:57.130952 2026] [security2:error] [pid 890058:tid 890177] [remote 31.42.184.154:34918] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxgXXzbEu1Ap1Mwpo-p2wABRHY"]
[Sat Jul 18 23:27:57.173738 2026] [security2:error] [pid 890058:tid 890201] [client 143.198.85.218:56762] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "403"] [hostname "jhavoctattoos.com"] [uri "/wp-comments-post.php"] [unique_id "alxgXXzbEu1Ap1Mwpo-p1gAAARc"]
[Sat Jul 18 23:27:57.359147 2026] [security2:error] [pid 890058:tid 890255] [client 107.161.92.6:45178] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "mail.myspineworld.com"] [uri "/service-account.json"] [unique_id "alxgXXzbEu1Ap1Mwpo-p5wAAAU0"]
[Sat Jul 18 23:27:57.359252 2026] [security2:error] [pid 890058:tid 890255] [client 107.161.92.6:45178] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "mail.myspineworld.com"] [uri "/service-account.json"] [unique_id "alxgXXzbEu1Ap1Mwpo-p5wAAAU0"]
[Sat Jul 18 23:27:57.371039 2026] [security2:error] [pid 890058:tid 890173] [remote 31.42.184.154:34918] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxgXXzbEu1Ap1Mwpo-p6AABJnI"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:27:57.413076 2026] [security2:error] [pid 881201:tid 881422] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/like.php"] [unique_id "alxgXQWL-zKlchkVWS1xPAAAAFo"]
[Sat Jul 18 23:27:57.413197 2026] [security2:error] [pid 881201:tid 881422] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/like.php"] [unique_id "alxgXQWL-zKlchkVWS1xPAAAAFo"]
[Sat Jul 18 23:27:57.811555 2026] [security2:error] [pid 890058:tid 890252] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/.well-known/about.php"] [unique_id "alxgXXzbEu1Ap1Mwpo-p_QAAAUo"]
[Sat Jul 18 23:27:57.811665 2026] [security2:error] [pid 890058:tid 890252] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/.well-known/about.php"] [unique_id "alxgXXzbEu1Ap1Mwpo-p_QAAAUo"]
[Sat Jul 18 23:27:57.943357 2026] [security2:error] [pid 881201:tid 881395] [client 107.161.92.6:45186] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "mail.myspineworld.com"] [uri "/firebase-adminsdk.json"] [unique_id "alxgXQWL-zKlchkVWS1xQwAAAD8"]
[Sat Jul 18 23:27:58.028533 2026] [security2:error] [pid 890058:tid 890238] [client 18.181.190.12:12893] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "suretybonds-california.com"] [uri "/wp-comments-post.php"] [unique_id "alxgXnzbEu1Ap1Mwpo-qDQAAATw"]
[Sat Jul 18 23:27:58.159914 2026] [security2:error] [pid 890058:tid 890254] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "alxgXnzbEu1Ap1Mwpo-qEAAAAUw"]
[Sat Jul 18 23:27:58.159918 2026] [security2:error] [pid 890058:tid 890238] [client 18.181.190.12:12893] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "500"] [hostname "suretybonds-california.com"] [uri "/wp-comments-post.php"] [unique_id "alxgXnzbEu1Ap1Mwpo-qDQAAATw"]
[Sat Jul 18 23:27:58.160058 2026] [security2:error] [pid 890058:tid 890254] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "alxgXnzbEu1Ap1Mwpo-qEAAAAUw"]
[Sat Jul 18 23:27:58.543632 2026] [proxy:error] [pid 890058:tid 890239] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:27:58.543701 2026] [proxy_http:error] [pid 890058:tid 890239] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:27:58.544373 2026] [proxy:error] [pid 890058:tid 890239] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:27:58.544413 2026] [proxy_http:error] [pid 890058:tid 890239] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:27:58.544508 2026] [security2:error] [pid 890058:tid 890239] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxgXnzbEu1Ap1Mwpo-qIwAAAT0"]
[Sat Jul 18 23:27:58.716955 2026] [security2:error] [pid 881201:tid 881408] [client 143.198.85.218:56766] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "jhavoctattoos.com"] [uri "/wp-comments-post.php"] [unique_id "alxgXgWL-zKlchkVWS1xUAAAAEw"]
[Sat Jul 18 23:27:58.818483 2026] [security2:error] [pid 881201:tid 881408] [client 143.198.85.218:56766] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "403"] [hostname "jhavoctattoos.com"] [uri "/wp-comments-post.php"] [unique_id "alxgXgWL-zKlchkVWS1xUAAAAEw"]
[Sat Jul 18 23:27:58.897578 2026] [proxy:error] [pid 881201:tid 881433] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:27:58.897654 2026] [proxy_http:error] [pid 881201:tid 881433] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:27:58.898527 2026] [proxy:error] [pid 881201:tid 881433] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:27:58.898560 2026] [proxy_http:error] [pid 881201:tid 881433] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:27:58.898654 2026] [security2:error] [pid 881201:tid 881433] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxgXgWL-zKlchkVWS1xVAAAAGU"]
[Sat Jul 18 23:27:58.942867 2026] [security2:error] [pid 881201:tid 881367] [client 134.122.113.99:52853] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.113.122.134.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "50.116.64.27"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "alxgXgWL-zKlchkVWS1xVgAAACM"], referer: www.google.com
[Sat Jul 18 23:27:58.981130 2026] [security2:error] [pid 890058:tid 890262] [client 107.161.92.6:45190] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "mail.myspineworld.com"] [uri "/appsettings.json"] [unique_id "alxgXnzbEu1Ap1Mwpo-qPQAAAVQ"]
[Sat Jul 18 23:27:58.981223 2026] [security2:error] [pid 890058:tid 890262] [client 107.161.92.6:45190] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "mail.myspineworld.com"] [uri "/appsettings.json"] [unique_id "alxgXnzbEu1Ap1Mwpo-qPQAAAVQ"]
[Sat Jul 18 23:27:59.009134 2026] [security2:error] [pid 890058:tid 890194] [client 57.141.18.45:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "falconarrowshop.com"] [uri "/index.php"] [unique_id "alxgXnzbEu1Ap1Mwpo-qNgAAARA"]
[Sat Jul 18 23:27:59.253321 2026] [security2:error] [pid 881201:tid 881429] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/pucci.php"] [unique_id "alxgXwWL-zKlchkVWS1xXgAAAGE"]
[Sat Jul 18 23:27:59.253438 2026] [security2:error] [pid 881201:tid 881429] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/pucci.php"] [unique_id "alxgXwWL-zKlchkVWS1xXgAAAGE"]
[Sat Jul 18 23:27:59.255337 2026] [security2:error] [pid 890058:tid 890207] [client 107.161.92.6:45202] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "mail.myspineworld.com"] [uri "/secrets.json"] [unique_id "alxgX3zbEu1Ap1Mwpo-qSwAAAR0"]
[Sat Jul 18 23:27:59.255430 2026] [security2:error] [pid 890058:tid 890207] [client 107.161.92.6:45202] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "mail.myspineworld.com"] [uri "/secrets.json"] [unique_id "alxgX3zbEu1Ap1Mwpo-qSwAAAR0"]
[Sat Jul 18 23:27:59.633677 2026] [proxy:error] [pid 890058:tid 890290] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:27:59.633737 2026] [proxy_http:error] [pid 890058:tid 890290] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:27:59.634330 2026] [proxy:error] [pid 890058:tid 890290] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:27:59.634361 2026] [proxy_http:error] [pid 890058:tid 890290] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:27:59.634439 2026] [security2:error] [pid 890058:tid 890290] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxgX3zbEu1Ap1Mwpo-qXgAAAXA"]
[Sat Jul 18 23:27:59.736087 2026] [security2:error] [pid 890058:tid 890192] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mail.myspineworld.com"] [uri "/index.php"] [unique_id "alxgX3zbEu1Ap1Mwpo-qXAAAAQ4"]
[Sat Jul 18 23:27:59.888490 2026] [security2:error] [pid 881201:tid 881389] [client 119.154.81.234:63560] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgXwWL-zKlchkVWS1xbgAAADk"]
[Sat Jul 18 23:27:59.888601 2026] [security2:error] [pid 881201:tid 881389] [client 119.154.81.234:63560] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgXwWL-zKlchkVWS1xbgAAADk"]
[Sat Jul 18 23:27:59.953125 2026] [security2:error] [pid 890058:tid 890244] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mail.myspineworld.com"] [uri "/index.php"] [unique_id "alxgX3zbEu1Ap1Mwpo-qZgAAAUI"]
[Sat Jul 18 23:27:59.984345 2026] [proxy:error] [pid 890058:tid 890215] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:27:59.984411 2026] [proxy_http:error] [pid 890058:tid 890215] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:27:59.984870 2026] [proxy:error] [pid 890058:tid 890215] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:27:59.984902 2026] [proxy_http:error] [pid 890058:tid 890215] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:27:59.984969 2026] [security2:error] [pid 890058:tid 890215] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxgX3zbEu1Ap1Mwpo-qbQAAASU"]
[Sat Jul 18 23:28:00.268841 2026] [security2:error] [pid 890058:tid 890225] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mail.myspineworld.com"] [uri "/index.php"] [unique_id "alxgYHzbEu1Ap1Mwpo-qcQAAAS8"]
[Sat Jul 18 23:28:00.336067 2026] [security2:error] [pid 890058:tid 890222] [client 143.198.85.218:57474] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "jhavoctattoos.com"] [uri "/wp-comments-post.php"] [unique_id "alxgYHzbEu1Ap1Mwpo-qfgAAASw"]
[Sat Jul 18 23:28:00.353949 2026] [security2:error] [pid 890058:tid 890207] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-temp.php"] [unique_id "alxgYHzbEu1Ap1Mwpo-qggAAAR0"]
[Sat Jul 18 23:28:00.354045 2026] [security2:error] [pid 890058:tid 890207] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-temp.php"] [unique_id "alxgYHzbEu1Ap1Mwpo-qggAAAR0"]
[Sat Jul 18 23:28:00.444047 2026] [security2:error] [pid 890058:tid 890222] [client 143.198.85.218:57474] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "403"] [hostname "jhavoctattoos.com"] [uri "/wp-comments-post.php"] [unique_id "alxgYHzbEu1Ap1Mwpo-qfgAAASw"]
[Sat Jul 18 23:28:00.551403 2026] [security2:error] [pid 881201:tid 881425] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mail.myspineworld.com"] [uri "/index.php"] [unique_id "alxgYAWL-zKlchkVWS1xegAAAF0"]
[Sat Jul 18 23:28:00.737837 2026] [proxy:error] [pid 890058:tid 890292] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:00.737914 2026] [proxy_http:error] [pid 890058:tid 890292] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:00.738408 2026] [proxy:error] [pid 890058:tid 890292] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:00.738438 2026] [proxy_http:error] [pid 890058:tid 890292] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:00.738534 2026] [security2:error] [pid 890058:tid 890292] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxgYHzbEu1Ap1Mwpo-qmQAAAXI"]
[Sat Jul 18 23:28:00.754002 2026] [security2:error] [pid 890058:tid 890297] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mail.myspineworld.com"] [uri "/index.php"] [unique_id "alxgYHzbEu1Ap1Mwpo-qkQAAAXc"]
[Sat Jul 18 23:28:00.756508 2026] [security2:error] [pid 881201:tid 881413] [client 107.161.92.6:45256] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "mail.myspineworld.com"] [uri "/health"] [unique_id "alxgYAWL-zKlchkVWS1xgwAAAFE"]
[Sat Jul 18 23:28:00.756883 2026] [security2:error] [pid 881201:tid 881413] [client 107.161.92.6:45256] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "mail.myspineworld.com"] [uri "/health"] [unique_id "alxgYAWL-zKlchkVWS1xgwAAAFE"]
[Sat Jul 18 23:28:01.131096 2026] [security2:error] [pid 890058:tid 890227] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/xmu.php"] [unique_id "alxgYXzbEu1Ap1Mwpo-qtQAAATE"]
[Sat Jul 18 23:28:01.131206 2026] [security2:error] [pid 890058:tid 890227] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/xmu.php"] [unique_id "alxgYXzbEu1Ap1Mwpo-qtQAAATE"]
[Sat Jul 18 23:28:01.147161 2026] [security2:error] [pid 890058:tid 890246] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mail.myspineworld.com"] [uri "/index.php"] [unique_id "alxgYHzbEu1Ap1Mwpo-qpgAAAUQ"]
[Sat Jul 18 23:28:01.294588 2026] [security2:error] [pid 890058:tid 890284] [client 66.249.74.43:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "myspineworld.com"] [uri "/index.php"] [unique_id "alxgYXzbEu1Ap1Mwpo-qtAAAAWo"]
[Sat Jul 18 23:28:01.304538 2026] [security2:error] [pid 881201:tid 881338] [client 106.222.249.209:19236] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgYQWL-zKlchkVWS1xjgAAAAY"]
[Sat Jul 18 23:28:01.304636 2026] [security2:error] [pid 881201:tid 881338] [client 106.222.249.209:19236] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgYQWL-zKlchkVWS1xjgAAAAY"]
[Sat Jul 18 23:28:01.338592 2026] [security2:error] [pid 881201:tid 881458] [client 107.161.92.6:45270] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "mail.myspineworld.com"] [uri "/.git/HEAD"] [unique_id "alxgYQWL-zKlchkVWS1xkAAAAH4"]
[Sat Jul 18 23:28:01.444855 2026] [security2:error] [pid 890058:tid 890195] [client 163.61.1.17:65200] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgYXzbEu1Ap1Mwpo-qyQAAARE"]
[Sat Jul 18 23:28:01.445048 2026] [security2:error] [pid 890058:tid 890195] [client 163.61.1.17:65200] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgYXzbEu1Ap1Mwpo-qyQAAARE"]
[Sat Jul 18 23:28:01.499367 2026] [security2:error] [pid 890058:tid 890308] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxgYXzbEu1Ap1Mwpo-qwwAAAYI"]
[Sat Jul 18 23:28:01.512483 2026] [security2:error] [pid 890058:tid 890191] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-admin/js/index.php"] [unique_id "alxgYXzbEu1Ap1Mwpo-qzgAAAQ0"]
[Sat Jul 18 23:28:01.512630 2026] [security2:error] [pid 890058:tid 890191] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-admin/js/index.php"] [unique_id "alxgYXzbEu1Ap1Mwpo-qzgAAAQ0"]
[Sat Jul 18 23:28:01.566818 2026] [security2:error] [pid 890058:tid 890268] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mail.myspineworld.com"] [uri "/index.php"] [unique_id "alxgYXzbEu1Ap1Mwpo-qxgAAAVo"]
[Sat Jul 18 23:28:01.857288 2026] [security2:error] [pid 890058:tid 890235] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mail.myspineworld.com"] [uri "/index.php"] [unique_id "alxgYXzbEu1Ap1Mwpo-q2gAAATk"]
[Sat Jul 18 23:28:01.867004 2026] [security2:error] [pid 890058:tid 890248] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/puc.php"] [unique_id "alxgYXzbEu1Ap1Mwpo-q4wAAAUY"]
[Sat Jul 18 23:28:01.867091 2026] [security2:error] [pid 890058:tid 890248] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/puc.php"] [unique_id "alxgYXzbEu1Ap1Mwpo-q4wAAAUY"]
[Sat Jul 18 23:28:01.927661 2026] [security2:error] [pid 890058:tid 890301] [client 143.198.85.218:57482] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "jhavoctattoos.com"] [uri "/wp-comments-post.php"] [unique_id "alxgYXzbEu1Ap1Mwpo-q6gAAAXs"]
[Sat Jul 18 23:28:01.990031 2026] [security2:error] [pid 890058:tid 890241] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxgYXzbEu1Ap1Mwpo-q4AAAAT8"]
[Sat Jul 18 23:28:02.036503 2026] [security2:error] [pid 890058:tid 890301] [client 143.198.85.218:57482] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "403"] [hostname "jhavoctattoos.com"] [uri "/wp-comments-post.php"] [unique_id "alxgYXzbEu1Ap1Mwpo-q6gAAAXs"]
[Sat Jul 18 23:28:02.105258 2026] [security2:error] [pid 881201:tid 881432] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mail.myspineworld.com"] [uri "/index.php"] [unique_id "alxgYQWL-zKlchkVWS1xnQAAAGQ"]
[Sat Jul 18 23:28:02.190932 2026] [security2:error] [pid 890058:tid 890229] [client 14.224.227.113:49741] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxgYnzbEu1Ap1Mwpo-q-AAAATM"]
[Sat Jul 18 23:28:02.237394 2026] [security2:error] [pid 881201:tid 881335] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/themes.php"] [unique_id "alxgYgWL-zKlchkVWS1xogAAAAM"]
[Sat Jul 18 23:28:02.237495 2026] [security2:error] [pid 881201:tid 881335] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/themes.php"] [unique_id "alxgYgWL-zKlchkVWS1xogAAAAM"]
[Sat Jul 18 23:28:02.331109 2026] [security2:error] [pid 890058:tid 890194] [client 50.116.65.227:26676] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.fkconstructionfunding.com"] [uri "/wp-content/plugins/contact-form-7/includes/css/styles.css"] [unique_id "alxgYnzbEu1Ap1Mwpo-rBgAAARA"]
[Sat Jul 18 23:28:02.344827 2026] [security2:error] [pid 890058:tid 890309] [client 50.116.65.227:26680] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.fkconstructionfunding.com"] [uri "/wp-content/plugins/contact-form-7/includes/css/styles-rtl.css"] [unique_id "alxgYnzbEu1Ap1Mwpo-rBwAAAYM"]
[Sat Jul 18 23:28:02.458168 2026] [security2:error] [pid 890058:tid 890264] [client 34.23.246.146:38764] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "mrbambooplus.com"] [uri "/"] [unique_id "alxgYnzbEu1Ap1Mwpo-rDwAAAVY"]
[Sat Jul 18 23:28:02.580027 2026] [security2:error] [pid 890058:tid 890192] [client 138.252.89.100:50686] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxgYnzbEu1Ap1Mwpo-rEwAAAQ4"]
[Sat Jul 18 23:28:02.580143 2026] [security2:error] [pid 890058:tid 890192] [client 138.252.89.100:50686] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxgYnzbEu1Ap1Mwpo-rEwAAAQ4"]
[Sat Jul 18 23:28:02.585076 2026] [security2:error] [pid 890058:tid 890212] [client 114.191.167.203:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "tiokubito.cl"] [uri "/index.php"] [unique_id "alxgYnzbEu1Ap1Mwpo-rCAABIj8"]
[Sat Jul 18 23:28:02.607383 2026] [security2:error] [pid 890058:tid 890205] [client 114.191.167.203:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tiokubito.cl"] [uri "/index.php"] [unique_id "alxgYnzbEu1Ap1Mwpo-rAgABG0Y"]
[Sat Jul 18 23:28:02.621488 2026] [proxy:error] [pid 881201:tid 881343] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:02.621549 2026] [proxy_http:error] [pid 881201:tid 881343] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:02.622332 2026] [proxy:error] [pid 881201:tid 881343] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:02.622365 2026] [proxy_http:error] [pid 881201:tid 881343] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:02.622455 2026] [security2:error] [pid 881201:tid 881343] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxgYgWL-zKlchkVWS1xqAAAAAs"]
[Sat Jul 18 23:28:02.628529 2026] [security2:error] [pid 890058:tid 890205] [client 114.191.167.203:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tiokubito.cl"] [uri "/index.php"] [unique_id "alxgYnzbEu1Ap1Mwpo-rAwABG08"]
[Sat Jul 18 23:28:02.636132 2026] [security2:error] [pid 890058:tid 890258] [client 190.245.146.99:49447] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgYnzbEu1Ap1Mwpo-rGAAAAVA"]
[Sat Jul 18 23:28:02.636215 2026] [security2:error] [pid 890058:tid 890258] [client 190.245.146.99:49447] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgYnzbEu1Ap1Mwpo-rGAAAAVA"]
[Sat Jul 18 23:28:02.979403 2026] [security2:error] [pid 890058:tid 890221] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/8.php"] [unique_id "alxgYnzbEu1Ap1Mwpo-rKAAAASs"]
[Sat Jul 18 23:28:02.979476 2026] [security2:error] [pid 890058:tid 890221] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/8.php"] [unique_id "alxgYnzbEu1Ap1Mwpo-rKAAAASs"]
[Sat Jul 18 23:28:03.254078 2026] [security2:error] [pid 890058:tid 890153] [remote 78.110.121.156:47200] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.121.110.78.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thierry-henry.fr"] [uri "/wp-login.php"] [unique_id "alxgY3zbEu1Ap1Mwpo-rOQABfF4"]
[Sat Jul 18 23:28:03.373596 2026] [security2:error] [pid 890058:tid 890290] [client 20.206.105.145:0] ModSecurity: Warning. Pattern match "/1\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1543"] [id "900921"] [msg "temporary TUW-72162 logging rule"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/1.php"] [unique_id "alxgY3zbEu1Ap1Mwpo-rPwAAAXA"]
[Sat Jul 18 23:28:03.373687 2026] [security2:error] [pid 890058:tid 890290] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/1.php"] [unique_id "alxgY3zbEu1Ap1Mwpo-rPwAAAXA"]
[Sat Jul 18 23:28:03.373795 2026] [security2:error] [pid 890058:tid 890290] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/1.php"] [unique_id "alxgY3zbEu1Ap1Mwpo-rPwAAAXA"]
[Sat Jul 18 23:28:03.578127 2026] [security2:error] [pid 890058:tid 890260] [client 143.198.85.218:57492] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "jhavoctattoos.com"] [uri "/wp-comments-post.php"] [unique_id "alxgY3zbEu1Ap1Mwpo-rRgAAAVI"]
[Sat Jul 18 23:28:03.585134 2026] [security2:error] [pid 890058:tid 890162] [remote 78.110.121.156:47200] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.121.110.78.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thierry-henry.fr"] [uri "/wp-login.php"] [unique_id "alxgY3zbEu1Ap1Mwpo-rSAABXWc"], referer: https://thierry-henry.fr/wp-login.php
[Sat Jul 18 23:28:03.674166 2026] [security2:error] [pid 890058:tid 890260] [client 143.198.85.218:57492] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "403"] [hostname "jhavoctattoos.com"] [uri "/wp-comments-post.php"] [unique_id "alxgY3zbEu1Ap1Mwpo-rRgAAAVI"]
[Sat Jul 18 23:28:03.750114 2026] [security2:error] [pid 890058:tid 890244] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/100.php"] [unique_id "alxgY3zbEu1Ap1Mwpo-rUAAAAUI"]
[Sat Jul 18 23:28:03.750203 2026] [security2:error] [pid 890058:tid 890244] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/100.php"] [unique_id "alxgY3zbEu1Ap1Mwpo-rUAAAAUI"]
[Sat Jul 18 23:28:03.823991 2026] [security2:error] [pid 881201:tid 881319] [remote 72.167.132.114:35948] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgYwWL-zKlchkVWS1xwgAAUXQ"]
[Sat Jul 18 23:28:03.824195 2026] [security2:error] [pid 881201:tid 881413] [client 72.167.132.114:35948] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgYwWL-zKlchkVWS1xwgAAUXQ"]
[Sat Jul 18 23:28:04.130536 2026] [security2:error] [pid 890058:tid 890285] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/about.php"] [unique_id "alxgZHzbEu1Ap1Mwpo-rWwAAAWs"]
[Sat Jul 18 23:28:04.130626 2026] [security2:error] [pid 890058:tid 890285] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/about.php"] [unique_id "alxgZHzbEu1Ap1Mwpo-rWwAAAWs"]
[Sat Jul 18 23:28:04.481949 2026] [security2:error] [pid 890058:tid 890313] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/about.php"] [unique_id "alxgZHzbEu1Ap1Mwpo-rcQAAAYc"]
[Sat Jul 18 23:28:04.482046 2026] [security2:error] [pid 890058:tid 890313] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/about.php"] [unique_id "alxgZHzbEu1Ap1Mwpo-rcQAAAYc"]
[Sat Jul 18 23:28:04.725671 2026] [security2:error] [pid 890058:tid 890291] [client 27.34.68.67:9540] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgZHzbEu1Ap1Mwpo-reQAAAXE"]
[Sat Jul 18 23:28:04.725792 2026] [security2:error] [pid 890058:tid 890291] [client 27.34.68.67:9540] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgZHzbEu1Ap1Mwpo-reQAAAXE"]
[Sat Jul 18 23:28:04.831123 2026] [security2:error] [pid 881201:tid 881399] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/admin.php"] [unique_id "alxgZAWL-zKlchkVWS1x0QAAAEM"]
[Sat Jul 18 23:28:04.831213 2026] [security2:error] [pid 881201:tid 881399] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/admin.php"] [unique_id "alxgZAWL-zKlchkVWS1x0QAAAEM"]
[Sat Jul 18 23:28:04.863190 2026] [security2:error] [pid 881201:tid 881332] [client 74.7.227.179:32976] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxgZAWL-zKlchkVWS1xzwAAADw"], referer: https://tejasenvironmental.com/p=346696
[Sat Jul 18 23:28:04.864273 2026] [security2:error] [pid 890058:tid 890253] [client 57.141.0.27:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.thescarystory.com"] [uri "/index.php"] [unique_id "alxgZHzbEu1Ap1Mwpo-rcAAAAUs"]
[Sat Jul 18 23:28:05.024005 2026] [security2:error] [pid 890058:tid 890072] [remote 47.128.120.196:23244] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "bruceledewitz.com"] [uri "/robots.txt"] [unique_id "alxgZXzbEu1Ap1Mwpo-rjAABOg0"]
[Sat Jul 18 23:28:05.223995 2026] [security2:error] [pid 890058:tid 890205] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/admin.php"] [unique_id "alxgZXzbEu1Ap1Mwpo-rmwAAARs"]
[Sat Jul 18 23:28:05.224115 2026] [security2:error] [pid 890058:tid 890205] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/admin.php"] [unique_id "alxgZXzbEu1Ap1Mwpo-rmwAAARs"]
[Sat Jul 18 23:28:05.513552 2026] [security2:error] [pid 890058:tid 890239] [client 65.111.21.110:27841] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.21.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxgZXzbEu1Ap1Mwpo-rpQAAAT0"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:28:05.595422 2026] [security2:error] [pid 890058:tid 890242] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/edit.php"] [unique_id "alxgZXzbEu1Ap1Mwpo-rqQAAAUA"]
[Sat Jul 18 23:28:05.595545 2026] [security2:error] [pid 890058:tid 890242] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/edit.php"] [unique_id "alxgZXzbEu1Ap1Mwpo-rqQAAAUA"]
[Sat Jul 18 23:28:05.621461 2026] [security2:error] [pid 881201:tid 881360] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxgZQWL-zKlchkVWS1x2QAAABw"]
[Sat Jul 18 23:28:05.710215 2026] [security2:error] [pid 890058:tid 890298] [client 34.23.246.146:38764] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mrbambooplus.com"] [uri "/index.php"] [unique_id "alxgYnzbEu1Ap1Mwpo-rKwAAAXg"], referer: http://mrbambooplus.com/wp-json/batch/v1
[Sat Jul 18 23:28:05.848970 2026] [security2:error] [pid 890058:tid 890219] [client 223.185.61.63:4622] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxgZXzbEu1Ap1Mwpo-rvgAAASk"]
[Sat Jul 18 23:28:05.849062 2026] [security2:error] [pid 890058:tid 890219] [client 223.185.61.63:4622] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxgZXzbEu1Ap1Mwpo-rvgAAASk"]
[Sat Jul 18 23:28:05.943084 2026] [security2:error] [pid 881201:tid 881356] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-content/admin.php"] [unique_id "alxgZQWL-zKlchkVWS1x5QAAABg"]
[Sat Jul 18 23:28:05.943185 2026] [security2:error] [pid 881201:tid 881356] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-content/admin.php"] [unique_id "alxgZQWL-zKlchkVWS1x5QAAABg"]
[Sat Jul 18 23:28:06.069273 2026] [security2:error] [pid 890058:tid 890245] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxgZXzbEu1Ap1Mwpo-rwAAAAUM"]
[Sat Jul 18 23:28:06.117442 2026] [security2:error] [pid 890058:tid 890201] [client 104.207.62.191:28043] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 191.62.207.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxgZnzbEu1Ap1Mwpo-ryAAAARc"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:28:06.176296 2026] [security2:error] [pid 890058:tid 890089] [remote 97.74.93.24:46348] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "longevityperformanceclinic.com"] [uri "/wp-login.php"] [unique_id "alxgZnzbEu1Ap1Mwpo-rzQABdh4"]
[Sat Jul 18 23:28:06.291814 2026] [security2:error] [pid 890058:tid 890239] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/f6.php"] [unique_id "alxgZnzbEu1Ap1Mwpo-r1wAAAT0"]
[Sat Jul 18 23:28:06.291897 2026] [security2:error] [pid 890058:tid 890239] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/f6.php"] [unique_id "alxgZnzbEu1Ap1Mwpo-r1wAAAT0"]
[Sat Jul 18 23:28:06.642993 2026] [security2:error] [pid 890058:tid 890088] [remote 97.74.93.24:46348] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "longevityperformanceclinic.com"] [uri "/wp-login.php"] [unique_id "alxgZnzbEu1Ap1Mwpo-r5QABXR0"], referer: https://longevityperformanceclinic.com/wp-login.php
[Sat Jul 18 23:28:06.668402 2026] [security2:error] [pid 890058:tid 890297] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/inputs.php"] [unique_id "alxgZnzbEu1Ap1Mwpo-r5wAAAXc"]
[Sat Jul 18 23:28:06.668497 2026] [security2:error] [pid 890058:tid 890297] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/inputs.php"] [unique_id "alxgZnzbEu1Ap1Mwpo-r5wAAAXc"]
[Sat Jul 18 23:28:07.055396 2026] [security2:error] [pid 881201:tid 881425] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/inputs.php"] [unique_id "alxgZwWL-zKlchkVWS1x9gAAAF0"]
[Sat Jul 18 23:28:07.055484 2026] [security2:error] [pid 881201:tid 881425] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/inputs.php"] [unique_id "alxgZwWL-zKlchkVWS1x9gAAAF0"]
[Sat Jul 18 23:28:07.220039 2026] [security2:error] [pid 881201:tid 881344] [client 45.95.25.1:64850] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.sesamegreenbeans.com"] [uri "/index.php"] [unique_id "alxgZwWL-zKlchkVWS1x9QAADGo"]
[Sat Jul 18 23:28:07.416633 2026] [security2:error] [pid 890058:tid 890305] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/av.php"] [unique_id "alxgZ3zbEu1Ap1Mwpo-sAwAAAX8"]
[Sat Jul 18 23:28:07.416762 2026] [security2:error] [pid 890058:tid 890305] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/av.php"] [unique_id "alxgZ3zbEu1Ap1Mwpo-sAwAAAX8"]
[Sat Jul 18 23:28:07.787237 2026] [security2:error] [pid 890058:tid 890307] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/classwithtostring.php"] [unique_id "alxgZ3zbEu1Ap1Mwpo-sEAAAAYE"]
[Sat Jul 18 23:28:07.787343 2026] [security2:error] [pid 890058:tid 890307] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/classwithtostring.php"] [unique_id "alxgZ3zbEu1Ap1Mwpo-sEAAAAYE"]
[Sat Jul 18 23:28:08.253764 2026] [proxy:error] [pid 890058:tid 890311] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:08.253850 2026] [proxy_http:error] [pid 890058:tid 890311] [client 23.137.105.42:37946] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:08.254436 2026] [proxy:error] [pid 890058:tid 890311] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:08.254473 2026] [proxy_http:error] [pid 890058:tid 890311] [client 23.137.105.42:37946] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:08.290068 2026] [proxy:error] [pid 881201:tid 881419] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:08.290151 2026] [proxy_http:error] [pid 881201:tid 881419] [client 23.137.105.42:65336] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:08.290886 2026] [proxy:error] [pid 881201:tid 881419] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:08.290922 2026] [proxy_http:error] [pid 881201:tid 881419] [client 23.137.105.42:65336] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:08.400948 2026] [proxy:error] [pid 890058:tid 890289] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:08.400992 2026] [proxy_http:error] [pid 890058:tid 890289] [client 23.137.105.42:65350] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:08.401650 2026] [proxy:error] [pid 890058:tid 890289] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:08.401676 2026] [proxy_http:error] [pid 890058:tid 890289] [client 23.137.105.42:65350] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:08.402195 2026] [proxy:error] [pid 890058:tid 890220] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:08.402277 2026] [proxy_http:error] [pid 890058:tid 890220] [client 23.137.105.42:65338] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:08.403065 2026] [proxy:error] [pid 890058:tid 890220] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:08.403113 2026] [proxy_http:error] [pid 890058:tid 890220] [client 23.137.105.42:65338] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:09.063542 2026] [security2:error] [pid 890058:tid 890297] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-content/themes/index.php"] [unique_id "alxgaXzbEu1Ap1Mwpo-sUQAAAXc"]
[Sat Jul 18 23:28:09.063664 2026] [security2:error] [pid 890058:tid 890297] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-content/themes/index.php"] [unique_id "alxgaXzbEu1Ap1Mwpo-sUQAAAXc"]
[Sat Jul 18 23:28:09.290125 2026] [security2:error] [pid 890058:tid 890138] [remote 31.42.184.154:41916] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgaXzbEu1Ap1Mwpo-sWgABWk8"]
[Sat Jul 18 23:28:09.290366 2026] [security2:error] [pid 890058:tid 890268] [client 31.42.184.154:41916] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgaXzbEu1Ap1Mwpo-sWgABWk8"]
[Sat Jul 18 23:28:09.402657 2026] [security2:error] [pid 890058:tid 890236] [client 18.139.208.24:32178] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.208.139.18.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxgaXzbEu1Ap1Mwpo-sXwAAATo"]
[Sat Jul 18 23:28:09.404082 2026] [security2:error] [pid 890058:tid 890276] [client 124.29.246.106:52092] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxgaXzbEu1Ap1Mwpo-sYQAAAWI"]
[Sat Jul 18 23:28:09.404165 2026] [security2:error] [pid 890058:tid 890276] [client 124.29.246.106:52092] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxgaXzbEu1Ap1Mwpo-sYQAAAWI"]
[Sat Jul 18 23:28:09.441577 2026] [security2:error] [pid 890058:tid 890220] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-blog.php"] [unique_id "alxgaXzbEu1Ap1Mwpo-sYwAAASo"]
[Sat Jul 18 23:28:09.441679 2026] [security2:error] [pid 890058:tid 890220] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-blog.php"] [unique_id "alxgaXzbEu1Ap1Mwpo-sYwAAASo"]
[Sat Jul 18 23:28:09.456119 2026] [security2:error] [pid 890058:tid 890104] [remote 41.186.86.12:8913] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxgaXzbEu1Ap1Mwpo-sZQABEy0"]
[Sat Jul 18 23:28:09.631883 2026] [security2:error] [pid 890058:tid 890273] [client 34.172.185.49:5968] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "1ilyn9.com"] [uri "/wp-json/batch/v1"] [unique_id "alxgaXzbEu1Ap1Mwpo-sbwAAAV8"]
[Sat Jul 18 23:28:09.722337 2026] [proxy:error] [pid 890058:tid 890189] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:09.722408 2026] [proxy_http:error] [pid 890058:tid 890189] [client 193.47.62.168:55348] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:09.722875 2026] [proxy:error] [pid 890058:tid 890189] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:09.722918 2026] [proxy_http:error] [pid 890058:tid 890189] [client 193.47.62.168:55348] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:09.816430 2026] [proxy:error] [pid 890058:tid 890256] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:09.816504 2026] [proxy_http:error] [pid 890058:tid 890256] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:09.817157 2026] [proxy:error] [pid 890058:tid 890256] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:09.817185 2026] [proxy_http:error] [pid 890058:tid 890256] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:09.817289 2026] [security2:error] [pid 890058:tid 890256] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxgaXzbEu1Ap1Mwpo-segAAAU4"]
[Sat Jul 18 23:28:10.023992 2026] [security2:error] [pid 890058:tid 890133] [remote 91.142.222.105:45142] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxganzbEu1Ap1Mwpo-sggABgUo"]
[Sat Jul 18 23:28:10.100249 2026] [security2:error] [pid 890058:tid 890206] [client 34.172.185.49:5968] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "1ilyn9.com"] [uri "/"] [unique_id "alxganzbEu1Ap1Mwpo-shwAAARw"]
[Sat Jul 18 23:28:10.169281 2026] [security2:error] [pid 890058:tid 890306] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-content/admin.php"] [unique_id "alxganzbEu1Ap1Mwpo-sigAAAYA"]
[Sat Jul 18 23:28:10.169362 2026] [security2:error] [pid 890058:tid 890306] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-content/admin.php"] [unique_id "alxganzbEu1Ap1Mwpo-sigAAAYA"]
[Sat Jul 18 23:28:10.235760 2026] [security2:error] [pid 890058:tid 890154] [remote 40.77.167.247:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxganzbEu1Ap1Mwpo-shAABGV8"]
[Sat Jul 18 23:28:10.350844 2026] [security2:error] [pid 890058:tid 890191] [client 18.136.194.202:50884] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 202.194.136.18.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxganzbEu1Ap1Mwpo-smQAAAQ0"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:28:10.554549 2026] [security2:error] [pid 890058:tid 890229] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/adminfuns.php"] [unique_id "alxganzbEu1Ap1Mwpo-snwAAATM"]
[Sat Jul 18 23:28:10.554664 2026] [security2:error] [pid 890058:tid 890229] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/adminfuns.php"] [unique_id "alxganzbEu1Ap1Mwpo-snwAAATM"]
[Sat Jul 18 23:28:10.647378 2026] [security2:error] [pid 881201:tid 881365] [client 119.154.81.234:64014] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgagWL-zKlchkVWS1yOQAAACE"]
[Sat Jul 18 23:28:10.647471 2026] [security2:error] [pid 881201:tid 881365] [client 119.154.81.234:64014] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgagWL-zKlchkVWS1yOQAAACE"]
[Sat Jul 18 23:28:10.751091 2026] [security2:error] [pid 890058:tid 890171] [remote 41.186.86.12:8913] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxganzbEu1Ap1Mwpo-sqwABd3A"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:28:10.917360 2026] [security2:error] [pid 890058:tid 890222] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/goods.php"] [unique_id "alxganzbEu1Ap1Mwpo-stwAAASw"]
[Sat Jul 18 23:28:10.917501 2026] [security2:error] [pid 890058:tid 890222] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/goods.php"] [unique_id "alxganzbEu1Ap1Mwpo-stwAAASw"]
[Sat Jul 18 23:28:11.238588 2026] [security2:error] [pid 890058:tid 890245] [client 206.163.254.243:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxga3zbEu1Ap1Mwpo-swQABQ3o"]
[Sat Jul 18 23:28:11.299809 2026] [security2:error] [pid 890058:tid 890201] [client 34.172.185.49:22162] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "1ilyn9.com"] [uri "/wp-json/batch/v1"] [unique_id "alxga3zbEu1Ap1Mwpo-syQAAARc"]
[Sat Jul 18 23:28:11.648408 2026] [security2:error] [pid 890058:tid 890259] [client 34.172.185.49:22162] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "1ilyn9.com"] [uri "/"] [unique_id "alxga3zbEu1Ap1Mwpo-s3AAAAVE"]
[Sat Jul 18 23:28:11.939986 2026] [security2:error] [pid 890058:tid 890210] [client 163.61.1.17:49265] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxga3zbEu1Ap1Mwpo-s8QAAASA"]
[Sat Jul 18 23:28:11.940124 2026] [security2:error] [pid 890058:tid 890210] [client 163.61.1.17:49265] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxga3zbEu1Ap1Mwpo-s8QAAASA"]
[Sat Jul 18 23:28:11.981857 2026] [security2:error] [pid 890058:tid 890193] [client 106.222.249.209:3862] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxga3zbEu1Ap1Mwpo-s9AAAAQ8"]
[Sat Jul 18 23:28:11.981948 2026] [security2:error] [pid 890058:tid 890193] [client 106.222.249.209:3862] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxga3zbEu1Ap1Mwpo-s9AAAAQ8"]
[Sat Jul 18 23:28:12.287960 2026] [security2:error] [pid 890058:tid 890197] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/ms-edit.php"] [unique_id "alxgbHzbEu1Ap1Mwpo-tBQAAARM"]
[Sat Jul 18 23:28:12.288047 2026] [security2:error] [pid 890058:tid 890197] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/ms-edit.php"] [unique_id "alxgbHzbEu1Ap1Mwpo-tBQAAARM"]
[Sat Jul 18 23:28:12.668833 2026] [security2:error] [pid 881201:tid 881342] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/222.php"] [unique_id "alxgbAWL-zKlchkVWS1yVQAAAAo"]
[Sat Jul 18 23:28:12.668950 2026] [security2:error] [pid 881201:tid 881342] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/222.php"] [unique_id "alxgbAWL-zKlchkVWS1yVQAAAAo"]
[Sat Jul 18 23:28:12.695331 2026] [security2:error] [pid 890058:tid 890263] [client 13.232.206.133:63298] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.206.232.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxgbHzbEu1Ap1Mwpo-tHAAAAVU"]
[Sat Jul 18 23:28:13.019463 2026] [security2:error] [pid 890058:tid 890296] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/cgi-bin/index.php"] [unique_id "alxgbXzbEu1Ap1Mwpo-tJwAAAXY"]
[Sat Jul 18 23:28:13.019570 2026] [security2:error] [pid 890058:tid 890296] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/cgi-bin/index.php"] [unique_id "alxgbXzbEu1Ap1Mwpo-tJwAAAXY"]
[Sat Jul 18 23:28:13.185621 2026] [security2:error] [pid 890058:tid 890300] [client 190.245.146.99:49984] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgbXzbEu1Ap1Mwpo-tNAAAAXo"]
[Sat Jul 18 23:28:13.185731 2026] [security2:error] [pid 890058:tid 890300] [client 190.245.146.99:49984] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgbXzbEu1Ap1Mwpo-tNAAAAXo"]
[Sat Jul 18 23:28:13.376096 2026] [proxy:error] [pid 890058:tid 890307] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:13.376183 2026] [proxy_http:error] [pid 890058:tid 890307] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:13.377538 2026] [proxy:error] [pid 890058:tid 890307] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:13.377586 2026] [proxy_http:error] [pid 890058:tid 890307] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:13.377694 2026] [security2:error] [pid 890058:tid 890307] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxgbXzbEu1Ap1Mwpo-tUwAAAYE"]
[Sat Jul 18 23:28:13.641671 2026] [security2:error] [pid 890058:tid 890109] [remote 91.142.222.105:45142] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxgbXzbEu1Ap1Mwpo-tbwABhTI"], referer: https://mezzacraft.com/wp-login.php
[Sat Jul 18 23:28:13.698415 2026] [security2:error] [pid 890058:tid 890269] [client 65.0.26.70:24734] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.26.0.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxgbXzbEu1Ap1Mwpo-tcQAAAVs"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:28:13.730267 2026] [security2:error] [pid 890058:tid 890291] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/BDKR28WP.php"] [unique_id "alxgbXzbEu1Ap1Mwpo-tcwAAAXE"]
[Sat Jul 18 23:28:13.730402 2026] [security2:error] [pid 890058:tid 890291] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/BDKR28WP.php"] [unique_id "alxgbXzbEu1Ap1Mwpo-tcwAAAXE"]
[Sat Jul 18 23:28:14.087702 2026] [proxy:error] [pid 890058:tid 890261] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:14.087769 2026] [proxy_http:error] [pid 890058:tid 890261] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:14.088459 2026] [proxy:error] [pid 890058:tid 890261] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:14.088488 2026] [proxy_http:error] [pid 890058:tid 890261] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:14.088567 2026] [security2:error] [pid 890058:tid 890261] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxgbnzbEu1Ap1Mwpo-tgQAAAVM"]
[Sat Jul 18 23:28:14.180191 2026] [security2:error] [pid 890058:tid 890256] [client 138.252.89.100:51133] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxgbnzbEu1Ap1Mwpo-tgwAAAU4"]
[Sat Jul 18 23:28:14.180307 2026] [security2:error] [pid 890058:tid 890256] [client 138.252.89.100:51133] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxgbnzbEu1Ap1Mwpo-tgwAAAU4"]
[Sat Jul 18 23:28:14.236031 2026] [security2:error] [pid 881201:tid 881456] [client 216.73.163.141:52087] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 141.163.73.216.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.amandathiem.com"] [uri "/wp-login.php"] [unique_id "alxgbgWL-zKlchkVWS1ycQAAAHw"]
[Sat Jul 18 23:28:14.448387 2026] [proxy:error] [pid 890058:tid 890234] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:14.448468 2026] [proxy_http:error] [pid 890058:tid 890234] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:14.449693 2026] [proxy:error] [pid 890058:tid 890234] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:14.449761 2026] [proxy_http:error] [pid 890058:tid 890234] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:14.449863 2026] [security2:error] [pid 890058:tid 890234] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxgbnzbEu1Ap1Mwpo-tigAAATg"]
[Sat Jul 18 23:28:14.831076 2026] [security2:error] [pid 881201:tid 881361] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/raw.php"] [unique_id "alxgbgWL-zKlchkVWS1yhAAAAB0"]
[Sat Jul 18 23:28:14.831185 2026] [security2:error] [pid 881201:tid 881361] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/raw.php"] [unique_id "alxgbgWL-zKlchkVWS1yhAAAAB0"]
[Sat Jul 18 23:28:15.209394 2026] [security2:error] [pid 890058:tid 890210] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/abcd.php"] [unique_id "alxgb3zbEu1Ap1Mwpo-tqQAAASA"]
[Sat Jul 18 23:28:15.209486 2026] [security2:error] [pid 890058:tid 890210] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/abcd.php"] [unique_id "alxgb3zbEu1Ap1Mwpo-tqQAAASA"]
[Sat Jul 18 23:28:15.314739 2026] [security2:error] [pid 881201:tid 881417] [client 27.34.68.67:59974] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgbwWL-zKlchkVWS1ykAAAAFU"]
[Sat Jul 18 23:28:15.314884 2026] [security2:error] [pid 881201:tid 881417] [client 27.34.68.67:59974] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgbwWL-zKlchkVWS1ykAAAAFU"]
[Sat Jul 18 23:28:15.587501 2026] [security2:error] [pid 881201:tid 881443] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/a1.php"] [unique_id "alxgbwWL-zKlchkVWS1ykgAAAG8"]
[Sat Jul 18 23:28:15.587602 2026] [security2:error] [pid 881201:tid 881443] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/a1.php"] [unique_id "alxgbwWL-zKlchkVWS1ykgAAAG8"]
[Sat Jul 18 23:28:15.627767 2026] [proxy:error] [pid 890058:tid 890252] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:15.627866 2026] [proxy_http:error] [pid 890058:tid 890252] [client 193.47.62.168:36424] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:15.628629 2026] [proxy:error] [pid 890058:tid 890252] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:15.628673 2026] [proxy_http:error] [pid 890058:tid 890252] [client 193.47.62.168:36424] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:15.939051 2026] [security2:error] [pid 881201:tid 881381] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "alxgbwWL-zKlchkVWS1ynQAAADE"]
[Sat Jul 18 23:28:15.939224 2026] [security2:error] [pid 881201:tid 881381] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "alxgbwWL-zKlchkVWS1ynQAAADE"]
[Sat Jul 18 23:28:15.945658 2026] [security2:error] [pid 890058:tid 890225] [client 65.111.20.86:45479] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 86.20.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxgb3zbEu1Ap1Mwpo-tzgAAAS8"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:28:16.047030 2026] [security2:error] [pid 881201:tid 881390] [client 45.3.45.116:21617] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "155"] [id "900406"] [msg "wp-login POST logging"] [data "200"] [hostname "tumbletyn.com"] [uri "/wp-login.php"] [unique_id "alxgbwWL-zKlchkVWS1ymgAAADo"], referer: https://tumbletyn.com/wp-login.php
[Sat Jul 18 23:28:16.157708 2026] [core:error] [pid 890058:tid 890230] [client 50.116.65.227:55796] AH00135: Invalid method in request PURGE /.* HTTP/1.1
[Sat Jul 18 23:28:16.169530 2026] [core:error] [pid 890058:tid 890310] [client 50.116.65.227:55806] AH00135: Invalid method in request PURGE /.* HTTP/1.1
[Sat Jul 18 23:28:16.315941 2026] [security2:error] [pid 890058:tid 890217] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/cgi-bin/admin.php"] [unique_id "alxgcHzbEu1Ap1Mwpo-t4QAAASc"]
[Sat Jul 18 23:28:16.316034 2026] [security2:error] [pid 890058:tid 890217] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/cgi-bin/admin.php"] [unique_id "alxgcHzbEu1Ap1Mwpo-t4QAAASc"]
[Sat Jul 18 23:28:16.356599 2026] [security2:error] [pid 890058:tid 890207] [client 223.185.61.63:33026] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxgcHzbEu1Ap1Mwpo-t6QAAAR0"]
[Sat Jul 18 23:28:16.356686 2026] [security2:error] [pid 890058:tid 890207] [client 223.185.61.63:33026] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxgcHzbEu1Ap1Mwpo-t6QAAAR0"]
[Sat Jul 18 23:28:16.574968 2026] [security2:error] [pid 890058:tid 890198] [client 74.208.214.194:53020] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxgcHzbEu1Ap1Mwpo-t9QAAARQ"]
[Sat Jul 18 23:28:16.588068 2026] [security2:error] [pid 890058:tid 890196] [client 45.3.44.136:23833] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 136.44.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxgcHzbEu1Ap1Mwpo-t8wAAARI"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:28:16.693102 2026] [security2:error] [pid 890058:tid 890256] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-content/BypassBest.php"] [unique_id "alxgcHzbEu1Ap1Mwpo-uAAAAAU4"]
[Sat Jul 18 23:28:16.693220 2026] [security2:error] [pid 890058:tid 890256] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-content/BypassBest.php"] [unique_id "alxgcHzbEu1Ap1Mwpo-uAAAAAU4"]
[Sat Jul 18 23:28:16.750497 2026] [security2:error] [pid 890058:tid 890314] [client 104.210.140.142:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.ali-alghanim.com"] [uri "/index.php"] [unique_id "alxgb3zbEu1Ap1Mwpo-togABiFI"]
[Sat Jul 18 23:28:17.083824 2026] [proxy:error] [pid 890058:tid 890264] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:17.083885 2026] [proxy_http:error] [pid 890058:tid 890264] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:17.084456 2026] [proxy:error] [pid 890058:tid 890264] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:17.084482 2026] [proxy_http:error] [pid 890058:tid 890264] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:17.084556 2026] [security2:error] [pid 890058:tid 890264] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxgcXzbEu1Ap1Mwpo-uFwAAAVY"]
[Sat Jul 18 23:28:17.466060 2026] [security2:error] [pid 890058:tid 890290] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/simple.php"] [unique_id "alxgcXzbEu1Ap1Mwpo-uKQAAAXA"]
[Sat Jul 18 23:28:17.466164 2026] [security2:error] [pid 890058:tid 890290] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/simple.php"] [unique_id "alxgcXzbEu1Ap1Mwpo-uKQAAAXA"]
[Sat Jul 18 23:28:17.837955 2026] [security2:error] [pid 881201:tid 881435] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/xxx.php"] [unique_id "alxgcQWL-zKlchkVWS1yugAAAGc"]
[Sat Jul 18 23:28:17.838046 2026] [security2:error] [pid 881201:tid 881435] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/xxx.php"] [unique_id "alxgcQWL-zKlchkVWS1yugAAAGc"]
[Sat Jul 18 23:28:18.191638 2026] [security2:error] [pid 881201:tid 881403] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/hypo.php"] [unique_id "alxgcgWL-zKlchkVWS1ywAAAAEc"]
[Sat Jul 18 23:28:18.191789 2026] [security2:error] [pid 881201:tid 881403] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/hypo.php"] [unique_id "alxgcgWL-zKlchkVWS1ywAAAAEc"]
[Sat Jul 18 23:28:18.339332 2026] [security2:error] [pid 881201:tid 881421] [client 74.7.175.169:41312] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "www.entraalnuevomundo.com"] [uri "/robots.txt"] [unique_id "alxgcgWL-zKlchkVWS1ywwAAWUY"]
[Sat Jul 18 23:28:18.569863 2026] [proxy:error] [pid 890058:tid 890308] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:18.569955 2026] [proxy_http:error] [pid 890058:tid 890308] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:18.571217 2026] [proxy:error] [pid 890058:tid 890308] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:18.571271 2026] [proxy_http:error] [pid 890058:tid 890308] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:18.571394 2026] [security2:error] [pid 890058:tid 890308] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxgcnzbEu1Ap1Mwpo-uZQAAAYI"]
[Sat Jul 18 23:28:18.954266 2026] [security2:error] [pid 890058:tid 890296] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/chosen.php"] [unique_id "alxgcnzbEu1Ap1Mwpo-ucAAAAXY"]
[Sat Jul 18 23:28:18.954346 2026] [security2:error] [pid 890058:tid 890296] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/chosen.php"] [unique_id "alxgcnzbEu1Ap1Mwpo-ucAAAAXY"]
[Sat Jul 18 23:28:19.333151 2026] [proxy:error] [pid 881201:tid 881445] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:19.333207 2026] [proxy_http:error] [pid 881201:tid 881445] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:19.333695 2026] [proxy:error] [pid 881201:tid 881445] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:19.333723 2026] [proxy_http:error] [pid 881201:tid 881445] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:19.333833 2026] [security2:error] [pid 881201:tid 881445] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxgcwWL-zKlchkVWS1y1AAAAHE"]
[Sat Jul 18 23:28:19.714767 2026] [security2:error] [pid 881201:tid 881442] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/file5.php"] [unique_id "alxgcwWL-zKlchkVWS1y4wAAAG4"]
[Sat Jul 18 23:28:19.714911 2026] [security2:error] [pid 881201:tid 881442] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/file5.php"] [unique_id "alxgcwWL-zKlchkVWS1y4wAAAG4"]
[Sat Jul 18 23:28:19.940806 2026] [security2:error] [pid 881201:tid 881387] [client 50.116.65.227:14860] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxgcwWL-zKlchkVWS1y6QAAADc"]
[Sat Jul 18 23:28:19.954765 2026] [security2:error] [pid 890058:tid 890251] [client 50.116.65.227:54636] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxgc3zbEu1Ap1Mwpo-umAAAAUk"]
[Sat Jul 18 23:28:20.094619 2026] [security2:error] [pid 890058:tid 890211] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/file.php"] [unique_id "alxgdHzbEu1Ap1Mwpo-unQAAASE"]
[Sat Jul 18 23:28:20.094692 2026] [security2:error] [pid 890058:tid 890211] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/file.php"] [unique_id "alxgdHzbEu1Ap1Mwpo-unQAAASE"]
[Sat Jul 18 23:28:21.194419 2026] [security2:error] [pid 890058:tid 890189] [client 119.154.81.234:64463] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgdXzbEu1Ap1Mwpo-uzgAAAQs"]
[Sat Jul 18 23:28:21.194562 2026] [security2:error] [pid 890058:tid 890189] [client 119.154.81.234:64463] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgdXzbEu1Ap1Mwpo-uzgAAAQs"]
[Sat Jul 18 23:28:21.412991 2026] [security2:error] [pid 890058:tid 890105] [remote 152.228.213.32:41044] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxgdXzbEu1Ap1Mwpo-u2QABVC4"]
[Sat Jul 18 23:28:21.599880 2026] [security2:error] [pid 890058:tid 890092] [remote 152.228.213.32:41044] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxgdXzbEu1Ap1Mwpo-u5gABdSE"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:28:21.716347 2026] [security2:error] [pid 890058:tid 890261] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/aa2.php"] [unique_id "alxgdXzbEu1Ap1Mwpo-u5wAAAVM"]
[Sat Jul 18 23:28:21.716435 2026] [security2:error] [pid 890058:tid 890261] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/aa2.php"] [unique_id "alxgdXzbEu1Ap1Mwpo-u5wAAAVM"]
[Sat Jul 18 23:28:22.009526 2026] [security2:error] [pid 890058:tid 890199] [client 216.244.66.231:60090] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.vfcthomasville.org"] [uri "/robots.txt"] [unique_id "alxgdnzbEu1Ap1Mwpo-u9gAAARU"]
[Sat Jul 18 23:28:22.009618 2026] [security2:error] [pid 890058:tid 890199] [client 216.244.66.231:60090] ModSecurity: Warning. Matched phrase "Dotbot" at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "www.vfcthomasville.org"] [uri "/robots.txt"] [unique_id "alxgdnzbEu1Ap1Mwpo-u9gAAARU"]
[Sat Jul 18 23:28:22.063871 2026] [security2:error] [pid 890058:tid 890240] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/ccou.php"] [unique_id "alxgdnzbEu1Ap1Mwpo-u-gAAAT4"]
[Sat Jul 18 23:28:22.063952 2026] [security2:error] [pid 890058:tid 890240] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/ccou.php"] [unique_id "alxgdnzbEu1Ap1Mwpo-u-gAAAT4"]
[Sat Jul 18 23:28:22.472019 2026] [security2:error] [pid 890058:tid 890297] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/dr.php"] [unique_id "alxgdnzbEu1Ap1Mwpo-vDAAAAXc"]
[Sat Jul 18 23:28:22.472114 2026] [security2:error] [pid 890058:tid 890297] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/dr.php"] [unique_id "alxgdnzbEu1Ap1Mwpo-vDAAAAXc"]
[Sat Jul 18 23:28:22.475089 2026] [security2:error] [pid 890058:tid 890262] [client 66.249.65.174:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.liquidationteam.com"] [uri "/index.php"] [unique_id "alxgdnzbEu1Ap1Mwpo-vAQAAAVQ"]
[Sat Jul 18 23:28:22.489277 2026] [security2:error] [pid 881201:tid 881385] [client 163.61.1.17:49716] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgdgWL-zKlchkVWS1zCAAAADU"]
[Sat Jul 18 23:28:22.489373 2026] [security2:error] [pid 881201:tid 881385] [client 163.61.1.17:49716] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgdgWL-zKlchkVWS1zCAAAADU"]
[Sat Jul 18 23:28:22.589987 2026] [security2:error] [pid 890058:tid 890135] [remote 163.227.186.27:32944] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "secoaches.co"] [uri "/wp-login.php"] [unique_id "alxgdnzbEu1Ap1Mwpo-vEwABgkw"]
[Sat Jul 18 23:28:22.629927 2026] [security2:error] [pid 890058:tid 890272] [client 93.152.221.118:55683] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.221.152.93.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-login.php"] [unique_id "alxgdnzbEu1Ap1Mwpo-vFQAAAV4"], referer: https://t.co/
[Sat Jul 18 23:28:22.696478 2026] [security2:error] [pid 890058:tid 890239] [client 106.222.249.209:23013] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgdnzbEu1Ap1Mwpo-vGwAAAT0"]
[Sat Jul 18 23:28:22.697243 2026] [security2:error] [pid 890058:tid 890239] [client 106.222.249.209:23013] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgdnzbEu1Ap1Mwpo-vGwAAAT0"]
[Sat Jul 18 23:28:22.834726 2026] [security2:error] [pid 890058:tid 890275] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/file31.php"] [unique_id "alxgdnzbEu1Ap1Mwpo-vIAAAAWE"]
[Sat Jul 18 23:28:22.834846 2026] [security2:error] [pid 890058:tid 890275] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/file31.php"] [unique_id "alxgdnzbEu1Ap1Mwpo-vIAAAAWE"]
[Sat Jul 18 23:28:22.915969 2026] [security2:error] [pid 890058:tid 890230] [client 93.152.221.118:55693] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.221.152.93.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-login.php"] [unique_id "alxgdnzbEu1Ap1Mwpo-vJAAAATQ"], referer: https://wordpress.org/
[Sat Jul 18 23:28:22.971788 2026] [security2:error] [pid 890058:tid 890164] [remote 154.61.75.100:59652] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxgdnzbEu1Ap1Mwpo-vJQABg2k"]
[Sat Jul 18 23:28:23.053193 2026] [security2:error] [pid 890058:tid 890173] [remote 163.227.186.27:32944] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "secoaches.co"] [uri "/wp-login.php"] [unique_id "alxgd3zbEu1Ap1Mwpo-vKQABGnI"], referer: https://secoaches.co/wp-login.php
[Sat Jul 18 23:28:23.181542 2026] [security2:error] [pid 890058:tid 890192] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/file6.php"] [unique_id "alxgd3zbEu1Ap1Mwpo-vMgAAAQ4"]
[Sat Jul 18 23:28:23.181634 2026] [security2:error] [pid 890058:tid 890192] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/file6.php"] [unique_id "alxgd3zbEu1Ap1Mwpo-vMgAAAQ4"]
[Sat Jul 18 23:28:23.562398 2026] [security2:error] [pid 890058:tid 890197] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/file15.php"] [unique_id "alxgd3zbEu1Ap1Mwpo-vPwAAARM"]
[Sat Jul 18 23:28:23.562474 2026] [security2:error] [pid 890058:tid 890197] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/file15.php"] [unique_id "alxgd3zbEu1Ap1Mwpo-vPwAAARM"]
[Sat Jul 18 23:28:23.634402 2026] [security2:error] [pid 890058:tid 890169] [remote 117.0.21.154:36292] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "dadanetnet.net"] [uri "/xmlrpc.php"] [unique_id "alxgd3zbEu1Ap1Mwpo-vQwABLm4"]
[Sat Jul 18 23:28:23.634648 2026] [security2:error] [pid 890058:tid 890224] [client 117.0.21.154:36292] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "dadanetnet.net"] [uri "/xmlrpc.php"] [unique_id "alxgd3zbEu1Ap1Mwpo-vQwABLm4"]
[Sat Jul 18 23:28:23.723137 2026] [security2:error] [pid 890058:tid 890301] [client 190.245.146.99:50502] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgd3zbEu1Ap1Mwpo-vRwAAAXs"]
[Sat Jul 18 23:28:23.723238 2026] [security2:error] [pid 890058:tid 890301] [client 190.245.146.99:50502] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgd3zbEu1Ap1Mwpo-vRwAAAXs"]
[Sat Jul 18 23:28:23.943697 2026] [security2:error] [pid 890058:tid 890256] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/jp.php"] [unique_id "alxgd3zbEu1Ap1Mwpo-vTwAAAU4"]
[Sat Jul 18 23:28:23.943843 2026] [security2:error] [pid 890058:tid 890256] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/jp.php"] [unique_id "alxgd3zbEu1Ap1Mwpo-vTwAAAU4"]
[Sat Jul 18 23:28:23.973790 2026] [security2:error] [pid 890058:tid 890181] [remote 154.61.75.100:59652] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxgd3zbEu1Ap1Mwpo-vUAABOno"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:28:24.312294 2026] [security2:error] [pid 890058:tid 890204] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/f35.php"] [unique_id "alxgeHzbEu1Ap1Mwpo-vZQAAARo"]
[Sat Jul 18 23:28:24.312422 2026] [security2:error] [pid 890058:tid 890204] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/f35.php"] [unique_id "alxgeHzbEu1Ap1Mwpo-vZQAAARo"]
[Sat Jul 18 23:28:24.702484 2026] [security2:error] [pid 890058:tid 890310] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-load.php"] [unique_id "alxgeHzbEu1Ap1Mwpo-vcQAAAYQ"]
[Sat Jul 18 23:28:24.702587 2026] [security2:error] [pid 890058:tid 890310] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-load.php"] [unique_id "alxgeHzbEu1Ap1Mwpo-vcQAAAYQ"]
[Sat Jul 18 23:28:24.777964 2026] [security2:error] [pid 890058:tid 890279] [client 93.152.221.118:55731] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.221.152.93.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.maxenengineering.com"] [uri "/wp-login.php"] [unique_id "alxgeHzbEu1Ap1Mwpo-vdgAAAWU"], referer: https://wordpress.org/
[Sat Jul 18 23:28:25.073039 2026] [proxy:error] [pid 890058:tid 890272] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:25.073101 2026] [proxy_http:error] [pid 890058:tid 890272] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:25.073628 2026] [proxy:error] [pid 890058:tid 890272] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:25.073653 2026] [proxy_http:error] [pid 890058:tid 890272] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:25.073741 2026] [security2:error] [pid 890058:tid 890272] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxgeXzbEu1Ap1Mwpo-vhQAAAV4"]
[Sat Jul 18 23:28:25.433892 2026] [proxy:error] [pid 890058:tid 890276] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:25.433944 2026] [proxy_http:error] [pid 890058:tid 890276] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:25.434386 2026] [proxy:error] [pid 890058:tid 890276] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:25.434411 2026] [proxy_http:error] [pid 890058:tid 890276] [client 20.206.105.145:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:25.434481 2026] [security2:error] [pid 890058:tid 890276] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "503"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/___proxy_subdomain_cpcalendars/cgi-sys/503.html"] [unique_id "alxgeXzbEu1Ap1Mwpo-vlAAAAWI"]
[Sat Jul 18 23:28:25.655249 2026] [security2:error] [pid 890058:tid 890254] [client 138.252.89.100:51577] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxgeXzbEu1Ap1Mwpo-vngAAAUw"]
[Sat Jul 18 23:28:25.655394 2026] [security2:error] [pid 890058:tid 890254] [client 138.252.89.100:51577] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxgeXzbEu1Ap1Mwpo-vngAAAUw"]
[Sat Jul 18 23:28:25.805868 2026] [security2:error] [pid 890058:tid 890302] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "alxgeXzbEu1Ap1Mwpo-vqAAAAXw"]
[Sat Jul 18 23:28:25.805960 2026] [security2:error] [pid 890058:tid 890302] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "alxgeXzbEu1Ap1Mwpo-vqAAAAXw"]
[Sat Jul 18 23:28:25.841264 2026] [security2:error] [pid 890058:tid 890288] [client 27.34.68.67:54079] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgeXzbEu1Ap1Mwpo-vqQAAAW4"]
[Sat Jul 18 23:28:25.841365 2026] [security2:error] [pid 890058:tid 890288] [client 27.34.68.67:54079] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgeXzbEu1Ap1Mwpo-vqQAAAW4"]
[Sat Jul 18 23:28:25.891091 2026] [ssl:error] [pid 890058:tid 890284] [client 3.233.59.216:50714] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname webdisk.maxenengineering.maxenengineering.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:28:26.191464 2026] [security2:error] [pid 890058:tid 890108] [remote 31.42.184.154:46140] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.holistichealthmassagenz.com"] [uri "/wp-login.php"] [unique_id "alxgenzbEu1Ap1Mwpo-vugABhTE"]
[Sat Jul 18 23:28:26.194138 2026] [security2:error] [pid 890058:tid 890194] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-links.php"] [unique_id "alxgenzbEu1Ap1Mwpo-vuwAAARA"]
[Sat Jul 18 23:28:26.194227 2026] [security2:error] [pid 890058:tid 890194] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wp-links.php"] [unique_id "alxgenzbEu1Ap1Mwpo-vuwAAARA"]
[Sat Jul 18 23:28:26.199976 2026] [security2:error] [pid 890058:tid 890059] [remote 72.167.132.114:50482] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxgenzbEu1Ap1Mwpo-vuQABVgA"]
[Sat Jul 18 23:28:26.209061 2026] [security2:error] [pid 890058:tid 890219] [client 223.228.182.224:32908] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxgenzbEu1Ap1Mwpo-vvAAAASk"]
[Sat Jul 18 23:28:26.209173 2026] [security2:error] [pid 890058:tid 890219] [client 223.228.182.224:32908] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxgenzbEu1Ap1Mwpo-vvAAAASk"]
[Sat Jul 18 23:28:26.258333 2026] [security2:error] [pid 881201:tid 881428] [client 65.111.26.179:38561] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 179.26.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxgegWL-zKlchkVWS1zTQAAAGA"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:28:26.272663 2026] [ssl:error] [pid 890058:tid 890305] [client 104.48.69.105:34702] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname blog.danwolfe.us provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:28:26.515064 2026] [security2:error] [pid 890058:tid 890088] [remote 31.42.184.154:46140] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.holistichealthmassagenz.com"] [uri "/wp-login.php"] [unique_id "alxgenzbEu1Ap1Mwpo-vygABYh0"], referer: https://mail.holistichealthmassagenz.com/wp-login.php
[Sat Jul 18 23:28:26.547736 2026] [security2:error] [pid 890058:tid 890285] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/solo1.php"] [unique_id "alxgenzbEu1Ap1Mwpo-vzwAAAWs"]
[Sat Jul 18 23:28:26.547850 2026] [security2:error] [pid 890058:tid 890285] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/solo1.php"] [unique_id "alxgenzbEu1Ap1Mwpo-vzwAAAWs"]
[Sat Jul 18 23:28:26.707957 2026] [security2:error] [pid 890058:tid 890112] [remote 45.157.54.14:13635] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cosanluis.com"] [uri "/xmlrpc.php"] [unique_id "alxgenzbEu1Ap1Mwpo-v0wABhzU"]
[Sat Jul 18 23:28:26.708158 2026] [security2:error] [pid 890058:tid 890313] [client 45.157.54.14:13635] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cosanluis.com"] [uri "/xmlrpc.php"] [unique_id "alxgenzbEu1Ap1Mwpo-v0wABhzU"]
[Sat Jul 18 23:28:26.795689 2026] [security2:error] [pid 890058:tid 890076] [remote 45.157.54.14:13719] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cosanluis.com"] [uri "/xmlrpc.php"] [unique_id "alxgenzbEu1Ap1Mwpo-v3AABUBE"]
[Sat Jul 18 23:28:26.795832 2026] [security2:error] [pid 890058:tid 890258] [client 45.157.54.14:13719] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cosanluis.com"] [uri "/xmlrpc.php"] [unique_id "alxgenzbEu1Ap1Mwpo-v3AABUBE"]
[Sat Jul 18 23:28:26.803315 2026] [security2:error] [pid 890058:tid 890107] [remote 72.167.132.114:50482] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxgenzbEu1Ap1Mwpo-v2wABPjA"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:28:26.889004 2026] [security2:error] [pid 881201:tid 881459] [client 195.63.31.72:18369] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 72.31.63.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxgegWL-zKlchkVWS1zUwAAAH8"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:28:26.898885 2026] [security2:error] [pid 890058:tid 890248] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/sixxis.php"] [unique_id "alxgenzbEu1Ap1Mwpo-v4AAAAUY"]
[Sat Jul 18 23:28:26.898970 2026] [security2:error] [pid 890058:tid 890248] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/sixxis.php"] [unique_id "alxgenzbEu1Ap1Mwpo-v4AAAAUY"]
[Sat Jul 18 23:28:26.928168 2026] [security2:error] [pid 890058:tid 890196] [client 212.237.123.165:15449] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "toddnielsen.com"] [uri "/index.php"] [unique_id "alxgenzbEu1Ap1Mwpo-vtAABEho"], referer: https://toddnielsen.com
[Sat Jul 18 23:28:27.026213 2026] [security2:error] [pid 890058:tid 890235] [client 223.185.61.63:20653] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxge3zbEu1Ap1Mwpo-v5gAAATk"]
[Sat Jul 18 23:28:27.026316 2026] [security2:error] [pid 890058:tid 890235] [client 223.185.61.63:20653] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxge3zbEu1Ap1Mwpo-v5gAAATk"]
[Sat Jul 18 23:28:27.299561 2026] [security2:error] [pid 890058:tid 890238] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/2P.update.php"] [unique_id "alxge3zbEu1Ap1Mwpo-v9gAAATw"]
[Sat Jul 18 23:28:27.299654 2026] [security2:error] [pid 890058:tid 890238] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/2P.update.php"] [unique_id "alxge3zbEu1Ap1Mwpo-v9gAAATw"]
[Sat Jul 18 23:28:27.648513 2026] [security2:error] [pid 881201:tid 881409] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/a.php"] [unique_id "alxgewWL-zKlchkVWS1zXQAAAE0"]
[Sat Jul 18 23:28:27.648589 2026] [security2:error] [pid 881201:tid 881409] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/a.php"] [unique_id "alxgewWL-zKlchkVWS1zXQAAAE0"]
[Sat Jul 18 23:28:27.989852 2026] [security2:error] [pid 881201:tid 881223] [remote 97.74.93.24:50612] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxgewWL-zKlchkVWS1zZgAAFBQ"]
[Sat Jul 18 23:28:28.018821 2026] [security2:error] [pid 890058:tid 890197] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/k.php"] [unique_id "alxgfHzbEu1Ap1Mwpo-wCwAAARM"]
[Sat Jul 18 23:28:28.018899 2026] [security2:error] [pid 890058:tid 890197] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/k.php"] [unique_id "alxgfHzbEu1Ap1Mwpo-wCwAAARM"]
[Sat Jul 18 23:28:28.387842 2026] [security2:error] [pid 881201:tid 881246] [remote 97.74.93.24:50612] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxgfAWL-zKlchkVWS1zbAAASys"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:28:28.390826 2026] [security2:error] [pid 890058:tid 890236] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/w.php"] [unique_id "alxgfHzbEu1Ap1Mwpo-wHgAAATo"]
[Sat Jul 18 23:28:28.390901 2026] [security2:error] [pid 890058:tid 890236] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/w.php"] [unique_id "alxgfHzbEu1Ap1Mwpo-wHgAAATo"]
[Sat Jul 18 23:28:28.774642 2026] [security2:error] [pid 881201:tid 881452] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/insc.php"] [unique_id "alxgfAWL-zKlchkVWS1zdAAAAHg"]
[Sat Jul 18 23:28:28.774741 2026] [security2:error] [pid 881201:tid 881452] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/insc.php"] [unique_id "alxgfAWL-zKlchkVWS1zdAAAAHg"]
[Sat Jul 18 23:28:29.041954 2026] [security2:error] [pid 881201:tid 881416] [client 104.207.57.217:28199] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 217.57.207.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxgfQWL-zKlchkVWS1zfAAAAFQ"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:28:29.127479 2026] [security2:error] [pid 890058:tid 890215] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/4PJcpMFsD8B.php"] [unique_id "alxgfXzbEu1Ap1Mwpo-wOgAAASU"]
[Sat Jul 18 23:28:29.127568 2026] [security2:error] [pid 890058:tid 890215] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/4PJcpMFsD8B.php"] [unique_id "alxgfXzbEu1Ap1Mwpo-wOgAAASU"]
[Sat Jul 18 23:28:29.223721 2026] [security2:error] [pid 881201:tid 881326] [remote 182.77.62.24:58266] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.62.77.182.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "kpb.qlr.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgfQWL-zKlchkVWS1zfwAAEXs"]
[Sat Jul 18 23:28:29.223918 2026] [security2:error] [pid 881201:tid 881349] [client 182.77.62.24:58266] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "kpb.qlr.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgfQWL-zKlchkVWS1zfwAAEXs"]
[Sat Jul 18 23:28:29.455174 2026] [security2:error] [pid 881201:tid 881451] [client 103.59.160.164:58908] ModSecurity: Access denied with code 406 (phase 1). Pattern match "^POST$" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "187"] [id "900401"] [msg "PHP Spam Botnet"] [hostname "webmail.blaizeaccountingservices.com"] [uri "/index.php"] [unique_id "alxgfQWL-zKlchkVWS1zhAAAAHc"]
[Sat Jul 18 23:28:29.488877 2026] [security2:error] [pid 890058:tid 890232] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/u.php"] [unique_id "alxgfXzbEu1Ap1Mwpo-wRAAAATY"]
[Sat Jul 18 23:28:29.488964 2026] [security2:error] [pid 890058:tid 890232] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/u.php"] [unique_id "alxgfXzbEu1Ap1Mwpo-wRAAAATY"]
[Sat Jul 18 23:28:29.876314 2026] [security2:error] [pid 881201:tid 881363] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/sss.php"] [unique_id "alxgfQWL-zKlchkVWS1zjQAAAB8"]
[Sat Jul 18 23:28:29.876402 2026] [security2:error] [pid 881201:tid 881363] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/sss.php"] [unique_id "alxgfQWL-zKlchkVWS1zjQAAAB8"]
[Sat Jul 18 23:28:30.122333 2026] [security2:error] [pid 890058:tid 890154] [remote 20.75.217.73:2341] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 73.217.75.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bridgeamazon.com"] [uri "/wp-login.php"] [unique_id "alxgfnzbEu1Ap1Mwpo-wYwABd18"]
[Sat Jul 18 23:28:30.128580 2026] [ssl:error] [pid 890058:tid 890271] [client 104.48.69.105:53010] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname www.bandsir.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:28:30.253867 2026] [security2:error] [pid 890058:tid 890278] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/sss.php"] [unique_id "alxgfnzbEu1Ap1Mwpo-wbAAAAWQ"]
[Sat Jul 18 23:28:30.253970 2026] [security2:error] [pid 890058:tid 890278] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/sss.php"] [unique_id "alxgfnzbEu1Ap1Mwpo-wbAAAAWQ"]
[Sat Jul 18 23:28:30.288187 2026] [security2:error] [pid 890058:tid 890179] [remote 20.75.217.73:2341] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 73.217.75.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bridgeamazon.com"] [uri "/wp-login.php"] [unique_id "alxgfnzbEu1Ap1Mwpo-wbgABJXg"], referer: https://bridgeamazon.com/wp-login.php
[Sat Jul 18 23:28:30.533785 2026] [security2:error] [pid 890058:tid 890184] [remote 163.227.186.27:48786] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxgfnzbEu1Ap1Mwpo-weAABLX0"]
[Sat Jul 18 23:28:30.635263 2026] [security2:error] [pid 890058:tid 890262] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/c.php"] [unique_id "alxgfnzbEu1Ap1Mwpo-wfQAAAVQ"]
[Sat Jul 18 23:28:30.635368 2026] [security2:error] [pid 890058:tid 890262] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/c.php"] [unique_id "alxgfnzbEu1Ap1Mwpo-wfQAAAVQ"]
[Sat Jul 18 23:28:31.006932 2026] [security2:error] [pid 890058:tid 890255] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/aa.php"] [unique_id "alxgf3zbEu1Ap1Mwpo-wjwAAAU0"]
[Sat Jul 18 23:28:31.007004 2026] [security2:error] [pid 890058:tid 890255] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/aa.php"] [unique_id "alxgf3zbEu1Ap1Mwpo-wjwAAAU0"]
[Sat Jul 18 23:28:31.038230 2026] [security2:error] [pid 890058:tid 890065] [remote 163.227.186.27:48786] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxgf3zbEu1Ap1Mwpo-wlQABQQY"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:28:31.387422 2026] [security2:error] [pid 890058:tid 890240] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/100.php"] [unique_id "alxgf3zbEu1Ap1Mwpo-wpwAAAT4"]
[Sat Jul 18 23:28:31.387502 2026] [security2:error] [pid 890058:tid 890240] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/100.php"] [unique_id "alxgf3zbEu1Ap1Mwpo-wpwAAAT4"]
[Sat Jul 18 23:28:31.757845 2026] [security2:error] [pid 881201:tid 881332] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/footer.php"] [unique_id "alxgfwWL-zKlchkVWS1zuAAAAAA"]
[Sat Jul 18 23:28:31.757940 2026] [security2:error] [pid 881201:tid 881332] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/footer.php"] [unique_id "alxgfwWL-zKlchkVWS1zuAAAAAA"]
[Sat Jul 18 23:28:31.819724 2026] [security2:error] [pid 890058:tid 890228] [client 57.141.18.52:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "falconarrowshop.com"] [uri "/index.php"] [unique_id "alxgf3zbEu1Ap1Mwpo-wsQAAATI"]
[Sat Jul 18 23:28:32.193852 2026] [security2:error] [pid 890058:tid 890206] [client 119.154.81.234:64910] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxggHzbEu1Ap1Mwpo-wyAAAARw"]
[Sat Jul 18 23:28:32.193949 2026] [security2:error] [pid 890058:tid 890206] [client 119.154.81.234:64910] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxggHzbEu1Ap1Mwpo-wyAAAARw"]
[Sat Jul 18 23:28:32.424381 2026] [security2:error] [pid 890058:tid 890278] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/users.php"] [unique_id "alxggHzbEu1Ap1Mwpo-w1AAAAWQ"]
[Sat Jul 18 23:28:32.424457 2026] [security2:error] [pid 890058:tid 890278] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/users.php"] [unique_id "alxggHzbEu1Ap1Mwpo-w1AAAAWQ"]
[Sat Jul 18 23:28:32.802188 2026] [security2:error] [pid 890058:tid 890296] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/177.php"] [unique_id "alxggHzbEu1Ap1Mwpo-w6AAAAXY"]
[Sat Jul 18 23:28:32.802267 2026] [security2:error] [pid 890058:tid 890296] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/177.php"] [unique_id "alxggHzbEu1Ap1Mwpo-w6AAAAXY"]
[Sat Jul 18 23:28:32.948410 2026] [security2:error] [pid 890058:tid 890269] [client 163.61.1.17:50161] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxggHzbEu1Ap1Mwpo-w8AAAAVs"]
[Sat Jul 18 23:28:32.948562 2026] [security2:error] [pid 890058:tid 890269] [client 163.61.1.17:50161] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxggHzbEu1Ap1Mwpo-w8AAAAVs"]
[Sat Jul 18 23:28:33.159367 2026] [security2:error] [pid 881201:tid 881458] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/config.php"] [unique_id "alxggQWL-zKlchkVWS1zxwAAAH4"]
[Sat Jul 18 23:28:33.159455 2026] [security2:error] [pid 881201:tid 881458] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/config.php"] [unique_id "alxggQWL-zKlchkVWS1zxwAAAH4"]
[Sat Jul 18 23:28:33.228407 2026] [security2:error] [pid 881201:tid 881441] [client 106.222.249.209:15193] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxggQWL-zKlchkVWS1zyQAAAG0"]
[Sat Jul 18 23:28:33.228519 2026] [security2:error] [pid 881201:tid 881441] [client 106.222.249.209:15193] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxggQWL-zKlchkVWS1zyQAAAG0"]
[Sat Jul 18 23:28:33.558113 2026] [security2:error] [pid 890058:tid 890222] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/gettest.php"] [unique_id "alxggXzbEu1Ap1Mwpo-xCQAAASw"]
[Sat Jul 18 23:28:33.558215 2026] [security2:error] [pid 890058:tid 890222] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/gettest.php"] [unique_id "alxggXzbEu1Ap1Mwpo-xCQAAASw"]
[Sat Jul 18 23:28:33.851958 2026] [security2:error] [pid 890058:tid 890285] [client 43.135.211.148:41482] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "lifeisbetterlakeside.com"] [uri "/index.php"] [unique_id "alxggXzbEu1Ap1Mwpo-xDQAAAWs"]
[Sat Jul 18 23:28:33.854739 2026] [security2:error] [pid 890058:tid 890193] [client 4.194.24.143:28091] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/nine2code.php"] [unique_id "alxggXzbEu1Ap1Mwpo-xGAAAAQ8"]
[Sat Jul 18 23:28:33.939099 2026] [security2:error] [pid 890058:tid 890188] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/min.php"] [unique_id "alxggXzbEu1Ap1Mwpo-xHAAAAQo"]
[Sat Jul 18 23:28:33.939191 2026] [security2:error] [pid 890058:tid 890188] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/min.php"] [unique_id "alxggXzbEu1Ap1Mwpo-xHAAAAQo"]
[Sat Jul 18 23:28:34.222215 2026] [security2:error] [pid 881201:tid 881369] [client 190.245.146.99:51018] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgggWL-zKlchkVWS1z3gAAACU"]
[Sat Jul 18 23:28:34.228220 2026] [security2:error] [pid 881201:tid 881369] [client 190.245.146.99:51018] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgggWL-zKlchkVWS1z3gAAACU"]
[Sat Jul 18 23:28:34.316113 2026] [security2:error] [pid 890058:tid 890252] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/edorxrr.php"] [unique_id "alxggnzbEu1Ap1Mwpo-xLQAAAUo"]
[Sat Jul 18 23:28:34.316199 2026] [security2:error] [pid 890058:tid 890252] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/edorxrr.php"] [unique_id "alxggnzbEu1Ap1Mwpo-xLQAAAUo"]
[Sat Jul 18 23:28:34.410470 2026] [security2:error] [pid 890058:tid 890312] [client 4.194.24.143:17482] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/num.php"] [unique_id "alxggnzbEu1Ap1Mwpo-xNgAAAYY"]
[Sat Jul 18 23:28:34.683887 2026] [security2:error] [pid 890058:tid 890245] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/hur.php"] [unique_id "alxggnzbEu1Ap1Mwpo-xRAAAAUM"]
[Sat Jul 18 23:28:34.683973 2026] [security2:error] [pid 890058:tid 890245] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/hur.php"] [unique_id "alxggnzbEu1Ap1Mwpo-xRAAAAUM"]
[Sat Jul 18 23:28:34.780489 2026] [ssl:error] [pid 890058:tid 890250] [client 104.48.69.105:53020] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname www.icemarc.org provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:28:34.968196 2026] [security2:error] [pid 890058:tid 890277] [client 4.194.24.143:17452] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/odf7udtspqtpxzyxmw2rccdefault.php"] [unique_id "alxggnzbEu1Ap1Mwpo-xYgAAAWM"]
[Sat Jul 18 23:28:35.068872 2026] [security2:error] [pid 890058:tid 890308] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/zoro.php"] [unique_id "alxgg3zbEu1Ap1Mwpo-xaQAAAYI"]
[Sat Jul 18 23:28:35.068960 2026] [security2:error] [pid 890058:tid 890308] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/zoro.php"] [unique_id "alxgg3zbEu1Ap1Mwpo-xaQAAAYI"]
[Sat Jul 18 23:28:35.466447 2026] [security2:error] [pid 881201:tid 881401] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/coffexium.php"] [unique_id "alxggwWL-zKlchkVWS1z9gAAAEU"]
[Sat Jul 18 23:28:35.466551 2026] [security2:error] [pid 881201:tid 881401] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/coffexium.php"] [unique_id "alxggwWL-zKlchkVWS1z9gAAAEU"]
[Sat Jul 18 23:28:35.537614 2026] [security2:error] [pid 881201:tid 881403] [client 4.194.24.143:17868] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/option.php"] [unique_id "alxggwWL-zKlchkVWS1z-AAAAEc"]
[Sat Jul 18 23:28:36.088024 2026] [security2:error] [pid 881201:tid 881365] [client 4.194.24.143:17446] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/p.php"] [unique_id "alxghAWL-zKlchkVWS1z_gAAACE"]
[Sat Jul 18 23:28:36.289467 2026] [security2:error] [pid 890058:tid 890214] [client 27.34.68.67:31317] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxghHzbEu1Ap1Mwpo-xqAAAASQ"]
[Sat Jul 18 23:28:36.289571 2026] [security2:error] [pid 890058:tid 890214] [client 27.34.68.67:31317] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxghHzbEu1Ap1Mwpo-xqAAAASQ"]
[Sat Jul 18 23:28:36.377524 2026] [security2:error] [pid 890058:tid 890258] [client 66.249.74.43:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "liquidationteam.com"] [uri "/index.php"] [unique_id "alxgg3zbEu1Ap1Mwpo-xjwAAAVA"]
[Sat Jul 18 23:28:36.637982 2026] [security2:error] [pid 890058:tid 890201] [client 4.194.24.143:28035] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/past.php"] [unique_id "alxghHzbEu1Ap1Mwpo-xwAAAARc"]
[Sat Jul 18 23:28:36.666910 2026] [security2:error] [pid 890058:tid 890205] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/app.php"] [unique_id "alxghHzbEu1Ap1Mwpo-xwQAAARs"]
[Sat Jul 18 23:28:36.666994 2026] [security2:error] [pid 890058:tid 890205] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/app.php"] [unique_id "alxghHzbEu1Ap1Mwpo-xwQAAARs"]
[Sat Jul 18 23:28:36.867024 2026] [security2:error] [pid 890058:tid 890280] [client 223.228.182.224:60712] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxghHzbEu1Ap1Mwpo-xzgAAAWY"]
[Sat Jul 18 23:28:36.867117 2026] [security2:error] [pid 890058:tid 890280] [client 223.228.182.224:60712] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxghHzbEu1Ap1Mwpo-xzgAAAWY"]
[Sat Jul 18 23:28:37.058481 2026] [security2:error] [pid 890058:tid 890193] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/core.php"] [unique_id "alxghXzbEu1Ap1Mwpo-x0gAAAQ8"]
[Sat Jul 18 23:28:37.058559 2026] [security2:error] [pid 890058:tid 890193] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/core.php"] [unique_id "alxghXzbEu1Ap1Mwpo-x0gAAAQ8"]
[Sat Jul 18 23:28:37.136805 2026] [security2:error] [pid 890058:tid 890288] [client 138.252.89.100:52035] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxghXzbEu1Ap1Mwpo-x2AAAAW4"]
[Sat Jul 18 23:28:37.136911 2026] [security2:error] [pid 890058:tid 890288] [client 138.252.89.100:52035] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxghXzbEu1Ap1Mwpo-x2AAAAW4"]
[Sat Jul 18 23:28:37.196944 2026] [security2:error] [pid 890058:tid 890285] [client 4.194.24.143:17457] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/php.php"] [unique_id "alxghXzbEu1Ap1Mwpo-x4QAAAWs"]
[Sat Jul 18 23:28:37.406663 2026] [security2:error] [pid 890058:tid 890241] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/main.php"] [unique_id "alxghXzbEu1Ap1Mwpo-x6wAAAT8"]
[Sat Jul 18 23:28:37.406774 2026] [security2:error] [pid 890058:tid 890241] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/main.php"] [unique_id "alxghXzbEu1Ap1Mwpo-x6wAAAT8"]
[Sat Jul 18 23:28:37.667873 2026] [security2:error] [pid 890058:tid 890302] [client 223.185.61.63:26060] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxghXzbEu1Ap1Mwpo-x-gAAAXw"]
[Sat Jul 18 23:28:37.668030 2026] [security2:error] [pid 890058:tid 890302] [client 223.185.61.63:26060] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxghXzbEu1Ap1Mwpo-x-gAAAXw"]
[Sat Jul 18 23:28:37.739433 2026] [security2:error] [pid 890058:tid 890293] [client 4.194.24.143:17454] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/php8.php"] [unique_id "alxghXzbEu1Ap1Mwpo-x_QAAAXM"]
[Sat Jul 18 23:28:37.787249 2026] [security2:error] [pid 881201:tid 881425] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/init.php"] [unique_id "alxghQWL-zKlchkVWS10EwAAAF0"]
[Sat Jul 18 23:28:37.787360 2026] [security2:error] [pid 881201:tid 881425] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/init.php"] [unique_id "alxghQWL-zKlchkVWS10EwAAAF0"]
[Sat Jul 18 23:28:38.130877 2026] [security2:error] [pid 881201:tid 881369] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/prekel.php"] [unique_id "alxghgWL-zKlchkVWS10FgAAACU"]
[Sat Jul 18 23:28:38.130974 2026] [security2:error] [pid 881201:tid 881369] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/prekel.php"] [unique_id "alxghgWL-zKlchkVWS10FgAAACU"]
[Sat Jul 18 23:28:38.318162 2026] [security2:error] [pid 890058:tid 890267] [client 4.194.24.143:17416] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/phpinfo.php"] [unique_id "alxghnzbEu1Ap1Mwpo-yFQAAAVk"]
[Sat Jul 18 23:28:38.339131 2026] [security2:error] [pid 890058:tid 890082] [remote 154.61.75.100:46646] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxghnzbEu1Ap1Mwpo-yFgABHBc"]
[Sat Jul 18 23:28:38.474495 2026] [security2:error] [pid 890058:tid 890246] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/0.php"] [unique_id "alxghnzbEu1Ap1Mwpo-yIAAAAUQ"]
[Sat Jul 18 23:28:38.474587 2026] [security2:error] [pid 890058:tid 890246] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/0.php"] [unique_id "alxghnzbEu1Ap1Mwpo-yIAAAAUQ"]
[Sat Jul 18 23:28:38.822206 2026] [security2:error] [pid 890058:tid 890300] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/BDKR28.php"] [unique_id "alxghnzbEu1Ap1Mwpo-yMAAAAXo"]
[Sat Jul 18 23:28:38.822301 2026] [security2:error] [pid 890058:tid 890300] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/BDKR28.php"] [unique_id "alxghnzbEu1Ap1Mwpo-yMAAAAXo"]
[Sat Jul 18 23:28:38.878891 2026] [security2:error] [pid 890058:tid 890255] [client 104.207.60.52:45961] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.60.207.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxghnzbEu1Ap1Mwpo-yMQAAAU0"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:28:39.048023 2026] [security2:error] [pid 881201:tid 881338] [client 4.194.24.143:28063] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/post.php"] [unique_id "alxghwWL-zKlchkVWS10KwAAAAY"]
[Sat Jul 18 23:28:39.190585 2026] [security2:error] [pid 890058:tid 890210] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/f35.update.php"] [unique_id "alxgh3zbEu1Ap1Mwpo-yPwAAASA"]
[Sat Jul 18 23:28:39.190688 2026] [security2:error] [pid 890058:tid 890210] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/f35.update.php"] [unique_id "alxgh3zbEu1Ap1Mwpo-yPwAAASA"]
[Sat Jul 18 23:28:39.567429 2026] [security2:error] [pid 890058:tid 890246] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/f900.php"] [unique_id "alxgh3zbEu1Ap1Mwpo-yTwAAAUQ"]
[Sat Jul 18 23:28:39.567499 2026] [security2:error] [pid 890058:tid 890246] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/f900.php"] [unique_id "alxgh3zbEu1Ap1Mwpo-yTwAAAUQ"]
[Sat Jul 18 23:28:39.651587 2026] [security2:error] [pid 890058:tid 890277] [client 4.194.24.143:17436] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/public/assets/design_1/css/parts/course_cards/grid_card_1.min.php"] [unique_id "alxgh3zbEu1Ap1Mwpo-yVgAAAWM"]
[Sat Jul 18 23:28:39.945655 2026] [proxy:error] [pid 890058:tid 890238] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:39.945742 2026] [proxy_http:error] [pid 890058:tid 890238] [client 193.47.62.168:56902] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:39.946859 2026] [proxy:error] [pid 890058:tid 890238] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:39.946896 2026] [proxy_http:error] [pid 890058:tid 890238] [client 193.47.62.168:56902] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:39.969946 2026] [security2:error] [pid 890058:tid 890196] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/xmrl.php"] [unique_id "alxgh3zbEu1Ap1Mwpo-yaAAAARI"]
[Sat Jul 18 23:28:39.970039 2026] [security2:error] [pid 890058:tid 890196] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/xmrl.php"] [unique_id "alxgh3zbEu1Ap1Mwpo-yaAAAARI"]
[Sat Jul 18 23:28:40.198988 2026] [security2:error] [pid 890058:tid 890255] [client 4.194.24.143:18224] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/public/css.php"] [unique_id "alxgiHzbEu1Ap1Mwpo-yfgAAAU0"]
[Sat Jul 18 23:28:40.347141 2026] [security2:error] [pid 890058:tid 890308] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/memberfuns.php"] [unique_id "alxgiHzbEu1Ap1Mwpo-yggAAAYI"]
[Sat Jul 18 23:28:40.347248 2026] [security2:error] [pid 890058:tid 890308] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/memberfuns.php"] [unique_id "alxgiHzbEu1Ap1Mwpo-yggAAAYI"]
[Sat Jul 18 23:28:40.682470 2026] [security2:error] [pid 890058:tid 890225] [client 74.208.214.194:34528] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxgiHzbEu1Ap1Mwpo-ykgAAAS8"]
[Sat Jul 18 23:28:40.740825 2026] [security2:error] [pid 881201:tid 881333] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/ms.php"] [unique_id "alxgiAWL-zKlchkVWS10QgAAAAE"]
[Sat Jul 18 23:28:40.740933 2026] [security2:error] [pid 881201:tid 881333] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/ms.php"] [unique_id "alxgiAWL-zKlchkVWS10QgAAAAE"]
[Sat Jul 18 23:28:40.741428 2026] [security2:error] [pid 881201:tid 881389] [client 4.194.24.143:23109] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/r.php"] [unique_id "alxgiAWL-zKlchkVWS10QwAAADk"]
[Sat Jul 18 23:28:41.136673 2026] [security2:error] [pid 881201:tid 881367] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/zz.php"] [unique_id "alxgiQWL-zKlchkVWS10SwAAACM"]
[Sat Jul 18 23:28:41.136846 2026] [security2:error] [pid 881201:tid 881367] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/zz.php"] [unique_id "alxgiQWL-zKlchkVWS10SwAAACM"]
[Sat Jul 18 23:28:41.312556 2026] [security2:error] [pid 881201:tid 881409] [client 4.194.24.143:18225] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/radio.php"] [unique_id "alxgiQWL-zKlchkVWS10TwAAAE0"]
[Sat Jul 18 23:28:41.516517 2026] [security2:error] [pid 881201:tid 881423] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/for.php"] [unique_id "alxgiQWL-zKlchkVWS10VgAAAFs"]
[Sat Jul 18 23:28:41.516604 2026] [security2:error] [pid 881201:tid 881423] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/for.php"] [unique_id "alxgiQWL-zKlchkVWS10VgAAAFs"]
[Sat Jul 18 23:28:41.662439 2026] [security2:error] [pid 881201:tid 881412] [client 104.28.228.198:15353] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "nvkdigital.co.uk"] [uri "/cgi-sys/suspendedpage.cgi/wp-includes/wlwmanifest.xml"] [unique_id "alxgiQWL-zKlchkVWS10VwAAAFA"]
[Sat Jul 18 23:28:41.855570 2026] [security2:error] [pid 890058:tid 890256] [client 4.194.24.143:28070] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/randkeyword.php7"] [unique_id "alxgiXzbEu1Ap1Mwpo-yygAAAU4"]
[Sat Jul 18 23:28:41.865338 2026] [security2:error] [pid 890058:tid 890248] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/yup.php"] [unique_id "alxgiXzbEu1Ap1Mwpo-yywAAAUY"]
[Sat Jul 18 23:28:41.865417 2026] [security2:error] [pid 890058:tid 890248] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/yup.php"] [unique_id "alxgiXzbEu1Ap1Mwpo-yywAAAUY"]
[Sat Jul 18 23:28:42.244881 2026] [security2:error] [pid 890058:tid 890260] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wpxml.php"] [unique_id "alxginzbEu1Ap1Mwpo-y2AAAAVI"]
[Sat Jul 18 23:28:42.245022 2026] [security2:error] [pid 890058:tid 890260] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/wpxml.php"] [unique_id "alxginzbEu1Ap1Mwpo-y2AAAAVI"]
[Sat Jul 18 23:28:42.398879 2026] [security2:error] [pid 890058:tid 890295] [client 4.194.24.143:28037] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/readme.php"] [unique_id "alxginzbEu1Ap1Mwpo-y5gAAAXU"]
[Sat Jul 18 23:28:42.600256 2026] [security2:error] [pid 890058:tid 890269] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/fffm.php"] [unique_id "alxginzbEu1Ap1Mwpo-y7wAAAVs"]
[Sat Jul 18 23:28:42.600349 2026] [security2:error] [pid 890058:tid 890269] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/fffm.php"] [unique_id "alxginzbEu1Ap1Mwpo-y7wAAAVs"]
[Sat Jul 18 23:28:42.832141 2026] [core:error] [pid 890058:tid 890304] [client 157.52.92.20:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:28:42.832160 2026] [core:error] [pid 890058:tid 890304] [client 157.52.92.20:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:28:42.847404 2026] [core:error] [pid 890058:tid 890283] [client 157.52.92.20:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:28:42.847427 2026] [core:error] [pid 890058:tid 890283] [client 157.52.92.20:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:28:42.853529 2026] [security2:error] [pid 890058:tid 890284] [client 119.154.81.234:65365] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxginzbEu1Ap1Mwpo-y-gAAAWo"]
[Sat Jul 18 23:28:42.855375 2026] [security2:error] [pid 890058:tid 890284] [client 119.154.81.234:65365] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxginzbEu1Ap1Mwpo-y-gAAAWo"]
[Sat Jul 18 23:28:42.972080 2026] [security2:error] [pid 890058:tid 890215] [client 4.194.24.143:23124] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/reze.php"] [unique_id "alxginzbEu1Ap1Mwpo-y_wAAASU"]
[Sat Jul 18 23:28:43.004071 2026] [security2:error] [pid 890058:tid 890224] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/gecko.php"] [unique_id "alxgi3zbEu1Ap1Mwpo-zAwAAAS4"]
[Sat Jul 18 23:28:43.004151 2026] [security2:error] [pid 890058:tid 890224] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/gecko.php"] [unique_id "alxgi3zbEu1Ap1Mwpo-zAwAAAS4"]
[Sat Jul 18 23:28:43.286180 2026] [security2:error] [pid 890058:tid 890156] [remote 45.157.54.14:29062] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "website-389dbb4e.safe-systems.net"] [uri "/xmlrpc.php"] [unique_id "alxgi3zbEu1Ap1Mwpo-zFAABg2E"]
[Sat Jul 18 23:28:43.286333 2026] [security2:error] [pid 890058:tid 890309] [client 45.157.54.14:29062] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "website-389dbb4e.safe-systems.net"] [uri "/xmlrpc.php"] [unique_id "alxgi3zbEu1Ap1Mwpo-zFAABg2E"]
[Sat Jul 18 23:28:43.379960 2026] [security2:error] [pid 890058:tid 890295] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/a1.php"] [unique_id "alxgi3zbEu1Ap1Mwpo-zGQAAAXU"]
[Sat Jul 18 23:28:43.380073 2026] [security2:error] [pid 890058:tid 890295] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/a1.php"] [unique_id "alxgi3zbEu1Ap1Mwpo-zGQAAAXU"]
[Sat Jul 18 23:28:43.521678 2026] [security2:error] [pid 890058:tid 890228] [client 4.194.24.143:17528] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/rh.php"] [unique_id "alxgi3zbEu1Ap1Mwpo-zHQAAATI"]
[Sat Jul 18 23:28:43.541728 2026] [security2:error] [pid 881201:tid 881370] [client 163.61.1.17:50606] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgiwWL-zKlchkVWS10dwAAACY"]
[Sat Jul 18 23:28:43.543431 2026] [security2:error] [pid 881201:tid 881370] [client 163.61.1.17:50606] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgiwWL-zKlchkVWS10dwAAACY"]
[Sat Jul 18 23:28:44.057095 2026] [security2:error] [pid 881201:tid 881385] [client 106.222.249.209:13276] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgjAWL-zKlchkVWS10ggAAADU"]
[Sat Jul 18 23:28:44.057233 2026] [security2:error] [pid 881201:tid 881385] [client 106.222.249.209:13276] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgjAWL-zKlchkVWS10ggAAADU"]
[Sat Jul 18 23:28:44.144808 2026] [security2:error] [pid 890058:tid 890244] [client 4.194.24.143:17529] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/rip.php"] [unique_id "alxgjHzbEu1Ap1Mwpo-zOgAAAUI"]
[Sat Jul 18 23:28:44.202448 2026] [security2:error] [pid 890058:tid 890288] [client 57.141.18.106:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "falconarrowshop.com"] [uri "/index.php"] [unique_id "alxgi3zbEu1Ap1Mwpo-zNAAAAW4"]
[Sat Jul 18 23:28:44.693719 2026] [security2:error] [pid 890058:tid 890242] [client 4.194.24.143:17911] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/root.php"] [unique_id "alxgjHzbEu1Ap1Mwpo-zVAAAAUA"]
[Sat Jul 18 23:28:44.713575 2026] [security2:error] [pid 881201:tid 881380] [client 190.245.146.99:51543] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgjAWL-zKlchkVWS10iwAAADA"]
[Sat Jul 18 23:28:44.716651 2026] [security2:error] [pid 881201:tid 881380] [client 190.245.146.99:51543] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgjAWL-zKlchkVWS10iwAAADA"]
[Sat Jul 18 23:28:44.928842 2026] [security2:error] [pid 890058:tid 890272] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/k2.php"] [unique_id "alxgjHzbEu1Ap1Mwpo-zYgAAAV4"]
[Sat Jul 18 23:28:44.928939 2026] [security2:error] [pid 890058:tid 890272] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/k2.php"] [unique_id "alxgjHzbEu1Ap1Mwpo-zYgAAAV4"]
[Sat Jul 18 23:28:45.323596 2026] [security2:error] [pid 890058:tid 890284] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/82.php"] [unique_id "alxgjXzbEu1Ap1Mwpo-zdAAAAWo"]
[Sat Jul 18 23:28:45.323664 2026] [security2:error] [pid 890058:tid 890284] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/82.php"] [unique_id "alxgjXzbEu1Ap1Mwpo-zdAAAAWo"]
[Sat Jul 18 23:28:45.372369 2026] [security2:error] [pid 890058:tid 890263] [client 4.194.24.143:17445] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/s.php"] [unique_id "alxgjXzbEu1Ap1Mwpo-zeAAAAVU"]
[Sat Jul 18 23:28:45.694477 2026] [security2:error] [pid 890058:tid 890278] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/config.json.php"] [unique_id "alxgjXzbEu1Ap1Mwpo-ziAAAAWQ"]
[Sat Jul 18 23:28:45.694562 2026] [security2:error] [pid 890058:tid 890278] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/config.json.php"] [unique_id "alxgjXzbEu1Ap1Mwpo-ziAAAAWQ"]
[Sat Jul 18 23:28:45.914370 2026] [security2:error] [pid 881201:tid 881407] [client 4.194.24.143:17896] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/sang.php"] [unique_id "alxgjQWL-zKlchkVWS10ogAAAEs"]
[Sat Jul 18 23:28:46.063283 2026] [security2:error] [pid 881201:tid 881336] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/fpwch.php"] [unique_id "alxgjgWL-zKlchkVWS10pgAAAAQ"]
[Sat Jul 18 23:28:46.063375 2026] [security2:error] [pid 881201:tid 881336] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpcalendars.luxuriaproperties.com"] [uri "/fpwch.php"] [unique_id "alxgjgWL-zKlchkVWS10pgAAAAQ"]
[Sat Jul 18 23:28:46.564357 2026] [security2:error] [pid 890058:tid 890244] [client 4.194.24.143:17893] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/scxy.php"] [unique_id "alxgjnzbEu1Ap1Mwpo-zrgAAAUI"]
[Sat Jul 18 23:28:46.860228 2026] [security2:error] [pid 890058:tid 890282] [client 27.34.68.67:27546] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgjnzbEu1Ap1Mwpo-zwAAAAWg"]
[Sat Jul 18 23:28:46.860349 2026] [security2:error] [pid 890058:tid 890282] [client 27.34.68.67:27546] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgjnzbEu1Ap1Mwpo-zwAAAAWg"]
[Sat Jul 18 23:28:47.116650 2026] [security2:error] [pid 881201:tid 881392] [client 4.194.24.143:17892] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/sd.php"] [unique_id "alxgjwWL-zKlchkVWS10vAAAADw"]
[Sat Jul 18 23:28:47.596232 2026] [security2:error] [pid 881201:tid 881313] [remote 97.74.93.24:42152] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tee.qtw.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxgjwWL-zKlchkVWS10wAAAd24"]
[Sat Jul 18 23:28:47.669945 2026] [security2:error] [pid 890058:tid 890260] [client 4.194.24.143:17498] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/sf.php"] [unique_id "alxgj3zbEu1Ap1Mwpo-z5wAAAVI"]
[Sat Jul 18 23:28:47.781066 2026] [security2:error] [pid 890058:tid 890300] [client 45.41.145.157:13120] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.sesamegreenbeans.com"] [uri "/index.php"] [unique_id "alxgj3zbEu1Ap1Mwpo-z3AABeks"]
[Sat Jul 18 23:28:47.781983 2026] [security2:error] [pid 890058:tid 890205] [client 74.7.228.52:57964] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "404"] [hostname "www.website-1f5ca1d0.zyi.feb.mybluehost.me"] [uri "/robots.txt"] [unique_id "alxgj3zbEu1Ap1Mwpo-z9AABG2A"]
[Sat Jul 18 23:28:47.984405 2026] [security2:error] [pid 881201:tid 881252] [remote 97.74.93.24:42152] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tee.qtw.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxgjwWL-zKlchkVWS10wwAANTE"], referer: https://tee.qtw.mybluehost.me/wp-login.php
[Sat Jul 18 23:28:48.207213 2026] [security2:error] [pid 890058:tid 890284] [client 223.185.61.63:20891] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxgkHzbEu1Ap1Mwpo-0BgAAAWo"]
[Sat Jul 18 23:28:48.207341 2026] [security2:error] [pid 890058:tid 890284] [client 223.185.61.63:20891] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxgkHzbEu1Ap1Mwpo-0BgAAAWo"]
[Sat Jul 18 23:28:48.221418 2026] [security2:error] [pid 890058:tid 890255] [client 189.85.97.35:64745] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.adambergeron.com"] [uri "/index.php"] [unique_id "alxgjnzbEu1Ap1Mwpo-zuQABTUI"]
[Sat Jul 18 23:28:48.229949 2026] [security2:error] [pid 881201:tid 881389] [client 4.194.24.143:24892] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/shell.php"] [unique_id "alxgkAWL-zKlchkVWS10yQAAADk"]
[Sat Jul 18 23:28:48.322043 2026] [security2:error] [pid 890058:tid 890202] [client 50.116.65.227:21454] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxgkHzbEu1Ap1Mwpo-0DAAAARg"]
[Sat Jul 18 23:28:48.337930 2026] [security2:error] [pid 890058:tid 890238] [client 50.116.65.227:10994] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxgkHzbEu1Ap1Mwpo-0DgAAATw"]
[Sat Jul 18 23:28:48.696654 2026] [security2:error] [pid 881201:tid 881280] [remote 188.138.102.156:34896] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxgkAWL-zKlchkVWS100wAAFE0"]
[Sat Jul 18 23:28:48.807254 2026] [security2:error] [pid 890058:tid 890291] [client 138.252.89.100:52478] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxgkHzbEu1Ap1Mwpo-0IAAAAXE"]
[Sat Jul 18 23:28:48.807331 2026] [security2:error] [pid 890058:tid 890291] [client 138.252.89.100:52478] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxgkHzbEu1Ap1Mwpo-0IAAAAXE"]
[Sat Jul 18 23:28:48.979007 2026] [security2:error] [pid 890058:tid 890307] [client 4.194.24.143:24856] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/sid3.php"] [unique_id "alxgkHzbEu1Ap1Mwpo-0KAAAAYE"]
[Sat Jul 18 23:28:49.172056 2026] [security2:error] [pid 881201:tid 881232] [remote 188.138.102.156:34896] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxgkQWL-zKlchkVWS103gAAGR0"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:28:49.563933 2026] [security2:error] [pid 890058:tid 890199] [client 4.194.24.143:17866] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/simple.php"] [unique_id "alxgkXzbEu1Ap1Mwpo-0QQAAARU"]
[Sat Jul 18 23:28:49.570963 2026] [security2:error] [pid 890058:tid 890156] [remote 31.42.184.154:48504] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "walkingandtalking.net"] [uri "/wp-login.php"] [unique_id "alxgkXzbEu1Ap1Mwpo-0QgABd2E"]
[Sat Jul 18 23:28:49.812348 2026] [security2:error] [pid 890058:tid 890061] [remote 31.42.184.154:48504] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "walkingandtalking.net"] [uri "/wp-login.php"] [unique_id "alxgkXzbEu1Ap1Mwpo-0TgABRwI"], referer: https://walkingandtalking.net/wp-login.php
[Sat Jul 18 23:28:50.140770 2026] [security2:error] [pid 881201:tid 881406] [client 4.194.24.143:23149] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/sitemap.php"] [unique_id "alxgkgWL-zKlchkVWS109gAAAEo"]
[Sat Jul 18 23:28:50.587101 2026] [security2:error] [pid 890058:tid 890290] [client 17.246.23.11:56846] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.guidehunting.com"] [uri "/index.php"] [unique_id "alxgkHzbEu1Ap1Mwpo-z-AABcFU"]
[Sat Jul 18 23:28:50.708179 2026] [security2:error] [pid 890058:tid 890248] [client 4.194.24.143:17898] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/size.php"] [unique_id "alxgknzbEu1Ap1Mwpo-0dQAAAUY"]
[Sat Jul 18 23:28:51.218429 2026] [security2:error] [pid 881201:tid 881372] [client 171.79.60.106:60444] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "adambergeron.com"] [uri "/index.php"] [unique_id "alxgkgWL-zKlchkVWS10_gAAKBw"]
[Sat Jul 18 23:28:51.260250 2026] [security2:error] [pid 890058:tid 890311] [client 4.194.24.143:24868] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/sm.php"] [unique_id "alxgk3zbEu1Ap1Mwpo-0kgAAAYU"]
[Sat Jul 18 23:28:51.621328 2026] [security2:error] [pid 881201:tid 881254] [remote 209.42.18.223:36452] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.18.42.209.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxgkwWL-zKlchkVWS11CwAAQDM"]
[Sat Jul 18 23:28:51.633996 2026] [security2:error] [pid 890058:tid 890082] [remote 49.13.1.223:53536] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.1.13.49.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sarahsnyder.net"] [uri "/wp-login.php"] [unique_id "alxgk3zbEu1Ap1Mwpo-0mAABfRc"]
[Sat Jul 18 23:28:51.789399 2026] [security2:error] [pid 881201:tid 881214] [remote 209.42.18.223:36452] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.18.42.209.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxgkwWL-zKlchkVWS11DwAATQs"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:28:51.808447 2026] [security2:error] [pid 890058:tid 890243] [client 4.194.24.143:17504] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/sql.php"] [unique_id "alxgk3zbEu1Ap1Mwpo-0nwAAAUE"]
[Sat Jul 18 23:28:51.827067 2026] [security2:error] [pid 890058:tid 890089] [remote 49.13.1.223:53536] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.1.13.49.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sarahsnyder.net"] [uri "/wp-login.php"] [unique_id "alxgk3zbEu1Ap1Mwpo-0pAABPB4"], referer: https://sarahsnyder.net/wp-login.php
[Sat Jul 18 23:28:52.059260 2026] [security2:error] [pid 890058:tid 890088] [remote 57.141.18.125:52762] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 125.18.141.57.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/product/5584465"] [unique_id "alxglHzbEu1Ap1Mwpo-0uwABhR0"]
[Sat Jul 18 23:28:52.372651 2026] [security2:error] [pid 890058:tid 890240] [client 4.194.24.143:24877] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/ss.php"] [unique_id "alxglHzbEu1Ap1Mwpo-0xwAAAT4"]
[Sat Jul 18 23:28:52.964921 2026] [security2:error] [pid 890058:tid 890297] [client 4.194.24.143:24875] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/stats.php"] [unique_id "alxglHzbEu1Ap1Mwpo-05wAAAXc"]
[Sat Jul 18 23:28:53.436105 2026] [security2:error] [pid 890058:tid 890195] [client 119.154.81.234:49442] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxglXzbEu1Ap1Mwpo-0-AAAARE"]
[Sat Jul 18 23:28:53.436187 2026] [security2:error] [pid 890058:tid 890195] [client 119.154.81.234:49442] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxglXzbEu1Ap1Mwpo-0-AAAARE"]
[Sat Jul 18 23:28:53.454165 2026] [security2:error] [pid 890058:tid 890105] [remote 91.142.222.105:60120] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxglXzbEu1Ap1Mwpo-0-QABaS4"]
[Sat Jul 18 23:28:53.514199 2026] [security2:error] [pid 890058:tid 890305] [client 4.194.24.143:43556] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/sump1.php"] [unique_id "alxglXzbEu1Ap1Mwpo-1AQAAAX8"]
[Sat Jul 18 23:28:53.828119 2026] [security2:error] [pid 890058:tid 890134] [remote 91.142.222.105:60120] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxglXzbEu1Ap1Mwpo-1EQABhEs"], referer: https://sesamegreenbeans.com/wp-login.php
[Sat Jul 18 23:28:54.064060 2026] [security2:error] [pid 881201:tid 881346] [client 4.194.24.143:17502] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/system.php"] [unique_id "alxglgWL-zKlchkVWS11KgAAAA4"]
[Sat Jul 18 23:28:54.065784 2026] [security2:error] [pid 881201:tid 881395] [client 163.61.1.17:51056] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxglgWL-zKlchkVWS11KwAAAD8"]
[Sat Jul 18 23:28:54.067484 2026] [security2:error] [pid 881201:tid 881395] [client 163.61.1.17:51056] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxglgWL-zKlchkVWS11KwAAAD8"]
[Sat Jul 18 23:28:54.649431 2026] [security2:error] [pid 890058:tid 890222] [client 4.194.24.143:43551] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/system/03n1hob7p03r2npdefault.php"] [unique_id "alxglnzbEu1Ap1Mwpo-1LAAAASw"]
[Sat Jul 18 23:28:54.669911 2026] [security2:error] [pid 890058:tid 890294] [client 106.222.249.209:28519] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxglnzbEu1Ap1Mwpo-1LQAAAXQ"]
[Sat Jul 18 23:28:54.670003 2026] [security2:error] [pid 890058:tid 890294] [client 106.222.249.209:28519] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxglnzbEu1Ap1Mwpo-1LQAAAXQ"]
[Sat Jul 18 23:28:54.682772 2026] [ssl:error] [pid 890058:tid 890199] [client 13.219.121.241:24407] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname cpcontacts.mdn.sxj.mybluehost.me provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:28:55.217478 2026] [security2:error] [pid 890058:tid 890191] [client 190.245.146.99:52053] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgl3zbEu1Ap1Mwpo-1RwAAAQ0"]
[Sat Jul 18 23:28:55.223254 2026] [security2:error] [pid 890058:tid 890191] [client 190.245.146.99:52053] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgl3zbEu1Ap1Mwpo-1RwAAAQ0"]
[Sat Jul 18 23:28:55.241004 2026] [security2:error] [pid 890058:tid 890265] [client 4.194.24.143:24858] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/system/cj5ha2rah8lyiqqdefault.php"] [unique_id "alxgl3zbEu1Ap1Mwpo-1SwAAAVc"]
[Sat Jul 18 23:28:55.489190 2026] [security2:error] [pid 890058:tid 890267] [client 18.195.15.81:16190] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 81.15.195.18.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxgl3zbEu1Ap1Mwpo-1VAAAAVk"]
[Sat Jul 18 23:28:55.489306 2026] [security2:error] [pid 890058:tid 890267] [client 18.195.15.81:16190] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxgl3zbEu1Ap1Mwpo-1VAAAAVk"]
[Sat Jul 18 23:28:55.612666 2026] [proxy:error] [pid 890058:tid 890195] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:55.612721 2026] [proxy_http:error] [pid 890058:tid 890195] [client 193.47.62.168:55338] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:55.613166 2026] [proxy:error] [pid 890058:tid 890195] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:55.613192 2026] [proxy_http:error] [pid 890058:tid 890195] [client 193.47.62.168:55338] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:55.805019 2026] [security2:error] [pid 890058:tid 890228] [client 4.194.24.143:23163] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/system_log.php"] [unique_id "alxgl3zbEu1Ap1Mwpo-1YAAAATI"]
[Sat Jul 18 23:28:56.354133 2026] [proxy:error] [pid 890058:tid 890200] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:56.354204 2026] [proxy_http:error] [pid 890058:tid 890200] [client 193.47.62.168:46464] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:56.354742 2026] [proxy:error] [pid 890058:tid 890200] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:28:56.354774 2026] [proxy_http:error] [pid 890058:tid 890200] [client 193.47.62.168:46464] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:28:56.415047 2026] [security2:error] [pid 890058:tid 890201] [client 4.194.24.143:24891] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/t.php"] [unique_id "alxgmHzbEu1Ap1Mwpo-1fgAAARc"]
[Sat Jul 18 23:28:56.760994 2026] [security2:error] [pid 890058:tid 890072] [remote 98.156.100.191:49206] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 191.100.156.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxgmHzbEu1Ap1Mwpo-1lQABNQ0"]
[Sat Jul 18 23:28:56.913410 2026] [security2:error] [pid 881201:tid 881332] [client 57.141.18.80:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxgmAWL-zKlchkVWS11QgAAAAA"]
[Sat Jul 18 23:28:56.967069 2026] [security2:error] [pid 881201:tid 881456] [client 4.194.24.143:43582] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/term.php"] [unique_id "alxgmAWL-zKlchkVWS11SAAAAHw"]
[Sat Jul 18 23:28:57.449259 2026] [security2:error] [pid 890058:tid 890255] [client 27.34.68.67:46063] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgmXzbEu1Ap1Mwpo-1sQAAAU0"]
[Sat Jul 18 23:28:57.449425 2026] [security2:error] [pid 890058:tid 890255] [client 27.34.68.67:46063] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgmXzbEu1Ap1Mwpo-1sQAAAU0"]
[Sat Jul 18 23:28:57.562716 2026] [security2:error] [pid 890058:tid 890288] [client 4.194.24.143:17865] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/test.php"] [unique_id "alxgmXzbEu1Ap1Mwpo-1ugAAAW4"]
[Sat Jul 18 23:28:57.726845 2026] [security2:error] [pid 890058:tid 890272] [client 45.3.44.54:31235] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.44.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxgmXzbEu1Ap1Mwpo-1vgAAAV4"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:28:57.850202 2026] [security2:error] [pid 890058:tid 890063] [remote 154.61.75.100:40800] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgmXzbEu1Ap1Mwpo-1xAABdAQ"]
[Sat Jul 18 23:28:57.850336 2026] [security2:error] [pid 890058:tid 890294] [client 154.61.75.100:40800] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgmXzbEu1Ap1Mwpo-1xAABdAQ"]
[Sat Jul 18 23:28:58.085677 2026] [security2:error] [pid 881201:tid 881290] [remote 102.134.101.35:59838] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 35.101.134.102.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxgmgWL-zKlchkVWS11YAAAFFc"]
[Sat Jul 18 23:28:58.184109 2026] [security2:error] [pid 890058:tid 890302] [client 4.194.24.143:21286] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/test1.php"] [unique_id "alxgmnzbEu1Ap1Mwpo-12gAAAXw"]
[Sat Jul 18 23:28:58.321013 2026] [security2:error] [pid 890058:tid 890246] [client 223.228.182.224:52539] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxgmnzbEu1Ap1Mwpo-14AAAAUQ"]
[Sat Jul 18 23:28:58.325836 2026] [security2:error] [pid 890058:tid 890246] [client 223.228.182.224:52539] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxgmnzbEu1Ap1Mwpo-14AAAAUQ"]
[Sat Jul 18 23:28:58.439675 2026] [security2:error] [pid 890058:tid 890250] [client 40.77.167.57:1035] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.guidehunting.com"] [uri "/index.php"] [unique_id "alxgmnzbEu1Ap1Mwpo-12AABSA8"]
[Sat Jul 18 23:28:58.512881 2026] [core:error] [pid 890058:tid 890265] [client 157.52.92.37:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:28:58.512932 2026] [core:error] [pid 890058:tid 890265] [client 157.52.92.37:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:28:58.530938 2026] [core:error] [pid 890058:tid 890244] [client 157.52.92.37:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:28:58.530957 2026] [core:error] [pid 890058:tid 890244] [client 157.52.92.37:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:28:58.553696 2026] [security2:error] [pid 881201:tid 881326] [remote 102.134.101.35:59838] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 35.101.134.102.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxgmgWL-zKlchkVWS11aAAAZ3s"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:28:58.758327 2026] [security2:error] [pid 881201:tid 881344] [client 4.194.24.143:23112] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/tfm.php"] [unique_id "alxgmgWL-zKlchkVWS11bQAAAAw"]
[Sat Jul 18 23:28:58.808132 2026] [security2:error] [pid 890058:tid 890221] [client 223.185.61.63:10121] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxgmnzbEu1Ap1Mwpo-1-QAAASs"]
[Sat Jul 18 23:28:58.808290 2026] [security2:error] [pid 890058:tid 890221] [client 223.185.61.63:10121] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxgmnzbEu1Ap1Mwpo-1-QAAASs"]
[Sat Jul 18 23:28:59.056438 2026] [security2:error] [pid 890058:tid 890195] [client 66.249.73.9:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "weifangsmefarm.com"] [uri "/index.php"] [unique_id "alxgmnzbEu1Ap1Mwpo-1_wAAARE"]
[Sat Jul 18 23:28:59.303729 2026] [security2:error] [pid 890058:tid 890298] [client 4.194.24.143:44638] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/thebe.php"] [unique_id "alxgm3zbEu1Ap1Mwpo-2GQAAAXg"]
[Sat Jul 18 23:28:59.373878 2026] [security2:error] [pid 890058:tid 890204] [client 66.249.73.69:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "mezzacraft.com"] [uri "/index.php"] [unique_id "alxgm3zbEu1Ap1Mwpo-2DgAAARo"]
[Sat Jul 18 23:28:59.845682 2026] [security2:error] [pid 890058:tid 890305] [client 4.194.24.143:23104] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/themes.php"] [unique_id "alxgm3zbEu1Ap1Mwpo-2NQAAAX8"]
[Sat Jul 18 23:29:00.458093 2026] [security2:error] [pid 890058:tid 890283] [client 4.194.24.143:21271] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/tiny.php"] [unique_id "alxgnHzbEu1Ap1Mwpo-2WAAAAWk"]
[Sat Jul 18 23:29:00.538133 2026] [security2:error] [pid 890058:tid 890277] [client 138.252.89.100:52942] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxgnHzbEu1Ap1Mwpo-2WwAAAWM"]
[Sat Jul 18 23:29:00.538217 2026] [security2:error] [pid 890058:tid 890277] [client 138.252.89.100:52942] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxgnHzbEu1Ap1Mwpo-2WwAAAWM"]
[Sat Jul 18 23:29:01.000950 2026] [security2:error] [pid 890058:tid 890291] [client 4.194.24.143:21292] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "charisandchesed.com"] [uri "/tmp/byp.php"] [unique_id "alxgnXzbEu1Ap1Mwpo-2eQAAAXE"]
[Sat Jul 18 23:29:01.561304 2026] [security2:error] [pid 881201:tid 881298] [remote 128.199.203.39:42580] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 39.203.199.128.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxgnQWL-zKlchkVWS11kAAAbF8"]
[Sat Jul 18 23:29:01.943594 2026] [security2:error] [pid 881201:tid 881224] [remote 128.199.203.39:42580] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 39.203.199.128.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxgnQWL-zKlchkVWS11mwAAUxU"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:29:02.131418 2026] [security2:error] [pid 890058:tid 890240] [client 5.193.175.36:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "maxcom.net"] [uri "/index.php"] [unique_id "alxgnHzbEu1Ap1Mwpo-2bgAAAT4"]
[Sat Jul 18 23:29:02.583276 2026] [security2:error] [pid 881201:tid 881206] [remote 91.142.222.105:35806] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "omegacompass.com"] [uri "/wp-login.php"] [unique_id "alxgngWL-zKlchkVWS11qAAAJQM"]
[Sat Jul 18 23:29:03.075232 2026] [security2:error] [pid 890058:tid 890212] [client 63.179.105.113:15410] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.105.179.63.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxgn3zbEu1Ap1Mwpo-20QAAASI"]
[Sat Jul 18 23:29:03.618151 2026] [security2:error] [pid 890058:tid 890194] [client 63.179.105.113:15416] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.105.179.63.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxgn3zbEu1Ap1Mwpo-27QAAARA"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:29:03.987580 2026] [security2:error] [pid 890058:tid 890314] [client 119.154.81.234:49919] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgn3zbEu1Ap1Mwpo-2-QAAAYg"]
[Sat Jul 18 23:29:03.987672 2026] [security2:error] [pid 890058:tid 890314] [client 119.154.81.234:49919] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgn3zbEu1Ap1Mwpo-2-QAAAYg"]
[Sat Jul 18 23:29:04.095495 2026] [security2:error] [pid 881201:tid 881280] [remote 91.142.222.105:35806] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "omegacompass.com"] [uri "/wp-login.php"] [unique_id "alxgoAWL-zKlchkVWS11vgAAUk0"], referer: https://omegacompass.com/wp-login.php
[Sat Jul 18 23:29:04.444043 2026] [security2:error] [pid 890058:tid 890077] [remote 182.77.62.24:49490] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.62.77.182.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "zoa.jji.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgoHzbEu1Ap1Mwpo-3DgABhhI"]
[Sat Jul 18 23:29:04.444251 2026] [security2:error] [pid 890058:tid 890312] [client 182.77.62.24:49490] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "zoa.jji.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgoHzbEu1Ap1Mwpo-3DgABhhI"]
[Sat Jul 18 23:29:04.539456 2026] [security2:error] [pid 890058:tid 890083] [remote 154.61.75.100:40812] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxgoHzbEu1Ap1Mwpo-3EgABFBg"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:29:04.622811 2026] [security2:error] [pid 881201:tid 881399] [client 163.61.1.17:51505] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgoAWL-zKlchkVWS11zgAAAEM"]
[Sat Jul 18 23:29:04.622962 2026] [security2:error] [pid 881201:tid 881399] [client 163.61.1.17:51505] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgoAWL-zKlchkVWS11zgAAAEM"]
[Sat Jul 18 23:29:04.953336 2026] [security2:error] [pid 881201:tid 881339] [client 74.7.227.179:55736] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxgoAWL-zKlchkVWS111AAABw4"], referer: https://tejasenvironmental.com/p=9474
[Sat Jul 18 23:29:05.054500 2026] [security2:error] [pid 890058:tid 890277] [client 14.251.3.155:54760] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxgoXzbEu1Ap1Mwpo-3KQAAAWM"]
[Sat Jul 18 23:29:05.332852 2026] [security2:error] [pid 881201:tid 881453] [client 106.222.249.209:8520] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgoQWL-zKlchkVWS114AAAAHk"]
[Sat Jul 18 23:29:05.333025 2026] [security2:error] [pid 881201:tid 881453] [client 106.222.249.209:8520] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgoQWL-zKlchkVWS114AAAAHk"]
[Sat Jul 18 23:29:05.650182 2026] [security2:error] [pid 881201:tid 881450] [client 190.245.146.99:52566] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgoQWL-zKlchkVWS115wAAAHY"]
[Sat Jul 18 23:29:05.650269 2026] [security2:error] [pid 881201:tid 881450] [client 190.245.146.99:52566] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgoQWL-zKlchkVWS115wAAAHY"]
[Sat Jul 18 23:29:05.650675 2026] [proxy:error] [pid 890058:tid 890233] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:29:05.650764 2026] [proxy_http:error] [pid 890058:tid 890233] [client 193.47.62.168:53072] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:29:05.651492 2026] [proxy:error] [pid 890058:tid 890233] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:29:05.651536 2026] [proxy_http:error] [pid 890058:tid 890233] [client 193.47.62.168:53072] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:29:06.611705 2026] [security2:error] [pid 890058:tid 890199] [client 216.73.216.68:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "mail.robiem.com"] [uri "/index.php"] [unique_id "alxgoHzbEu1Ap1Mwpo-3GgAAARU"]
[Sat Jul 18 23:29:07.382186 2026] [security2:error] [pid 881201:tid 881381] [client 104.207.56.198:46233] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 198.56.207.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxgowWL-zKlchkVWS119QAAADE"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:29:08.129543 2026] [security2:error] [pid 890058:tid 890229] [client 27.34.68.67:38232] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgpHzbEu1Ap1Mwpo-3ugAAATM"]
[Sat Jul 18 23:29:08.129701 2026] [security2:error] [pid 890058:tid 890229] [client 27.34.68.67:38232] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgpHzbEu1Ap1Mwpo-3ugAAATM"]
[Sat Jul 18 23:29:08.610325 2026] [security2:error] [pid 890058:tid 890310] [client 52.167.144.184:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxgpHzbEu1Ap1Mwpo-3xQABhFk"]
[Sat Jul 18 23:29:09.299864 2026] [security2:error] [pid 890058:tid 890199] [client 34.171.169.105:46290] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "ambienthost.com"] [uri "/wp-json/batch/v1"] [unique_id "alxgpXzbEu1Ap1Mwpo-37wAAARU"]
[Sat Jul 18 23:29:09.367237 2026] [security2:error] [pid 890058:tid 890202] [client 34.171.169.105:46290] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "ambienthost.com"] [uri "/"] [unique_id "alxgpXzbEu1Ap1Mwpo-39QAAARg"]
[Sat Jul 18 23:29:09.469475 2026] [security2:error] [pid 890058:tid 890278] [client 223.185.61.63:8364] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.61.185.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxgpXzbEu1Ap1Mwpo-3-QAAAWQ"]
[Sat Jul 18 23:29:09.469567 2026] [security2:error] [pid 890058:tid 890278] [client 223.185.61.63:8364] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lizrichter.com.au"] [uri "/xmlrpc.php"] [unique_id "alxgpXzbEu1Ap1Mwpo-3-QAAAWQ"]
[Sat Jul 18 23:29:09.478416 2026] [security2:error] [pid 890058:tid 890184] [remote 102.134.101.35:44932] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 35.101.134.102.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "rtkenergypartners.com"] [uri "/wp-login.php"] [unique_id "alxgpXzbEu1Ap1Mwpo-3_AABF30"]
[Sat Jul 18 23:29:09.570455 2026] [security2:error] [pid 890058:tid 890253] [client 31.171.130.11:57991] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/ms-themes.php"] [unique_id "alxgpXzbEu1Ap1Mwpo-4AAAAAUs"]
[Sat Jul 18 23:29:09.573807 2026] [security2:error] [pid 881201:tid 881377] [client 31.171.130.23:27035] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/ms-themes.php"] [unique_id "alxgpQWL-zKlchkVWS12DwAAAC0"]
[Sat Jul 18 23:29:09.597114 2026] [security2:error] [pid 890058:tid 890247] [client 31.171.130.5:31287] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/ms-themes.php"] [unique_id "alxgpXzbEu1Ap1Mwpo-4AgAAAUU"]
[Sat Jul 18 23:29:09.961275 2026] [security2:error] [pid 890058:tid 890170] [remote 102.134.101.35:44932] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 35.101.134.102.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "rtkenergypartners.com"] [uri "/wp-login.php"] [unique_id "alxgpXzbEu1Ap1Mwpo-4DQABUm8"], referer: https://rtkenergypartners.com/wp-login.php
[Sat Jul 18 23:29:10.058303 2026] [security2:error] [pid 890058:tid 890226] [client 31.171.130.16:55131] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/chosen.php"] [unique_id "alxgpnzbEu1Ap1Mwpo-4FQAAATA"]
[Sat Jul 18 23:29:10.058677 2026] [security2:error] [pid 890058:tid 890198] [client 31.171.130.39:42871] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/chosen.php"] [unique_id "alxgpnzbEu1Ap1Mwpo-4FgAAARQ"]
[Sat Jul 18 23:29:10.138517 2026] [security2:error] [pid 890058:tid 890303] [client 31.171.130.27:25795] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/chosen.php"] [unique_id "alxgpnzbEu1Ap1Mwpo-4HwAAAX0"]
[Sat Jul 18 23:29:10.693990 2026] [security2:error] [pid 881201:tid 881397] [client 31.171.130.11:61705] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/file.php"] [unique_id "alxgpgWL-zKlchkVWS12JQAAAEE"]
[Sat Jul 18 23:29:10.701465 2026] [security2:error] [pid 890058:tid 890216] [client 31.171.130.25:22385] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/file.php"] [unique_id "alxgpnzbEu1Ap1Mwpo-4OQAAASY"]
[Sat Jul 18 23:29:10.753419 2026] [security2:error] [pid 890058:tid 890221] [client 31.171.130.39:41615] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/file.php"] [unique_id "alxgpnzbEu1Ap1Mwpo-4PAAAASs"]
[Sat Jul 18 23:29:11.014010 2026] [security2:error] [pid 890058:tid 890286] [client 65.55.210.245:60423] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "vfcthomasville.org"] [uri "/index.php"] [unique_id "alxgpnzbEu1Ap1Mwpo-4QwABbGo"]
[Sat Jul 18 23:29:11.270031 2026] [security2:error] [pid 881201:tid 881350] [client 31.171.130.24:37835] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/flower.php"] [unique_id "alxgpwWL-zKlchkVWS12MQAAABI"]
[Sat Jul 18 23:29:11.270574 2026] [security2:error] [pid 890058:tid 890238] [client 31.171.130.6:59629] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/flower.php"] [unique_id "alxgp3zbEu1Ap1Mwpo-4UAAAATw"]
[Sat Jul 18 23:29:11.283471 2026] [security2:error] [pid 881201:tid 881369] [client 31.171.130.22:21045] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/flower.php"] [unique_id "alxgpwWL-zKlchkVWS12MwAAACU"]
[Sat Jul 18 23:29:11.768643 2026] [security2:error] [pid 890058:tid 890284] [client 31.171.130.36:30957] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/gifclass.php"] [unique_id "alxgp3zbEu1Ap1Mwpo-4bAAAAWo"]
[Sat Jul 18 23:29:11.768672 2026] [security2:error] [pid 890058:tid 890223] [client 31.171.130.24:38153] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/gifclass.php"] [unique_id "alxgp3zbEu1Ap1Mwpo-4bQAAAS0"]
[Sat Jul 18 23:29:11.778728 2026] [security2:error] [pid 890058:tid 890249] [client 31.171.130.16:21623] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/gifclass.php"] [unique_id "alxgp3zbEu1Ap1Mwpo-4bwAAAUc"]
[Sat Jul 18 23:29:11.978866 2026] [security2:error] [pid 890058:tid 890245] [client 138.252.89.100:53402] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxgp3zbEu1Ap1Mwpo-4cwAAAUM"]
[Sat Jul 18 23:29:11.978962 2026] [security2:error] [pid 890058:tid 890245] [client 138.252.89.100:53402] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxgp3zbEu1Ap1Mwpo-4cwAAAUM"]
[Sat Jul 18 23:29:12.279800 2026] [security2:error] [pid 890058:tid 890232] [client 31.171.130.33:20155] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/bless.php"] [unique_id "alxgqHzbEu1Ap1Mwpo-4fwAAATY"]
[Sat Jul 18 23:29:12.279996 2026] [security2:error] [pid 890058:tid 890237] [client 31.171.130.11:45765] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/bless.php"] [unique_id "alxgqHzbEu1Ap1Mwpo-4gAAAATs"]
[Sat Jul 18 23:29:12.280028 2026] [security2:error] [pid 890058:tid 890238] [client 31.171.130.50:26159] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/bless.php"] [unique_id "alxgqHzbEu1Ap1Mwpo-4gQAAATw"]
[Sat Jul 18 23:29:12.759472 2026] [security2:error] [pid 890058:tid 890265] [client 31.171.130.30:57257] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/class-t.api.php"] [unique_id "alxgqHzbEu1Ap1Mwpo-4kQAAAVc"]
[Sat Jul 18 23:29:12.760432 2026] [security2:error] [pid 890058:tid 890210] [client 31.171.130.25:27157] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/class-t.api.php"] [unique_id "alxgqHzbEu1Ap1Mwpo-4kgAAASA"]
[Sat Jul 18 23:29:12.760597 2026] [security2:error] [pid 890058:tid 890297] [client 31.171.130.45:47711] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/class-t.api.php"] [unique_id "alxgqHzbEu1Ap1Mwpo-4kwAAAXc"]
[Sat Jul 18 23:29:13.244974 2026] [security2:error] [pid 890058:tid 890255] [client 223.228.182.224:51361] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxgqXzbEu1Ap1Mwpo-4owAAAU0"]
[Sat Jul 18 23:29:13.245081 2026] [security2:error] [pid 890058:tid 890255] [client 223.228.182.224:51361] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxgqXzbEu1Ap1Mwpo-4owAAAU0"]
[Sat Jul 18 23:29:13.316201 2026] [security2:error] [pid 890058:tid 890301] [client 31.171.130.12:64059] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/blurbs.php"] [unique_id "alxgqXzbEu1Ap1Mwpo-4qQAAAXs"]
[Sat Jul 18 23:29:13.316379 2026] [security2:error] [pid 890058:tid 890193] [client 31.171.130.25:64785] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/blurbs.php"] [unique_id "alxgqXzbEu1Ap1Mwpo-4qgAAAQ8"]
[Sat Jul 18 23:29:13.317292 2026] [security2:error] [pid 890058:tid 890206] [client 31.171.130.17:58001] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/blurbs.php"] [unique_id "alxgqXzbEu1Ap1Mwpo-4qwAAARw"]
[Sat Jul 18 23:29:13.533590 2026] [security2:error] [pid 890058:tid 890300] [client 50.116.65.227:57926] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxgqXzbEu1Ap1Mwpo-4vQAAAXo"]
[Sat Jul 18 23:29:13.548622 2026] [security2:error] [pid 890058:tid 890203] [client 50.116.65.227:60384] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxgqXzbEu1Ap1Mwpo-4vgAAARk"]
[Sat Jul 18 23:29:13.844091 2026] [security2:error] [pid 890058:tid 890275] [client 31.171.130.4:30411] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/akcc.php"] [unique_id "alxgqXzbEu1Ap1Mwpo-4zgAAAWE"]
[Sat Jul 18 23:29:13.850519 2026] [security2:error] [pid 890058:tid 890290] [client 31.171.130.8:60577] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/akcc.php"] [unique_id "alxgqXzbEu1Ap1Mwpo-40AAAAXA"]
[Sat Jul 18 23:29:13.861348 2026] [security2:error] [pid 890058:tid 890282] [client 31.171.130.15:45271] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/akcc.php"] [unique_id "alxgqXzbEu1Ap1Mwpo-40QAAAWg"]
[Sat Jul 18 23:29:14.223497 2026] [security2:error] [pid 881201:tid 881408] [client 152.58.31.118:54831] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.guidehunting.com"] [uri "/index.php"] [unique_id "alxgqQWL-zKlchkVWS12YgAAAEw"]
[Sat Jul 18 23:29:14.317488 2026] [security2:error] [pid 890058:tid 890300] [client 31.171.130.13:34741] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/abcd.php"] [unique_id "alxgqnzbEu1Ap1Mwpo-45AAAAXo"]
[Sat Jul 18 23:29:14.324309 2026] [security2:error] [pid 890058:tid 890202] [client 31.171.130.35:64855] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/abcd.php"] [unique_id "alxgqnzbEu1Ap1Mwpo-45QAAARg"]
[Sat Jul 18 23:29:14.338661 2026] [security2:error] [pid 890058:tid 890210] [client 31.171.130.42:24531] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/abcd.php"] [unique_id "alxgqnzbEu1Ap1Mwpo-45gAAASA"]
[Sat Jul 18 23:29:14.603955 2026] [security2:error] [pid 881201:tid 881419] [client 119.154.81.234:50638] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgqgWL-zKlchkVWS12awAAAFc"]
[Sat Jul 18 23:29:14.604204 2026] [security2:error] [pid 881201:tid 881419] [client 119.154.81.234:50638] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgqgWL-zKlchkVWS12awAAAFc"]
[Sat Jul 18 23:29:14.851051 2026] [security2:error] [pid 881201:tid 881362] [client 31.171.130.44:41467] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/shelp.php"] [unique_id "alxgqgWL-zKlchkVWS12cQAAAB4"]
[Sat Jul 18 23:29:14.860814 2026] [security2:error] [pid 890058:tid 890189] [client 31.171.130.4:59053] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/shelp.php"] [unique_id "alxgqnzbEu1Ap1Mwpo-5AAAAAQs"]
[Sat Jul 18 23:29:14.862825 2026] [security2:error] [pid 890058:tid 890199] [client 31.171.130.15:59795] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/shelp.php"] [unique_id "alxgqnzbEu1Ap1Mwpo-5AQAAARU"]
[Sat Jul 18 23:29:15.074338 2026] [security2:error] [pid 890058:tid 890209] [client 34.171.169.105:54936] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "ambienthost.com"] [uri "/"] [unique_id "alxgq3zbEu1Ap1Mwpo-5CwAAAR8"]
[Sat Jul 18 23:29:15.097281 2026] [security2:error] [pid 890058:tid 890276] [client 163.61.1.17:51957] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgq3zbEu1Ap1Mwpo-5DAAAAWI"]
[Sat Jul 18 23:29:15.097381 2026] [security2:error] [pid 890058:tid 890276] [client 163.61.1.17:51957] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgq3zbEu1Ap1Mwpo-5DAAAAWI"]
[Sat Jul 18 23:29:15.138057 2026] [security2:error] [pid 890058:tid 890246] [client 124.29.207.185:54526] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxgq3zbEu1Ap1Mwpo-5DgAAAUQ"]
[Sat Jul 18 23:29:15.138187 2026] [security2:error] [pid 890058:tid 890246] [client 124.29.207.185:54526] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxgq3zbEu1Ap1Mwpo-5DgAAAUQ"]
[Sat Jul 18 23:29:15.173968 2026] [security2:error] [pid 890058:tid 890142] [remote 57.141.18.120:57442] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 120.18.141.57.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/product/3379371"] [unique_id "alxgq3zbEu1Ap1Mwpo-5DwABiFM"]
[Sat Jul 18 23:29:15.354494 2026] [security2:error] [pid 881201:tid 881452] [client 31.171.130.16:40675] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/cord.php"] [unique_id "alxgqwWL-zKlchkVWS12eAAAAHg"]
[Sat Jul 18 23:29:15.358055 2026] [security2:error] [pid 881201:tid 881411] [client 31.171.130.50:39917] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/cord.php"] [unique_id "alxgqwWL-zKlchkVWS12eQAAAE8"]
[Sat Jul 18 23:29:15.369183 2026] [security2:error] [pid 890058:tid 890243] [client 31.171.130.30:36713] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/cord.php"] [unique_id "alxgq3zbEu1Ap1Mwpo-5GAAAAUE"]
[Sat Jul 18 23:29:15.831939 2026] [security2:error] [pid 881201:tid 881384] [client 152.58.31.118:54831] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.guidehunting.com"] [uri "/index.php"] [unique_id "alxgqwWL-zKlchkVWS12gQAAADQ"]
[Sat Jul 18 23:29:15.833162 2026] [security2:error] [pid 890058:tid 890292] [client 31.171.130.45:20159] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/dex.php"] [unique_id "alxgq3zbEu1Ap1Mwpo-5KQAAAXI"]
[Sat Jul 18 23:29:15.840407 2026] [security2:error] [pid 890058:tid 890198] [client 31.171.130.7:47823] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/dex.php"] [unique_id "alxgq3zbEu1Ap1Mwpo-5KwAAARQ"]
[Sat Jul 18 23:29:15.874859 2026] [security2:error] [pid 890058:tid 890249] [client 31.171.130.35:61881] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/dex.php"] [unique_id "alxgq3zbEu1Ap1Mwpo-5MAAAAUc"]
[Sat Jul 18 23:29:15.977500 2026] [security2:error] [pid 890058:tid 890259] [client 106.222.249.209:16918] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgq3zbEu1Ap1Mwpo-5OQAAAVE"]
[Sat Jul 18 23:29:15.977609 2026] [security2:error] [pid 890058:tid 890259] [client 106.222.249.209:16918] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgq3zbEu1Ap1Mwpo-5OQAAAVE"]
[Sat Jul 18 23:29:16.150728 2026] [security2:error] [pid 890058:tid 890279] [client 190.245.146.99:53082] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgrHzbEu1Ap1Mwpo-5RAAAAWU"]
[Sat Jul 18 23:29:16.150848 2026] [security2:error] [pid 890058:tid 890279] [client 190.245.146.99:53082] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgrHzbEu1Ap1Mwpo-5RAAAAWU"]
[Sat Jul 18 23:29:16.233498 2026] [security2:error] [pid 890058:tid 890234] [client 114.119.159.101:21009] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "thelastgamestandingexp.com"] [uri "/project-horned-owl-review"] [unique_id "alxgrHzbEu1Ap1Mwpo-5SAAAATg"], referer: https://thelastgamestandingexp.com/project-horned-owl-review/
[Sat Jul 18 23:29:16.352617 2026] [security2:error] [pid 890058:tid 890272] [client 31.171.130.21:56873] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxgrHzbEu1Ap1Mwpo-5TwAAAV4"]
[Sat Jul 18 23:29:16.367876 2026] [security2:error] [pid 890058:tid 890307] [client 31.171.130.3:49611] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxgrHzbEu1Ap1Mwpo-5UAAAAYE"]
[Sat Jul 18 23:29:16.370233 2026] [security2:error] [pid 890058:tid 890196] [client 31.171.130.43:34975] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxgrHzbEu1Ap1Mwpo-5UQAAARI"]
[Sat Jul 18 23:29:16.666082 2026] [security2:error] [pid 881201:tid 881401] [client 152.58.31.118:54831] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.guidehunting.com"] [uri "/index.php"] [unique_id "alxgrAWL-zKlchkVWS12lQAAAEU"]
[Sat Jul 18 23:29:16.823869 2026] [security2:error] [pid 890058:tid 890262] [client 31.171.130.14:51867] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/zwso.php"] [unique_id "alxgrHzbEu1Ap1Mwpo-5aAAAAVQ"]
[Sat Jul 18 23:29:16.850425 2026] [security2:error] [pid 890058:tid 890305] [client 31.171.130.36:51413] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/zwso.php"] [unique_id "alxgrHzbEu1Ap1Mwpo-5awAAAX8"]
[Sat Jul 18 23:29:16.860370 2026] [security2:error] [pid 890058:tid 890228] [client 31.171.130.2:35663] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/zwso.php"] [unique_id "alxgrHzbEu1Ap1Mwpo-5bQAAATI"]
[Sat Jul 18 23:29:16.981327 2026] [security2:error] [pid 890058:tid 890255] [client 74.208.214.194:50138] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxgrHzbEu1Ap1Mwpo-5ewAAAU0"]
[Sat Jul 18 23:29:17.015931 2026] [security2:error] [pid 890058:tid 890273] [client 104.207.56.198:41285] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 198.56.207.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxgrXzbEu1Ap1Mwpo-5fQAAAV8"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:29:17.222578 2026] [security2:error] [pid 890058:tid 890196] [client 54.149.239.117:31724] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.239.149.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxgrXzbEu1Ap1Mwpo-5gwAAARI"]
[Sat Jul 18 23:29:17.296707 2026] [security2:error] [pid 881201:tid 881388] [client 31.171.130.21:20215] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxgrQWL-zKlchkVWS12pwAAADg"]
[Sat Jul 18 23:29:17.365012 2026] [security2:error] [pid 881201:tid 881438] [client 31.171.130.25:45379] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxgrQWL-zKlchkVWS12qQAAAGo"]
[Sat Jul 18 23:29:17.376637 2026] [security2:error] [pid 881201:tid 881339] [client 31.171.130.40:22453] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxgrQWL-zKlchkVWS12qgAAAAc"]
[Sat Jul 18 23:29:17.469255 2026] [security2:error] [pid 881201:tid 881385] [client 152.58.31.118:54831] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.guidehunting.com"] [uri "/index.php"] [unique_id "alxgrQWL-zKlchkVWS12pgAAADU"]
[Sat Jul 18 23:29:17.773291 2026] [security2:error] [pid 890058:tid 890305] [client 31.171.130.40:48675] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/bolt.php"] [unique_id "alxgrXzbEu1Ap1Mwpo-5mQAAAX8"]
[Sat Jul 18 23:29:17.836874 2026] [security2:error] [pid 890058:tid 890314] [client 31.171.130.1:52757] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/bolt.php"] [unique_id "alxgrXzbEu1Ap1Mwpo-5ngAAAYg"]
[Sat Jul 18 23:29:17.857336 2026] [security2:error] [pid 881201:tid 881357] [client 31.171.130.1:36709] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/bolt.php"] [unique_id "alxgrQWL-zKlchkVWS12vQAAABk"]
[Sat Jul 18 23:29:18.254788 2026] [security2:error] [pid 890058:tid 890250] [client 31.171.130.25:40279] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/cjfuns.php"] [unique_id "alxgrnzbEu1Ap1Mwpo-5tgAAAUg"]
[Sat Jul 18 23:29:18.287053 2026] [security2:error] [pid 881201:tid 881335] [client 152.58.31.118:54831] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.guidehunting.com"] [uri "/index.php"] [unique_id "alxgrgWL-zKlchkVWS12vwAAAAM"]
[Sat Jul 18 23:29:18.313956 2026] [security2:error] [pid 890058:tid 890209] [client 31.171.130.3:24065] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/cjfuns.php"] [unique_id "alxgrnzbEu1Ap1Mwpo-5twAAAR8"]
[Sat Jul 18 23:29:18.374218 2026] [security2:error] [pid 890058:tid 890195] [client 31.171.130.37:38587] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/cjfuns.php"] [unique_id "alxgrnzbEu1Ap1Mwpo-5ugAAARE"]
[Sat Jul 18 23:29:18.655160 2026] [security2:error] [pid 890058:tid 890263] [client 27.34.68.67:10589] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgrnzbEu1Ap1Mwpo-5xwAAAVU"]
[Sat Jul 18 23:29:18.655271 2026] [security2:error] [pid 890058:tid 890263] [client 27.34.68.67:10589] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgrnzbEu1Ap1Mwpo-5xwAAAVU"]
[Sat Jul 18 23:29:18.782694 2026] [security2:error] [pid 890058:tid 890305] [client 31.171.130.45:38939] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxgrnzbEu1Ap1Mwpo-50gAAAX8"]
[Sat Jul 18 23:29:18.801766 2026] [security2:error] [pid 890058:tid 890229] [client 31.171.130.23:51597] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxgrnzbEu1Ap1Mwpo-51AAAATM"]
[Sat Jul 18 23:29:18.904726 2026] [security2:error] [pid 890058:tid 890247] [client 31.171.130.14:46709] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxgrnzbEu1Ap1Mwpo-52AAAAUU"]
[Sat Jul 18 23:29:19.088418 2026] [security2:error] [pid 881201:tid 881384] [client 152.58.31.118:54831] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.guidehunting.com"] [uri "/index.php"] [unique_id "alxgrgWL-zKlchkVWS122wAAADQ"]
[Sat Jul 18 23:29:19.323972 2026] [security2:error] [pid 890058:tid 890224] [client 31.171.130.33:27427] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxgr3zbEu1Ap1Mwpo-57wAAAS4"]
[Sat Jul 18 23:29:19.332175 2026] [security2:error] [pid 890058:tid 890202] [client 31.171.130.28:58563] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxgr3zbEu1Ap1Mwpo-58AAAARg"]
[Sat Jul 18 23:29:19.388861 2026] [security2:error] [pid 890058:tid 890227] [client 31.171.130.4:28463] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxgr3zbEu1Ap1Mwpo-59AAAATE"]
[Sat Jul 18 23:29:19.706264 2026] [security2:error] [pid 890058:tid 890188] [client 41.33.104.114:36485] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "skiboutiques.com"] [uri "/wp-comments-post.php"] [unique_id "alxgr3zbEu1Ap1Mwpo-5-gAAAQo"]
[Sat Jul 18 23:29:19.855179 2026] [security2:error] [pid 890058:tid 890188] [client 41.33.104.114:36485] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "403"] [hostname "skiboutiques.com"] [uri "/wp-comments-post.php"] [unique_id "alxgr3zbEu1Ap1Mwpo-5-gAAAQo"]
[Sat Jul 18 23:29:19.885573 2026] [security2:error] [pid 890058:tid 890271] [client 31.171.130.50:43087] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/wp-content/index.php"] [unique_id "alxgr3zbEu1Ap1Mwpo-6CQAAAV0"]
[Sat Jul 18 23:29:19.893362 2026] [security2:error] [pid 890058:tid 890206] [client 31.171.130.47:31125] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/wp-content/index.php"] [unique_id "alxgr3zbEu1Ap1Mwpo-6CwAAARw"]
[Sat Jul 18 23:29:19.899403 2026] [security2:error] [pid 881201:tid 881337] [client 152.58.31.118:54831] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.guidehunting.com"] [uri "/index.php"] [unique_id "alxgrwWL-zKlchkVWS127wAAAAU"]
[Sat Jul 18 23:29:19.982024 2026] [security2:error] [pid 890058:tid 890234] [client 31.171.130.3:58725] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/wp-content/index.php"] [unique_id "alxgr3zbEu1Ap1Mwpo-6DQAAATg"]
[Sat Jul 18 23:29:20.362103 2026] [security2:error] [pid 890058:tid 890227] [client 31.171.130.28:45667] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/ioxi-o.php"] [unique_id "alxgsHzbEu1Ap1Mwpo-6JAAAATE"]
[Sat Jul 18 23:29:20.372327 2026] [security2:error] [pid 881201:tid 881339] [client 31.171.130.31:63829] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/ioxi-o.php"] [unique_id "alxgsAWL-zKlchkVWS12_gAAAAc"]
[Sat Jul 18 23:29:20.493560 2026] [security2:error] [pid 890058:tid 890191] [client 185.213.229.201:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "worbals.com"] [uri "/index.php"] [unique_id "alxgrnzbEu1Ap1Mwpo-5rwAAAQ0"]
[Sat Jul 18 23:29:20.495010 2026] [security2:error] [pid 881201:tid 881425] [client 31.171.130.11:28189] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/ioxi-o.php"] [unique_id "alxgsAWL-zKlchkVWS13AQAAAF0"]
[Sat Jul 18 23:29:20.924497 2026] [security2:error] [pid 890058:tid 890308] [client 31.171.130.48:30889] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/insc.php"] [unique_id "alxgsHzbEu1Ap1Mwpo-6PQAAAYI"]
[Sat Jul 18 23:29:20.973521 2026] [security2:error] [pid 881201:tid 881439] [client 31.171.130.36:22847] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/insc.php"] [unique_id "alxgsAWL-zKlchkVWS13EgAAAGs"]
[Sat Jul 18 23:29:21.091628 2026] [security2:error] [pid 881201:tid 881395] [client 31.171.130.12:61835] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/insc.php"] [unique_id "alxgsQWL-zKlchkVWS13GAAAAD8"]
[Sat Jul 18 23:29:21.432662 2026] [security2:error] [pid 881201:tid 881366] [client 31.171.130.6:38753] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/classwithtostring.php"] [unique_id "alxgsQWL-zKlchkVWS13IQAAACI"]
[Sat Jul 18 23:29:21.469709 2026] [security2:error] [pid 890058:tid 890222] [client 31.171.130.30:65347] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/classwithtostring.php"] [unique_id "alxgsXzbEu1Ap1Mwpo-6UwAAASw"]
[Sat Jul 18 23:29:21.526932 2026] [security2:error] [pid 890058:tid 890260] [client 51.195.248.115:28040] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "autodiscover.nub.jdq.mybluehost.me"] [uri "/.env"] [unique_id "alxgsXzbEu1Ap1Mwpo-6VQAAAVI"]
[Sat Jul 18 23:29:21.570046 2026] [proxy:error] [pid 890058:tid 890227] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:29:21.570121 2026] [proxy_http:error] [pid 890058:tid 890227] [client 193.47.62.168:44380] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:29:21.570627 2026] [proxy:error] [pid 890058:tid 890227] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:29:21.570652 2026] [proxy_http:error] [pid 890058:tid 890227] [client 193.47.62.168:44380] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:29:21.605837 2026] [security2:error] [pid 890058:tid 890254] [client 31.171.130.1:48043] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/classwithtostring.php"] [unique_id "alxgsXzbEu1Ap1Mwpo-6WgAAAUw"]
[Sat Jul 18 23:29:21.712673 2026] [security2:error] [pid 890058:tid 890209] [client 107.189.14.87:55873] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 87.14.189.107.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "jndsupport.com"] [uri "/wp-login.php"] [unique_id "alxgsXzbEu1Ap1Mwpo-6XQAAAR8"]
[Sat Jul 18 23:29:21.921594 2026] [security2:error] [pid 890058:tid 890076] [remote 31.42.184.154:39126] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nextlevelpressurewashing.com"] [uri "/wp-login.php"] [unique_id "alxgsXzbEu1Ap1Mwpo-6bAABaxE"]
[Sat Jul 18 23:29:21.931896 2026] [security2:error] [pid 890058:tid 890286] [client 31.171.130.19:56233] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/txets.php"] [unique_id "alxgsXzbEu1Ap1Mwpo-6bQAAAWw"]
[Sat Jul 18 23:29:21.949941 2026] [security2:error] [pid 890058:tid 890270] [client 31.171.130.52:55801] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/txets.php"] [unique_id "alxgsXzbEu1Ap1Mwpo-6bgAAAVw"]
[Sat Jul 18 23:29:22.146678 2026] [security2:error] [pid 890058:tid 890247] [client 31.171.130.51:43091] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/txets.php"] [unique_id "alxgsnzbEu1Ap1Mwpo-6ewAAAUU"]
[Sat Jul 18 23:29:22.156320 2026] [security2:error] [pid 890058:tid 890124] [remote 31.42.184.154:39126] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nextlevelpressurewashing.com"] [uri "/wp-login.php"] [unique_id "alxgsnzbEu1Ap1Mwpo-6fQABNEE"], referer: https://nextlevelpressurewashing.com/wp-login.php
[Sat Jul 18 23:29:22.430394 2026] [security2:error] [pid 890058:tid 890195] [client 31.171.130.11:56545] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxgsnzbEu1Ap1Mwpo-6iAAAARE"]
[Sat Jul 18 23:29:22.459117 2026] [security2:error] [pid 890058:tid 890276] [client 31.171.130.19:52875] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxgsnzbEu1Ap1Mwpo-6igAAAWI"]
[Sat Jul 18 23:29:22.632810 2026] [security2:error] [pid 890058:tid 890284] [client 31.171.130.52:64945] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxgsnzbEu1Ap1Mwpo-6kAAAAWo"]
[Sat Jul 18 23:29:22.951971 2026] [security2:error] [pid 890058:tid 890204] [client 31.171.130.32:32097] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/wp-admin/txets.php"] [unique_id "alxgsnzbEu1Ap1Mwpo-6oQAAARo"]
[Sat Jul 18 23:29:22.966288 2026] [security2:error] [pid 881201:tid 881450] [client 31.171.130.35:52691] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/wp-admin/txets.php"] [unique_id "alxgsgWL-zKlchkVWS13TgAAAHY"]
[Sat Jul 18 23:29:23.133160 2026] [security2:error] [pid 890058:tid 890234] [client 31.171.130.23:38223] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/wp-admin/txets.php"] [unique_id "alxgs3zbEu1Ap1Mwpo-6qgAAATg"]
[Sat Jul 18 23:29:23.444142 2026] [security2:error] [pid 890058:tid 890277] [client 31.171.130.24:53991] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/wp-includes/txets.php"] [unique_id "alxgs3zbEu1Ap1Mwpo-6uAAAAWM"]
[Sat Jul 18 23:29:23.450058 2026] [security2:error] [pid 890058:tid 890261] [client 31.171.130.31:26319] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/wp-includes/txets.php"] [unique_id "alxgs3zbEu1Ap1Mwpo-6uQAAAVM"]
[Sat Jul 18 23:29:23.571107 2026] [security2:error] [pid 890058:tid 890228] [client 138.252.89.100:53870] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxgs3zbEu1Ap1Mwpo-6vQAAATI"]
[Sat Jul 18 23:29:23.571205 2026] [security2:error] [pid 890058:tid 890228] [client 138.252.89.100:53870] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxgs3zbEu1Ap1Mwpo-6vQAAATI"]
[Sat Jul 18 23:29:23.654537 2026] [security2:error] [pid 890058:tid 890252] [client 31.171.130.26:37515] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/wp-includes/txets.php"] [unique_id "alxgs3zbEu1Ap1Mwpo-6xwAAAUo"]
[Sat Jul 18 23:29:23.976919 2026] [security2:error] [pid 890058:tid 890242] [client 31.171.130.47:38883] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/goods.php"] [unique_id "alxgs3zbEu1Ap1Mwpo-65QAAAUA"]
[Sat Jul 18 23:29:24.250400 2026] [security2:error] [pid 881201:tid 881354] [client 31.171.130.11:44653] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/goods.php"] [unique_id "alxgtAWL-zKlchkVWS13ZAAAABY"]
[Sat Jul 18 23:29:24.515512 2026] [security2:error] [pid 890058:tid 890279] [client 31.171.130.41:28465] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/wp-editor.php"] [unique_id "alxgtHzbEu1Ap1Mwpo-6_QAAAWU"]
[Sat Jul 18 23:29:24.732558 2026] [security2:error] [pid 890058:tid 890270] [client 31.171.130.7:55847] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/wp-editor.php"] [unique_id "alxgtHzbEu1Ap1Mwpo-7DAAAAVw"]
[Sat Jul 18 23:29:24.986309 2026] [security2:error] [pid 890058:tid 890197] [client 31.171.130.24:54363] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/goods.php"] [unique_id "alxgtHzbEu1Ap1Mwpo-7HAAAARM"]
[Sat Jul 18 23:29:25.044459 2026] [security2:error] [pid 890058:tid 890252] [client 31.171.130.3:64901] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/lufix.php"] [unique_id "alxgtXzbEu1Ap1Mwpo-7IAAAAUo"]
[Sat Jul 18 23:29:25.051327 2026] [security2:error] [pid 890058:tid 890278] [client 57.141.18.34:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxgtHzbEu1Ap1Mwpo-7FAAAAWQ"]
[Sat Jul 18 23:29:25.219369 2026] [security2:error] [pid 881201:tid 881365] [client 119.154.81.234:51267] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgtQWL-zKlchkVWS13eAAAACE"]
[Sat Jul 18 23:29:25.219520 2026] [security2:error] [pid 881201:tid 881365] [client 119.154.81.234:51267] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgtQWL-zKlchkVWS13eAAAACE"]
[Sat Jul 18 23:29:25.223943 2026] [security2:error] [pid 881201:tid 881339] [client 31.171.130.4:44035] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/lufix.php"] [unique_id "alxgtQWL-zKlchkVWS13eQAAAAc"]
[Sat Jul 18 23:29:25.461084 2026] [security2:error] [pid 890058:tid 890286] [client 31.171.130.28:41229] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/wp-editor.php"] [unique_id "alxgtXzbEu1Ap1Mwpo-7NQAAAWw"]
[Sat Jul 18 23:29:25.500888 2026] [security2:error] [pid 881201:tid 881426] [client 181.124.6.131:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "webgardensbypaula.com"] [uri "/index.php"] [unique_id "alxgrgWL-zKlchkVWS12xwAAAF4"]
[Sat Jul 18 23:29:25.602203 2026] [security2:error] [pid 890058:tid 890261] [client 163.61.1.17:52407] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgtXzbEu1Ap1Mwpo-7OwAAAVM"]
[Sat Jul 18 23:29:25.602354 2026] [security2:error] [pid 890058:tid 890261] [client 163.61.1.17:52407] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgtXzbEu1Ap1Mwpo-7OwAAAVM"]
[Sat Jul 18 23:29:25.664016 2026] [security2:error] [pid 890058:tid 890301] [client 146.190.153.30:51382] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "50.116.65.227"] [uri "/robots.txt"] [unique_id "alxgtXzbEu1Ap1Mwpo-7PwAAAXs"]
[Sat Jul 18 23:29:25.701793 2026] [core:error] [pid 890058:tid 890305] [client 157.52.92.90:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:29:25.701818 2026] [core:error] [pid 890058:tid 890305] [client 157.52.92.90:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:29:25.704054 2026] [security2:error] [pid 881201:tid 881369] [client 31.171.130.11:49247] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.jmfinnfilms.com"] [uri "/style.php"] [unique_id "alxgtQWL-zKlchkVWS13hgAAACU"]
[Sat Jul 18 23:29:25.729740 2026] [core:error] [pid 890058:tid 890224] [client 157.52.92.90:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:29:25.729767 2026] [core:error] [pid 890058:tid 890224] [client 157.52.92.90:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:29:25.753815 2026] [security2:error] [pid 881201:tid 881284] [remote 47.128.116.13:10912] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "mobilesurvsolutions.com"] [uri "/"] [unique_id "alxgtQWL-zKlchkVWS13hwAAOlE"]
[Sat Jul 18 23:29:25.949335 2026] [security2:error] [pid 890058:tid 890199] [client 31.171.130.27:54609] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/lufix.php"] [unique_id "alxgtXzbEu1Ap1Mwpo-7VAAAARU"]
[Sat Jul 18 23:29:25.975628 2026] [security2:error] [pid 890058:tid 890212] [client 146.190.153.30:51386] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "50.116.65.227"] [uri "/index.cgi"] [unique_id "alxgtXzbEu1Ap1Mwpo-7VQAAASI"]
[Sat Jul 18 23:29:26.284951 2026] [security2:error] [pid 890058:tid 890234] [client 146.190.153.30:51390] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "404"] [hostname "50.116.65.227"] [uri "/cgi-sys/404.html"] [unique_id "alxgtnzbEu1Ap1Mwpo-7ZgAAATg"]
[Sat Jul 18 23:29:26.429244 2026] [security2:error] [pid 890058:tid 890296] [client 31.171.130.30:30003] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.jmfinnfilms.com"] [uri "/style.php"] [unique_id "alxgtnzbEu1Ap1Mwpo-7cAAAAXY"]
[Sat Jul 18 23:29:26.537697 2026] [security2:error] [pid 890058:tid 890240] [client 14.162.47.39:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "worbals.com"] [uri "/index.php"] [unique_id "alxgtnzbEu1Ap1Mwpo-7aAAAAT4"]
[Sat Jul 18 23:29:26.548706 2026] [security2:error] [pid 881201:tid 881443] [client 31.171.130.5:36743] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.jmfinnfilms.com"] [uri "/style.php"] [unique_id "alxgtgWL-zKlchkVWS13nAAAAG8"]
[Sat Jul 18 23:29:26.642362 2026] [security2:error] [pid 890058:tid 890303] [client 190.245.146.99:53593] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgtnzbEu1Ap1Mwpo-7dwAAAX0"]
[Sat Jul 18 23:29:26.648567 2026] [security2:error] [pid 890058:tid 890303] [client 190.245.146.99:53593] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgtnzbEu1Ap1Mwpo-7dwAAAX0"]
[Sat Jul 18 23:29:26.741620 2026] [security2:error] [pid 890058:tid 890191] [client 106.222.249.209:17606] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgtnzbEu1Ap1Mwpo-7fgAAAQ0"]
[Sat Jul 18 23:29:26.741894 2026] [security2:error] [pid 890058:tid 890191] [client 106.222.249.209:17606] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgtnzbEu1Ap1Mwpo-7fgAAAQ0"]
[Sat Jul 18 23:29:27.130192 2026] [security2:error] [pid 890058:tid 890309] [client 37.139.53.80:51908] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "royalart-lb.com"] [uri "/index.php"] [unique_id "alxgtXzbEu1Ap1Mwpo-7HgAAARY"], referer: http://royalart-lb.com/ar/Glass-Decoration-lebanon/default.asp
[Sat Jul 18 23:29:27.814606 2026] [security2:error] [pid 890058:tid 890091] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "karimnawfal.com"] [uri "/graphql/console"] [unique_id "alxgt3zbEu1Ap1Mwpo-7rAABhiA"]
[Sat Jul 18 23:29:27.814802 2026] [security2:error] [pid 890058:tid 890312] [client 35.221.188.122:33610] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "karimnawfal.com"] [uri "/graphql/console"] [unique_id "alxgt3zbEu1Ap1Mwpo-7rAABhiA"]
[Sat Jul 18 23:29:27.830247 2026] [security2:error] [pid 890058:tid 890112] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "karimnawfal.com"] [uri "/wp-json"] [unique_id "alxgt3zbEu1Ap1Mwpo-7sQABhjU"]
[Sat Jul 18 23:29:27.830533 2026] [security2:error] [pid 890058:tid 890116] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "karimnawfal.com"] [uri "/service-worker.js"] [unique_id "alxgt3zbEu1Ap1Mwpo-7swABhjk"]
[Sat Jul 18 23:29:27.947424 2026] [security2:error] [pid 890058:tid 890312] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgt3zbEu1Ap1Mwpo-7pAABhh4"]
[Sat Jul 18 23:29:28.064080 2026] [security2:error] [pid 890058:tid 890312] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgt3zbEu1Ap1Mwpo-7qwABhic"]
[Sat Jul 18 23:29:28.082306 2026] [security2:error] [pid 890058:tid 890312] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgt3zbEu1Ap1Mwpo-7rQABhiY"]
[Sat Jul 18 23:29:28.088567 2026] [security2:error] [pid 890058:tid 890101] [remote 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgt3zbEu1Ap1Mwpo-7tAABhio"]
[Sat Jul 18 23:29:28.089493 2026] [security2:error] [pid 890058:tid 890312] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgt3zbEu1Ap1Mwpo-7rwABhjE"]
[Sat Jul 18 23:29:28.119607 2026] [security2:error] [pid 890058:tid 890312] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgt3zbEu1Ap1Mwpo-7sgABhh0"]
[Sat Jul 18 23:29:28.148959 2026] [security2:error] [pid 890058:tid 890312] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgt3zbEu1Ap1Mwpo-7rgABhiw"]
[Sat Jul 18 23:29:28.164623 2026] [security2:error] [pid 890058:tid 890106] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.188.221.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "karimnawfal.com"] [uri "/phpinfo.php"] [unique_id "alxguHzbEu1Ap1Mwpo-7wwABhi8"]
[Sat Jul 18 23:29:28.239196 2026] [security2:error] [pid 890058:tid 890094] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.188.221.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "karimnawfal.com"] [uri "/pi.php"] [unique_id "alxguHzbEu1Ap1Mwpo-7ywABhiM"]
[Sat Jul 18 23:29:28.239415 2026] [security2:error] [pid 890058:tid 890102] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.188.221.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "karimnawfal.com"] [uri "/test.php"] [unique_id "alxguHzbEu1Ap1Mwpo-7yQABhis"]
[Sat Jul 18 23:29:28.239422 2026] [security2:error] [pid 890058:tid 890085] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.188.221.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "karimnawfal.com"] [uri "/info.php"] [unique_id "alxguHzbEu1Ap1Mwpo-7ygABhho"]
[Sat Jul 18 23:29:28.259643 2026] [security2:error] [pid 890058:tid 890312] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxguHzbEu1Ap1Mwpo-7uQABhjg"]
[Sat Jul 18 23:29:28.301186 2026] [security2:error] [pid 890058:tid 890131] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.188.221.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "karimnawfal.com"] [uri "/i.php"] [unique_id "alxguHzbEu1Ap1Mwpo-70AABeEg"]
[Sat Jul 18 23:29:28.618840 2026] [security2:error] [pid 890058:tid 890107] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.188.221.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "karimnawfal.com"] [uri "/app_dev.php"] [unique_id "alxguHzbEu1Ap1Mwpo-74gABVzA"]
[Sat Jul 18 23:29:28.628422 2026] [security2:error] [pid 890058:tid 890265] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxguHzbEu1Ap1Mwpo-72QABV1E"]
[Sat Jul 18 23:29:28.640026 2026] [security2:error] [pid 890058:tid 890265] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxguHzbEu1Ap1Mwpo-72AABV0E"]
[Sat Jul 18 23:29:28.708929 2026] [security2:error] [pid 890058:tid 890110] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "karimnawfal.com"] [uri "/graphql"] [unique_id "alxguHzbEu1Ap1Mwpo-75gABfzM"]
[Sat Jul 18 23:29:28.783064 2026] [security2:error] [pid 890058:tid 890142] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.188.221.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "karimnawfal.com"] [uri "/app_dev.php/_profiler"] [unique_id "alxguHzbEu1Ap1Mwpo-76QABMFM"]
[Sat Jul 18 23:29:28.847907 2026] [security2:error] [pid 890058:tid 890160] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "karimnawfal.com"] [uri "/server-info"] [unique_id "alxguHzbEu1Ap1Mwpo-78QABTWU"]
[Sat Jul 18 23:29:28.983434 2026] [security2:error] [pid 890058:tid 890151] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "karimnawfal.com"] [uri "/api/graphql"] [unique_id "alxguHzbEu1Ap1Mwpo-7_AABTVw"]
[Sat Jul 18 23:29:29.090012 2026] [access_compat:error] [pid 890058:tid 890139] [remote 35.221.188.122:33610] AH01797: client denied by server configuration: /home1/twzoinmy/public_html/karimnawfal/server-status
[Sat Jul 18 23:29:29.188940 2026] [security2:error] [pid 890058:tid 890230] [client 27.34.68.67:4044] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxguXzbEu1Ap1Mwpo-8DAAAATQ"]
[Sat Jul 18 23:29:29.189143 2026] [security2:error] [pid 890058:tid 890230] [client 27.34.68.67:4044] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxguXzbEu1Ap1Mwpo-8DAAAATQ"]
[Sat Jul 18 23:29:29.228361 2026] [security2:error] [pid 890058:tid 890255] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxguHzbEu1Ap1Mwpo-78gABTVs"]
[Sat Jul 18 23:29:29.236802 2026] [security2:error] [pid 890058:tid 890255] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxguHzbEu1Ap1Mwpo-77wABTVo"]
[Sat Jul 18 23:29:29.241067 2026] [security2:error] [pid 890058:tid 890255] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxguHzbEu1Ap1Mwpo-77gABTUc"]
[Sat Jul 18 23:29:29.262206 2026] [security2:error] [pid 890058:tid 890255] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxguHzbEu1Ap1Mwpo-79AABTWA"]
[Sat Jul 18 23:29:29.271424 2026] [security2:error] [pid 890058:tid 890136] [remote 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxguHzbEu1Ap1Mwpo-79gABTU0"]
[Sat Jul 18 23:29:29.278941 2026] [security2:error] [pid 890058:tid 890138] [remote 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxguHzbEu1Ap1Mwpo-78wABTU8"]
[Sat Jul 18 23:29:29.284697 2026] [security2:error] [pid 890058:tid 890255] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxguHzbEu1Ap1Mwpo-79QABTTs"]
[Sat Jul 18 23:29:29.315826 2026] [security2:error] [pid 890058:tid 890235] [client 57.141.18.113:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxguXzbEu1Ap1Mwpo-8BwAAATk"]
[Sat Jul 18 23:29:29.321233 2026] [security2:error] [pid 890058:tid 890148] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "karimnawfal.com"] [uri "/v1/graphql"] [unique_id "alxguXzbEu1Ap1Mwpo-8EgABbFk"]
[Sat Jul 18 23:29:29.538253 2026] [security2:error] [pid 890058:tid 890172] [remote 103.90.233.75:35700] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.233.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "oswegooperatheater.com"] [uri "/wp-login.php"] [unique_id "alxguXzbEu1Ap1Mwpo-8HQABJHE"]
[Sat Jul 18 23:29:29.592302 2026] [security2:error] [pid 890058:tid 890120] [remote 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxguXzbEu1Ap1Mwpo-8FAABaj0"]
[Sat Jul 18 23:29:29.686652 2026] [security2:error] [pid 890058:tid 890153] [remote 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxguXzbEu1Ap1Mwpo-8GgABal4"]
[Sat Jul 18 23:29:29.804346 2026] [security2:error] [pid 890058:tid 890284] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxguXzbEu1Ap1Mwpo-8HwABan0"]
[Sat Jul 18 23:29:29.854185 2026] [security2:error] [pid 890058:tid 890170] [remote 20.153.140.50:56100] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ouw.egd.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxguXzbEu1Ap1Mwpo-8MQABCm8"]
[Sat Jul 18 23:29:29.892347 2026] [security2:error] [pid 890058:tid 890183] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "karimnawfal.com"] [uri "/.env"] [unique_id "alxguXzbEu1Ap1Mwpo-8NAABanw"]
[Sat Jul 18 23:29:29.920615 2026] [security2:error] [pid 890058:tid 890178] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "karimnawfal.com"] [uri "/.env.production"] [unique_id "alxguXzbEu1Ap1Mwpo-8NwABanc"]
[Sat Jul 18 23:29:29.920758 2026] [security2:error] [pid 890058:tid 890284] [client 35.221.188.122:33610] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "karimnawfal.com"] [uri "/.env.production"] [unique_id "alxguXzbEu1Ap1Mwpo-8NwABanc"]
[Sat Jul 18 23:29:29.949043 2026] [security2:error] [pid 890058:tid 890062] [remote 103.90.233.75:35700] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.233.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "oswegooperatheater.com"] [uri "/wp-login.php"] [unique_id "alxguXzbEu1Ap1Mwpo-8OAABegM"], referer: https://oswegooperatheater.com/wp-login.php
[Sat Jul 18 23:29:30.154575 2026] [security2:error] [pid 890058:tid 890064] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "karimnawfal.com"] [uri "/api/.env"] [unique_id "alxgunzbEu1Ap1Mwpo-8QwABagU"]
[Sat Jul 18 23:29:30.162163 2026] [security2:error] [pid 881201:tid 881363] [client 74.208.214.194:47214] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxgugWL-zKlchkVWS13_gAAAB8"]
[Sat Jul 18 23:29:30.171869 2026] [security2:error] [pid 890058:tid 890284] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxguXzbEu1Ap1Mwpo-8IwABam4"]
[Sat Jul 18 23:29:30.198247 2026] [security2:error] [pid 890058:tid 890168] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.old$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1263"] [id "390583"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .old)"] [severity "CRITICAL"] [hostname "karimnawfal.com"] [uri "/.env.old"] [unique_id "alxgunzbEu1Ap1Mwpo-8RgABam0"]
[Sat Jul 18 23:29:30.198387 2026] [security2:error] [pid 890058:tid 890072] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\.bak|\\\\.bak\\\\.php)$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1260"] [id "390582"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that nclude .bak)"] [severity "CRITICAL"] [hostname "karimnawfal.com"] [uri "/.env.bak"] [unique_id "alxgunzbEu1Ap1Mwpo-8RwABag0"]
[Sat Jul 18 23:29:30.198388 2026] [security2:error] [pid 890058:tid 890165] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.backup$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1279"] [id "390588"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .backup)"] [severity "CRITICAL"] [hostname "karimnawfal.com"] [uri "/.env.backup"] [unique_id "alxgunzbEu1Ap1Mwpo-8SAABamo"]
[Sat Jul 18 23:29:30.225977 2026] [security2:error] [pid 890058:tid 890284] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxguXzbEu1Ap1Mwpo-8KAABanA"]
[Sat Jul 18 23:29:30.268640 2026] [security2:error] [pid 890058:tid 890075] [remote 20.153.140.50:56100] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ouw.egd.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxgunzbEu1Ap1Mwpo-8SwABGxA"], referer: https://ouw.egd.mybluehost.me/wp-login.php
[Sat Jul 18 23:29:30.324019 2026] [security2:error] [pid 890058:tid 890284] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxguXzbEu1Ap1Mwpo-8LgABanI"]
[Sat Jul 18 23:29:30.341999 2026] [security2:error] [pid 890058:tid 890176] [remote 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxguXzbEu1Ap1Mwpo-8LwABanU"]
[Sat Jul 18 23:29:30.381832 2026] [security2:error] [pid 890058:tid 890182] [remote 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxguXzbEu1Ap1Mwpo-8NQABans"]
[Sat Jul 18 23:29:30.400284 2026] [security2:error] [pid 890058:tid 890156] [remote 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxguXzbEu1Ap1Mwpo-8MwABamE"]
[Sat Jul 18 23:29:30.402462 2026] [security2:error] [pid 890058:tid 890174] [remote 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxguXzbEu1Ap1Mwpo-8MgABanM"]
[Sat Jul 18 23:29:30.413568 2026] [security2:error] [pid 890058:tid 890071] [remote 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgunzbEu1Ap1Mwpo-8RAABagw"]
[Sat Jul 18 23:29:30.488900 2026] [security2:error] [pid 890058:tid 890157] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "karimnawfal.com"] [uri "/service-account.json"] [unique_id "alxgunzbEu1Ap1Mwpo-8UwABGmI"]
[Sat Jul 18 23:29:30.490558 2026] [security2:error] [pid 890058:tid 890068] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "karimnawfal.com"] [uri "/backend/.env"] [unique_id "alxgunzbEu1Ap1Mwpo-8VQABGgk"]
[Sat Jul 18 23:29:30.578403 2026] [security2:error] [pid 890058:tid 890086] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "karimnawfal.com"] [uri "/config/.env"] [unique_id "alxgunzbEu1Ap1Mwpo-8WAABGhs"]
[Sat Jul 18 23:29:30.712633 2026] [security2:error] [pid 890058:tid 890204] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgunzbEu1Ap1Mwpo-8VgABGhI"]
[Sat Jul 18 23:29:30.826709 2026] [security2:error] [pid 890058:tid 890111] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "karimnawfal.com"] [uri "/.htpasswd"] [unique_id "alxgunzbEu1Ap1Mwpo-8bAABXjQ"]
[Sat Jul 18 23:29:30.826933 2026] [security2:error] [pid 890058:tid 890272] [client 35.221.188.122:33610] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "karimnawfal.com"] [uri "/.htpasswd"] [unique_id "alxgunzbEu1Ap1Mwpo-8bAABXjQ"]
[Sat Jul 18 23:29:30.827050 2026] [security2:error] [pid 890058:tid 890063] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "karimnawfal.com"] [uri "/serviceAccountKey.json"] [unique_id "alxgunzbEu1Ap1Mwpo-8bgABXgQ"]
[Sat Jul 18 23:29:30.891275 2026] [security2:error] [pid 881201:tid 881440] [client 4.194.24.143:45742] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/nine2code.php"] [unique_id "alxgugWL-zKlchkVWS14EwAAAGw"]
[Sat Jul 18 23:29:30.892011 2026] [security2:error] [pid 890058:tid 890100] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "karimnawfal.com"] [uri "/.ssh/id_rsa"] [unique_id "alxgunzbEu1Ap1Mwpo-8cwABXik"]
[Sat Jul 18 23:29:31.031319 2026] [security2:error] [pid 890058:tid 890116] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "karimnawfal.com"] [uri "/.ssh/id_dsa"] [unique_id "alxgu3zbEu1Ap1Mwpo-8ewABXjk"]
[Sat Jul 18 23:29:31.366860 2026] [security2:error] [pid 890058:tid 890103] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "karimnawfal.com"] [uri "/id_rsa"] [unique_id "alxgu3zbEu1Ap1Mwpo-8kgABXiw"]
[Sat Jul 18 23:29:31.468985 2026] [security2:error] [pid 881201:tid 881303] [remote 199.189.225.167:63127] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.225.189.199.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "talknutritionwithlesley.com"] [uri "/wp-login.php"] [unique_id "alxguwWL-zKlchkVWS14JAAAQGQ"]
[Sat Jul 18 23:29:31.524592 2026] [security2:error] [pid 881201:tid 881395] [client 193.47.62.167:60320] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "lutheranphilosopher.com"] [uri "/index.php"] [unique_id "alxguQWL-zKlchkVWS135AAAAD8"], referer: http://lutheranphilosopher.com/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings
[Sat Jul 18 23:29:31.598085 2026] [security2:error] [pid 890058:tid 890284] [client 4.194.24.143:45723] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/num.php"] [unique_id "alxgu3zbEu1Ap1Mwpo-8mwAAAWo"]
[Sat Jul 18 23:29:31.651310 2026] [security2:error] [pid 890058:tid 890246] [client 57.141.18.21:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxgu3zbEu1Ap1Mwpo-8fAAAAUQ"]
[Sat Jul 18 23:29:31.711638 2026] [security2:error] [pid 881201:tid 881236] [remote 199.189.225.167:63127] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.225.189.199.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "talknutritionwithlesley.com"] [uri "/wp-login.php"] [unique_id "alxguwWL-zKlchkVWS14KgAAZiE"], referer: https://talknutritionwithlesley.com/wp-login.php
[Sat Jul 18 23:29:31.806004 2026] [security2:error] [pid 890058:tid 890115] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "karimnawfal.com"] [uri "/id_dsa"] [unique_id "alxgu3zbEu1Ap1Mwpo-8pwABXjg"]
[Sat Jul 18 23:29:31.902573 2026] [security2:error] [pid 881201:tid 881274] [remote 20.153.140.50:56110] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxguwWL-zKlchkVWS14LAAAREc"]
[Sat Jul 18 23:29:32.141899 2026] [security2:error] [pid 890058:tid 890272] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgunzbEu1Ap1Mwpo-8aAABXgI"]
[Sat Jul 18 23:29:32.153391 2026] [security2:error] [pid 890058:tid 890272] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgunzbEu1Ap1Mwpo-8bQABXnk"]
[Sat Jul 18 23:29:32.162961 2026] [security2:error] [pid 890058:tid 890272] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgunzbEu1Ap1Mwpo-8cAABXhM"]
[Sat Jul 18 23:29:32.167347 2026] [security2:error] [pid 890058:tid 890272] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgunzbEu1Ap1Mwpo-8awABXhw"]
[Sat Jul 18 23:29:32.167403 2026] [security2:error] [pid 890058:tid 890074] [remote 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgunzbEu1Ap1Mwpo-8cgABXg8"]
[Sat Jul 18 23:29:32.174831 2026] [security2:error] [pid 890058:tid 890099] [remote 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgunzbEu1Ap1Mwpo-8bwABXig"]
[Sat Jul 18 23:29:32.180893 2026] [security2:error] [pid 890058:tid 890272] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgu3zbEu1Ap1Mwpo-8gwABXjI"]
[Sat Jul 18 23:29:32.216000 2026] [security2:error] [pid 890058:tid 890272] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgu3zbEu1Ap1Mwpo-8hAABXiI"]
[Sat Jul 18 23:29:32.229756 2026] [security2:error] [pid 890058:tid 890091] [remote 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgunzbEu1Ap1Mwpo-8dwABXiA"]
[Sat Jul 18 23:29:32.332424 2026] [security2:error] [pid 890058:tid 890108] [remote 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgu3zbEu1Ap1Mwpo-8jQABXjE"]
[Sat Jul 18 23:29:32.334446 2026] [security2:error] [pid 890058:tid 890272] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgu3zbEu1Ap1Mwpo-8jAABXio"]
[Sat Jul 18 23:29:32.342201 2026] [security2:error] [pid 890058:tid 890237] [client 4.194.24.143:40791] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/odf7udtspqtpxzyxmw2rccdefault.php"] [unique_id "alxgvHzbEu1Ap1Mwpo-8xQAAATs"]
[Sat Jul 18 23:29:32.385104 2026] [security2:error] [pid 890058:tid 890272] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgvHzbEu1Ap1Mwpo-8tAABXjA"]
[Sat Jul 18 23:29:32.429340 2026] [security2:error] [pid 890058:tid 890137] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "karimnawfal.com"] [uri "/key.pem"] [unique_id "alxgvHzbEu1Ap1Mwpo-80QABL04"]
[Sat Jul 18 23:29:32.535977 2026] [security2:error] [pid 890058:tid 890114] [remote 194.164.192.228:34054] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 228.192.164.194.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxgvHzbEu1Ap1Mwpo-81wABUjc"]
[Sat Jul 18 23:29:32.563863 2026] [security2:error] [pid 890058:tid 890163] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "karimnawfal.com"] [uri "/privatekey.key"] [unique_id "alxgvHzbEu1Ap1Mwpo-83AABL2g"]
[Sat Jul 18 23:29:32.565667 2026] [security2:error] [pid 890058:tid 890150] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "karimnawfal.com"] [uri "/.openclaw/.env"] [unique_id "alxgvHzbEu1Ap1Mwpo-83gABL1s"]
[Sat Jul 18 23:29:32.674152 2026] [security2:error] [pid 890058:tid 890225] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgvHzbEu1Ap1Mwpo-80gABL1w"]
[Sat Jul 18 23:29:32.740298 2026] [security2:error] [pid 890058:tid 890161] [remote 194.164.192.228:34054] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 228.192.164.194.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxgvHzbEu1Ap1Mwpo-9AAABHGY"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:29:32.808706 2026] [security2:error] [pid 890058:tid 890141] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "karimnawfal.com"] [uri "/.hermes/.env"] [unique_id "alxgvHzbEu1Ap1Mwpo-9CgABL1I"]
[Sat Jul 18 23:29:32.869241 2026] [security2:error] [pid 890058:tid 890154] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "karimnawfal.com"] [uri "/.hermes/auth.json"] [unique_id "alxgvHzbEu1Ap1Mwpo-9EAABL18"]
[Sat Jul 18 23:29:33.032762 2026] [security2:error] [pid 890058:tid 890186] [remote 193.70.112.205:43816] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 205.112.70.193.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.holistichealthmassagenz.com"] [uri "/xmlrpc.php"] [unique_id "alxgvXzbEu1Ap1Mwpo-9GwABb38"]
[Sat Jul 18 23:29:33.032921 2026] [security2:error] [pid 890058:tid 890289] [client 193.70.112.205:43816] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "mail.holistichealthmassagenz.com"] [uri "/xmlrpc.php"] [unique_id "alxgvXzbEu1Ap1Mwpo-9GwABb38"]
[Sat Jul 18 23:29:33.117242 2026] [security2:error] [pid 890058:tid 890169] [remote 20.153.140.50:56126] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxgvXzbEu1Ap1Mwpo-9JgABEW4"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:29:33.133793 2026] [security2:error] [pid 890058:tid 890225] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgvHzbEu1Ap1Mwpo-80AABL0A"]
[Sat Jul 18 23:29:33.188370 2026] [security2:error] [pid 890058:tid 890168] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "karimnawfal.com"] [uri "/.claude.json"] [unique_id "alxgvXzbEu1Ap1Mwpo-9JwABL20"]
[Sat Jul 18 23:29:33.268444 2026] [security2:error] [pid 890058:tid 890225] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgvHzbEu1Ap1Mwpo-82wABL1A"]
[Sat Jul 18 23:29:33.277174 2026] [security2:error] [pid 890058:tid 890225] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgvHzbEu1Ap1Mwpo-83QABLxY"]
[Sat Jul 18 23:29:33.285250 2026] [security2:error] [pid 890058:tid 890225] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgvHzbEu1Ap1Mwpo-82gABL0I"]
[Sat Jul 18 23:29:33.311080 2026] [security2:error] [pid 890058:tid 890225] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgvHzbEu1Ap1Mwpo-82QABLy0"]
[Sat Jul 18 23:29:33.326931 2026] [security2:error] [pid 890058:tid 890234] [client 4.194.24.143:58683] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/option.php"] [unique_id "alxgvXzbEu1Ap1Mwpo-9NgAAATg"]
[Sat Jul 18 23:29:33.338852 2026] [security2:error] [pid 890058:tid 890225] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgvHzbEu1Ap1Mwpo-88QABL10"]
[Sat Jul 18 23:29:33.358481 2026] [security2:error] [pid 890058:tid 890184] [remote 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgvHzbEu1Ap1Mwpo-9CwABL30"]
[Sat Jul 18 23:29:33.373470 2026] [security2:error] [pid 890058:tid 890158] [remote 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgvHzbEu1Ap1Mwpo-9BAABL2M"]
[Sat Jul 18 23:29:33.382563 2026] [security2:error] [pid 890058:tid 890225] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgvHzbEu1Ap1Mwpo-9BQABLz0"]
[Sat Jul 18 23:29:33.513788 2026] [security2:error] [pid 890058:tid 890084] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "karimnawfal.com"] [uri "/laravel/.env"] [unique_id "alxgvXzbEu1Ap1Mwpo-9QgABcRk"]
[Sat Jul 18 23:29:33.528146 2026] [security2:error] [pid 890058:tid 890157] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-config\\\\.php(?:\\\\W[a-z]*|bak)" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "300"] [id "900256"] [msg "Wp-Config Backup/edit file request"] [hostname "karimnawfal.com"] [uri "/wp-config.php.old"] [unique_id "alxgvXzbEu1Ap1Mwpo-9RAABcWI"]
[Sat Jul 18 23:29:33.528369 2026] [security2:error] [pid 890058:tid 890068] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-config\\\\.php(?:\\\\W[a-z]*|bak)" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "300"] [id "900256"] [msg "Wp-Config Backup/edit file request"] [hostname "karimnawfal.com"] [uri "/wp-config.php.bak"] [unique_id "alxgvXzbEu1Ap1Mwpo-9RQABcQk"]
[Sat Jul 18 23:29:33.647403 2026] [security2:error] [pid 890058:tid 890086] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "karimnawfal.com"] [uri "/core/.env"] [unique_id "alxgvXzbEu1Ap1Mwpo-9SAABcRs"]
[Sat Jul 18 23:29:33.667289 2026] [security2:error] [pid 890058:tid 890070] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.188.221.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "karimnawfal.com"] [uri "/config/.env.php"] [unique_id "alxgvXzbEu1Ap1Mwpo-9SQABcQs"]
[Sat Jul 18 23:29:33.699860 2026] [security2:error] [pid 890058:tid 890111] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.188.221.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "karimnawfal.com"] [uri "/configuration.php.bak"] [unique_id "alxgvXzbEu1Ap1Mwpo-9UgABcTQ"]
[Sat Jul 18 23:29:33.699990 2026] [security2:error] [pid 890058:tid 890080] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.188.221.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "karimnawfal.com"] [uri "/config.php.bak"] [unique_id "alxgvXzbEu1Ap1Mwpo-9UQABcRU"]
[Sat Jul 18 23:29:33.725574 2026] [security2:error] [pid 890058:tid 890146] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.188.221.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "karimnawfal.com"] [uri "/.env.php.bak"] [unique_id "alxgvXzbEu1Ap1Mwpo-9VQABcVc"]
[Sat Jul 18 23:29:33.829417 2026] [security2:error] [pid 890058:tid 890112] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.sw[a-z]$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1275"] [id "390587"] [rev "5"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .sw)"] [severity "CRITICAL"] [hostname "karimnawfal.com"] [uri "/.env.swp"] [unique_id "alxgvXzbEu1Ap1Mwpo-9cAABcTU"]
[Sat Jul 18 23:29:33.865529 2026] [security2:error] [pid 890058:tid 890175] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "karimnawfal.com"] [uri "/web/.env"] [unique_id "alxgvXzbEu1Ap1Mwpo-9fAABcXQ"]
[Sat Jul 18 23:29:33.979195 2026] [security2:error] [pid 890058:tid 890103] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "karimnawfal.com"] [uri "/public/.env"] [unique_id "alxgvXzbEu1Ap1Mwpo-9iQABcSw"]
[Sat Jul 18 23:29:34.059587 2026] [security2:error] [pid 890058:tid 890293] [client 4.194.24.143:40800] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/p.php"] [unique_id "alxgvnzbEu1Ap1Mwpo-9kwAAAXM"]
[Sat Jul 18 23:29:34.105197 2026] [security2:error] [pid 890058:tid 890095] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "karimnawfal.com"] [uri "/config.js"] [unique_id "alxgvnzbEu1Ap1Mwpo-9mAABcSQ"]
[Sat Jul 18 23:29:34.105356 2026] [security2:error] [pid 890058:tid 890291] [client 35.221.188.122:33610] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "karimnawfal.com"] [uri "/config.js"] [unique_id "alxgvnzbEu1Ap1Mwpo-9mAABcSQ"]
[Sat Jul 18 23:29:34.225084 2026] [security2:error] [pid 890058:tid 890076] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "karimnawfal.com"] [uri "/api/config"] [unique_id "alxgvnzbEu1Ap1Mwpo-9ngABcRE"]
[Sat Jul 18 23:29:34.258915 2026] [security2:error] [pid 890058:tid 890291] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgvXzbEu1Ap1Mwpo-9PAABcXo"]
[Sat Jul 18 23:29:34.288004 2026] [security2:error] [pid 890058:tid 890105] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "karimnawfal.com"] [uri "/settings.json"] [unique_id "alxgvnzbEu1Ap1Mwpo-9ogABcS4"]
[Sat Jul 18 23:29:34.311128 2026] [security2:error] [pid 890058:tid 890291] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgvXzbEu1Ap1Mwpo-9PQABcWE"]
[Sat Jul 18 23:29:34.316181 2026] [security2:error] [pid 890058:tid 890291] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgvXzbEu1Ap1Mwpo-9QAABcQw"]
[Sat Jul 18 23:29:34.321151 2026] [security2:error] [pid 890058:tid 890291] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgvXzbEu1Ap1Mwpo-9PwABcXM"]
[Sat Jul 18 23:29:34.706319 2026] [security2:error] [pid 890058:tid 890258] [client 4.194.24.143:45713] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/past.php"] [unique_id "alxgvnzbEu1Ap1Mwpo-9xAAAAVA"]
[Sat Jul 18 23:29:34.725761 2026] [security2:error] [pid 890058:tid 890160] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "karimnawfal.com"] [uri "/api/v2/settings"] [unique_id "alxgvnzbEu1Ap1Mwpo-9yAABcWU"]
[Sat Jul 18 23:29:35.151481 2026] [security2:error] [pid 890058:tid 890291] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgvXzbEu1Ap1Mwpo-9QwABcX4"]
[Sat Jul 18 23:29:35.177014 2026] [security2:error] [pid 890058:tid 890291] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgvXzbEu1Ap1Mwpo-9SgABcWw"]
[Sat Jul 18 23:29:35.178888 2026] [security2:error] [pid 890058:tid 890291] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgvXzbEu1Ap1Mwpo-9eQABcR4"]
[Sat Jul 18 23:29:35.180833 2026] [security2:error] [pid 890058:tid 890291] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgvnzbEu1Ap1Mwpo-9lAABcS8"]
[Sat Jul 18 23:29:35.192458 2026] [security2:error] [pid 890058:tid 890240] [client 138.252.89.100:54337] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxgv3zbEu1Ap1Mwpo-99AAAAT4"]
[Sat Jul 18 23:29:35.192618 2026] [security2:error] [pid 890058:tid 890240] [client 138.252.89.100:54337] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxgv3zbEu1Ap1Mwpo-99AAAAT4"]
[Sat Jul 18 23:29:35.195999 2026] [security2:error] [pid 890058:tid 890222] [client 34.71.230.24:18216] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "bruceledewitz.com"] [uri "/wp-json/batch/v1"] [unique_id "alxgv3zbEu1Ap1Mwpo-98wAAASw"]
[Sat Jul 18 23:29:35.208271 2026] [security2:error] [pid 890058:tid 890153] [remote 31.42.184.154:34150] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxgv3zbEu1Ap1Mwpo-99wABeF4"]
[Sat Jul 18 23:29:35.282110 2026] [security2:error] [pid 890058:tid 890307] [client 4.194.24.143:40793] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/php.php"] [unique_id "alxgv3zbEu1Ap1Mwpo-9_gAAAYE"]
[Sat Jul 18 23:29:35.296595 2026] [security2:error] [pid 890058:tid 890291] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgvnzbEu1Ap1Mwpo-9nwABcUQ"]
[Sat Jul 18 23:29:35.344074 2026] [security2:error] [pid 890058:tid 890291] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgvnzbEu1Ap1Mwpo-9oQABcUY"]
[Sat Jul 18 23:29:35.347580 2026] [security2:error] [pid 890058:tid 890136] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "karimnawfal.com"] [uri "/__env.js"] [unique_id "alxgv3zbEu1Ap1Mwpo--AwABcU0"]
[Sat Jul 18 23:29:35.445860 2026] [security2:error] [pid 890058:tid 890164] [remote 31.42.184.154:34150] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxgv3zbEu1Ap1Mwpo--EQABFmk"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:29:35.655473 2026] [proxy:error] [pid 890058:tid 890309] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:29:35.655564 2026] [proxy_http:error] [pid 890058:tid 890309] [client 204.10.194.153:45650] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:29:35.656195 2026] [proxy:error] [pid 890058:tid 890309] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:29:35.656228 2026] [proxy_http:error] [pid 890058:tid 890309] [client 204.10.194.153:45650] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:29:35.871677 2026] [core:error] [pid 890058:tid 890212] [client 204.10.194.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:29:35.871697 2026] [core:error] [pid 890058:tid 890212] [client 204.10.194.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:29:35.886580 2026] [security2:error] [pid 890058:tid 890252] [client 119.154.81.234:51731] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgv3zbEu1Ap1Mwpo--LgAAAUo"]
[Sat Jul 18 23:29:35.886674 2026] [security2:error] [pid 890058:tid 890252] [client 119.154.81.234:51731] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgv3zbEu1Ap1Mwpo--LgAAAUo"]
[Sat Jul 18 23:29:36.087073 2026] [security2:error] [pid 890058:tid 890209] [client 4.194.24.143:45708] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/php8.php"] [unique_id "alxgwHzbEu1Ap1Mwpo--RQAAAR8"]
[Sat Jul 18 23:29:36.130544 2026] [security2:error] [pid 890058:tid 890159] [remote 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgv3zbEu1Ap1Mwpo-94wABcWQ"]
[Sat Jul 18 23:29:36.134303 2026] [security2:error] [pid 890058:tid 890291] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgvnzbEu1Ap1Mwpo-9zgABcVs"]
[Sat Jul 18 23:29:36.158379 2026] [security2:error] [pid 890058:tid 890285] [client 163.61.1.17:52861] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgwHzbEu1Ap1Mwpo--SQAAAWs"]
[Sat Jul 18 23:29:36.158518 2026] [security2:error] [pid 890058:tid 890285] [client 163.61.1.17:52861] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgwHzbEu1Ap1Mwpo--SQAAAWs"]
[Sat Jul 18 23:29:36.160602 2026] [security2:error] [pid 890058:tid 890291] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgv3zbEu1Ap1Mwpo-95gABcT8"]
[Sat Jul 18 23:29:36.161512 2026] [security2:error] [pid 890058:tid 890291] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgvnzbEu1Ap1Mwpo-9vQABcVg"]
[Sat Jul 18 23:29:36.164593 2026] [security2:error] [pid 890058:tid 890291] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgvnzbEu1Ap1Mwpo-9wwABcU4"]
[Sat Jul 18 23:29:36.352893 2026] [security2:error] [pid 890058:tid 890291] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgv3zbEu1Ap1Mwpo--BAABcXg"]
[Sat Jul 18 23:29:36.373502 2026] [security2:error] [pid 890058:tid 890291] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgv3zbEu1Ap1Mwpo--FQABcQ0"]
[Sat Jul 18 23:29:36.445716 2026] [security2:error] [pid 890058:tid 890188] [client 34.71.230.24:18216] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "bruceledewitz.com"] [uri "/"] [unique_id "alxgwHzbEu1Ap1Mwpo--YQAAAQo"]
[Sat Jul 18 23:29:36.479480 2026] [core:error] [pid 890058:tid 890194] [client 204.10.194.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:29:36.479499 2026] [core:error] [pid 890058:tid 890194] [client 204.10.194.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:29:36.513312 2026] [core:error] [pid 890058:tid 890239] [client 204.10.194.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:29:36.513333 2026] [core:error] [pid 890058:tid 890239] [client 204.10.194.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:29:36.744096 2026] [security2:error] [pid 890058:tid 890180] [remote 157.230.148.169:43160] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 169.148.230.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mtredistricting.gov"] [uri "/wp-login.php"] [unique_id "alxgwHzbEu1Ap1Mwpo--fAABE3k"]
[Sat Jul 18 23:29:36.876225 2026] [security2:error] [pid 890058:tid 890309] [client 4.194.24.143:45754] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/phpinfo.php"] [unique_id "alxgwHzbEu1Ap1Mwpo--iwAAAYM"]
[Sat Jul 18 23:29:36.919973 2026] [security2:error] [pid 890058:tid 890061] [remote 157.230.148.169:43160] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 169.148.230.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mtredistricting.gov"] [uri "/wp-login.php"] [unique_id "alxgwHzbEu1Ap1Mwpo--jwABGAI"], referer: https://mtredistricting.gov/wp-login.php
[Sat Jul 18 23:29:37.189241 2026] [security2:error] [pid 890058:tid 890200] [client 190.245.146.99:54111] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgwXzbEu1Ap1Mwpo--owAAARY"]
[Sat Jul 18 23:29:37.189354 2026] [security2:error] [pid 890058:tid 890200] [client 190.245.146.99:54111] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgwXzbEu1Ap1Mwpo--owAAARY"]
[Sat Jul 18 23:29:37.390687 2026] [security2:error] [pid 890058:tid 890263] [client 106.222.249.209:6567] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgwXzbEu1Ap1Mwpo--swAAAVU"]
[Sat Jul 18 23:29:37.390972 2026] [security2:error] [pid 890058:tid 890263] [client 106.222.249.209:6567] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgwXzbEu1Ap1Mwpo--swAAAVU"]
[Sat Jul 18 23:29:37.881362 2026] [core:error] [pid 890058:tid 890196] [client 4.194.24.143:28194] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:29:37.881383 2026] [core:error] [pid 890058:tid 890196] [client 4.194.24.143:28194] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:29:38.006376 2026] [security2:error] [pid 890058:tid 890193] [client 41.33.104.114:36688] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "skiboutiques.com"] [uri "/wp-comments-post.php"] [unique_id "alxgwnzbEu1Ap1Mwpo--3QAAAQ8"]
[Sat Jul 18 23:29:38.161421 2026] [security2:error] [pid 890058:tid 890193] [client 41.33.104.114:36688] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "403"] [hostname "skiboutiques.com"] [uri "/wp-comments-post.php"] [unique_id "alxgwnzbEu1Ap1Mwpo--3QAAAQ8"]
[Sat Jul 18 23:29:38.569730 2026] [security2:error] [pid 890058:tid 890262] [client 4.194.24.143:40811] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/post.php"] [unique_id "alxgwnzbEu1Ap1Mwpo--_gAAAVQ"]
[Sat Jul 18 23:29:38.939009 2026] [security2:error] [pid 890058:tid 890297] [client 34.71.230.24:18216] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "bruceledewitz.com"] [uri "/index.php"] [unique_id "alxgwnzbEu1Ap1Mwpo-_CwAAAXc"], referer: http://bruceledewitz.com/wp-json/batch/v1
[Sat Jul 18 23:29:39.246727 2026] [security2:error] [pid 890058:tid 890210] [client 4.194.24.143:28167] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/public/assets/design_1/css/parts/course_cards/grid_card_1.min.php"] [unique_id "alxgw3zbEu1Ap1Mwpo-_MQAAASA"]
[Sat Jul 18 23:29:39.734425 2026] [security2:error] [pid 890058:tid 890137] [remote 31.42.184.154:34638] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgw3zbEu1Ap1Mwpo-_VAABKU4"]
[Sat Jul 18 23:29:39.734559 2026] [security2:error] [pid 890058:tid 890219] [client 31.42.184.154:34638] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgw3zbEu1Ap1Mwpo-_VAABKU4"]
[Sat Jul 18 23:29:39.741984 2026] [security2:error] [pid 890058:tid 890218] [client 27.34.68.67:40300] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgw3zbEu1Ap1Mwpo-_VwAAASg"]
[Sat Jul 18 23:29:39.742098 2026] [security2:error] [pid 890058:tid 890218] [client 27.34.68.67:40300] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgw3zbEu1Ap1Mwpo-_VwAAASg"]
[Sat Jul 18 23:29:40.020589 2026] [security2:error] [pid 890058:tid 890310] [client 4.194.24.143:14274] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/public/css.php"] [unique_id "alxgxHzbEu1Ap1Mwpo-_awAAAYQ"]
[Sat Jul 18 23:29:40.720195 2026] [security2:error] [pid 890058:tid 890267] [client 4.194.24.143:45729] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/r.php"] [unique_id "alxgxHzbEu1Ap1Mwpo-_oQAAAVk"]
[Sat Jul 18 23:29:41.016564 2026] [security2:error] [pid 890058:tid 890109] [remote 97.74.93.24:58674] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgxHzbEu1Ap1Mwpo-_tQABRDI"]
[Sat Jul 18 23:29:41.016806 2026] [security2:error] [pid 890058:tid 890246] [client 97.74.93.24:58674] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxgxHzbEu1Ap1Mwpo-_tQABRDI"]
[Sat Jul 18 23:29:41.305485 2026] [security2:error] [pid 890058:tid 890247] [client 4.194.24.143:58658] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/radio.php"] [unique_id "alxgxXzbEu1Ap1Mwpo-_0QAAAUU"]
[Sat Jul 18 23:29:41.376815 2026] [security2:error] [pid 890058:tid 890276] [client 66.249.70.2:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxgxXzbEu1Ap1Mwpo-_wQABYic"]
[Sat Jul 18 23:29:41.896380 2026] [core:error] [pid 890058:tid 890307] [client 94.154.43.229:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:29:41.896418 2026] [core:error] [pid 890058:tid 890307] [client 94.154.43.229:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:29:41.911540 2026] [core:error] [pid 890058:tid 890275] [client 94.154.43.178:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:29:41.911569 2026] [core:error] [pid 890058:tid 890275] [client 94.154.43.178:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:29:41.914074 2026] [core:error] [pid 890058:tid 890300] [client 94.154.43.184:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:29:41.914088 2026] [core:error] [pid 890058:tid 890300] [client 94.154.43.184:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:29:41.914628 2026] [core:error] [pid 890058:tid 890191] [client 94.154.43.178:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:29:41.914649 2026] [core:error] [pid 890058:tid 890191] [client 94.154.43.178:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:29:41.979728 2026] [core:error] [pid 890058:tid 890209] [client 94.154.43.187:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:29:41.979757 2026] [core:error] [pid 890058:tid 890209] [client 94.154.43.187:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:29:41.984039 2026] [security2:error] [pid 890058:tid 890242] [client 4.194.24.143:58632] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/randkeyword.php7"] [unique_id "alxgxXzbEu1Ap1Mwpo_AFwAAAUA"]
[Sat Jul 18 23:29:42.216416 2026] [security2:error] [pid 890058:tid 890208] [client 192.178.8.73:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.secretkeynumerology.com"] [uri "/index.php"] [unique_id "alxgxXzbEu1Ap1Mwpo_AFgAAAR4"]
[Sat Jul 18 23:29:42.313398 2026] [security2:error] [pid 890058:tid 890178] [remote 157.66.47.83:53130] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxgxnzbEu1Ap1Mwpo_AMgABhXc"]
[Sat Jul 18 23:29:42.581812 2026] [security2:error] [pid 890058:tid 890194] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgxnzbEu1Ap1Mwpo_AOAABEG8"]
[Sat Jul 18 23:29:42.590152 2026] [security2:error] [pid 890058:tid 890194] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgxnzbEu1Ap1Mwpo_AOQABEC8"]
[Sat Jul 18 23:29:42.592469 2026] [security2:error] [pid 890058:tid 890290] [client 4.194.24.143:45735] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/readme.php"] [unique_id "alxgxnzbEu1Ap1Mwpo_AQwAAAXA"]
[Sat Jul 18 23:29:42.599900 2026] [security2:error] [pid 890058:tid 890194] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgxnzbEu1Ap1Mwpo_AOgABEE0"]
[Sat Jul 18 23:29:42.704846 2026] [security2:error] [pid 890058:tid 890194] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgxnzbEu1Ap1Mwpo_AOwABEEY"]
[Sat Jul 18 23:29:42.723010 2026] [security2:error] [pid 890058:tid 890165] [remote 157.66.47.83:53130] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxgxnzbEu1Ap1Mwpo_ASwABN2o"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:29:42.725123 2026] [security2:error] [pid 890058:tid 890306] [client 23.160.60.106:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.savilerowtravel.com"] [uri "/index.php"] [unique_id "alxgxHzbEu1Ap1Mwpo-_rgAAAYA"]
[Sat Jul 18 23:29:42.786118 2026] [security2:error] [pid 890058:tid 890194] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgxnzbEu1Ap1Mwpo_APQABEE8"]
[Sat Jul 18 23:29:43.219356 2026] [security2:error] [pid 890058:tid 890230] [client 4.194.24.143:40786] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/reze.php"] [unique_id "alxgx3zbEu1Ap1Mwpo_AdwAAATQ"]
[Sat Jul 18 23:29:43.233233 2026] [security2:error] [pid 890058:tid 890210] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgx3zbEu1Ap1Mwpo_AZwABIF0"]
[Sat Jul 18 23:29:43.395156 2026] [security2:error] [pid 890058:tid 890210] [client 35.221.188.122:33610] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "karimnawfal.com"] [uri "/index.php"] [unique_id "alxgx3zbEu1Ap1Mwpo_AbAABIGM"]
[Sat Jul 18 23:29:43.562504 2026] [security2:error] [pid 890058:tid 890122] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.188.221.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "karimnawfal.com"] [uri "/wp-login.php"] [unique_id "alxgx3zbEu1Ap1Mwpo_AjgABID8"], referer: https://karimnawfal.com/login
[Sat Jul 18 23:29:43.785471 2026] [security2:error] [pid 890058:tid 890303] [client 4.194.24.143:28182] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/rh.php"] [unique_id "alxgx3zbEu1Ap1Mwpo_AngAAAX0"]
[Sat Jul 18 23:29:43.863726 2026] [proxy:error] [pid 890058:tid 890249] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:29:43.863822 2026] [proxy_http:error] [pid 890058:tid 890249] [client 193.47.62.168:40312] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:29:43.864257 2026] [proxy:error] [pid 890058:tid 890249] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:29:43.864282 2026] [proxy_http:error] [pid 890058:tid 890249] [client 193.47.62.168:40312] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:29:43.890809 2026] [security2:error] [pid 890058:tid 890147] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.188.221.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "karimnawfal.com"] [uri "/wp-login.php"] [unique_id "alxgx3zbEu1Ap1Mwpo_AqQABIVg"], referer: https://karimnawfal.com/wp-admin/
[Sat Jul 18 23:29:43.891374 2026] [security2:error] [pid 890058:tid 890111] [remote 35.221.188.122:33610] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.188.221.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "karimnawfal.com"] [uri "/wp-login.php"] [unique_id "alxgx3zbEu1Ap1Mwpo_AqgABITQ"], referer: https://karimnawfal.com/wp-admin/
[Sat Jul 18 23:29:44.752405 2026] [security2:error] [pid 890058:tid 890293] [client 4.194.24.143:45705] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/rip.php"] [unique_id "alxgyHzbEu1Ap1Mwpo_A5QAAAXM"]
[Sat Jul 18 23:29:44.816915 2026] [security2:error] [pid 890058:tid 890105] [remote 154.61.75.100:49246] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxgyHzbEu1Ap1Mwpo_A8AABHi4"]
[Sat Jul 18 23:29:45.170913 2026] [security2:error] [pid 890058:tid 890201] [client 103.140.177.24:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "elementconstruction.co.uk"] [uri "/index.php"] [unique_id "alxgx3zbEu1Ap1Mwpo_AeQAAARc"]
[Sat Jul 18 23:29:45.669334 2026] [security2:error] [pid 890058:tid 890235] [client 4.194.24.143:49415] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/root.php"] [unique_id "alxgyXzbEu1Ap1Mwpo_BJQAAATk"]
[Sat Jul 18 23:29:46.351575 2026] [security2:error] [pid 890058:tid 890201] [client 119.154.81.234:52180] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgynzbEu1Ap1Mwpo_BVQAAARc"]
[Sat Jul 18 23:29:46.352089 2026] [security2:error] [pid 890058:tid 890201] [client 119.154.81.234:52180] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxgynzbEu1Ap1Mwpo_BVQAAARc"]
[Sat Jul 18 23:29:46.369585 2026] [security2:error] [pid 890058:tid 890234] [client 4.194.24.143:14296] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/s.php"] [unique_id "alxgynzbEu1Ap1Mwpo_BVwAAATg"]
[Sat Jul 18 23:29:46.736367 2026] [security2:error] [pid 890058:tid 890208] [client 163.61.1.17:53316] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgynzbEu1Ap1Mwpo_BawAAAR4"]
[Sat Jul 18 23:29:46.736448 2026] [security2:error] [pid 890058:tid 890208] [client 163.61.1.17:53316] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxgynzbEu1Ap1Mwpo_BawAAAR4"]
[Sat Jul 18 23:29:46.891791 2026] [security2:error] [pid 890058:tid 890271] [client 138.252.89.100:54806] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxgynzbEu1Ap1Mwpo_BdgAAAV0"]
[Sat Jul 18 23:29:46.892554 2026] [security2:error] [pid 890058:tid 890271] [client 138.252.89.100:54806] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxgynzbEu1Ap1Mwpo_BdgAAAV0"]
[Sat Jul 18 23:29:47.462812 2026] [security2:error] [pid 890058:tid 890303] [client 4.194.24.143:58686] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/sang.php"] [unique_id "alxgy3zbEu1Ap1Mwpo_BnQAAAX0"]
[Sat Jul 18 23:29:47.488504 2026] [security2:error] [pid 890058:tid 890270] [client 57.141.18.74:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxgy3zbEu1Ap1Mwpo_BkQAAAVw"]
[Sat Jul 18 23:29:47.610075 2026] [security2:error] [pid 890058:tid 890289] [client 31.42.184.154:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lakelopezonline.com"] [uri "/wp-login.php"] [unique_id "alxgy3zbEu1Ap1Mwpo_BqQAAAW8"], referer: https://lakelopezonline.com/wp-login.php
[Sat Jul 18 23:29:47.634384 2026] [security2:error] [pid 890058:tid 890314] [client 190.245.146.99:54618] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgy3zbEu1Ap1Mwpo_BqgAAAYg"]
[Sat Jul 18 23:29:47.640271 2026] [security2:error] [pid 890058:tid 890314] [client 190.245.146.99:54618] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxgy3zbEu1Ap1Mwpo_BqgAAAYg"]
[Sat Jul 18 23:29:47.825921 2026] [security2:error] [pid 890058:tid 890287] [client 106.222.249.209:9074] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgy3zbEu1Ap1Mwpo_BtQAAAW0"]
[Sat Jul 18 23:29:47.826260 2026] [security2:error] [pid 890058:tid 890287] [client 106.222.249.209:9074] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxgy3zbEu1Ap1Mwpo_BtQAAAW0"]
[Sat Jul 18 23:29:48.004962 2026] [security2:error] [pid 890058:tid 890173] [remote 31.42.184.154:34672] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "amalia-capital.com"] [uri "/wp-login.php"] [unique_id "alxgzHzbEu1Ap1Mwpo_BvQABKHI"]
[Sat Jul 18 23:29:48.209808 2026] [security2:error] [pid 890058:tid 890312] [client 3.109.49.224:51022] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "155"] [id "900406"] [msg "wp-login POST logging"] [data "200"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxgy3zbEu1Ap1Mwpo_BowAAAYY"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:29:48.242400 2026] [security2:error] [pid 890058:tid 890073] [remote 31.42.184.154:34672] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "amalia-capital.com"] [uri "/wp-login.php"] [unique_id "alxgzHzbEu1Ap1Mwpo_BxQABHA4"], referer: https://amalia-capital.com/wp-login.php
[Sat Jul 18 23:29:48.296895 2026] [security2:error] [pid 890058:tid 890116] [remote 113.160.142.119:52020] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "snctaxgroup.com"] [uri "/wp-login.php"] [unique_id "alxgzHzbEu1Ap1Mwpo_BygABNzk"]
[Sat Jul 18 23:29:48.512965 2026] [security2:error] [pid 890058:tid 890132] [remote 154.61.75.100:49246] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxgzHzbEu1Ap1Mwpo_B3AABfkk"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:29:48.652610 2026] [security2:error] [pid 890058:tid 890224] [client 4.194.24.143:55742] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/scxy.php"] [unique_id "alxgzHzbEu1Ap1Mwpo_B7QAAAS4"]
[Sat Jul 18 23:29:48.803084 2026] [security2:error] [pid 890058:tid 890181] [remote 113.160.142.119:52020] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "snctaxgroup.com"] [uri "/wp-login.php"] [unique_id "alxgzHzbEu1Ap1Mwpo_B9AABbno"], referer: https://snctaxgroup.com/wp-login.php
[Sat Jul 18 23:29:49.940303 2026] [security2:error] [pid 890058:tid 890292] [client 4.194.24.143:58638] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/sd.php"] [unique_id "alxgzXzbEu1Ap1Mwpo_CRgAAAXI"]
[Sat Jul 18 23:29:50.385717 2026] [security2:error] [pid 890058:tid 890310] [client 136.64.169.133:28922] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "fkconstructionfunding.com"] [uri "/wp-json/batch/v1"] [unique_id "alxgznzbEu1Ap1Mwpo_CagAAAYQ"]
[Sat Jul 18 23:29:50.449306 2026] [security2:error] [pid 890058:tid 890204] [client 27.34.68.67:22095] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgznzbEu1Ap1Mwpo_CawAAARo"]
[Sat Jul 18 23:29:50.449455 2026] [security2:error] [pid 890058:tid 890204] [client 27.34.68.67:22095] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxgznzbEu1Ap1Mwpo_CawAAARo"]
[Sat Jul 18 23:29:51.156608 2026] [security2:error] [pid 890058:tid 890270] [client 136.64.169.133:28922] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "fkconstructionfunding.com"] [uri "/"] [unique_id "alxgz3zbEu1Ap1Mwpo_ClwAAAVw"]
[Sat Jul 18 23:29:51.169633 2026] [security2:error] [pid 890058:tid 890232] [client 4.194.24.143:45697] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/sf.php"] [unique_id "alxgz3zbEu1Ap1Mwpo_CmQAAATY"]
[Sat Jul 18 23:29:52.199333 2026] [security2:error] [pid 890058:tid 890315] [client 4.194.24.143:55705] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/shell.php"] [unique_id "alxg0HzbEu1Ap1Mwpo_C4gAAAYk"]
[Sat Jul 18 23:29:52.393737 2026] [security2:error] [pid 890058:tid 890252] [client 124.29.207.185:56139] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxg0HzbEu1Ap1Mwpo_C9QAAAUo"]
[Sat Jul 18 23:29:52.393892 2026] [security2:error] [pid 890058:tid 890252] [client 124.29.207.185:56139] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxg0HzbEu1Ap1Mwpo_C9QAAAUo"]
[Sat Jul 18 23:29:52.399805 2026] [security2:error] [pid 890058:tid 890301] [client 57.141.18.74:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxg0HzbEu1Ap1Mwpo_C4wAAAXs"]
[Sat Jul 18 23:29:52.766454 2026] [security2:error] [pid 890058:tid 890304] [client 223.228.182.224:36805] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxg0HzbEu1Ap1Mwpo_DFAAAAX4"]
[Sat Jul 18 23:29:52.766606 2026] [security2:error] [pid 890058:tid 890304] [client 223.228.182.224:36805] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxg0HzbEu1Ap1Mwpo_DFAAAAX4"]
[Sat Jul 18 23:29:52.974389 2026] [security2:error] [pid 890058:tid 890112] [remote 97.74.93.24:50386] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.verdunestate.com"] [uri "/wp-login.php"] [unique_id "alxg0HzbEu1Ap1Mwpo_DKQABQTU"]
[Sat Jul 18 23:29:53.251324 2026] [core:error] [pid 890058:tid 890314] [client 4.194.24.143:58676] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:29:53.251344 2026] [core:error] [pid 890058:tid 890314] [client 4.194.24.143:58676] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:29:53.729899 2026] [security2:error] [pid 890058:tid 890093] [remote 157.66.47.83:57818] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.narv.co"] [uri "/xmlrpc.php"] [unique_id "alxg0XzbEu1Ap1Mwpo_DVgABESI"]
[Sat Jul 18 23:29:53.730009 2026] [security2:error] [pid 890058:tid 890195] [client 157.66.47.83:57818] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.narv.co"] [uri "/xmlrpc.php"] [unique_id "alxg0XzbEu1Ap1Mwpo_DVgABESI"]
[Sat Jul 18 23:29:53.903810 2026] [security2:error] [pid 890058:tid 890177] [remote 97.74.93.24:50386] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.verdunestate.com"] [uri "/wp-login.php"] [unique_id "alxg0XzbEu1Ap1Mwpo_DagABYnY"], referer: https://mail.verdunestate.com/wp-login.php
[Sat Jul 18 23:29:54.623211 2026] [security2:error] [pid 890058:tid 890222] [client 136.64.169.133:28922] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "fkconstructionfunding.com"] [uri "/index.php"] [unique_id "alxg0nzbEu1Ap1Mwpo_DegAAASw"], referer: http://fkconstructionfunding.com/wp-json/batch/v1
[Sat Jul 18 23:29:54.929968 2026] [security2:error] [pid 890058:tid 890307] [client 50.116.65.227:10450] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.fkconstructionfunding.com"] [uri "/index.php"] [unique_id "alxg0nzbEu1Ap1Mwpo_DmgAAAYE"]
[Sat Jul 18 23:29:55.115209 2026] [security2:error] [pid 890058:tid 890277] [client 50.116.65.227:10460] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.fkconstructionfunding.com"] [uri "/index.php"] [unique_id "alxg0nzbEu1Ap1Mwpo_DtAAAAWM"]
[Sat Jul 18 23:29:55.381452 2026] [security2:error] [pid 890058:tid 890139] [remote 20.153.140.50:40710] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxg03zbEu1Ap1Mwpo_D0AABGlA"]
[Sat Jul 18 23:29:55.394812 2026] [security2:error] [pid 890058:tid 890169] [remote 208.109.9.173:54436] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 173.9.109.208.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "39ishlife.com"] [uri "/wp-login.php"] [unique_id "alxg03zbEu1Ap1Mwpo_D0wABLW4"]
[Sat Jul 18 23:29:55.671204 2026] [security2:error] [pid 890058:tid 890176] [remote 31.42.184.154:60270] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxg03zbEu1Ap1Mwpo_D9gABKXU"]
[Sat Jul 18 23:29:55.700391 2026] [security2:error] [pid 890058:tid 890314] [client 4.194.24.143:40789] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/sid3.php"] [unique_id "alxg03zbEu1Ap1Mwpo_D-wAAAYg"]
[Sat Jul 18 23:29:55.794222 2026] [security2:error] [pid 890058:tid 890084] [remote 20.153.140.50:40710] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxg03zbEu1Ap1Mwpo_D_gABfRk"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:29:55.810311 2026] [security2:error] [pid 890058:tid 890137] [remote 208.109.9.173:54436] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 173.9.109.208.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "39ishlife.com"] [uri "/wp-login.php"] [unique_id "alxg03zbEu1Ap1Mwpo_EAQABTk4"], referer: https://39ishlife.com/wp-login.php
[Sat Jul 18 23:29:55.928212 2026] [security2:error] [pid 890058:tid 890077] [remote 31.42.184.154:60270] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxg03zbEu1Ap1Mwpo_EEgABVhI"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:29:56.066361 2026] [proxy:error] [pid 890058:tid 890214] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:29:56.066434 2026] [proxy_http:error] [pid 890058:tid 890214] [client 193.47.62.168:46928] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:29:56.066873 2026] [proxy:error] [pid 890058:tid 890214] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:29:56.066896 2026] [proxy_http:error] [pid 890058:tid 890214] [client 193.47.62.168:46928] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:29:56.469688 2026] [security2:error] [pid 890058:tid 890199] [client 3.109.49.224:29510] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "200"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxg03zbEu1Ap1Mwpo_EAgAAARU"]
[Sat Jul 18 23:29:57.147757 2026] [security2:error] [pid 890058:tid 890285] [client 4.194.24.143:55712] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/simple.php"] [unique_id "alxg1XzbEu1Ap1Mwpo_EiAAAAWs"]
[Sat Jul 18 23:29:57.174577 2026] [security2:error] [pid 890058:tid 890298] [client 119.154.81.234:52640] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxg1XzbEu1Ap1Mwpo_EiQAAAXg"]
[Sat Jul 18 23:29:57.174663 2026] [security2:error] [pid 890058:tid 890298] [client 119.154.81.234:52640] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxg1XzbEu1Ap1Mwpo_EiQAAAXg"]
[Sat Jul 18 23:29:57.181305 2026] [security2:error] [pid 890058:tid 890289] [client 163.61.1.17:53768] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxg1XzbEu1Ap1Mwpo_EiwAAAW8"]
[Sat Jul 18 23:29:57.181411 2026] [security2:error] [pid 890058:tid 890289] [client 163.61.1.17:53768] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxg1XzbEu1Ap1Mwpo_EiwAAAW8"]
[Sat Jul 18 23:29:57.933737 2026] [security2:error] [pid 890058:tid 890269] [client 4.194.24.143:58659] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/sitemap.php"] [unique_id "alxg1XzbEu1Ap1Mwpo_EwgAAAVs"]
[Sat Jul 18 23:29:58.144393 2026] [security2:error] [pid 890058:tid 890298] [client 190.245.146.99:55133] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxg1nzbEu1Ap1Mwpo_E0QAAAXg"]
[Sat Jul 18 23:29:58.150182 2026] [security2:error] [pid 890058:tid 890298] [client 190.245.146.99:55133] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxg1nzbEu1Ap1Mwpo_E0QAAAXg"]
[Sat Jul 18 23:29:58.523722 2026] [security2:error] [pid 890058:tid 890286] [client 106.222.249.209:7605] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxg1nzbEu1Ap1Mwpo_E5wAAAWw"]
[Sat Jul 18 23:29:58.523829 2026] [security2:error] [pid 890058:tid 890286] [client 106.222.249.209:7605] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxg1nzbEu1Ap1Mwpo_E5wAAAWw"]
[Sat Jul 18 23:29:58.554449 2026] [security2:error] [pid 890058:tid 890196] [client 138.252.89.100:55291] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxg1nzbEu1Ap1Mwpo_E6wAAARI"]
[Sat Jul 18 23:29:58.554530 2026] [security2:error] [pid 890058:tid 890196] [client 138.252.89.100:55291] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxg1nzbEu1Ap1Mwpo_E6wAAARI"]
[Sat Jul 18 23:29:58.756057 2026] [security2:error] [pid 890058:tid 890246] [client 4.194.24.143:55696] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/size.php"] [unique_id "alxg1nzbEu1Ap1Mwpo_E-wAAAUQ"]
[Sat Jul 18 23:29:59.003384 2026] [security2:error] [pid 890058:tid 890285] [client 50.116.65.227:13988] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxg13zbEu1Ap1Mwpo_FDAAAAWs"]
[Sat Jul 18 23:29:59.017094 2026] [security2:error] [pid 890058:tid 890257] [client 50.116.65.227:38518] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxg13zbEu1Ap1Mwpo_FDQAAAU8"]
[Sat Jul 18 23:29:59.550129 2026] [security2:error] [pid 890058:tid 890224] [client 4.194.24.143:40821] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/sm.php"] [unique_id "alxg13zbEu1Ap1Mwpo_FNwAAAS4"]
[Sat Jul 18 23:30:00.338475 2026] [security2:error] [pid 890058:tid 890236] [client 4.194.24.143:45726] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/sql.php"] [unique_id "alxg2HzbEu1Ap1Mwpo_FhAAAATo"]
[Sat Jul 18 23:30:00.662691 2026] [security2:error] [pid 890058:tid 890106] [remote 41.76.213.235:51542] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nwcarvingacademy.com"] [uri "/wp-login.php"] [unique_id "alxg2HzbEu1Ap1Mwpo_FlQABiC8"]
[Sat Jul 18 23:30:00.927358 2026] [security2:error] [pid 890058:tid 890239] [client 4.194.24.143:58631] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/ss.php"] [unique_id "alxg2HzbEu1Ap1Mwpo_FsQAAAT0"]
[Sat Jul 18 23:30:01.008680 2026] [security2:error] [pid 890058:tid 890191] [client 27.34.68.67:4113] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxg2XzbEu1Ap1Mwpo_FswAAAQ0"]
[Sat Jul 18 23:30:01.008866 2026] [security2:error] [pid 890058:tid 890191] [client 27.34.68.67:4113] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxg2XzbEu1Ap1Mwpo_FswAAAQ0"]
[Sat Jul 18 23:30:01.158675 2026] [security2:error] [pid 890058:tid 890062] [remote 41.76.213.235:51542] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nwcarvingacademy.com"] [uri "/wp-login.php"] [unique_id "alxg2XzbEu1Ap1Mwpo_FxQABHwM"], referer: https://nwcarvingacademy.com/wp-login.php
[Sat Jul 18 23:30:01.330910 2026] [security2:error] [pid 890058:tid 890154] [remote 157.66.47.83:36644] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "maa.hws.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxg2XzbEu1Ap1Mwpo_F0QABLV8"]
[Sat Jul 18 23:30:01.480826 2026] [security2:error] [pid 890058:tid 890269] [client 4.194.24.143:45709] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/stats.php"] [unique_id "alxg2XzbEu1Ap1Mwpo_F2wAAAVs"]
[Sat Jul 18 23:30:01.734605 2026] [security2:error] [pid 890058:tid 890075] [remote 157.66.47.83:36644] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "maa.hws.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxg2XzbEu1Ap1Mwpo_F6wABLBA"], referer: https://maa.hws.mybluehost.me/wp-login.php
[Sat Jul 18 23:30:02.082372 2026] [security2:error] [pid 890058:tid 890195] [client 4.194.24.143:49448] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/sump1.php"] [unique_id "alxg2nzbEu1Ap1Mwpo_GAwAAARE"]
[Sat Jul 18 23:30:02.180277 2026] [security2:error] [pid 890058:tid 890188] [client 57.141.18.52:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxg2XzbEu1Ap1Mwpo_F_wAAAQo"]
[Sat Jul 18 23:30:02.477562 2026] [core:error] [pid 890058:tid 890236] [client 103.96.147.148:45106] AH10244: invalid URI path (/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh)
[Sat Jul 18 23:30:02.660226 2026] [security2:error] [pid 890058:tid 890237] [client 4.194.24.143:58636] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/system.php"] [unique_id "alxg2nzbEu1Ap1Mwpo_GLgAAATs"]
[Sat Jul 18 23:30:03.234264 2026] [security2:error] [pid 890058:tid 890241] [client 4.194.24.143:58680] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/system/03n1hob7p03r2npdefault.php"] [unique_id "alxg23zbEu1Ap1Mwpo_GWAAAAT8"]
[Sat Jul 18 23:30:03.481326 2026] [security2:error] [pid 890058:tid 890298] [client 223.228.182.224:15604] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxg23zbEu1Ap1Mwpo_GagAAAXg"]
[Sat Jul 18 23:30:03.481454 2026] [security2:error] [pid 890058:tid 890298] [client 223.228.182.224:15604] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxg23zbEu1Ap1Mwpo_GagAAAXg"]
[Sat Jul 18 23:30:03.783563 2026] [security2:error] [pid 890058:tid 890309] [client 4.194.24.143:40769] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/system/cj5ha2rah8lyiqqdefault.php"] [unique_id "alxg23zbEu1Ap1Mwpo_GfgAAAYM"]
[Sat Jul 18 23:30:03.949444 2026] [security2:error] [pid 890058:tid 890093] [remote 31.42.184.154:36572] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxg23zbEu1Ap1Mwpo_GjgABTSI"]
[Sat Jul 18 23:30:04.340542 2026] [security2:error] [pid 890058:tid 890188] [client 191.237.250.106:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.250.237.191.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "shantimethod.com"] [uri "/.well-known/about.php"] [unique_id "alxg3HzbEu1Ap1Mwpo_GpAAAAQo"]
[Sat Jul 18 23:30:04.340683 2026] [security2:error] [pid 890058:tid 890188] [client 191.237.250.106:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "shantimethod.com"] [uri "/.well-known/about.php"] [unique_id "alxg3HzbEu1Ap1Mwpo_GpAAAAQo"]
[Sat Jul 18 23:30:04.393117 2026] [security2:error] [pid 890058:tid 890087] [remote 31.42.184.154:36572] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxg3HzbEu1Ap1Mwpo_GqQABEhw"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:30:04.414418 2026] [security2:error] [pid 890058:tid 890308] [client 4.194.24.143:40794] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/system_log.php"] [unique_id "alxg3HzbEu1Ap1Mwpo_GrgAAAYI"]
[Sat Jul 18 23:30:04.872477 2026] [security2:error] [pid 890058:tid 890113] [remote 31.42.184.154:50924] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "momheadquarters.com"] [uri "/wp-login.php"] [unique_id "alxg3HzbEu1Ap1Mwpo_GyAABDDY"]
[Sat Jul 18 23:30:05.021517 2026] [security2:error] [pid 890058:tid 890261] [client 4.194.24.143:40830] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/t.php"] [unique_id "alxg3XzbEu1Ap1Mwpo_G1gAAAVM"]
[Sat Jul 18 23:30:05.100860 2026] [security2:error] [pid 890058:tid 890145] [remote 31.42.184.154:50924] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "momheadquarters.com"] [uri "/wp-login.php"] [unique_id "alxg3XzbEu1Ap1Mwpo_G4wABXlY"], referer: https://momheadquarters.com/wp-login.php
[Sat Jul 18 23:30:05.565654 2026] [security2:error] [pid 890058:tid 890256] [client 4.194.24.143:55685] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/term.php"] [unique_id "alxg3XzbEu1Ap1Mwpo_HBAAAAU4"]
[Sat Jul 18 23:30:06.116716 2026] [security2:error] [pid 890058:tid 890269] [client 4.194.24.143:55714] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/test.php"] [unique_id "alxg3nzbEu1Ap1Mwpo_HKAAAAVs"]
[Sat Jul 18 23:30:06.670563 2026] [security2:error] [pid 890058:tid 890220] [client 4.194.24.143:58672] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/test1.php"] [unique_id "alxg3nzbEu1Ap1Mwpo_HTAAAASo"]
[Sat Jul 18 23:30:07.086016 2026] [security2:error] [pid 890058:tid 890285] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxg3nzbEu1Ap1Mwpo_HXAAAAWs"]
[Sat Jul 18 23:30:07.214120 2026] [security2:error] [pid 890058:tid 890258] [client 4.194.24.143:14277] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/tfm.php"] [unique_id "alxg33zbEu1Ap1Mwpo_HbwAAAVA"]
[Sat Jul 18 23:30:07.441250 2026] [security2:error] [pid 890058:tid 890212] [client 74.7.227.179:48384] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxg33zbEu1Ap1Mwpo_HcgABIis"], referer: https://tejasenvironmental.com/p=3560050
[Sat Jul 18 23:30:07.565185 2026] [security2:error] [pid 890058:tid 890311] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxg33zbEu1Ap1Mwpo_HdAAAAYU"]
[Sat Jul 18 23:30:07.693093 2026] [security2:error] [pid 890058:tid 890189] [client 163.61.1.17:54222] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxg33zbEu1Ap1Mwpo_HlAAAAQs"]
[Sat Jul 18 23:30:07.694606 2026] [security2:error] [pid 890058:tid 890189] [client 163.61.1.17:54222] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxg33zbEu1Ap1Mwpo_HlAAAAQs"]
[Sat Jul 18 23:30:07.805267 2026] [security2:error] [pid 890058:tid 890273] [client 4.194.24.143:49431] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/thebe.php"] [unique_id "alxg33zbEu1Ap1Mwpo_HoAAAAV8"]
[Sat Jul 18 23:30:07.912397 2026] [security2:error] [pid 890058:tid 890242] [client 119.154.81.234:53113] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxg33zbEu1Ap1Mwpo_HpQAAAUA"]
[Sat Jul 18 23:30:07.912522 2026] [security2:error] [pid 890058:tid 890242] [client 119.154.81.234:53113] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxg33zbEu1Ap1Mwpo_HpQAAAUA"]
[Sat Jul 18 23:30:08.380161 2026] [security2:error] [pid 890058:tid 890313] [client 4.194.24.143:58664] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/themes.php"] [unique_id "alxg4HzbEu1Ap1Mwpo_HwgAAAYc"]
[Sat Jul 18 23:30:08.697661 2026] [security2:error] [pid 890058:tid 890200] [client 190.245.146.99:55639] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxg4HzbEu1Ap1Mwpo_H1AAAARY"]
[Sat Jul 18 23:30:08.697800 2026] [security2:error] [pid 890058:tid 890200] [client 190.245.146.99:55639] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxg4HzbEu1Ap1Mwpo_H1AAAARY"]
[Sat Jul 18 23:30:08.912766 2026] [security2:error] [pid 890058:tid 890259] [client 145.239.10.137:49401] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 137.10.239.145.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nwcarvingacademy.com"] [uri "/ty.php"] [unique_id "alxg4HzbEu1Ap1Mwpo_H4QAAAVE"], referer: http://nwcarvingacademy.com/ty.php
[Sat Jul 18 23:30:08.927817 2026] [security2:error] [pid 890058:tid 890304] [client 4.194.24.143:45704] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/tiny.php"] [unique_id "alxg4HzbEu1Ap1Mwpo_H5AAAAX4"]
[Sat Jul 18 23:30:09.291477 2026] [security2:error] [pid 890058:tid 890305] [client 106.222.249.209:13323] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxg4XzbEu1Ap1Mwpo_IBgAAAX8"]
[Sat Jul 18 23:30:09.291607 2026] [security2:error] [pid 890058:tid 890305] [client 106.222.249.209:13323] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxg4XzbEu1Ap1Mwpo_IBgAAAX8"]
[Sat Jul 18 23:30:09.483457 2026] [security2:error] [pid 890058:tid 890224] [client 4.194.24.143:49435] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "duskme.com"] [uri "/tmp/byp.php"] [unique_id "alxg4XzbEu1Ap1Mwpo_IGQAAAS4"]
[Sat Jul 18 23:30:09.490725 2026] [security2:error] [pid 890058:tid 890264] [client 198.12.69.94:39080] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "zarbeautyworld.twz.oin.mybluehost.me"] [uri "/index.php"] [unique_id "alxg23zbEu1Ap1Mwpo_GkQAAAVY"]
[Sat Jul 18 23:30:10.348921 2026] [security2:error] [pid 890058:tid 890242] [client 138.252.89.100:55762] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxg4nzbEu1Ap1Mwpo_ISwAAAUA"]
[Sat Jul 18 23:30:10.349022 2026] [security2:error] [pid 890058:tid 890242] [client 138.252.89.100:55762] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxg4nzbEu1Ap1Mwpo_ISwAAAUA"]
[Sat Jul 18 23:30:11.469876 2026] [security2:error] [pid 890058:tid 890203] [client 27.34.68.67:20006] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxg43zbEu1Ap1Mwpo_IlgAAARk"]
[Sat Jul 18 23:30:11.470002 2026] [security2:error] [pid 890058:tid 890203] [client 27.34.68.67:20006] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxg43zbEu1Ap1Mwpo_IlgAAARk"]
[Sat Jul 18 23:30:12.075290 2026] [security2:error] [pid 890058:tid 890306] [client 45.3.47.192:32079] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 192.47.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxg5HzbEu1Ap1Mwpo_IwwAAAYA"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:30:12.997811 2026] [security2:error] [pid 890058:tid 890314] [client 4.194.217.15:6777] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/nine2code.php"] [unique_id "alxg5HzbEu1Ap1Mwpo_JEgAAAYg"]
[Sat Jul 18 23:30:13.357918 2026] [security2:error] [pid 890058:tid 890252] [client 124.29.246.106:57063] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxg5XzbEu1Ap1Mwpo_JSAAAAUo"]
[Sat Jul 18 23:30:13.358044 2026] [security2:error] [pid 890058:tid 890252] [client 124.29.246.106:57063] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxg5XzbEu1Ap1Mwpo_JSAAAAUo"]
[Sat Jul 18 23:30:13.833938 2026] [security2:error] [pid 890058:tid 890293] [client 4.194.217.15:8697] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/num.php"] [unique_id "alxg5XzbEu1Ap1Mwpo_JYQAAAXM"]
[Sat Jul 18 23:30:13.903883 2026] [security2:error] [pid 890058:tid 890271] [client 198.12.69.94:39094] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "zarbeautyworld.twz.oin.mybluehost.me"] [uri "/index.php"] [unique_id "alxg43zbEu1Ap1Mwpo_IsgAAAV0"], referer: https://zarbeautyworld.twz.oin.mybluehost.me/contact
[Sat Jul 18 23:30:14.307145 2026] [security2:error] [pid 890058:tid 890290] [client 223.228.182.224:49193] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxg5nzbEu1Ap1Mwpo_JkgAAAXA"]
[Sat Jul 18 23:30:14.311559 2026] [security2:error] [pid 890058:tid 890290] [client 223.228.182.224:49193] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxg5nzbEu1Ap1Mwpo_JkgAAAXA"]
[Sat Jul 18 23:30:14.699685 2026] [security2:error] [pid 890058:tid 890249] [client 4.194.217.15:5658] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/odf7udtspqtpxzyxmw2rccdefault.php"] [unique_id "alxg5nzbEu1Ap1Mwpo_JrwAAAUc"]
[Sat Jul 18 23:30:15.312358 2026] [security2:error] [pid 890058:tid 890208] [client 4.194.217.15:6753] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/option.php"] [unique_id "alxg53zbEu1Ap1Mwpo_J2AAAAR4"]
[Sat Jul 18 23:30:15.872701 2026] [security2:error] [pid 890058:tid 890260] [client 4.194.217.15:7651] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/p.php"] [unique_id "alxg53zbEu1Ap1Mwpo_KAwAAAVI"]
[Sat Jul 18 23:30:16.477956 2026] [security2:error] [pid 890058:tid 890235] [client 57.141.18.27:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxg6HzbEu1Ap1Mwpo_KKwAAATk"]
[Sat Jul 18 23:30:16.589913 2026] [security2:error] [pid 890058:tid 890245] [client 57.141.18.54:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxg6HzbEu1Ap1Mwpo_KMQAAAUM"]
[Sat Jul 18 23:30:16.593365 2026] [security2:error] [pid 890058:tid 890293] [client 4.194.217.15:7667] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/past.php"] [unique_id "alxg6HzbEu1Ap1Mwpo_KPQAAAXM"]
[Sat Jul 18 23:30:17.203036 2026] [security2:error] [pid 890058:tid 890252] [client 4.194.217.15:6730] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/php.php"] [unique_id "alxg6XzbEu1Ap1Mwpo_KawAAAUo"]
[Sat Jul 18 23:30:17.314555 2026] [security2:error] [pid 890058:tid 890276] [client 196.251.121.187:49841] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\w ?(?:user|and)(\\\\w+)char ?\\\\([0-9]| \\\\b(?:execute|convert) ?\\\\(|; ?\\\\bdelete\\\\b.{1,100}?; ?(?:insert|declare @|varchar) ?|\\\\bdrop\\\\b .{1,100} table |(?:declare|convert) .{1,100} varchar\\\\(|null ?, ?null ?, ?(?:accesslevel|user_?name) ?,|\\\\bconcat ..." at ARGS:requests.requests.body.requests.requests.path. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "395"] [id "340157"] [rev "38"] [msg "Atomicorp.com WAF Rules: Generic SQL inline command protection"] [data "union select ,ARGS:requests.requests.body.requests.requests.path"] [severity "CRITICAL"] [tag "SQLi"] [hostname "getgarrison.com"] [uri "/"] [unique_id "alxg6HzbEu1Ap1Mwpo_KWgAAAWI"]
[Sat Jul 18 23:30:17.747692 2026] [security2:error] [pid 890058:tid 890304] [client 4.194.217.15:7128] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/php8.php"] [unique_id "alxg6XzbEu1Ap1Mwpo_KkQAAAX4"]
[Sat Jul 18 23:30:18.147623 2026] [security2:error] [pid 890058:tid 890211] [client 163.61.1.17:54676] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxg6nzbEu1Ap1Mwpo_KpAAAASE"]
[Sat Jul 18 23:30:18.147743 2026] [security2:error] [pid 890058:tid 890211] [client 163.61.1.17:54676] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxg6nzbEu1Ap1Mwpo_KpAAAASE"]
[Sat Jul 18 23:30:18.167913 2026] [security2:error] [pid 890058:tid 890120] [remote 216.73.216.174:12283] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.216.73.216.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/contact-us/"] [unique_id "alxg6nzbEu1Ap1Mwpo_KpwABaj0"]
[Sat Jul 18 23:30:18.290428 2026] [security2:error] [pid 890058:tid 890190] [client 4.194.217.15:7062] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/phpinfo.php"] [unique_id "alxg6nzbEu1Ap1Mwpo_KrQAAAQw"]
[Sat Jul 18 23:30:18.387438 2026] [security2:error] [pid 890058:tid 890100] [remote 152.228.213.32:52902] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxg6nzbEu1Ap1Mwpo_KsgABVik"]
[Sat Jul 18 23:30:18.439776 2026] [security2:error] [pid 890058:tid 890300] [client 23.160.60.53:51151] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "vfcthomasville.org"] [uri "/index.php"] [unique_id "alxg6nzbEu1Ap1Mwpo_KtQAAAXo"]
[Sat Jul 18 23:30:18.473458 2026] [security2:error] [pid 890058:tid 890246] [client 119.154.81.234:53567] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxg6nzbEu1Ap1Mwpo_KtwAAAUQ"]
[Sat Jul 18 23:30:18.473572 2026] [security2:error] [pid 890058:tid 890246] [client 119.154.81.234:53567] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxg6nzbEu1Ap1Mwpo_KtwAAAUQ"]
[Sat Jul 18 23:30:18.671123 2026] [security2:error] [pid 890058:tid 890147] [remote 152.228.213.32:52902] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxg6nzbEu1Ap1Mwpo_KyQABX1g"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:30:19.015943 2026] [security2:error] [pid 890058:tid 890286] [client 4.194.217.15:2086] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/post.php"] [unique_id "alxg63zbEu1Ap1Mwpo_K6wAAAWw"]
[Sat Jul 18 23:30:19.101890 2026] [security2:error] [pid 890058:tid 890272] [client 57.141.18.65:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxg6nzbEu1Ap1Mwpo_K5QAAAV4"]
[Sat Jul 18 23:30:19.166190 2026] [security2:error] [pid 890058:tid 890259] [client 190.245.146.99:56149] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxg63zbEu1Ap1Mwpo_K-QAAAVE"]
[Sat Jul 18 23:30:19.166292 2026] [security2:error] [pid 890058:tid 890259] [client 190.245.146.99:56149] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxg63zbEu1Ap1Mwpo_K-QAAAVE"]
[Sat Jul 18 23:30:19.189067 2026] [security2:error] [pid 890058:tid 890099] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "momheadquarters.com"] [uri "/graphql/console"] [unique_id "alxg63zbEu1Ap1Mwpo_LAQABFyg"]
[Sat Jul 18 23:30:19.189212 2026] [security2:error] [pid 890058:tid 890201] [client 34.39.87.128:53338] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "momheadquarters.com"] [uri "/graphql/console"] [unique_id "alxg63zbEu1Ap1Mwpo_LAQABFyg"]
[Sat Jul 18 23:30:19.273297 2026] [security2:error] [pid 890058:tid 890201] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg63zbEu1Ap1Mwpo_K-AABFys"]
[Sat Jul 18 23:30:19.414760 2026] [security2:error] [pid 890058:tid 890086] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "momheadquarters.com"] [uri "/z9x8c7v6b5-debug-trigger-momheadquarters.com"] [unique_id "alxg63zbEu1Ap1Mwpo_LFAABSBs"]
[Sat Jul 18 23:30:19.541004 2026] [security2:error] [pid 890058:tid 890250] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg63zbEu1Ap1Mwpo_LDwABSHo"]
[Sat Jul 18 23:30:19.543186 2026] [security2:error] [pid 890058:tid 890250] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg63zbEu1Ap1Mwpo_LGQABSCY"]
[Sat Jul 18 23:30:19.559419 2026] [security2:error] [pid 890058:tid 890236] [client 51.195.248.115:9794] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "autodiscover.nvkdigital.co.uk"] [uri "/.env"] [unique_id "alxg63zbEu1Ap1Mwpo_LLQAAATo"]
[Sat Jul 18 23:30:19.587690 2026] [security2:error] [pid 890058:tid 890307] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg63zbEu1Ap1Mwpo_LIwAAAYE"]
[Sat Jul 18 23:30:19.609119 2026] [security2:error] [pid 890058:tid 890302] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg63zbEu1Ap1Mwpo_LJAAAAXw"]
[Sat Jul 18 23:30:19.611437 2026] [security2:error] [pid 890058:tid 890274] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg63zbEu1Ap1Mwpo_LJgAAAWA"]
[Sat Jul 18 23:30:19.611697 2026] [security2:error] [pid 890058:tid 890189] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg63zbEu1Ap1Mwpo_LKAAAAQs"]
[Sat Jul 18 23:30:19.618438 2026] [security2:error] [pid 890058:tid 890199] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg63zbEu1Ap1Mwpo_LJwAAARU"]
[Sat Jul 18 23:30:19.639659 2026] [security2:error] [pid 890058:tid 890214] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg63zbEu1Ap1Mwpo_LKQAAASQ"]
[Sat Jul 18 23:30:19.651540 2026] [security2:error] [pid 890058:tid 890244] [client 4.194.217.15:7052] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/public/assets/design_1/css/parts/course_cards/grid_card_1.min.php"] [unique_id "alxg63zbEu1Ap1Mwpo_LNQAAAUI"]
[Sat Jul 18 23:30:19.695514 2026] [security2:error] [pid 890058:tid 890121] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "momheadquarters.com"] [uri "/phpinfo.php"] [unique_id "alxg63zbEu1Ap1Mwpo_LPQABSD4"]
[Sat Jul 18 23:30:19.700251 2026] [security2:error] [pid 890058:tid 890087] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "momheadquarters.com"] [uri "/graphql"] [unique_id "alxg63zbEu1Ap1Mwpo_LPgABSBw"]
[Sat Jul 18 23:30:19.819438 2026] [security2:error] [pid 890058:tid 890151] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "partnerselectricalllc.com"] [uri "/.git/config"] [unique_id "alxg63zbEu1Ap1Mwpo_LUwABWVw"]
[Sat Jul 18 23:30:19.819621 2026] [security2:error] [pid 890058:tid 890267] [client 34.100.180.213:58168] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "partnerselectricalllc.com"] [uri "/.git/config"] [unique_id "alxg63zbEu1Ap1Mwpo_LUwABWVw"]
[Sat Jul 18 23:30:19.820388 2026] [security2:error] [pid 890058:tid 890185] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "partnerselectricalllc.com"] [uri "/z9x8c7v6b5-debug-trigger-partnerselectricalllc.com"] [unique_id "alxg63zbEu1Ap1Mwpo_LWwABWX4"]
[Sat Jul 18 23:30:19.855086 2026] [security2:error] [pid 890058:tid 890101] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.87.39.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "momheadquarters.com"] [uri "/test.php"] [unique_id "alxg63zbEu1Ap1Mwpo_LaAABWyo"]
[Sat Jul 18 23:30:19.857293 2026] [security2:error] [pid 890058:tid 890145] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.87.39.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "momheadquarters.com"] [uri "/info.php"] [unique_id "alxg63zbEu1Ap1Mwpo_LawABW1Y"]
[Sat Jul 18 23:30:19.858732 2026] [security2:error] [pid 890058:tid 890098] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.87.39.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "momheadquarters.com"] [uri "/pi.php"] [unique_id "alxg63zbEu1Ap1Mwpo_LbAABWyc"]
[Sat Jul 18 23:30:19.861284 2026] [security2:error] [pid 890058:tid 890220] [client 106.222.249.209:26548] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxg63zbEu1Ap1Mwpo_LcgAAASo"]
[Sat Jul 18 23:30:19.861477 2026] [security2:error] [pid 890058:tid 890220] [client 106.222.249.209:26548] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxg63zbEu1Ap1Mwpo_LcgAAASo"]
[Sat Jul 18 23:30:19.897808 2026] [security2:error] [pid 890058:tid 890143] [remote 103.255.134.61:50278] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.134.255.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "rtkenergypartners.com"] [uri "/wp-login.php"] [unique_id "alxg63zbEu1Ap1Mwpo_LdAABKVQ"]
[Sat Jul 18 23:30:19.937259 2026] [security2:error] [pid 890058:tid 890131] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "momheadquarters.com"] [uri "/_profiler/latest"] [unique_id "alxg63zbEu1Ap1Mwpo_LdwABW0g"]
[Sat Jul 18 23:30:19.937697 2026] [security2:error] [pid 890058:tid 890064] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.87.39.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "momheadquarters.com"] [uri "/i.php"] [unique_id "alxg63zbEu1Ap1Mwpo_LeAABWwU"]
[Sat Jul 18 23:30:19.975297 2026] [security2:error] [pid 890058:tid 890189] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg63zbEu1Ap1Mwpo_LZQAAAQs"]
[Sat Jul 18 23:30:20.130661 2026] [security2:error] [pid 890058:tid 890200] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg63zbEu1Ap1Mwpo_LZgAAARY"]
[Sat Jul 18 23:30:20.160482 2026] [security2:error] [pid 890058:tid 890257] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg63zbEu1Ap1Mwpo_LbQAAAU8"]
[Sat Jul 18 23:30:20.164861 2026] [security2:error] [pid 890058:tid 890263] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg63zbEu1Ap1Mwpo_LaQAAAVU"]
[Sat Jul 18 23:30:20.171086 2026] [security2:error] [pid 890058:tid 890287] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg63zbEu1Ap1Mwpo_LbgAAAW0"]
[Sat Jul 18 23:30:20.172271 2026] [security2:error] [pid 890058:tid 890313] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg63zbEu1Ap1Mwpo_LZwAAAYc"]
[Sat Jul 18 23:30:20.180172 2026] [security2:error] [pid 890058:tid 890211] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg63zbEu1Ap1Mwpo_LagAAASE"]
[Sat Jul 18 23:30:20.180892 2026] [security2:error] [pid 890058:tid 890208] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg63zbEu1Ap1Mwpo_LbwAAAR4"]
[Sat Jul 18 23:30:20.184510 2026] [security2:error] [pid 890058:tid 890078] [remote 216.73.216.174:12283] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.216.73.216.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/training/"] [unique_id "alxg7HzbEu1Ap1Mwpo_LigABfBM"]
[Sat Jul 18 23:30:20.214257 2026] [security2:error] [pid 890058:tid 890065] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "momheadquarters.com"] [uri "/api/graphql"] [unique_id "alxg7HzbEu1Ap1Mwpo_LjQABUQY"]
[Sat Jul 18 23:30:20.216305 2026] [security2:error] [pid 890058:tid 890060] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.87.39.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "momheadquarters.com"] [uri "/app_dev.php/_profiler"] [unique_id "alxg7HzbEu1Ap1Mwpo_LjgABCwE"]
[Sat Jul 18 23:30:20.245822 2026] [security2:error] [pid 890058:tid 890229] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg63zbEu1Ap1Mwpo_LdgAAATM"]
[Sat Jul 18 23:30:20.295549 2026] [security2:error] [pid 890058:tid 890308] [client 4.194.217.15:7155] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/public/css.php"] [unique_id "alxg7HzbEu1Ap1Mwpo_LmwAAAYI"]
[Sat Jul 18 23:30:20.343211 2026] [security2:error] [pid 890058:tid 890168] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "momheadquarters.com"] [uri "/telescope/requests"] [unique_id "alxg7HzbEu1Ap1Mwpo_LoAABgW0"]
[Sat Jul 18 23:30:20.343359 2026] [security2:error] [pid 890058:tid 890307] [client 34.39.87.128:53338] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "momheadquarters.com"] [uri "/telescope/requests"] [unique_id "alxg7HzbEu1Ap1Mwpo_LoAABgW0"]
[Sat Jul 18 23:30:20.343584 2026] [security2:error] [pid 890058:tid 890133] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "momheadquarters.com"] [uri "/app_dev.php"] [unique_id "alxg7HzbEu1Ap1Mwpo_LogABgUo"]
[Sat Jul 18 23:30:20.371504 2026] [security2:error] [pid 890058:tid 890153] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "partnerselectricalllc.com"] [uri "/graphql"] [unique_id "alxg7HzbEu1Ap1Mwpo_LqQABWV4"]
[Sat Jul 18 23:30:20.372385 2026] [security2:error] [pid 890058:tid 890182] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "partnerselectricalllc.com"] [uri "/.env"] [unique_id "alxg7HzbEu1Ap1Mwpo_LrAABWXs"]
[Sat Jul 18 23:30:20.484073 2026] [security2:error] [pid 890058:tid 890313] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7HzbEu1Ap1Mwpo_LqAAAAYc"]
[Sat Jul 18 23:30:20.486125 2026] [security2:error] [pid 890058:tid 890287] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7HzbEu1Ap1Mwpo_LpwAAAW0"]
[Sat Jul 18 23:30:20.496206 2026] [security2:error] [pid 890058:tid 890139] [remote 103.255.134.61:50278] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.134.255.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "rtkenergypartners.com"] [uri "/wp-login.php"] [unique_id "alxg7HzbEu1Ap1Mwpo_LsgABcVA"], referer: https://rtkenergypartners.com/wp-login.php
[Sat Jul 18 23:30:20.537997 2026] [security2:error] [pid 890058:tid 890171] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "momheadquarters.com"] [uri "/v1/graphql"] [unique_id "alxg7HzbEu1Ap1Mwpo_LuAABHHA"]
[Sat Jul 18 23:30:20.612886 2026] [security2:error] [pid 890058:tid 890297] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg7HzbEu1Ap1Mwpo_LsAAAAXc"]
[Sat Jul 18 23:30:20.662762 2026] [security2:error] [pid 890058:tid 890221] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg7HzbEu1Ap1Mwpo_LrwAAASs"]
[Sat Jul 18 23:30:20.736437 2026] [security2:error] [pid 890058:tid 890150] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "momheadquarters.com"] [uri "/nginx_status"] [unique_id "alxg7HzbEu1Ap1Mwpo_L1gABOVs"]
[Sat Jul 18 23:30:20.736440 2026] [security2:error] [pid 890058:tid 890146] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "momheadquarters.com"] [uri "/server-status"] [unique_id "alxg7HzbEu1Ap1Mwpo_L1QABOVc"]
[Sat Jul 18 23:30:20.737947 2026] [security2:error] [pid 890058:tid 890144] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 2). Match of "ipMatch 127.0.0.1,::1" against "REMOTE_ADDR" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "724"] [id "340114"] [rev "2"] [msg "Atomicorp.com WAF Rules: Apache admin service access attempt"] [severity "CRITICAL"] [hostname "momheadquarters.com"] [uri "/server-info"] [unique_id "alxg7HzbEu1Ap1Mwpo_L2AABOVU"]
[Sat Jul 18 23:30:20.738095 2026] [security2:error] [pid 890058:tid 890158] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "momheadquarters.com"] [uri "/elmah.axd"] [unique_id "alxg7HzbEu1Ap1Mwpo_L2gABOWM"]
[Sat Jul 18 23:30:20.781786 2026] [security2:error] [pid 890058:tid 890290] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7HzbEu1Ap1Mwpo_LyQAAAXA"]
[Sat Jul 18 23:30:20.788443 2026] [security2:error] [pid 890058:tid 890235] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7HzbEu1Ap1Mwpo_LwgABOT0"]
[Sat Jul 18 23:30:20.793730 2026] [security2:error] [pid 890058:tid 890165] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.backup$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1279"] [id "390588"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .backup)"] [severity "CRITICAL"] [hostname "partnerselectricalllc.com"] [uri "/.env.backup"] [unique_id "alxg7HzbEu1Ap1Mwpo_L4gABWWo"]
[Sat Jul 18 23:30:20.873000 2026] [security2:error] [pid 890058:tid 890235] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7HzbEu1Ap1Mwpo_LzAABOQg"]
[Sat Jul 18 23:30:20.873149 2026] [security2:error] [pid 890058:tid 890235] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7HzbEu1Ap1Mwpo_L1AABOSk"]
[Sat Jul 18 23:30:20.880766 2026] [security2:error] [pid 890058:tid 890238] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7HzbEu1Ap1Mwpo_L3QAAATw"]
[Sat Jul 18 23:30:20.884204 2026] [security2:error] [pid 890058:tid 890296] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg7HzbEu1Ap1Mwpo_LvgAAAXY"]
[Sat Jul 18 23:30:20.887295 2026] [security2:error] [pid 890058:tid 890263] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7HzbEu1Ap1Mwpo_L3wAAAVU"]
[Sat Jul 18 23:30:20.970830 2026] [security2:error] [pid 890058:tid 890280] [client 3.108.60.216:45468] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxg7HzbEu1Ap1Mwpo_L6wAAAWY"]
[Sat Jul 18 23:30:20.971819 2026] [security2:error] [pid 890058:tid 890162] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "momheadquarters.com"] [uri "/config.json"] [unique_id "alxg7HzbEu1Ap1Mwpo_L7AABFWc"]
[Sat Jul 18 23:30:20.971992 2026] [security2:error] [pid 890058:tid 890199] [client 34.39.87.128:53338] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "momheadquarters.com"] [uri "/config.json"] [unique_id "alxg7HzbEu1Ap1Mwpo_L7AABFWc"]
[Sat Jul 18 23:30:21.011918 2026] [authz_core:error] [pid 890058:tid 890190] [client 34.39.87.128:0] AH01630: client denied by server configuration: /home1/momheadq/public_html/.htpasswd
[Sat Jul 18 23:30:21.014289 2026] [security2:error] [pid 890058:tid 890199] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7HzbEu1Ap1Mwpo_L6QABFXI"]
[Sat Jul 18 23:30:21.121552 2026] [security2:error] [pid 890058:tid 890205] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7XzbEu1Ap1Mwpo_L-AAAARs"]
[Sat Jul 18 23:30:21.125525 2026] [security2:error] [pid 890058:tid 890229] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7XzbEu1Ap1Mwpo_L_QAAATM"]
[Sat Jul 18 23:30:21.133136 2026] [security2:error] [pid 890058:tid 890262] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7XzbEu1Ap1Mwpo_L_gAAAVQ"]
[Sat Jul 18 23:30:21.133741 2026] [security2:error] [pid 890058:tid 890302] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7XzbEu1Ap1Mwpo_L-wAAAXw"]
[Sat Jul 18 23:30:21.146828 2026] [security2:error] [pid 890058:tid 890265] [client 4.194.217.15:2092] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/r.php"] [unique_id "alxg7XzbEu1Ap1Mwpo_MFQAAAVc"]
[Sat Jul 18 23:30:21.186822 2026] [security2:error] [pid 890058:tid 890240] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7XzbEu1Ap1Mwpo_MCAAAAT4"]
[Sat Jul 18 23:30:21.199830 2026] [security2:error] [pid 890058:tid 890272] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7XzbEu1Ap1Mwpo_MCQAAAV4"]
[Sat Jul 18 23:30:21.281739 2026] [security2:error] [pid 890058:tid 890296] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7XzbEu1Ap1Mwpo_MGAAAAXY"]
[Sat Jul 18 23:30:21.345270 2026] [security2:error] [pid 890058:tid 890086] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "momheadquarters.com"] [uri "/.env"] [unique_id "alxg7XzbEu1Ap1Mwpo_MJwABSBs"]
[Sat Jul 18 23:30:21.412834 2026] [security2:error] [pid 890058:tid 890091] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.backup$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1279"] [id "390588"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .backup)"] [severity "CRITICAL"] [hostname "momheadquarters.com"] [uri "/.env.backup"] [unique_id "alxg7XzbEu1Ap1Mwpo_MLAABMyA"]
[Sat Jul 18 23:30:21.412873 2026] [security2:error] [pid 890058:tid 890181] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.old$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1263"] [id "390583"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .old)"] [severity "CRITICAL"] [hostname "momheadquarters.com"] [uri "/.env.old"] [unique_id "alxg7XzbEu1Ap1Mwpo_MLQABM3o"]
[Sat Jul 18 23:30:21.475036 2026] [security2:error] [pid 890058:tid 890229] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7XzbEu1Ap1Mwpo_MKAABM3Y"]
[Sat Jul 18 23:30:21.498100 2026] [security2:error] [pid 890058:tid 890079] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "momheadquarters.com"] [uri "/.github/workflows/deploy.yml"] [unique_id "alxg7XzbEu1Ap1Mwpo_MMwABMxQ"]
[Sat Jul 18 23:30:21.531855 2026] [security2:error] [pid 890058:tid 890117] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\.bak|\\\\.bak\\\\.php)$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1260"] [id "390582"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that nclude .bak)"] [severity "CRITICAL"] [hostname "partnerselectricalllc.com"] [uri "/.env.bak"] [unique_id "alxg7XzbEu1Ap1Mwpo_MOgABejo"]
[Sat Jul 18 23:30:21.553479 2026] [security2:error] [pid 890058:tid 890116] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\.bak|\\\\.bak\\\\.php)$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1260"] [id "390582"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that nclude .bak)"] [severity "CRITICAL"] [hostname "momheadquarters.com"] [uri "/.env.bak"] [unique_id "alxg7XzbEu1Ap1Mwpo_MPAABMzk"]
[Sat Jul 18 23:30:21.565062 2026] [security2:error] [pid 890058:tid 890092] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "momheadquarters.com"] [uri "/backend/.env"] [unique_id "alxg7XzbEu1Ap1Mwpo_MQAABMyE"]
[Sat Jul 18 23:30:21.565212 2026] [security2:error] [pid 890058:tid 890179] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "momheadquarters.com"] [uri "/api/.env"] [unique_id "alxg7XzbEu1Ap1Mwpo_MQQABM3g"]
[Sat Jul 18 23:30:21.579742 2026] [security2:error] [pid 890058:tid 890244] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7XzbEu1Ap1Mwpo_MMQAAAUI"]
[Sat Jul 18 23:30:21.603860 2026] [security2:error] [pid 890058:tid 890265] [client 40.77.167.77:48341] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.bandsir.com"] [uri "/index.php"] [unique_id "alxg7XzbEu1Ap1Mwpo_MKwAAAVc"]
[Sat Jul 18 23:30:21.608744 2026] [security2:error] [pid 890058:tid 890121] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "partnerselectricalllc.com"] [uri "/api/graphql"] [unique_id "alxg7XzbEu1Ap1Mwpo_MRgABbD4"]
[Sat Jul 18 23:30:21.630417 2026] [security2:error] [pid 890058:tid 890087] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "partnerselectricalllc.com"] [uri "/backend/.env"] [unique_id "alxg7XzbEu1Ap1Mwpo_MSgABWRw"]
[Sat Jul 18 23:30:21.632677 2026] [security2:error] [pid 890058:tid 890118] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "partnerselectricalllc.com"] [uri "/api/.env"] [unique_id "alxg7XzbEu1Ap1Mwpo_MTQABWTs"]
[Sat Jul 18 23:30:21.635042 2026] [security2:error] [pid 890058:tid 890273] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7XzbEu1Ap1Mwpo_MOAAAAV8"]
[Sat Jul 18 23:30:21.635130 2026] [security2:error] [pid 890058:tid 890315] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7XzbEu1Ap1Mwpo_MOQAAAYk"]
[Sat Jul 18 23:30:21.635160 2026] [security2:error] [pid 890058:tid 890059] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.old$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1263"] [id "390583"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .old)"] [severity "CRITICAL"] [hostname "partnerselectricalllc.com"] [uri "/.env.old"] [unique_id "alxg7XzbEu1Ap1Mwpo_MTwABWQA"]
[Sat Jul 18 23:30:21.669379 2026] [security2:error] [pid 890058:tid 890130] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "partnerselectricalllc.com"] [uri "/config/.env"] [unique_id "alxg7XzbEu1Ap1Mwpo_MUQABWUc"]
[Sat Jul 18 23:30:21.679577 2026] [security2:error] [pid 890058:tid 890251] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7XzbEu1Ap1Mwpo_MQgAAAUk"]
[Sat Jul 18 23:30:21.738093 2026] [security2:error] [pid 890058:tid 890145] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "momheadquarters.com"] [uri "/secrets.yml"] [unique_id "alxg7XzbEu1Ap1Mwpo_MZAABXVY"]
[Sat Jul 18 23:30:21.738270 2026] [security2:error] [pid 890058:tid 890271] [client 34.39.87.128:53338] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "momheadquarters.com"] [uri "/secrets.yml"] [unique_id "alxg7XzbEu1Ap1Mwpo_MZAABXVY"]
[Sat Jul 18 23:30:21.822605 2026] [security2:error] [pid 890058:tid 890252] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7XzbEu1Ap1Mwpo_MYAAAAUo"]
[Sat Jul 18 23:30:21.845254 2026] [security2:error] [pid 890058:tid 890127] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "momheadquarters.com"] [uri "/config/.env"] [unique_id "alxg7XzbEu1Ap1Mwpo_McgABO0Q"]
[Sat Jul 18 23:30:21.901303 2026] [security2:error] [pid 890058:tid 890307] [client 138.252.89.100:56240] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxg7XzbEu1Ap1Mwpo_MdgAAAYE"]
[Sat Jul 18 23:30:21.901414 2026] [security2:error] [pid 890058:tid 890307] [client 138.252.89.100:56240] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxg7XzbEu1Ap1Mwpo_MdgAAAYE"]
[Sat Jul 18 23:30:21.904018 2026] [security2:error] [pid 890058:tid 890284] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg7XzbEu1Ap1Mwpo_MUAAAAWo"]
[Sat Jul 18 23:30:21.950723 2026] [security2:error] [pid 890058:tid 890247] [client 4.194.217.15:7619] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/radio.php"] [unique_id "alxg7XzbEu1Ap1Mwpo_MeQAAAUU"]
[Sat Jul 18 23:30:21.955679 2026] [security2:error] [pid 890058:tid 890237] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7XzbEu1Ap1Mwpo_McQABOyM"]
[Sat Jul 18 23:30:21.955989 2026] [security2:error] [pid 890058:tid 890237] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7XzbEu1Ap1Mwpo_McAABO2w"]
[Sat Jul 18 23:30:22.101460 2026] [security2:error] [pid 890058:tid 890298] [client 27.34.68.67:43110] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_MiAAAAXg"]
[Sat Jul 18 23:30:22.101610 2026] [security2:error] [pid 890058:tid 890298] [client 27.34.68.67:43110] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_MiAAAAXg"]
[Sat Jul 18 23:30:22.115927 2026] [security2:error] [pid 890058:tid 890301] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7XzbEu1Ap1Mwpo_MgAABe28"]
[Sat Jul 18 23:30:22.119118 2026] [security2:error] [pid 890058:tid 890061] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "partnerselectricalllc.com"] [uri "/v1/graphql"] [unique_id "alxg7nzbEu1Ap1Mwpo_MjQABJQI"]
[Sat Jul 18 23:30:22.155722 2026] [security2:error] [pid 890058:tid 890251] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_MhAAAAUk"]
[Sat Jul 18 23:30:22.160837 2026] [authz_core:error] [pid 890058:tid 890263] [client 34.100.180.213:0] AH01630: client denied by server configuration: /home3/obilesur/public_html/partnerselectricalllc/site/.htpasswd
[Sat Jul 18 23:30:22.182371 2026] [security2:error] [pid 890058:tid 890190] [client 65.0.26.70:21002] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.26.0.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_MmgAAAQw"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:30:22.224413 2026] [security2:error] [pid 890058:tid 890290] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg7XzbEu1Ap1Mwpo_MfgAAAXA"]
[Sat Jul 18 23:30:22.226838 2026] [security2:error] [pid 890058:tid 890301] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_MiQABewY"]
[Sat Jul 18 23:30:22.238946 2026] [security2:error] [pid 890058:tid 890301] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_MigABewE"]
[Sat Jul 18 23:30:22.239098 2026] [security2:error] [pid 890058:tid 890301] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_MiwABe0E"]
[Sat Jul 18 23:30:22.270205 2026] [security2:error] [pid 890058:tid 890075] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "momheadquarters.com"] [uri "/.s3cfg"] [unique_id "alxg7nzbEu1Ap1Mwpo_MqQABexA"]
[Sat Jul 18 23:30:22.270362 2026] [security2:error] [pid 890058:tid 890301] [client 34.39.87.128:53338] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "momheadquarters.com"] [uri "/.s3cfg"] [unique_id "alxg7nzbEu1Ap1Mwpo_MqQABexA"]
[Sat Jul 18 23:30:22.272341 2026] [security2:error] [pid 890058:tid 890114] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "momheadquarters.com"] [uri "/.ssh/id_rsa"] [unique_id "alxg7nzbEu1Ap1Mwpo_MqwABezc"]
[Sat Jul 18 23:30:22.344875 2026] [security2:error] [pid 890058:tid 890301] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_MoQABe2g"]
[Sat Jul 18 23:30:22.386494 2026] [security2:error] [pid 890058:tid 890301] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_MrAABe3E"]
[Sat Jul 18 23:30:22.408837 2026] [security2:error] [pid 890058:tid 890275] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_MlwAAAWE"]
[Sat Jul 18 23:30:22.414455 2026] [security2:error] [pid 890058:tid 890289] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_MtQAAAW8"]
[Sat Jul 18 23:30:22.415566 2026] [security2:error] [pid 890058:tid 890306] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_MmQAAAYA"]
[Sat Jul 18 23:30:22.416832 2026] [security2:error] [pid 890058:tid 890246] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_MtgAAAUQ"]
[Sat Jul 18 23:30:22.425037 2026] [security2:error] [pid 890058:tid 890164] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "momheadquarters.com"] [uri "/.ssh/id_ecdsa"] [unique_id "alxg7nzbEu1Ap1Mwpo_MwwABe2k"]
[Sat Jul 18 23:30:22.425167 2026] [security2:error] [pid 890058:tid 890301] [client 34.39.87.128:53338] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "momheadquarters.com"] [uri "/.ssh/id_ecdsa"] [unique_id "alxg7nzbEu1Ap1Mwpo_MwwABe2k"]
[Sat Jul 18 23:30:22.425353 2026] [security2:error] [pid 890058:tid 890269] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_MtAAAAVs"]
[Sat Jul 18 23:30:22.461006 2026] [security2:error] [pid 890058:tid 890115] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "momheadquarters.com"] [uri "/.ssh/id_dsa"] [unique_id "alxg7nzbEu1Ap1Mwpo_MyAABNjg"]
[Sat Jul 18 23:30:22.518854 2026] [security2:error] [pid 890058:tid 890312] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_MsgAAAYY"]
[Sat Jul 18 23:30:22.523153 2026] [security2:error] [pid 890058:tid 890144] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "partnerselectricalllc.com"] [uri "/.ssh/id_rsa"] [unique_id "alxg7nzbEu1Ap1Mwpo_MzgABJVU"]
[Sat Jul 18 23:30:22.538577 2026] [security2:error] [pid 890058:tid 890158] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "partnerselectricalllc.com"] [uri "/terraform.tfstate"] [unique_id "alxg7nzbEu1Ap1Mwpo_M0QABJWM"]
[Sat Jul 18 23:30:22.560462 2026] [security2:error] [pid 890058:tid 890152] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "momheadquarters.com"] [uri "/id_dsa"] [unique_id "alxg7nzbEu1Ap1Mwpo_M1gABNl0"]
[Sat Jul 18 23:30:22.586793 2026] [security2:error] [pid 890058:tid 890220] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_MvAAAASo"]
[Sat Jul 18 23:30:22.594226 2026] [security2:error] [pid 890058:tid 890277] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_MygAAAWM"]
[Sat Jul 18 23:30:22.705093 2026] [security2:error] [pid 890058:tid 890149] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "partnerselectricalllc.com"] [uri "/.ssh/id_dsa"] [unique_id "alxg7nzbEu1Ap1Mwpo_M4gABJVo"]
[Sat Jul 18 23:30:22.711350 2026] [security2:error] [pid 890058:tid 890208] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_M2wAAAR4"]
[Sat Jul 18 23:30:22.714711 2026] [security2:error] [pid 890058:tid 890260] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_M2gAAAVI"]
[Sat Jul 18 23:30:22.723494 2026] [security2:error] [pid 890058:tid 890067] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "momheadquarters.com"] [uri "/.ssh/known_hosts"] [unique_id "alxg7nzbEu1Ap1Mwpo_M5wABYQg"]
[Sat Jul 18 23:30:22.725167 2026] [security2:error] [pid 890058:tid 890100] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "momheadquarters.com"] [uri "/id_rsa"] [unique_id "alxg7nzbEu1Ap1Mwpo_M6AABKSk"]
[Sat Jul 18 23:30:22.728093 2026] [security2:error] [pid 890058:tid 890175] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "momheadquarters.com"] [uri "/key.pem"] [unique_id "alxg7nzbEu1Ap1Mwpo_M6QABP3Q"]
[Sat Jul 18 23:30:22.738492 2026] [security2:error] [pid 890058:tid 890262] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_MzwAAAVQ"]
[Sat Jul 18 23:30:22.781355 2026] [security2:error] [pid 890058:tid 890236] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_M2QAAATo"]
[Sat Jul 18 23:30:22.784551 2026] [security2:error] [pid 890058:tid 890288] [client 4.194.217.15:8658] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/randkeyword.php7"] [unique_id "alxg7nzbEu1Ap1Mwpo_M9AAAAW4"]
[Sat Jul 18 23:30:22.808898 2026] [security2:error] [pid 890058:tid 890173] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "momheadquarters.com"] [uri "/id_ecdsa"] [unique_id "alxg7nzbEu1Ap1Mwpo_M-QABb3I"]
[Sat Jul 18 23:30:22.810159 2026] [security2:error] [pid 890058:tid 890132] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "momheadquarters.com"] [uri "/privatekey.key"] [unique_id "alxg7nzbEu1Ap1Mwpo_M-wABb0k"]
[Sat Jul 18 23:30:22.889928 2026] [security2:error] [pid 890058:tid 890193] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_M8QAAAQ8"]
[Sat Jul 18 23:30:22.920867 2026] [security2:error] [pid 890058:tid 890159] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "partnerselectricalllc.com"] [uri "/id_rsa"] [unique_id "alxg7nzbEu1Ap1Mwpo_NGAABcGQ"]
[Sat Jul 18 23:30:22.939332 2026] [security2:error] [pid 890058:tid 890251] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_NAQAAAUk"]
[Sat Jul 18 23:30:22.942551 2026] [security2:error] [pid 890058:tid 890276] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_NAgAAAWI"]
[Sat Jul 18 23:30:23.044569 2026] [security2:error] [pid 890058:tid 890297] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_NGgAAAXc"]
[Sat Jul 18 23:30:23.048199 2026] [security2:error] [pid 890058:tid 890310] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_NGQAAAYQ"]
[Sat Jul 18 23:30:23.077362 2026] [security2:error] [pid 890058:tid 890174] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "momheadquarters.com"] [uri "/.openclaw/.env"] [unique_id "alxg73zbEu1Ap1Mwpo_NMAABfHM"]
[Sat Jul 18 23:30:23.155026 2026] [security2:error] [pid 890058:tid 890079] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "partnerselectricalllc.com"] [uri "/privatekey.key"] [unique_id "alxg73zbEu1Ap1Mwpo_NOwABcBQ"]
[Sat Jul 18 23:30:23.155687 2026] [security2:error] [pid 890058:tid 890177] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "partnerselectricalllc.com"] [uri "/key.pem"] [unique_id "alxg73zbEu1Ap1Mwpo_NOgABcHY"]
[Sat Jul 18 23:30:23.201740 2026] [security2:error] [pid 890058:tid 890069] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "momheadquarters.com"] [uri "/.hermes/.env"] [unique_id "alxg73zbEu1Ap1Mwpo_NQwABfAo"]
[Sat Jul 18 23:30:23.209816 2026] [security2:error] [pid 890058:tid 890302] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg73zbEu1Ap1Mwpo_NLAABfBo"]
[Sat Jul 18 23:30:23.229393 2026] [security2:error] [pid 890058:tid 890285] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg73zbEu1Ap1Mwpo_NMQAAAWs"]
[Sat Jul 18 23:30:23.235294 2026] [security2:error] [pid 890058:tid 890091] [remote 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg73zbEu1Ap1Mwpo_NMgABfCA"]
[Sat Jul 18 23:30:23.236053 2026] [security2:error] [pid 890058:tid 890271] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_NFwAAAV0"]
[Sat Jul 18 23:30:23.241281 2026] [security2:error] [pid 890058:tid 890103] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "partnerselectricalllc.com"] [uri "/localhost.key"] [unique_id "alxg73zbEu1Ap1Mwpo_NTwABcCw"]
[Sat Jul 18 23:30:23.241425 2026] [security2:error] [pid 890058:tid 890290] [client 34.100.180.213:58168] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "partnerselectricalllc.com"] [uri "/localhost.key"] [unique_id "alxg73zbEu1Ap1Mwpo_NTwABcCw"]
[Sat Jul 18 23:30:23.242971 2026] [security2:error] [pid 890058:tid 890302] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg73zbEu1Ap1Mwpo_NNAABfCY"]
[Sat Jul 18 23:30:23.247546 2026] [security2:error] [pid 890058:tid 890221] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_NFQAAASs"]
[Sat Jul 18 23:30:23.270219 2026] [security2:error] [pid 890058:tid 890199] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_NJAAAARU"]
[Sat Jul 18 23:30:23.277829 2026] [security2:error] [pid 890058:tid 890270] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg73zbEu1Ap1Mwpo_NOAAAAVw"]
[Sat Jul 18 23:30:23.287801 2026] [security2:error] [pid 890058:tid 890110] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "partnerselectricalllc.com"] [uri "/id_dsa"] [unique_id "alxg73zbEu1Ap1Mwpo_NVQABcDM"]
[Sat Jul 18 23:30:23.292524 2026] [security2:error] [pid 890058:tid 890204] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_NJQAAARo"]
[Sat Jul 18 23:30:23.307319 2026] [security2:error] [pid 890058:tid 890230] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_NKAAAATQ"]
[Sat Jul 18 23:30:23.313726 2026] [security2:error] [pid 890058:tid 890237] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_NJwAAATs"]
[Sat Jul 18 23:30:23.319956 2026] [security2:error] [pid 890058:tid 890229] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg73zbEu1Ap1Mwpo_NQAAAATM"]
[Sat Jul 18 23:30:23.334241 2026] [security2:error] [pid 890058:tid 890275] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg7nzbEu1Ap1Mwpo_NKgAAAWE"]
[Sat Jul 18 23:30:23.361173 2026] [security2:error] [pid 890058:tid 890274] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg73zbEu1Ap1Mwpo_NUQAAAWA"]
[Sat Jul 18 23:30:23.366882 2026] [security2:error] [pid 890058:tid 890258] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg73zbEu1Ap1Mwpo_NUAAAAVA"]
[Sat Jul 18 23:30:23.382347 2026] [security2:error] [pid 890058:tid 890307] [client 4.194.217.15:2094] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/readme.php"] [unique_id "alxg73zbEu1Ap1Mwpo_NXQAAAYE"]
[Sat Jul 18 23:30:23.384531 2026] [security2:error] [pid 890058:tid 890108] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "momheadquarters.com"] [uri "/.config/anthropic/credentials/default.json"] [unique_id "alxg73zbEu1Ap1Mwpo_NXgABazE"]
[Sat Jul 18 23:30:23.453286 2026] [security2:error] [pid 890058:tid 890250] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg73zbEu1Ap1Mwpo_NTQAAAUg"]
[Sat Jul 18 23:30:23.504239 2026] [security2:error] [pid 890058:tid 890253] [client 186.22.253.252:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mtlegnews.gov"] [uri "/index.php"] [unique_id "alxg73zbEu1Ap1Mwpo_NPwAAAUs"]
[Sat Jul 18 23:30:23.513281 2026] [security2:error] [pid 890058:tid 890196] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg73zbEu1Ap1Mwpo_NZAAAARI"]
[Sat Jul 18 23:30:23.513507 2026] [security2:error] [pid 890058:tid 890264] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg73zbEu1Ap1Mwpo_NYQABVjI"]
[Sat Jul 18 23:30:23.514296 2026] [security2:error] [pid 890058:tid 890264] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg73zbEu1Ap1Mwpo_NYgABVlw"]
[Sat Jul 18 23:30:23.565359 2026] [security2:error] [pid 890058:tid 890131] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "momheadquarters.com"] [uri "/.bash_profile"] [unique_id "alxg73zbEu1Ap1Mwpo_NbQABVkg"]
[Sat Jul 18 23:30:23.567912 2026] [security2:error] [pid 890058:tid 890101] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "partnerselectricalllc.com"] [uri "/ssl/server.key"] [unique_id "alxg73zbEu1Ap1Mwpo_NbwABYio"]
[Sat Jul 18 23:30:23.607391 2026] [security2:error] [pid 890058:tid 890264] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg73zbEu1Ap1Mwpo_NZwABVlY"]
[Sat Jul 18 23:30:23.609466 2026] [security2:error] [pid 890058:tid 890185] [remote 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg73zbEu1Ap1Mwpo_NaQABVn4"]
[Sat Jul 18 23:30:23.656896 2026] [security2:error] [pid 890058:tid 890251] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg73zbEu1Ap1Mwpo_NbAAAAUk"]
[Sat Jul 18 23:30:23.692773 2026] [security2:error] [pid 890058:tid 890143] [remote 216.73.216.174:12283] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.216.73.216.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/contact-us/"] [unique_id "alxg73zbEu1Ap1Mwpo_NeQABJlQ"]
[Sat Jul 18 23:30:23.704569 2026] [security2:error] [pid 890058:tid 890094] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "momheadquarters.com"] [uri "/laravel/.env"] [unique_id "alxg73zbEu1Ap1Mwpo_NfAABdyM"]
[Sat Jul 18 23:30:23.757422 2026] [security2:error] [pid 890058:tid 890061] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-config\\\\.php(?:\\\\W[a-z]*|bak)" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "300"] [id "900256"] [msg "Wp-Config Backup/edit file request"] [hostname "momheadquarters.com"] [uri "/wp-config.php.bak"] [unique_id "alxg73zbEu1Ap1Mwpo_NiwABDgI"]
[Sat Jul 18 23:30:23.757606 2026] [security2:error] [pid 890058:tid 890192] [client 34.39.87.128:53338] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "momheadquarters.com"] [uri "/wp-config.php.bak"] [unique_id "alxg73zbEu1Ap1Mwpo_NiwABDgI"]
[Sat Jul 18 23:30:23.795949 2026] [security2:error] [pid 890058:tid 890202] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg73zbEu1Ap1Mwpo_NcQAAARg"]
[Sat Jul 18 23:30:23.798399 2026] [security2:error] [pid 890058:tid 890168] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "partnerselectricalllc.com"] [uri "/.hermes/.env"] [unique_id "alxg73zbEu1Ap1Mwpo_NlAABYm0"]
[Sat Jul 18 23:30:23.798619 2026] [security2:error] [pid 890058:tid 890276] [client 34.100.180.213:58168] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "partnerselectricalllc.com"] [uri "/.hermes/.env"] [unique_id "alxg73zbEu1Ap1Mwpo_NlAABYm0"]
[Sat Jul 18 23:30:23.799360 2026] [security2:error] [pid 890058:tid 890098] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "partnerselectricalllc.com"] [uri "/.openclaw/.env"] [unique_id "alxg73zbEu1Ap1Mwpo_NkwABYic"]
[Sat Jul 18 23:30:23.849652 2026] [security2:error] [pid 890058:tid 890220] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg73zbEu1Ap1Mwpo_NhgAAASo"]
[Sat Jul 18 23:30:23.871438 2026] [security2:error] [pid 890058:tid 890192] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg73zbEu1Ap1Mwpo_NigABDm8"]
[Sat Jul 18 23:30:23.929956 2026] [security2:error] [pid 890058:tid 890133] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-config\\\\.php(?:\\\\W[a-z]*|bak)" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "300"] [id "900256"] [msg "Wp-Config Backup/edit file request"] [hostname "momheadquarters.com"] [uri "/wp-config.php.old"] [unique_id "alxg73zbEu1Ap1Mwpo_NrQABQUo"]
[Sat Jul 18 23:30:23.941611 2026] [security2:error] [pid 890058:tid 890291] [client 4.194.217.15:7146] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/reze.php"] [unique_id "alxg73zbEu1Ap1Mwpo_NrwAAAXE"]
[Sat Jul 18 23:30:24.152955 2026] [security2:error] [pid 890058:tid 890206] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg73zbEu1Ap1Mwpo_NnwAAARw"]
[Sat Jul 18 23:30:24.163090 2026] [security2:error] [pid 890058:tid 890233] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg73zbEu1Ap1Mwpo_NnAAAATc"]
[Sat Jul 18 23:30:24.189329 2026] [security2:error] [pid 890058:tid 890293] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg73zbEu1Ap1Mwpo_NngAAAXM"]
[Sat Jul 18 23:30:24.264876 2026] [security2:error] [pid 890058:tid 890115] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.87.39.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "momheadquarters.com"] [uri "/config.php.bak"] [unique_id "alxg8HzbEu1Ap1Mwpo_NzgABIDg"]
[Sat Jul 18 23:30:24.266576 2026] [security2:error] [pid 890058:tid 890081] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.87.39.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "momheadquarters.com"] [uri "/config/.env.php"] [unique_id "alxg8HzbEu1Ap1Mwpo_NzwABXhY"]
[Sat Jul 18 23:30:24.283712 2026] [security2:error] [pid 890058:tid 890306] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg73zbEu1Ap1Mwpo_NrAAAAYA"]
[Sat Jul 18 23:30:24.363353 2026] [security2:error] [pid 890058:tid 890152] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-config\\\\.php(?:\\\\W[a-z]*|bak)" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "300"] [id "900256"] [msg "Wp-Config Backup/edit file request"] [hostname "partnerselectricalllc.com"] [uri "/wp-config.php.bak"] [unique_id "alxg8HzbEu1Ap1Mwpo_N3gABYl0"]
[Sat Jul 18 23:30:24.377946 2026] [security2:error] [pid 890058:tid 890221] [client 124.29.246.106:57509] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxg8HzbEu1Ap1Mwpo_N3wAAASs"]
[Sat Jul 18 23:30:24.378114 2026] [security2:error] [pid 890058:tid 890221] [client 124.29.246.106:57509] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxg8HzbEu1Ap1Mwpo_N3wAAASs"]
[Sat Jul 18 23:30:24.415681 2026] [security2:error] [pid 890058:tid 890090] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.87.39.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "momheadquarters.com"] [uri "/.env.php.bak"] [unique_id "alxg8HzbEu1Ap1Mwpo_N6AABfx8"]
[Sat Jul 18 23:30:24.415761 2026] [security2:error] [pid 890058:tid 890067] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.87.39.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "momheadquarters.com"] [uri "/configuration.php.bak"] [unique_id "alxg8HzbEu1Ap1Mwpo_N6QABfwg"]
[Sat Jul 18 23:30:24.416555 2026] [security2:error] [pid 890058:tid 890100] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "momheadquarters.com"] [uri "/web/.env"] [unique_id "alxg8HzbEu1Ap1Mwpo_N6gABfyk"]
[Sat Jul 18 23:30:24.416556 2026] [security2:error] [pid 890058:tid 890122] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "momheadquarters.com"] [uri "/core/.env"] [unique_id "alxg8HzbEu1Ap1Mwpo_N5QABfz8"]
[Sat Jul 18 23:30:24.416672 2026] [security2:error] [pid 890058:tid 890074] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "momheadquarters.com"] [uri "/public/.env"] [unique_id "alxg8HzbEu1Ap1Mwpo_N5wABfw8"]
[Sat Jul 18 23:30:24.417226 2026] [security2:error] [pid 890058:tid 890149] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.sw[a-z]$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1275"] [id "390587"] [rev "5"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .sw)"] [severity "CRITICAL"] [hostname "momheadquarters.com"] [uri "/.env.swp"] [unique_id "alxg8HzbEu1Ap1Mwpo_N5AABf1o"]
[Sat Jul 18 23:30:24.417289 2026] [security2:error] [pid 890058:tid 890282] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8HzbEu1Ap1Mwpo_N2QAAAWg"]
[Sat Jul 18 23:30:24.420708 2026] [security2:error] [pid 890058:tid 890208] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8HzbEu1Ap1Mwpo_N2wAAAR4"]
[Sat Jul 18 23:30:24.482487 2026] [security2:error] [pid 890058:tid 890280] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg8HzbEu1Ap1Mwpo_NxwAAAWY"]
[Sat Jul 18 23:30:24.497959 2026] [security2:error] [pid 890058:tid 890270] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg8HzbEu1Ap1Mwpo_N1QAAAVw"]
[Sat Jul 18 23:30:24.501427 2026] [security2:error] [pid 890058:tid 890260] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg8HzbEu1Ap1Mwpo_N0wAAAVI"]
[Sat Jul 18 23:30:24.504374 2026] [security2:error] [pid 890058:tid 890289] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg8HzbEu1Ap1Mwpo_N1wAAAW8"]
[Sat Jul 18 23:30:24.506139 2026] [security2:error] [pid 890058:tid 890309] [client 4.194.217.15:7107] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/rh.php"] [unique_id "alxg8HzbEu1Ap1Mwpo_N7gAAAYM"]
[Sat Jul 18 23:30:24.527144 2026] [security2:error] [pid 890058:tid 890305] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8HzbEu1Ap1Mwpo_N5gABfz0"]
[Sat Jul 18 23:30:24.535867 2026] [security2:error] [pid 890058:tid 890175] [remote 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8HzbEu1Ap1Mwpo_N6wABf3Q"]
[Sat Jul 18 23:30:24.641472 2026] [security2:error] [pid 890058:tid 890073] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "partnerselectricalllc.com"] [uri "/laravel/.env"] [unique_id "alxg8HzbEu1Ap1Mwpo_N9wABVQ4"]
[Sat Jul 18 23:30:24.644021 2026] [security2:error] [pid 890058:tid 890129] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-config\\\\.php(?:\\\\W[a-z]*|bak)" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "300"] [id "900256"] [msg "Wp-Config Backup/edit file request"] [hostname "partnerselectricalllc.com"] [uri "/wp-config.php.old"] [unique_id "alxg8HzbEu1Ap1Mwpo_N-AABEEY"]
[Sat Jul 18 23:30:24.645279 2026] [security2:error] [pid 890058:tid 890132] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "partnerselectricalllc.com"] [uri "/config/.env.php"] [unique_id "alxg8HzbEu1Ap1Mwpo_N-gABY0k"]
[Sat Jul 18 23:30:24.645377 2026] [security2:error] [pid 890058:tid 890277] [client 34.100.180.213:58168] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "partnerselectricalllc.com"] [uri "/config/.env.php"] [unique_id "alxg8HzbEu1Ap1Mwpo_N-gABY0k"]
[Sat Jul 18 23:30:24.656979 2026] [security2:error] [pid 890058:tid 890147] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 213.180.100.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "partnerselectricalllc.com"] [uri "/.env.php.bak"] [unique_id "alxg8HzbEu1Ap1Mwpo_N-wABY1g"]
[Sat Jul 18 23:30:24.657840 2026] [security2:error] [pid 890058:tid 890080] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "partnerselectricalllc.com"] [uri "/core/.env"] [unique_id "alxg8HzbEu1Ap1Mwpo_N_gABYxU"]
[Sat Jul 18 23:30:24.756078 2026] [security2:error] [pid 890058:tid 890310] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8HzbEu1Ap1Mwpo_N_QABhH0"]
[Sat Jul 18 23:30:24.783198 2026] [security2:error] [pid 890058:tid 890228] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8HzbEu1Ap1Mwpo_OAQAAATI"]
[Sat Jul 18 23:30:24.793498 2026] [security2:error] [pid 890058:tid 890174] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "momheadquarters.com"] [uri "/.well-known/jwks.json"] [unique_id "alxg8HzbEu1Ap1Mwpo_ODQABhHM"]
[Sat Jul 18 23:30:24.827080 2026] [security2:error] [pid 890058:tid 890069] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.sw[a-z]$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1275"] [id "390587"] [rev "5"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .sw)"] [severity "CRITICAL"] [hostname "partnerselectricalllc.com"] [uri "/.env.swp"] [unique_id "alxg8HzbEu1Ap1Mwpo_OFgABYwo"]
[Sat Jul 18 23:30:24.840227 2026] [security2:error] [pid 890058:tid 890091] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "partnerselectricalllc.com"] [uri "/public/.env"] [unique_id "alxg8HzbEu1Ap1Mwpo_OGwABYyA"]
[Sat Jul 18 23:30:24.854038 2026] [security2:error] [pid 890058:tid 890277] [client 34.100.180.213:58168] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg8HzbEu1Ap1Mwpo_N-QABY3I"]
[Sat Jul 18 23:30:24.855266 2026] [security2:error] [pid 890058:tid 890111] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 213.180.100.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "partnerselectricalllc.com"] [uri "/configuration.php.bak"] [unique_id "alxg8HzbEu1Ap1Mwpo_OIAABYzQ"]
[Sat Jul 18 23:30:24.884360 2026] [security2:error] [pid 890058:tid 890310] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8HzbEu1Ap1Mwpo_OBgABhBc"]
[Sat Jul 18 23:30:24.898639 2026] [security2:error] [pid 890058:tid 890181] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 213.180.100.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "partnerselectricalllc.com"] [uri "/config.php.bak"] [unique_id "alxg8HzbEu1Ap1Mwpo_OLgABY3o"]
[Sat Jul 18 23:30:24.915645 2026] [security2:error] [pid 890058:tid 890233] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8HzbEu1Ap1Mwpo_ODwAAATc"]
[Sat Jul 18 23:30:24.923080 2026] [security2:error] [pid 890058:tid 890203] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8HzbEu1Ap1Mwpo_OEAAAARk"]
[Sat Jul 18 23:30:24.927624 2026] [security2:error] [pid 890058:tid 890310] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8HzbEu1Ap1Mwpo_OEwABhBQ"]
[Sat Jul 18 23:30:24.936624 2026] [security2:error] [pid 890058:tid 890310] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8HzbEu1Ap1Mwpo_OFAABhHY"]
[Sat Jul 18 23:30:24.940126 2026] [security2:error] [pid 890058:tid 890310] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8HzbEu1Ap1Mwpo_OEgABhBs"]
[Sat Jul 18 23:30:24.941684 2026] [security2:error] [pid 890058:tid 890275] [client 223.228.182.224:53129] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxg8HzbEu1Ap1Mwpo_OMAAAAWE"]
[Sat Jul 18 23:30:24.941808 2026] [security2:error] [pid 890058:tid 890275] [client 223.228.182.224:53129] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxg8HzbEu1Ap1Mwpo_OMAAAAWE"]
[Sat Jul 18 23:30:24.959150 2026] [security2:error] [pid 890058:tid 890204] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8HzbEu1Ap1Mwpo_OHwAAARo"]
[Sat Jul 18 23:30:24.970774 2026] [security2:error] [pid 890058:tid 890262] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8HzbEu1Ap1Mwpo_OIQAAAVQ"]
[Sat Jul 18 23:30:25.075121 2026] [security2:error] [pid 890058:tid 890309] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg8HzbEu1Ap1Mwpo_OJQAAAYM"]
[Sat Jul 18 23:30:25.079252 2026] [security2:error] [pid 890058:tid 890226] [client 4.194.217.15:5657] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/rip.php"] [unique_id "alxg8XzbEu1Ap1Mwpo_ORgAAATA"]
[Sat Jul 18 23:30:25.130076 2026] [security2:error] [pid 890058:tid 890108] [remote 34.39.87.128:53338] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "momheadquarters.com"] [uri "/api/openapi.json"] [unique_id "alxg8XzbEu1Ap1Mwpo_OTQABFTE"]
[Sat Jul 18 23:30:25.130304 2026] [security2:error] [pid 890058:tid 890199] [client 34.39.87.128:53338] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "momheadquarters.com"] [uri "/api/openapi.json"] [unique_id "alxg8XzbEu1Ap1Mwpo_OTQABFTE"]
[Sat Jul 18 23:30:25.170268 2026] [security2:error] [pid 890058:tid 890272] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8XzbEu1Ap1Mwpo_OPwAAAV4"]
[Sat Jul 18 23:30:25.209080 2026] [security2:error] [pid 890058:tid 890151] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "partnerselectricalllc.com"] [uri "/web/.env"] [unique_id "alxg8XzbEu1Ap1Mwpo_OWAABY1w"]
[Sat Jul 18 23:30:25.225886 2026] [security2:error] [pid 890058:tid 890131] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "partnerselectricalllc.com"] [uri "/firebase-config.json"] [unique_id "alxg8XzbEu1Ap1Mwpo_OWwABY0g"]
[Sat Jul 18 23:30:25.241622 2026] [security2:error] [pid 890058:tid 890199] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8XzbEu1Ap1Mwpo_OTAABFVE"]
[Sat Jul 18 23:30:25.253308 2026] [security2:error] [pid 890058:tid 890199] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8XzbEu1Ap1Mwpo_OTwABFQA"]
[Sat Jul 18 23:30:25.266922 2026] [security2:error] [pid 890058:tid 890200] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8XzbEu1Ap1Mwpo_OUgAAARY"]
[Sat Jul 18 23:30:25.301772 2026] [security2:error] [pid 890058:tid 890267] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg8XzbEu1Ap1Mwpo_ORwAAAVk"]
[Sat Jul 18 23:30:25.324528 2026] [security2:error] [pid 890058:tid 890303] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg8XzbEu1Ap1Mwpo_OSAAAAX0"]
[Sat Jul 18 23:30:25.386592 2026] [security2:error] [pid 890058:tid 890223] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8XzbEu1Ap1Mwpo_OYwAAAS0"]
[Sat Jul 18 23:30:25.406493 2026] [security2:error] [pid 890058:tid 890292] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg8XzbEu1Ap1Mwpo_OVQAAAXI"]
[Sat Jul 18 23:30:25.463719 2026] [security2:error] [pid 890058:tid 890265] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg8XzbEu1Ap1Mwpo_OYgAAAVc"]
[Sat Jul 18 23:30:25.470388 2026] [security2:error] [pid 890058:tid 890220] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8XzbEu1Ap1Mwpo_OawAAASo"]
[Sat Jul 18 23:30:25.475241 2026] [security2:error] [pid 890058:tid 890315] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8XzbEu1Ap1Mwpo_ObQAAAYk"]
[Sat Jul 18 23:30:25.708052 2026] [security2:error] [pid 890058:tid 890208] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8XzbEu1Ap1Mwpo_OgwABHm4"]
[Sat Jul 18 23:30:25.710918 2026] [security2:error] [pid 890058:tid 890208] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8XzbEu1Ap1Mwpo_OhAABHgY"]
[Sat Jul 18 23:30:25.763426 2026] [security2:error] [pid 890058:tid 890208] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8XzbEu1Ap1Mwpo_OiQABHnw"]
[Sat Jul 18 23:30:25.763569 2026] [security2:error] [pid 890058:tid 890208] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8XzbEu1Ap1Mwpo_OhgABHgE"]
[Sat Jul 18 23:30:25.774522 2026] [security2:error] [pid 890058:tid 890208] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8XzbEu1Ap1Mwpo_OigABHkE"]
[Sat Jul 18 23:30:25.776131 2026] [security2:error] [pid 890058:tid 890202] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg8XzbEu1Ap1Mwpo_OgQAAARg"]
[Sat Jul 18 23:30:25.777007 2026] [security2:error] [pid 890058:tid 890062] [remote 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8XzbEu1Ap1Mwpo_OhwABHgM"]
[Sat Jul 18 23:30:25.804441 2026] [security2:error] [pid 890058:tid 890208] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8XzbEu1Ap1Mwpo_OjwABHlI"]
[Sat Jul 18 23:30:25.820191 2026] [security2:error] [pid 890058:tid 890208] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8XzbEu1Ap1Mwpo_OkAABHko"]
[Sat Jul 18 23:30:25.839149 2026] [security2:error] [pid 890058:tid 890287] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8XzbEu1Ap1Mwpo_OkwAAAW0"]
[Sat Jul 18 23:30:25.892073 2026] [security2:error] [pid 890058:tid 890220] [client 223.109.252.250:46768] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.appelmanimages.com"] [uri "/investment/"] [unique_id "alxg8XzbEu1Ap1Mwpo_OowAAASo"]
[Sat Jul 18 23:30:25.892164 2026] [security2:error] [pid 890058:tid 890220] [client 223.109.252.250:46768] ModSecurity: Warning. Matched phrase "Sogou web spider" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "www.appelmanimages.com"] [uri "/investment/"] [unique_id "alxg8XzbEu1Ap1Mwpo_OowAAASo"]
[Sat Jul 18 23:30:25.899776 2026] [security2:error] [pid 890058:tid 890219] [client 4.194.217.15:2099] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/root.php"] [unique_id "alxg8XzbEu1Ap1Mwpo_OpAAAASk"]
[Sat Jul 18 23:30:26.123923 2026] [security2:error] [pid 890058:tid 890260] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8nzbEu1Ap1Mwpo_OrAABUi0"]
[Sat Jul 18 23:30:26.148914 2026] [security2:error] [pid 890058:tid 890153] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "partnerselectricalllc.com"] [uri "/api/v1/config"] [unique_id "alxg8nzbEu1Ap1Mwpo_OtwABUV4"]
[Sat Jul 18 23:30:26.149040 2026] [security2:error] [pid 890058:tid 890259] [client 34.100.180.213:58168] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "partnerselectricalllc.com"] [uri "/api/v1/config"] [unique_id "alxg8nzbEu1Ap1Mwpo_OtwABUV4"]
[Sat Jul 18 23:30:26.149445 2026] [security2:error] [pid 890058:tid 890142] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "partnerselectricalllc.com"] [uri "/api/v2/settings"] [unique_id "alxg8nzbEu1Ap1Mwpo_OuAABUVM"]
[Sat Jul 18 23:30:26.149512 2026] [security2:error] [pid 890058:tid 890259] [client 34.100.180.213:58168] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "partnerselectricalllc.com"] [uri "/api/v2/settings"] [unique_id "alxg8nzbEu1Ap1Mwpo_OuAABUVM"]
[Sat Jul 18 23:30:26.234340 2026] [security2:error] [pid 890058:tid 890269] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8nzbEu1Ap1Mwpo_OsgABWzg"]
[Sat Jul 18 23:30:26.390723 2026] [security2:error] [pid 890058:tid 890259] [client 34.100.180.213:58168] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg8nzbEu1Ap1Mwpo_OugABUXA"]
[Sat Jul 18 23:30:26.405229 2026] [security2:error] [pid 890058:tid 890258] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg8nzbEu1Ap1Mwpo_OvQAAAVA"]
[Sat Jul 18 23:30:26.415234 2026] [security2:error] [pid 890058:tid 890216] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg8nzbEu1Ap1Mwpo_OvAAAASY"]
[Sat Jul 18 23:30:26.449408 2026] [security2:error] [pid 890058:tid 890089] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "partnerselectricalllc.com"] [uri "/swagger.json"] [unique_id "alxg8nzbEu1Ap1Mwpo_O4wABUR4"]
[Sat Jul 18 23:30:26.463937 2026] [security2:error] [pid 890058:tid 890274] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg8nzbEu1Ap1Mwpo_OzAAAAWA"]
[Sat Jul 18 23:30:26.484473 2026] [security2:error] [pid 890058:tid 890084] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "partnerselectricalllc.com"] [uri "/graphql"] [unique_id "alxg8nzbEu1Ap1Mwpo_O5QABURk"]
[Sat Jul 18 23:30:26.490080 2026] [security2:error] [pid 890058:tid 890306] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8nzbEu1Ap1Mwpo_O1gABgE8"]
[Sat Jul 18 23:30:26.494766 2026] [security2:error] [pid 890058:tid 890306] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8nzbEu1Ap1Mwpo_O1wABgFA"]
[Sat Jul 18 23:30:26.495369 2026] [security2:error] [pid 890058:tid 890306] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8nzbEu1Ap1Mwpo_O2QABgEU"]
[Sat Jul 18 23:30:26.513739 2026] [security2:error] [pid 890058:tid 890250] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg8nzbEu1Ap1Mwpo_O0QAAAUg"]
[Sat Jul 18 23:30:26.535988 2026] [security2:error] [pid 890058:tid 890306] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8nzbEu1Ap1Mwpo_O3QABgBM"]
[Sat Jul 18 23:30:26.563020 2026] [security2:error] [pid 890058:tid 890176] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "partnerselectricalllc.com"] [uri "/__env.js"] [unique_id "alxg8nzbEu1Ap1Mwpo_O8QABFnU"]
[Sat Jul 18 23:30:26.767078 2026] [security2:error] [pid 890058:tid 890214] [client 4.194.217.15:2767] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/s.php"] [unique_id "alxg8nzbEu1Ap1Mwpo_PAAAAASQ"]
[Sat Jul 18 23:30:26.794668 2026] [security2:error] [pid 890058:tid 890235] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg8nzbEu1Ap1Mwpo_O8wAAATk"]
[Sat Jul 18 23:30:26.821776 2026] [security2:error] [pid 890058:tid 890209] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8nzbEu1Ap1Mwpo_O_AABHxI"]
[Sat Jul 18 23:30:26.822557 2026] [security2:error] [pid 890058:tid 890069] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "partnerselectricalllc.com"] [uri "/api/graphql"] [unique_id "alxg8nzbEu1Ap1Mwpo_PAwABhQo"]
[Sat Jul 18 23:30:26.824475 2026] [security2:error] [pid 890058:tid 890209] [client 34.39.87.128:53338] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxg8nzbEu1Ap1Mwpo_O-wABHwQ"]
[Sat Jul 18 23:30:26.904877 2026] [security2:error] [pid 890058:tid 890180] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 213.180.100.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "partnerselectricalllc.com"] [uri "/phpinfo.php"] [unique_id "alxg8nzbEu1Ap1Mwpo_PDgABM3k"]
[Sat Jul 18 23:30:26.933929 2026] [security2:error] [pid 890058:tid 890079] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "partnerselectricalllc.com"] [uri "/pi.php"] [unique_id "alxg8nzbEu1Ap1Mwpo_PGQABMxQ"]
[Sat Jul 18 23:30:26.934081 2026] [security2:error] [pid 890058:tid 890229] [client 34.100.180.213:58168] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "partnerselectricalllc.com"] [uri "/pi.php"] [unique_id "alxg8nzbEu1Ap1Mwpo_PGQABMxQ"]
[Sat Jul 18 23:30:26.958505 2026] [security2:error] [pid 890058:tid 890096] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 213.180.100.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "partnerselectricalllc.com"] [uri "/i.php"] [unique_id "alxg8nzbEu1Ap1Mwpo_PHAABMyU"]
[Sat Jul 18 23:30:26.958655 2026] [security2:error] [pid 890058:tid 890177] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 213.180.100.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "partnerselectricalllc.com"] [uri "/info.php"] [unique_id "alxg8nzbEu1Ap1Mwpo_PGwABM3Y"]
[Sat Jul 18 23:30:26.959483 2026] [security2:error] [pid 890058:tid 890086] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 213.180.100.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "partnerselectricalllc.com"] [uri "/test.php"] [unique_id "alxg8nzbEu1Ap1Mwpo_PHQABMxs"]
[Sat Jul 18 23:30:27.162518 2026] [security2:error] [pid 890058:tid 890312] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg8nzbEu1Ap1Mwpo_PBwAAAYY"]
[Sat Jul 18 23:30:27.221391 2026] [security2:error] [pid 890058:tid 890211] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg8nzbEu1Ap1Mwpo_PGAAAASE"]
[Sat Jul 18 23:30:27.222138 2026] [security2:error] [pid 890058:tid 890223] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg8nzbEu1Ap1Mwpo_PFwAAAS0"]
[Sat Jul 18 23:30:27.226278 2026] [security2:error] [pid 890058:tid 890194] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg8nzbEu1Ap1Mwpo_PFAAAARA"]
[Sat Jul 18 23:30:27.242008 2026] [security2:error] [pid 890058:tid 890272] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg8nzbEu1Ap1Mwpo_PFgAAAV4"]
[Sat Jul 18 23:30:27.346253 2026] [security2:error] [pid 890058:tid 890294] [client 4.194.217.15:8782] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/sang.php"] [unique_id "alxg83zbEu1Ap1Mwpo_PQAAAAXQ"]
[Sat Jul 18 23:30:27.351576 2026] [security2:error] [pid 890058:tid 890130] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 213.180.100.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "partnerselectricalllc.com"] [uri "/app_dev.php/_profiler"] [unique_id "alxg83zbEu1Ap1Mwpo_PQwABM0c"]
[Sat Jul 18 23:30:27.398474 2026] [security2:error] [pid 890058:tid 890262] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg83zbEu1Ap1Mwpo_PNQAAAVQ"]
[Sat Jul 18 23:30:27.398641 2026] [security2:error] [pid 890058:tid 890220] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg83zbEu1Ap1Mwpo_PNAAAASo"]
[Sat Jul 18 23:30:27.473059 2026] [security2:error] [pid 890058:tid 890145] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 213.180.100.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "partnerselectricalllc.com"] [uri "/app_dev.php"] [unique_id "alxg83zbEu1Ap1Mwpo_PUAABM1Y"]
[Sat Jul 18 23:30:27.583874 2026] [security2:error] [pid 890058:tid 890232] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg83zbEu1Ap1Mwpo_PSAAAATY"]
[Sat Jul 18 23:30:27.593994 2026] [security2:error] [pid 890058:tid 890247] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg83zbEu1Ap1Mwpo_PRwAAAUU"]
[Sat Jul 18 23:30:27.628088 2026] [security2:error] [pid 890058:tid 890160] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "partnerselectricalllc.com"] [uri "/__debug__/"] [unique_id "alxg83zbEu1Ap1Mwpo_PZwABM2U"]
[Sat Jul 18 23:30:27.628291 2026] [security2:error] [pid 890058:tid 890229] [client 34.100.180.213:58168] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "partnerselectricalllc.com"] [uri "/__debug__/"] [unique_id "alxg83zbEu1Ap1Mwpo_PZwABM2U"]
[Sat Jul 18 23:30:27.635209 2026] [security2:error] [pid 890058:tid 890292] [client 23.251.146.115:6272] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "mourgroup.com"] [uri "/index.php"] [unique_id "alxg8nzbEu1Ap1Mwpo_O2AABckA"]
[Sat Jul 18 23:30:27.664915 2026] [security2:error] [pid 890058:tid 890107] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 2). Match of "ipMatch 127.0.0.1,::1" against "REMOTE_ADDR" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "724"] [id "340114"] [rev "2"] [msg "Atomicorp.com WAF Rules: Apache admin service access attempt"] [severity "CRITICAL"] [hostname "partnerselectricalllc.com"] [uri "/server-info"] [unique_id "alxg83zbEu1Ap1Mwpo_PbgABMzA"]
[Sat Jul 18 23:30:27.709768 2026] [security2:error] [pid 890058:tid 890280] [client 23.251.146.115:55984] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "mourgroup.com"] [uri "/index.php"] [unique_id "alxg8nzbEu1Ap1Mwpo_PBgABZnI"]
[Sat Jul 18 23:30:27.716219 2026] [security2:error] [pid 890058:tid 890189] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg83zbEu1Ap1Mwpo_PVQAAAQs"]
[Sat Jul 18 23:30:27.716348 2026] [access_compat:error] [pid 890058:tid 890156] [remote 34.100.180.213:58168] AH01797: client denied by server configuration: proxy:https://127.0.0.1:8443/server-status
[Sat Jul 18 23:30:27.739663 2026] [security2:error] [pid 890058:tid 890195] [client 23.251.146.115:6272] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "mourgroup.com"] [uri "/index.php"] [unique_id "alxg83zbEu1Ap1Mwpo_PcAABESM"]
[Sat Jul 18 23:30:27.860075 2026] [security2:error] [pid 890058:tid 890301] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg83zbEu1Ap1Mwpo_PbAAAAXs"]
[Sat Jul 18 23:30:27.884290 2026] [security2:error] [pid 890058:tid 890304] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg83zbEu1Ap1Mwpo_PbwAAAX4"]
[Sat Jul 18 23:30:27.886481 2026] [security2:error] [pid 890058:tid 890143] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "partnerselectricalllc.com"] [uri "/nginx_status"] [unique_id "alxg83zbEu1Ap1Mwpo_PggABM1Q"]
[Sat Jul 18 23:30:27.895357 2026] [security2:error] [pid 890058:tid 890311] [client 4.194.217.15:2048] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/scxy.php"] [unique_id "alxg83zbEu1Ap1Mwpo_PhQAAAYU"]
[Sat Jul 18 23:30:27.915725 2026] [security2:error] [pid 890058:tid 890221] [client 23.251.146.115:55984] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "mourgroup.com"] [uri "/index.php"] [unique_id "alxg83zbEu1Ap1Mwpo_PfgABK0M"]
[Sat Jul 18 23:30:27.949328 2026] [security2:error] [pid 890058:tid 890228] [client 23.251.146.115:6272] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "mourgroup.com"] [uri "/index.php"] [unique_id "alxg83zbEu1Ap1Mwpo_PgAABMgE"]
[Sat Jul 18 23:30:28.222134 2026] [security2:error] [pid 890058:tid 890284] [client 23.251.146.115:55984] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "mourgroup.com"] [uri "/index.php"] [unique_id "alxg9HzbEu1Ap1Mwpo_PoQABai0"]
[Sat Jul 18 23:30:28.437237 2026] [security2:error] [pid 890058:tid 890270] [client 4.194.217.15:5652] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/sd.php"] [unique_id "alxg9HzbEu1Ap1Mwpo_PvQAAAVw"]
[Sat Jul 18 23:30:28.660815 2026] [security2:error] [pid 890058:tid 890280] [client 163.61.1.17:55133] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxg9HzbEu1Ap1Mwpo_P3gAAAWY"]
[Sat Jul 18 23:30:28.662833 2026] [security2:error] [pid 890058:tid 890280] [client 163.61.1.17:55133] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxg9HzbEu1Ap1Mwpo_P3gAAAWY"]
[Sat Jul 18 23:30:28.958469 2026] [security2:error] [pid 890058:tid 890211] [client 119.154.81.234:54027] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxg9HzbEu1Ap1Mwpo_P7gAAASE"]
[Sat Jul 18 23:30:28.958559 2026] [security2:error] [pid 890058:tid 890211] [client 119.154.81.234:54027] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxg9HzbEu1Ap1Mwpo_P7gAAASE"]
[Sat Jul 18 23:30:28.980547 2026] [security2:error] [pid 890058:tid 890286] [client 4.194.217.15:2095] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/sf.php"] [unique_id "alxg9HzbEu1Ap1Mwpo_P8QAAAWw"]
[Sat Jul 18 23:30:29.535656 2026] [security2:error] [pid 890058:tid 890233] [client 4.194.217.15:8814] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/shell.php"] [unique_id "alxg9XzbEu1Ap1Mwpo_QJQAAATc"]
[Sat Jul 18 23:30:29.669584 2026] [security2:error] [pid 890058:tid 890244] [client 190.245.146.99:56657] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxg9XzbEu1Ap1Mwpo_QMwAAAUI"]
[Sat Jul 18 23:30:29.669693 2026] [security2:error] [pid 890058:tid 890244] [client 190.245.146.99:56657] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxg9XzbEu1Ap1Mwpo_QMwAAAUI"]
[Sat Jul 18 23:30:30.259285 2026] [security2:error] [pid 890058:tid 890270] [client 4.194.217.15:2813] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/sid3.php"] [unique_id "alxg9nzbEu1Ap1Mwpo_QaAAAAVw"]
[Sat Jul 18 23:30:30.551281 2026] [security2:error] [pid 890058:tid 890208] [client 106.222.249.209:29941] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxg9nzbEu1Ap1Mwpo_QfwAAAR4"]
[Sat Jul 18 23:30:30.551558 2026] [security2:error] [pid 890058:tid 890208] [client 106.222.249.209:29941] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxg9nzbEu1Ap1Mwpo_QfwAAAR4"]
[Sat Jul 18 23:30:30.653848 2026] [security2:error] [pid 890058:tid 890258] [client 34.100.180.213:58168] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg9nzbEu1Ap1Mwpo_QcQABUFQ"]
[Sat Jul 18 23:30:30.828662 2026] [security2:error] [pid 890058:tid 890229] [client 4.194.217.15:5646] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/simple.php"] [unique_id "alxg9nzbEu1Ap1Mwpo_QjgAAATM"]
[Sat Jul 18 23:30:30.842353 2026] [security2:error] [pid 890058:tid 890258] [client 34.100.180.213:58168] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg9nzbEu1Ap1Mwpo_QhAABUC8"]
[Sat Jul 18 23:30:31.372935 2026] [security2:error] [pid 890058:tid 890231] [client 4.194.217.15:2798] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/sitemap.php"] [unique_id "alxg93zbEu1Ap1Mwpo_QsgAAATU"]
[Sat Jul 18 23:30:31.791727 2026] [security2:error] [pid 890058:tid 890298] [client 45.3.45.220:49537] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 220.45.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxg93zbEu1Ap1Mwpo_Q2gAAAXg"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:30:31.848063 2026] [security2:error] [pid 890058:tid 890301] [client 93.170.71.235:5479] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/wp-content/plugins/aawp/public/image.php"] [unique_id "alxg93zbEu1Ap1Mwpo_Q3gABe1o"]
[Sat Jul 18 23:30:31.875120 2026] [security2:error] [pid 890058:tid 890209] [client 52.167.144.232:57562] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "bandsir.com"] [uri "/index.php"] [unique_id "alxg93zbEu1Ap1Mwpo_QzAABHx4"]
[Sat Jul 18 23:30:31.917126 2026] [security2:error] [pid 890058:tid 890304] [client 4.194.217.15:5687] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/size.php"] [unique_id "alxg93zbEu1Ap1Mwpo_Q5QAAAX4"]
[Sat Jul 18 23:30:32.090329 2026] [security2:error] [pid 890058:tid 890315] [client 34.100.180.213:58168] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg93zbEu1Ap1Mwpo_Q4wABiT0"]
[Sat Jul 18 23:30:32.528482 2026] [security2:error] [pid 890058:tid 890174] [remote 98.70.32.248:33936] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.32.70.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.fvx.wyy.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxg-HzbEu1Ap1Mwpo_REgABP3M"]
[Sat Jul 18 23:30:32.550688 2026] [security2:error] [pid 890058:tid 890297] [client 186.189.97.48:43392] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/wp-content/plugins/aawp/public/image.php"] [unique_id "alxg-HzbEu1Ap1Mwpo_REAABd2M"]
[Sat Jul 18 23:30:32.616441 2026] [security2:error] [pid 890058:tid 890259] [client 202.51.202.242:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 242.202.51.202.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lakelopezonline.com"] [uri "/wp-login.php"] [unique_id "alxg-HzbEu1Ap1Mwpo_RFQAAAVE"], referer: https://lakelopezonline.com/wp-login.php
[Sat Jul 18 23:30:32.693035 2026] [security2:error] [pid 890058:tid 890193] [client 4.194.217.15:2762] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/sm.php"] [unique_id "alxg-HzbEu1Ap1Mwpo_RIQAAAQ8"]
[Sat Jul 18 23:30:32.748507 2026] [security2:error] [pid 890058:tid 890282] [client 27.34.68.67:45340] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.68.34.27.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxg-HzbEu1Ap1Mwpo_RJwAAAWg"]
[Sat Jul 18 23:30:32.748615 2026] [security2:error] [pid 890058:tid 890282] [client 27.34.68.67:45340] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxg-HzbEu1Ap1Mwpo_RJwAAAWg"]
[Sat Jul 18 23:30:32.782711 2026] [security2:error] [pid 890058:tid 890197] [client 4.194.24.143:18559] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/nine2code.php"] [unique_id "alxg-HzbEu1Ap1Mwpo_RLQAAARM"]
[Sat Jul 18 23:30:32.949184 2026] [security2:error] [pid 890058:tid 890069] [remote 98.70.32.248:33936] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.32.70.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.fvx.wyy.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxg-HzbEu1Ap1Mwpo_RNgABXQo"], referer: https://mail.fvx.wyy.mybluehost.me/wp-login.php
[Sat Jul 18 23:30:33.188774 2026] [security2:error] [pid 890058:tid 890260] [client 45.3.42.217:56805] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 217.42.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxg-XzbEu1Ap1Mwpo_RRwAAAVI"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:30:33.341089 2026] [security2:error] [pid 890058:tid 890266] [client 4.194.24.143:25519] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/num.php"] [unique_id "alxg-XzbEu1Ap1Mwpo_RUwAAAVg"]
[Sat Jul 18 23:30:33.425574 2026] [security2:error] [pid 890058:tid 890315] [client 138.252.89.100:56714] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxg-XzbEu1Ap1Mwpo_RWAAAAYk"]
[Sat Jul 18 23:30:33.425669 2026] [security2:error] [pid 890058:tid 890315] [client 138.252.89.100:56714] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxg-XzbEu1Ap1Mwpo_RWAAAAYk"]
[Sat Jul 18 23:30:33.578630 2026] [security2:error] [pid 890058:tid 890296] [client 4.194.217.15:8646] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/sql.php"] [unique_id "alxg-XzbEu1Ap1Mwpo_RZQAAAXY"]
[Sat Jul 18 23:30:33.834089 2026] [security2:error] [pid 890058:tid 890307] [client 65.111.26.79:41121] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 79.26.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxg-XzbEu1Ap1Mwpo_ReQAAAYE"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:30:33.867121 2026] [security2:error] [pid 890058:tid 890123] [remote 98.70.32.248:48384] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.32.70.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.innspace.ca"] [uri "/wp-login.php"] [unique_id "alxg-XzbEu1Ap1Mwpo_RegABcUA"]
[Sat Jul 18 23:30:33.903041 2026] [security2:error] [pid 890058:tid 890257] [client 4.194.24.143:25512] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/odf7udtspqtpxzyxmw2rccdefault.php"] [unique_id "alxg-XzbEu1Ap1Mwpo_RgQAAAU8"]
[Sat Jul 18 23:30:33.950057 2026] [security2:error] [pid 890058:tid 890260] [client 52.221.236.148:45664] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 148.236.221.52.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxg-XzbEu1Ap1Mwpo_RgwAAAVI"]
[Sat Jul 18 23:30:33.950195 2026] [security2:error] [pid 890058:tid 890260] [client 52.221.236.148:45664] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxg-XzbEu1Ap1Mwpo_RgwAAAVI"]
[Sat Jul 18 23:30:34.277948 2026] [security2:error] [pid 890058:tid 890185] [remote 98.70.32.248:48384] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.32.70.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.innspace.ca"] [uri "/wp-login.php"] [unique_id "alxg-nzbEu1Ap1Mwpo_RmgABIX4"], referer: https://mail.innspace.ca/wp-login.php
[Sat Jul 18 23:30:34.283240 2026] [security2:error] [pid 890058:tid 890228] [client 4.194.217.15:2802] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/ss.php"] [unique_id "alxg-nzbEu1Ap1Mwpo_RnQAAATI"]
[Sat Jul 18 23:30:34.496714 2026] [security2:error] [pid 890058:tid 890278] [client 4.194.24.143:18496] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/option.php"] [unique_id "alxg-nzbEu1Ap1Mwpo_RsAAAAWQ"]
[Sat Jul 18 23:30:34.619441 2026] [security2:error] [pid 890058:tid 890279] [client 74.208.214.194:35692] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxg-nzbEu1Ap1Mwpo_RtQAAAWU"]
[Sat Jul 18 23:30:35.043721 2026] [security2:error] [pid 890058:tid 890247] [client 4.194.24.143:18497] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/p.php"] [unique_id "alxg-3zbEu1Ap1Mwpo_R3AAAAUU"]
[Sat Jul 18 23:30:35.160615 2026] [security2:error] [pid 890058:tid 890280] [client 4.194.217.15:5662] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/stats.php"] [unique_id "alxg-3zbEu1Ap1Mwpo_R5QAAAWY"]
[Sat Jul 18 23:30:35.269251 2026] [security2:error] [pid 890058:tid 890289] [client 45.3.44.115:35193] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.44.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxg-3zbEu1Ap1Mwpo_R6QAAAW8"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:30:35.288829 2026] [security2:error] [pid 890058:tid 890172] [remote 154.61.75.100:51190] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thefriendlyspreadsheet.com"] [uri "/wp-login.php"] [unique_id "alxg-3zbEu1Ap1Mwpo_R7AABR3E"]
[Sat Jul 18 23:30:35.618919 2026] [security2:error] [pid 890058:tid 890243] [client 4.194.24.143:22145] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/past.php"] [unique_id "alxg-3zbEu1Ap1Mwpo_SCQAAAUE"]
[Sat Jul 18 23:30:35.899574 2026] [security2:error] [pid 890058:tid 890297] [client 223.228.182.224:51360] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxg-3zbEu1Ap1Mwpo_SJQAAAXc"]
[Sat Jul 18 23:30:35.899678 2026] [security2:error] [pid 890058:tid 890297] [client 223.228.182.224:51360] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxg-3zbEu1Ap1Mwpo_SJQAAAXc"]
[Sat Jul 18 23:30:35.901583 2026] [security2:error] [pid 890058:tid 890294] [client 65.111.26.25:13635] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.26.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxg-3zbEu1Ap1Mwpo_SHwAAAXQ"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:30:35.956708 2026] [security2:error] [pid 890058:tid 890199] [client 4.194.217.15:2781] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/sump1.php"] [unique_id "alxg-3zbEu1Ap1Mwpo_SKAAAARU"]
[Sat Jul 18 23:30:35.976332 2026] [security2:error] [pid 890058:tid 890315] [client 46.105.39.50:32939] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "coltinnovate.com"] [uri "/robots.txt"] [unique_id "alxg-3zbEu1Ap1Mwpo_SLAAAAYk"]
[Sat Jul 18 23:30:35.976428 2026] [security2:error] [pid 890058:tid 890315] [client 46.105.39.50:32939] ModSecurity: Warning. Matched phrase "MJ12bot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "coltinnovate.com"] [uri "/robots.txt"] [unique_id "alxg-3zbEu1Ap1Mwpo_SLAAAAYk"]
[Sat Jul 18 23:30:36.167038 2026] [security2:error] [pid 890058:tid 890310] [client 4.194.24.143:24116] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/php.php"] [unique_id "alxg_HzbEu1Ap1Mwpo_SQAAAAYQ"]
[Sat Jul 18 23:30:36.709329 2026] [security2:error] [pid 890058:tid 890241] [client 4.194.24.143:24106] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/php8.php"] [unique_id "alxg_HzbEu1Ap1Mwpo_SYwAAAT8"]
[Sat Jul 18 23:30:36.863709 2026] [security2:error] [pid 890058:tid 890253] [client 4.194.217.15:2080] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/system.php"] [unique_id "alxg_HzbEu1Ap1Mwpo_ScQAAAUs"]
[Sat Jul 18 23:30:36.986902 2026] [security2:error] [pid 890058:tid 890307] [client 183.81.169.76:49948] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 76.169.81.183.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "talknutritionwithlesley.com"] [uri "/installer.php"] [unique_id "alxg_HzbEu1Ap1Mwpo_SfQAAAYE"]
[Sat Jul 18 23:30:37.302984 2026] [security2:error] [pid 890058:tid 890303] [client 4.194.24.143:24084] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/phpinfo.php"] [unique_id "alxg_XzbEu1Ap1Mwpo_SkwAAAX0"]
[Sat Jul 18 23:30:37.343595 2026] [security2:error] [pid 890058:tid 890290] [client 62.150.67.110:17605] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "ali-alghanim.net"] [uri "/index.php"] [unique_id "alxg_XzbEu1Ap1Mwpo_SiQAAAXA"]
[Sat Jul 18 23:30:37.596440 2026] [security2:error] [pid 890058:tid 890240] [client 183.81.169.76:49960] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 76.169.81.183.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "talknutritionwithlesley.com"] [uri "/wordpress1/wp-admin/setup-config.php"] [unique_id "alxg_XzbEu1Ap1Mwpo_SrgAAAT4"]
[Sat Jul 18 23:30:37.876068 2026] [core:error] [pid 890058:tid 890242] [client 4.194.24.143:18547] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:30:37.876091 2026] [core:error] [pid 890058:tid 890242] [client 4.194.24.143:18547] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:30:38.014213 2026] [security2:error] [pid 890058:tid 890204] [client 4.194.217.15:4655] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/system/03n1hob7p03r2npdefault.php"] [unique_id "alxg_nzbEu1Ap1Mwpo_S2AAAARo"]
[Sat Jul 18 23:30:38.383132 2026] [security2:error] [pid 890058:tid 890124] [remote 72.167.132.114:60154] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxg_nzbEu1Ap1Mwpo_S9AABZUE"]
[Sat Jul 18 23:30:38.421483 2026] [security2:error] [pid 890058:tid 890310] [client 4.194.24.143:25501] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/post.php"] [unique_id "alxg_nzbEu1Ap1Mwpo_S-wAAAYQ"]
[Sat Jul 18 23:30:38.869511 2026] [security2:error] [pid 890058:tid 890178] [remote 72.167.132.114:60154] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxg_nzbEu1Ap1Mwpo_TFQABPHc"], referer: https://sesamegreenbeans.com/wp-login.php
[Sat Jul 18 23:30:38.966556 2026] [security2:error] [pid 890058:tid 890242] [client 4.194.24.143:27086] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/public/assets/design_1/css/parts/course_cards/grid_card_1.min.php"] [unique_id "alxg_nzbEu1Ap1Mwpo_THQAAAUA"]
[Sat Jul 18 23:30:39.034269 2026] [security2:error] [pid 890058:tid 890309] [client 4.194.217.15:7981] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/system/cj5ha2rah8lyiqqdefault.php"] [unique_id "alxg_3zbEu1Ap1Mwpo_TJwAAAYM"]
[Sat Jul 18 23:30:39.054586 2026] [security2:error] [pid 890058:tid 890090] [remote 98.156.100.191:48920] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 191.100.156.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxg_3zbEu1Ap1Mwpo_TLgABNh8"]
[Sat Jul 18 23:30:39.132943 2026] [security2:error] [pid 890058:tid 890224] [client 163.61.1.17:55588] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxg_3zbEu1Ap1Mwpo_TNgAAAS4"]
[Sat Jul 18 23:30:39.133044 2026] [security2:error] [pid 890058:tid 890224] [client 163.61.1.17:55588] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxg_3zbEu1Ap1Mwpo_TNgAAAS4"]
[Sat Jul 18 23:30:39.539846 2026] [security2:error] [pid 890058:tid 890256] [client 119.154.81.234:54480] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxg_3zbEu1Ap1Mwpo_TWAAAAU4"]
[Sat Jul 18 23:30:39.539957 2026] [security2:error] [pid 890058:tid 890256] [client 119.154.81.234:54480] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxg_3zbEu1Ap1Mwpo_TWAAAAU4"]
[Sat Jul 18 23:30:39.549106 2026] [security2:error] [pid 890058:tid 890191] [client 4.194.24.143:25530] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/public/css.php"] [unique_id "alxg_3zbEu1Ap1Mwpo_TWwAAAQ0"]
[Sat Jul 18 23:30:39.776289 2026] [security2:error] [pid 890058:tid 890216] [client 4.194.217.15:6441] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/system_log.php"] [unique_id "alxg_3zbEu1Ap1Mwpo_TcQAAASY"]
[Sat Jul 18 23:30:39.776698 2026] [security2:error] [pid 890058:tid 890224] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg_3zbEu1Ap1Mwpo_TZwAAAS4"]
[Sat Jul 18 23:30:39.818799 2026] [security2:error] [pid 890058:tid 890289] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg_3zbEu1Ap1Mwpo_TaQAAAW8"]
[Sat Jul 18 23:30:39.833959 2026] [security2:error] [pid 890058:tid 890226] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg_3zbEu1Ap1Mwpo_TYwAAATA"]
[Sat Jul 18 23:30:39.954809 2026] [security2:error] [pid 890058:tid 890308] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg_3zbEu1Ap1Mwpo_TewAAAYI"]
[Sat Jul 18 23:30:40.023040 2026] [security2:error] [pid 890058:tid 890245] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg_3zbEu1Ap1Mwpo_TegAAAUM"]
[Sat Jul 18 23:30:40.025861 2026] [security2:error] [pid 890058:tid 890285] [client 34.100.180.213:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxg_3zbEu1Ap1Mwpo_TfAAAAWs"]
[Sat Jul 18 23:30:40.112118 2026] [security2:error] [pid 890058:tid 890214] [client 4.194.24.143:25480] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/r.php"] [unique_id "alxhAHzbEu1Ap1Mwpo_TpQAAASQ"]
[Sat Jul 18 23:30:40.177063 2026] [security2:error] [pid 890058:tid 890262] [client 190.245.146.99:57171] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhAHzbEu1Ap1Mwpo_TpwAAAVQ"]
[Sat Jul 18 23:30:40.183160 2026] [security2:error] [pid 890058:tid 890262] [client 190.245.146.99:57171] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhAHzbEu1Ap1Mwpo_TpwAAAVQ"]
[Sat Jul 18 23:30:40.184330 2026] [security2:error] [pid 890058:tid 890230] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxhAHzbEu1Ap1Mwpo_TnwAAATQ"]
[Sat Jul 18 23:30:40.184332 2026] [security2:error] [pid 890058:tid 890307] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxhAHzbEu1Ap1Mwpo_TogAAAYE"]
[Sat Jul 18 23:30:40.191668 2026] [security2:error] [pid 890058:tid 890260] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxhAHzbEu1Ap1Mwpo_ToAAAAVI"]
[Sat Jul 18 23:30:40.203933 2026] [security2:error] [pid 890058:tid 890304] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxhAHzbEu1Ap1Mwpo_TowAAAX4"]
[Sat Jul 18 23:30:40.215591 2026] [security2:error] [pid 890058:tid 890240] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxhAHzbEu1Ap1Mwpo_ToQAAAT4"]
[Sat Jul 18 23:30:40.220401 2026] [security2:error] [pid 890058:tid 890294] [client 34.39.87.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "momheadquarters.com"] [uri "/index.php"] [unique_id "alxhAHzbEu1Ap1Mwpo_TpAAAAXQ"]
[Sat Jul 18 23:30:40.229471 2026] [security2:error] [pid 890058:tid 890072] [remote 216.73.216.174:12283] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.216.73.216.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/training-temp"] [unique_id "alxhAHzbEu1Ap1Mwpo_TqgABbg0"]
[Sat Jul 18 23:30:40.385608 2026] [security2:error] [pid 890058:tid 890297] [client 4.194.217.15:4662] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/t.php"] [unique_id "alxhAHzbEu1Ap1Mwpo_TuAAAAXc"]
[Sat Jul 18 23:30:40.469507 2026] [security2:error] [pid 890058:tid 890095] [remote 34.39.87.128:52424] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.87.39.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "momheadquarters.com"] [uri "/wp-login.php"] [unique_id "alxhAHzbEu1Ap1Mwpo_TvQABcSQ"], referer: https://momheadquarters.com/login
[Sat Jul 18 23:30:40.507883 2026] [security2:error] [pid 890058:tid 890118] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 213.180.100.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "partnerselectricalllc.com"] [uri "/wp-login.php"] [unique_id "alxhAHzbEu1Ap1Mwpo_TwAABHzs"], referer: https://partnerselectricalllc.com/login
[Sat Jul 18 23:30:40.676465 2026] [security2:error] [pid 890058:tid 890193] [client 4.194.24.143:18532] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/radio.php"] [unique_id "alxhAHzbEu1Ap1Mwpo_TzwAAAQ8"]
[Sat Jul 18 23:30:40.953295 2026] [security2:error] [pid 890058:tid 890108] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 213.180.100.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "partnerselectricalllc.com"] [uri "/wp-login.php"] [unique_id "alxhAHzbEu1Ap1Mwpo_T4QABgzE"], referer: https://partnerselectricalllc.com/wp-admin/
[Sat Jul 18 23:30:41.046968 2026] [security2:error] [pid 890058:tid 890238] [client 4.194.217.15:6423] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/term.php"] [unique_id "alxhAXzbEu1Ap1Mwpo_T5wAAATw"]
[Sat Jul 18 23:30:41.119976 2026] [security2:error] [pid 890058:tid 890166] [remote 31.42.184.154:40556] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "scott-assist.com"] [uri "/wp-login.php"] [unique_id "alxhAXzbEu1Ap1Mwpo_T6wABY2s"]
[Sat Jul 18 23:30:41.249435 2026] [security2:error] [pid 890058:tid 890253] [client 106.222.249.209:11354] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhAXzbEu1Ap1Mwpo_T9wAAAUs"]
[Sat Jul 18 23:30:41.249722 2026] [security2:error] [pid 890058:tid 890253] [client 106.222.249.209:11354] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhAXzbEu1Ap1Mwpo_T9wAAAUs"]
[Sat Jul 18 23:30:41.275092 2026] [security2:error] [pid 890058:tid 890311] [client 4.194.24.143:27129] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/randkeyword.php7"] [unique_id "alxhAXzbEu1Ap1Mwpo_T_wAAAYU"]
[Sat Jul 18 23:30:41.286388 2026] [security2:error] [pid 890058:tid 890119] [remote 34.100.180.213:58168] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 213.180.100.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "partnerselectricalllc.com"] [uri "/wp-login.php"] [unique_id "alxhAXzbEu1Ap1Mwpo_UAQABbTw"], referer: https://partnerselectricalllc.com/wp-admin/
[Sat Jul 18 23:30:41.352306 2026] [security2:error] [pid 890058:tid 890085] [remote 31.42.184.154:40556] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "scott-assist.com"] [uri "/wp-login.php"] [unique_id "alxhAXzbEu1Ap1Mwpo_UBQABURo"], referer: https://scott-assist.com/wp-login.php
[Sat Jul 18 23:30:41.630225 2026] [security2:error] [pid 890058:tid 890289] [client 4.194.217.15:4656] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/test.php"] [unique_id "alxhAXzbEu1Ap1Mwpo_UEwAAAW8"]
[Sat Jul 18 23:30:41.639205 2026] [security2:error] [pid 890058:tid 890264] [client 34.91.129.93:24576] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "sbinframx.com"] [uri "/"] [unique_id "alxhAXzbEu1Ap1Mwpo_UFAAAAVY"]
[Sat Jul 18 23:30:41.639274 2026] [security2:error] [pid 890058:tid 890264] [client 34.91.129.93:24576] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "sbinframx.com"] [uri "/"] [unique_id "alxhAXzbEu1Ap1Mwpo_UFAAAAVY"]
[Sat Jul 18 23:30:41.820538 2026] [security2:error] [pid 890058:tid 890314] [client 4.194.24.143:24066] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/readme.php"] [unique_id "alxhAXzbEu1Ap1Mwpo_UIgAAAYg"]
[Sat Jul 18 23:30:41.843073 2026] [security2:error] [pid 890058:tid 890124] [remote 34.39.87.128:52424] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.87.39.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "momheadquarters.com"] [uri "/wp-login.php"] [unique_id "alxhAXzbEu1Ap1Mwpo_UJAABSkE"], referer: https://momheadquarters.com/wp-admin/
[Sat Jul 18 23:30:41.843247 2026] [security2:error] [pid 890058:tid 890143] [remote 34.39.87.128:52424] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.87.39.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "momheadquarters.com"] [uri "/wp-login.php"] [unique_id "alxhAXzbEu1Ap1Mwpo_UJQABSlQ"], referer: https://momheadquarters.com/wp-admin/
[Sat Jul 18 23:30:42.068493 2026] [security2:error] [pid 890058:tid 890167] [remote 98.70.32.248:57108] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.32.70.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxhAnzbEu1Ap1Mwpo_ULwABemw"]
[Sat Jul 18 23:30:42.075115 2026] [proxy:error] [pid 890058:tid 890302] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:30:42.075182 2026] [proxy_http:error] [pid 890058:tid 890302] [client 193.47.62.168:40106] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:30:42.076050 2026] [proxy:error] [pid 890058:tid 890302] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:30:42.076099 2026] [proxy_http:error] [pid 890058:tid 890302] [client 193.47.62.168:40106] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:30:42.184402 2026] [security2:error] [pid 890058:tid 890233] [client 4.194.217.15:7997] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/test1.php"] [unique_id "alxhAnzbEu1Ap1Mwpo_UNQAAATc"]
[Sat Jul 18 23:30:42.385970 2026] [security2:error] [pid 890058:tid 890308] [client 4.194.24.143:24113] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/reze.php"] [unique_id "alxhAnzbEu1Ap1Mwpo_USAAAAYI"]
[Sat Jul 18 23:30:42.412175 2026] [security2:error] [pid 890058:tid 890276] [client 50.116.65.227:53212] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "lifeisbetterlakeside.com"] [uri "/wp-content/uploads/2024/08/IMG_8766.jpeg"] [unique_id "alxhAnzbEu1Ap1Mwpo_USQAAAWI"]
[Sat Jul 18 23:30:42.474717 2026] [security2:error] [pid 890058:tid 890141] [remote 98.70.32.248:57108] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.32.70.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxhAnzbEu1Ap1Mwpo_USgABOlI"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:30:42.530334 2026] [security2:error] [pid 890058:tid 890203] [client 57.141.18.95:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxhAnzbEu1Ap1Mwpo_URgAAARk"]
[Sat Jul 18 23:30:42.737092 2026] [security2:error] [pid 890058:tid 890305] [client 4.194.217.15:2377] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/tfm.php"] [unique_id "alxhAnzbEu1Ap1Mwpo_UWAAAAX8"]
[Sat Jul 18 23:30:42.926373 2026] [security2:error] [pid 890058:tid 890306] [client 4.194.24.143:18507] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/rh.php"] [unique_id "alxhAnzbEu1Ap1Mwpo_UawAAAYA"]
[Sat Jul 18 23:30:43.238302 2026] [security2:error] [pid 890058:tid 890247] [client 143.244.57.88:53554] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "ericsnotary.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "alxhA3zbEu1Ap1Mwpo_UegAAAUU"]
[Sat Jul 18 23:30:43.298005 2026] [security2:error] [pid 890058:tid 890246] [client 4.194.217.15:2056] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/thebe.php"] [unique_id "alxhA3zbEu1Ap1Mwpo_UhgAAAUQ"]
[Sat Jul 18 23:30:43.481479 2026] [security2:error] [pid 890058:tid 890265] [client 4.194.24.143:24110] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/rip.php"] [unique_id "alxhA3zbEu1Ap1Mwpo_UlgAAAVc"]
[Sat Jul 18 23:30:43.571776 2026] [security2:error] [pid 890058:tid 890271] [client 143.244.57.88:53568] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 88.57.244.143.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ericsnotary.com"] [uri "/xmlrpc.php"] [unique_id "alxhA3zbEu1Ap1Mwpo_UnAAAAV0"]
[Sat Jul 18 23:30:43.703260 2026] [security2:error] [pid 890058:tid 890120] [remote 98.156.100.191:48920] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 191.100.156.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxhA3zbEu1Ap1Mwpo_UpQABTz0"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:30:43.724012 2026] [security2:error] [pid 890058:tid 890128] [remote 31.42.184.154:40568] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxhA3zbEu1Ap1Mwpo_UpgABf0U"]
[Sat Jul 18 23:30:43.850983 2026] [security2:error] [pid 890058:tid 890232] [client 4.194.217.15:8648] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/themes.php"] [unique_id "alxhA3zbEu1Ap1Mwpo_UtwAAATY"]
[Sat Jul 18 23:30:43.862431 2026] [security2:error] [pid 890058:tid 890311] [client 34.90.238.78:16384] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "securingmemories.com"] [uri "/"] [unique_id "alxhA3zbEu1Ap1Mwpo_UugAAAYU"]
[Sat Jul 18 23:30:43.862529 2026] [security2:error] [pid 890058:tid 890311] [client 34.90.238.78:16384] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "securingmemories.com"] [uri "/"] [unique_id "alxhA3zbEu1Ap1Mwpo_UugAAAYU"]
[Sat Jul 18 23:30:43.985139 2026] [security2:error] [pid 890058:tid 890079] [remote 31.42.184.154:40568] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxhA3zbEu1Ap1Mwpo_UwgABYhQ"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:30:44.031495 2026] [security2:error] [pid 890058:tid 890210] [client 57.141.18.102:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxhA3zbEu1Ap1Mwpo_UtQAAASA"]
[Sat Jul 18 23:30:44.040140 2026] [security2:error] [pid 890058:tid 890226] [client 4.194.24.143:25496] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/root.php"] [unique_id "alxhBHzbEu1Ap1Mwpo_UxgAAATA"]
[Sat Jul 18 23:30:44.068417 2026] [security2:error] [pid 890058:tid 890306] [client 143.244.57.88:41850] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "ericsnotary.com"] [uri "/blog/wp-includes/wlwmanifest.xml"] [unique_id "alxhBHzbEu1Ap1Mwpo_UyAAAAYA"]
[Sat Jul 18 23:30:44.372367 2026] [security2:error] [pid 890058:tid 890246] [client 143.244.57.88:41862] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "ericsnotary.com"] [uri "/web/wp-includes/wlwmanifest.xml"] [unique_id "alxhBHzbEu1Ap1Mwpo_U3QAAAUQ"]
[Sat Jul 18 23:30:44.408474 2026] [security2:error] [pid 890058:tid 890257] [client 4.194.217.15:2104] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/tiny.php"] [unique_id "alxhBHzbEu1Ap1Mwpo_U4AAAAU8"]
[Sat Jul 18 23:30:44.587287 2026] [security2:error] [pid 890058:tid 890313] [client 4.194.24.143:18506] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/s.php"] [unique_id "alxhBHzbEu1Ap1Mwpo_U6gAAAYc"]
[Sat Jul 18 23:30:44.663666 2026] [security2:error] [pid 890058:tid 890291] [client 143.244.57.88:41872] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "ericsnotary.com"] [uri "/wordpress/wp-includes/wlwmanifest.xml"] [unique_id "alxhBHzbEu1Ap1Mwpo_U8AAAAXE"]
[Sat Jul 18 23:30:44.947987 2026] [security2:error] [pid 890058:tid 890297] [client 138.252.89.100:57219] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhBHzbEu1Ap1Mwpo_U_QAAAXc"]
[Sat Jul 18 23:30:44.948065 2026] [security2:error] [pid 890058:tid 890297] [client 138.252.89.100:57219] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhBHzbEu1Ap1Mwpo_U_QAAAXc"]
[Sat Jul 18 23:30:44.951100 2026] [security2:error] [pid 890058:tid 890308] [client 4.194.217.15:2811] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.217.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bucknutscoffeeco.com"] [uri "/tmp/byp.php"] [unique_id "alxhBHzbEu1Ap1Mwpo_U_gAAAYI"]
[Sat Jul 18 23:30:44.959036 2026] [security2:error] [pid 890058:tid 890293] [client 143.244.57.88:41880] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "ericsnotary.com"] [uri "/website/wp-includes/wlwmanifest.xml"] [unique_id "alxhBHzbEu1Ap1Mwpo_VAQAAAXM"]
[Sat Jul 18 23:30:45.179605 2026] [security2:error] [pid 890058:tid 890295] [client 4.194.24.143:24120] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/sang.php"] [unique_id "alxhBXzbEu1Ap1Mwpo_VFQAAAXU"]
[Sat Jul 18 23:30:45.266515 2026] [security2:error] [pid 890058:tid 890302] [client 143.244.57.88:41884] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "ericsnotary.com"] [uri "/wp/wp-includes/wlwmanifest.xml"] [unique_id "alxhBXzbEu1Ap1Mwpo_VHwAAAXw"]
[Sat Jul 18 23:30:45.345633 2026] [security2:error] [pid 890058:tid 890192] [client 124.29.246.106:58405] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxhBXzbEu1Ap1Mwpo_VJAAAAQ4"]
[Sat Jul 18 23:30:45.345722 2026] [security2:error] [pid 890058:tid 890192] [client 124.29.246.106:58405] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxhBXzbEu1Ap1Mwpo_VJAAAAQ4"]
[Sat Jul 18 23:30:45.566933 2026] [security2:error] [pid 890058:tid 890197] [client 143.244.57.88:41894] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "ericsnotary.com"] [uri "/news/wp-includes/wlwmanifest.xml"] [unique_id "alxhBXzbEu1Ap1Mwpo_VOAAAARM"]
[Sat Jul 18 23:30:45.757551 2026] [security2:error] [pid 890058:tid 890236] [client 4.194.24.143:27102] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/scxy.php"] [unique_id "alxhBXzbEu1Ap1Mwpo_VQwAAATo"]
[Sat Jul 18 23:30:46.414444 2026] [http2:info] [pid 897595:tid 897595] h2_workers: created with min=128 max=192 idle_ms=600000
[Sat Jul 18 23:30:46.430549 2026] [security2:error] [pid 897595:tid 897726] [client 143.244.57.88:41898] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "ericsnotary.com"] [uri "/2018/wp-includes/wlwmanifest.xml"] [unique_id "alxhBuZhsBlduL7gIyygMAAAAIU"]
[Sat Jul 18 23:30:46.633737 2026] [security2:error] [pid 897595:tid 897736] [client 4.194.24.143:18553] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/sd.php"] [unique_id "alxhBuZhsBlduL7gIyygYwAAAI8"]
[Sat Jul 18 23:30:46.682596 2026] [security2:error] [pid 897595:tid 897744] [client 65.111.28.74:24289] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.28.111.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxhBuZhsBlduL7gIyygYgAAAJc"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:30:46.691836 2026] [security2:error] [pid 897595:tid 897760] [client 57.141.18.113:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxhBuZhsBlduL7gIyygUQAAAKc"]
[Sat Jul 18 23:30:46.733599 2026] [security2:error] [pid 897595:tid 897808] [client 143.244.57.88:41906] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "ericsnotary.com"] [uri "/2019/wp-includes/wlwmanifest.xml"] [unique_id "alxhBuZhsBlduL7gIyygaAAAANc"]
[Sat Jul 18 23:30:47.031972 2026] [security2:error] [pid 897595:tid 897738] [client 143.244.57.88:41912] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "ericsnotary.com"] [uri "/shop/wp-includes/wlwmanifest.xml"] [unique_id "alxhB-ZhsBlduL7gIyygegAAAJE"]
[Sat Jul 18 23:30:47.250666 2026] [security2:error] [pid 897595:tid 897747] [client 4.194.24.143:27092] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/sf.php"] [unique_id "alxhB-ZhsBlduL7gIyygigAAAJo"]
[Sat Jul 18 23:30:47.344764 2026] [security2:error] [pid 897595:tid 897768] [client 45.3.44.175:36879] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 175.44.3.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxhB-ZhsBlduL7gIyyglgAAAK8"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:30:47.347320 2026] [security2:error] [pid 897595:tid 897778] [client 143.244.57.88:41920] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "ericsnotary.com"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "alxhB-ZhsBlduL7gIyyglwAAALk"]
[Sat Jul 18 23:30:47.658203 2026] [security2:error] [pid 897595:tid 897809] [client 143.244.57.88:41936] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "ericsnotary.com"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "alxhB-ZhsBlduL7gIyygpgAAANg"]
[Sat Jul 18 23:30:47.687452 2026] [security2:error] [pid 897595:tid 897646] [remote 113.160.142.119:44802] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxhB-ZhsBlduL7gIyygpwABAzE"]
[Sat Jul 18 23:30:47.825941 2026] [security2:error] [pid 897595:tid 897808] [client 4.194.24.143:27122] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/shell.php"] [unique_id "alxhB-ZhsBlduL7gIyygswAAANc"]
[Sat Jul 18 23:30:47.952072 2026] [security2:error] [pid 897595:tid 897777] [client 143.244.57.88:41938] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "ericsnotary.com"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "alxhB-ZhsBlduL7gIyygzAAAALg"]
[Sat Jul 18 23:30:47.990855 2026] [security2:error] [pid 897595:tid 897834] [client 104.207.61.234:34673] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.61.207.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathyspeed.org"] [uri "/wp-login.php"] [unique_id "alxhB-ZhsBlduL7gIyygygAAAPE"], referer: https://cathyspeed.org/wp-login.php
[Sat Jul 18 23:30:48.250159 2026] [security2:error] [pid 897595:tid 897800] [client 143.244.57.88:41948] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "ericsnotary.com"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "alxhCOZhsBlduL7gIyyg1gAAAM8"]
[Sat Jul 18 23:30:48.340160 2026] [security2:error] [pid 897595:tid 897669] [remote 113.160.142.119:44802] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxhCOZhsBlduL7gIyyg4AAA2Eg"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:30:48.369631 2026] [core:error] [pid 897595:tid 897796] [client 4.194.24.143:24102] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:30:48.369658 2026] [core:error] [pid 897595:tid 897796] [client 4.194.24.143:24102] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:30:48.456224 2026] [security2:error] [pid 897595:tid 897807] [client 4.194.24.143:52517] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/nine2code.php"] [unique_id "alxhCOZhsBlduL7gIyyg6QAAANY"]
[Sat Jul 18 23:30:48.542315 2026] [security2:error] [pid 897595:tid 897785] [client 143.244.57.88:41958] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "ericsnotary.com"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "alxhCOZhsBlduL7gIyyg7AAAAMA"]
[Sat Jul 18 23:30:48.813235 2026] [security2:error] [pid 897595:tid 897680] [remote 4.205.168.44:36062] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory-com.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxhCOZhsBlduL7gIyyg-QAA9FM"]
[Sat Jul 18 23:30:48.813408 2026] [security2:error] [pid 897595:tid 897837] [client 4.205.168.44:36062] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory-com.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxhCOZhsBlduL7gIyyg-QAA9FM"]
[Sat Jul 18 23:30:48.822833 2026] [security2:error] [pid 897595:tid 897797] [client 223.228.182.224:32257] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhCOZhsBlduL7gIyyg_AAAAMw"]
[Sat Jul 18 23:30:48.822935 2026] [security2:error] [pid 897595:tid 897797] [client 223.228.182.224:32257] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhCOZhsBlduL7gIyyg_AAAAMw"]
[Sat Jul 18 23:30:48.842791 2026] [security2:error] [pid 897595:tid 897751] [client 143.244.57.88:41962] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "ericsnotary.com"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "alxhCOZhsBlduL7gIyyg_gAAAJ4"]
[Sat Jul 18 23:30:48.863670 2026] [fcgid:warn] [pid 897595:tid 897829] (70014)End of file found: [client 103.129.135.232:63822] mod_fcgid: can't get data from http client
[Sat Jul 18 23:30:48.911455 2026] [security2:error] [pid 897595:tid 897749] [client 4.194.24.143:24101] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/sid3.php"] [unique_id "alxhCOZhsBlduL7gIyyhBwAAAJw"]
[Sat Jul 18 23:30:49.003766 2026] [security2:error] [pid 897595:tid 897739] [client 4.194.24.143:60008] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/num.php"] [unique_id "alxhCeZhsBlduL7gIyyhDwAAAJI"]
[Sat Jul 18 23:30:49.147713 2026] [security2:error] [pid 897595:tid 897744] [client 143.244.57.88:41968] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "ericsnotary.com"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "alxhCeZhsBlduL7gIyyhFgAAAJc"]
[Sat Jul 18 23:30:49.253222 2026] [security2:error] [pid 897595:tid 897695] [remote 216.73.216.174:25019] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.216.73.216.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/training/"] [unique_id "alxhCeZhsBlduL7gIyyhIAAAkGI"]
[Sat Jul 18 23:30:49.486306 2026] [security2:error] [pid 897595:tid 897804] [client 4.194.24.143:18521] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/simple.php"] [unique_id "alxhCeZhsBlduL7gIyyhNgAAANM"]
[Sat Jul 18 23:30:49.549130 2026] [security2:error] [pid 897595:tid 897803] [client 4.194.24.143:52535] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/odf7udtspqtpxzyxmw2rccdefault.php"] [unique_id "alxhCeZhsBlduL7gIyyhOwAAANI"]
[Sat Jul 18 23:30:49.764075 2026] [security2:error] [pid 897595:tid 897753] [client 163.61.1.17:56051] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhCeZhsBlduL7gIyyhQQAAAKA"]
[Sat Jul 18 23:30:49.764245 2026] [security2:error] [pid 897595:tid 897753] [client 163.61.1.17:56051] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhCeZhsBlduL7gIyyhQQAAAKA"]
[Sat Jul 18 23:30:50.041324 2026] [security2:error] [pid 897595:tid 897838] [client 4.194.24.143:25483] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/sitemap.php"] [unique_id "alxhCuZhsBlduL7gIyyhVQAAAPU"]
[Sat Jul 18 23:30:50.050484 2026] [security2:error] [pid 897595:tid 897828] [client 119.154.81.234:54933] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhCuZhsBlduL7gIyyhVAAAAOs"]
[Sat Jul 18 23:30:50.050587 2026] [security2:error] [pid 897595:tid 897828] [client 119.154.81.234:54933] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhCuZhsBlduL7gIyyhVAAAAOs"]
[Sat Jul 18 23:30:50.102353 2026] [security2:error] [pid 897595:tid 897801] [client 4.194.24.143:60415] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/option.php"] [unique_id "alxhCuZhsBlduL7gIyyhWQAAANA"]
[Sat Jul 18 23:30:50.189221 2026] [security2:error] [pid 897595:tid 897737] [client 185.241.208.244:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 244.208.241.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "innovativecleaningsvs.com"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "alxhCuZhsBlduL7gIyyhXQAAAJA"]
[Sat Jul 18 23:30:50.189461 2026] [security2:error] [pid 897595:tid 897824] [client 185.241.208.244:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 244.208.241.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "innovativecleaningsvs.com"] [uri "/wp-plain.php"] [unique_id "alxhCuZhsBlduL7gIyyhXgAAAOc"], referer: www.google.com
[Sat Jul 18 23:30:50.191003 2026] [security2:error] [pid 897595:tid 897760] [client 185.241.208.244:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 244.208.241.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "innovativecleaningsvs.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "alxhCuZhsBlduL7gIyyhXAAAAKc"], referer: www.google.com
[Sat Jul 18 23:30:50.529490 2026] [security2:error] [pid 897595:tid 897608] [remote 163.227.186.27:52456] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxhCuZhsBlduL7gIyyheQAA3Qs"]
[Sat Jul 18 23:30:50.529670 2026] [security2:error] [pid 897595:tid 897814] [client 163.227.186.27:52456] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxhCuZhsBlduL7gIyyheQAA3Qs"]
[Sat Jul 18 23:30:50.544342 2026] [security2:error] [pid 897595:tid 897763] [client 185.241.208.244:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 244.208.241.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "innovativecleaningsvs.com"] [uri "/bmrjnmbt.php"] [unique_id "alxhCuZhsBlduL7gIyyhegAAAKo"], referer: www.google.com
[Sat Jul 18 23:30:50.571691 2026] [security2:error] [pid 897595:tid 897609] [remote 31.42.184.154:36650] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bbwipartnerconference.com"] [uri "/wp-login.php"] [unique_id "alxhCuZhsBlduL7gIyyhfQAAxww"]
[Sat Jul 18 23:30:50.592483 2026] [security2:error] [pid 897595:tid 897731] [client 4.194.24.143:18509] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/size.php"] [unique_id "alxhCuZhsBlduL7gIyyhfwAAAIo"]
[Sat Jul 18 23:30:50.661621 2026] [security2:error] [pid 897595:tid 897743] [client 4.194.24.143:23203] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/p.php"] [unique_id "alxhCuZhsBlduL7gIyyhhAAAAJY"]
[Sat Jul 18 23:30:50.729246 2026] [security2:error] [pid 897595:tid 897810] [client 190.245.146.99:57689] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhCuZhsBlduL7gIyyhhwAAANk"]
[Sat Jul 18 23:30:50.735276 2026] [security2:error] [pid 897595:tid 897810] [client 190.245.146.99:57689] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhCuZhsBlduL7gIyyhhwAAANk"]
[Sat Jul 18 23:30:50.738675 2026] [security2:error] [pid 897595:tid 897603] [remote 185.241.208.244:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 244.208.241.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "innovativecleaningsvs.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "alxhCuZhsBlduL7gIyyhiAAAjQY"], referer: www.google.com
[Sat Jul 18 23:30:50.804666 2026] [security2:error] [pid 897595:tid 897605] [remote 31.42.184.154:36650] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bbwipartnerconference.com"] [uri "/wp-login.php"] [unique_id "alxhCuZhsBlduL7gIyyhkAAA_Ag"], referer: https://bbwipartnerconference.com/wp-login.php
[Sat Jul 18 23:30:51.076548 2026] [security2:error] [pid 897595:tid 897625] [remote 185.241.208.244:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 244.208.241.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "innovativecleaningsvs.com"] [uri "/wp-plain.php"] [unique_id "alxhC-ZhsBlduL7gIyyhpAAA6xw"], referer: www.google.com
[Sat Jul 18 23:30:51.187185 2026] [security2:error] [pid 897595:tid 897827] [client 4.194.24.143:27131] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/sm.php"] [unique_id "alxhC-ZhsBlduL7gIyyhrgAAAOo"]
[Sat Jul 18 23:30:51.278099 2026] [security2:error] [pid 897595:tid 897797] [client 4.194.24.143:59978] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/past.php"] [unique_id "alxhC-ZhsBlduL7gIyyhsgAAAMw"]
[Sat Jul 18 23:30:51.620603 2026] [security2:error] [pid 897595:tid 897638] [remote 185.241.208.244:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 244.208.241.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "innovativecleaningsvs.com"] [uri "/hbkbdqax.php"] [unique_id "alxhC-ZhsBlduL7gIyyhwwAAtik"], referer: www.google.com
[Sat Jul 18 23:30:51.741649 2026] [security2:error] [pid 897595:tid 897800] [client 4.194.24.143:18501] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/sql.php"] [unique_id "alxhC-ZhsBlduL7gIyyhyQAAAM8"]
[Sat Jul 18 23:30:51.820819 2026] [security2:error] [pid 897595:tid 897783] [client 185.241.208.244:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "innovativecleaningsvs.com"] [uri "/index.php"] [unique_id "alxhCuZhsBlduL7gIyyhXwAAAL4"], referer: www.google.com
[Sat Jul 18 23:30:51.823280 2026] [security2:error] [pid 897595:tid 897754] [client 4.194.24.143:60357] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/php.php"] [unique_id "alxhC-ZhsBlduL7gIyyh0gAAAKE"]
[Sat Jul 18 23:30:52.008766 2026] [security2:error] [pid 897595:tid 897821] [client 106.222.249.209:3081] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhDOZhsBlduL7gIyyh3gAAAOQ"]
[Sat Jul 18 23:30:52.008959 2026] [security2:error] [pid 897595:tid 897821] [client 106.222.249.209:3081] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhDOZhsBlduL7gIyyh3gAAAOQ"]
[Sat Jul 18 23:30:52.313717 2026] [security2:error] [pid 897595:tid 897762] [client 4.194.24.143:18546] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/ss.php"] [unique_id "alxhDOZhsBlduL7gIyyh8AAAAKk"]
[Sat Jul 18 23:30:52.389849 2026] [security2:error] [pid 897595:tid 897791] [client 4.194.24.143:52493] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/php8.php"] [unique_id "alxhDOZhsBlduL7gIyyh9gAAAMY"]
[Sat Jul 18 23:30:52.854166 2026] [security2:error] [pid 897595:tid 897739] [client 4.194.24.143:27085] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/stats.php"] [unique_id "alxhDOZhsBlduL7gIyyiGwAAAJI"]
[Sat Jul 18 23:30:52.932945 2026] [security2:error] [pid 897595:tid 897842] [client 4.194.24.143:60393] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/phpinfo.php"] [unique_id "alxhDOZhsBlduL7gIyyiHQAAAPk"]
[Sat Jul 18 23:30:53.139408 2026] [security2:error] [pid 897595:tid 897680] [remote 185.241.208.244:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 244.208.241.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "innovativecleaningsvs.com"] [uri "/wp-content/plugins/apikey/apikey.php"] [unique_id "alxhDeZhsBlduL7gIyyiKQAAnFM"]
[Sat Jul 18 23:30:53.319947 2026] [security2:error] [pid 897595:tid 897686] [remote 185.241.208.244:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 244.208.241.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "innovativecleaningsvs.com"] [uri "/plugins/content/apismtp/apismtp.php"] [unique_id "alxhDeZhsBlduL7gIyyiNAAA0Vk"]
[Sat Jul 18 23:30:53.396024 2026] [security2:error] [pid 897595:tid 897791] [client 4.194.24.143:27074] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/sump1.php"] [unique_id "alxhDeZhsBlduL7gIyyiOQAAAMY"]
[Sat Jul 18 23:30:53.506884 2026] [security2:error] [pid 897595:tid 897693] [remote 185.241.208.244:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 244.208.241.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "innovativecleaningsvs.com"] [uri "/wp-content/plugins/apikey/apikey.php.suspected"] [unique_id "alxhDeZhsBlduL7gIyyiQgAAtWA"]
[Sat Jul 18 23:30:53.547265 2026] [security2:error] [pid 897595:tid 897765] [client 4.194.24.143:23230] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "adultdaycarereno.com"] [uri "/index.php"] [unique_id "alxhDeZhsBlduL7gIyyiQAAAAKw"]
[Sat Jul 18 23:30:53.715840 2026] [security2:error] [pid 897595:tid 897702] [remote 185.241.208.244:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 244.208.241.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "innovativecleaningsvs.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "alxhDeZhsBlduL7gIyyiYQAAiWk"]
[Sat Jul 18 23:30:53.726364 2026] [security2:error] [pid 897595:tid 897726] [client 4.194.24.143:23230] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/post.php"] [unique_id "alxhDeZhsBlduL7gIyyiYgAAAIU"]
[Sat Jul 18 23:30:54.032980 2026] [security2:error] [pid 897595:tid 897787] [client 4.194.24.143:22148] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/system.php"] [unique_id "alxhDuZhsBlduL7gIyyicgAAAMI"]
[Sat Jul 18 23:30:54.148312 2026] [proxy:error] [pid 897595:tid 897838] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:30:54.148355 2026] [proxy_http:error] [pid 897595:tid 897838] [client 193.47.62.168:41842] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:30:54.149023 2026] [proxy:error] [pid 897595:tid 897838] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:30:54.149047 2026] [proxy_http:error] [pid 897595:tid 897838] [client 193.47.62.168:41842] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:30:54.269038 2026] [security2:error] [pid 897595:tid 897810] [client 4.194.24.143:21801] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/public/assets/design_1/css/parts/course_cards/grid_card_1.min.php"] [unique_id "alxhDuZhsBlduL7gIyyiiAAAANk"]
[Sat Jul 18 23:30:54.468270 2026] [security2:error] [pid 897595:tid 897839] [client 185.241.208.244:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "innovativecleaningsvs.com"] [uri "/index.php"] [unique_id "alxhDuZhsBlduL7gIyyijgAAAPY"], referer: www.google.com
[Sat Jul 18 23:30:54.613443 2026] [security2:error] [pid 897595:tid 897827] [client 4.194.24.143:24105] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/system/03n1hob7p03r2npdefault.php"] [unique_id "alxhDuZhsBlduL7gIyyinwAAAOo"]
[Sat Jul 18 23:30:54.810551 2026] [security2:error] [pid 897595:tid 897734] [client 4.194.24.143:60401] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/public/css.php"] [unique_id "alxhDuZhsBlduL7gIyyisAAAAI0"]
[Sat Jul 18 23:30:55.099283 2026] [security2:error] [pid 897595:tid 897742] [client 51.195.248.115:56966] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "autodiscover.nyradigitalsolutions.com"] [uri "/.env"] [unique_id "alxhD-ZhsBlduL7gIyyixQAAAJU"]
[Sat Jul 18 23:30:55.168365 2026] [security2:error] [pid 897595:tid 897842] [client 4.194.24.143:27080] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/system/cj5ha2rah8lyiqqdefault.php"] [unique_id "alxhD-ZhsBlduL7gIyyiygAAAPk"]
[Sat Jul 18 23:30:55.267007 2026] [security2:error] [pid 897595:tid 897619] [remote 216.73.216.174:25019] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.216.73.216.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/training/"] [unique_id "alxhD-ZhsBlduL7gIyyi0AABARY"]
[Sat Jul 18 23:30:55.378531 2026] [security2:error] [pid 897595:tid 897797] [client 4.194.24.143:59982] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/r.php"] [unique_id "alxhD-ZhsBlduL7gIyyi1QAAAMw"]
[Sat Jul 18 23:30:55.712045 2026] [security2:error] [pid 897595:tid 897783] [client 4.194.24.143:27108] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/system_log.php"] [unique_id "alxhD-ZhsBlduL7gIyyi7QAAAL4"]
[Sat Jul 18 23:30:55.769162 2026] [security2:error] [pid 897595:tid 897620] [remote 216.73.216.174:25019] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.216.73.216.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/training-temp"] [unique_id "alxhD-ZhsBlduL7gIyyi8QAA-xc"]
[Sat Jul 18 23:30:55.955272 2026] [security2:error] [pid 897595:tid 897751] [client 4.194.24.143:59970] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/radio.php"] [unique_id "alxhD-ZhsBlduL7gIyyi9wAAAJ4"]
[Sat Jul 18 23:30:56.271415 2026] [security2:error] [pid 897595:tid 897776] [client 4.194.24.143:18536] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/t.php"] [unique_id "alxhEOZhsBlduL7gIyyjGAAAALc"]
[Sat Jul 18 23:30:56.294977 2026] [security2:error] [pid 897595:tid 897649] [remote 188.138.102.156:43594] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxhEOZhsBlduL7gIyyjHQAA5zQ"]
[Sat Jul 18 23:30:56.486615 2026] [security2:error] [pid 897595:tid 897749] [client 138.252.89.100:57699] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhEOZhsBlduL7gIyyjJwAAAJw"]
[Sat Jul 18 23:30:56.486722 2026] [security2:error] [pid 897595:tid 897749] [client 138.252.89.100:57699] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhEOZhsBlduL7gIyyjJwAAAJw"]
[Sat Jul 18 23:30:56.492949 2026] [security2:error] [pid 897595:tid 897650] [remote 188.138.102.156:43594] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxhEOZhsBlduL7gIyyjKAAA-zU"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:30:56.497912 2026] [security2:error] [pid 897595:tid 897815] [client 4.194.24.143:23207] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/randkeyword.php7"] [unique_id "alxhEOZhsBlduL7gIyyjKQAAAN4"]
[Sat Jul 18 23:30:56.789242 2026] [security2:error] [pid 897595:tid 897652] [remote 154.61.75.100:50468] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thefriendlyspreadsheet.com"] [uri "/wp-login.php"] [unique_id "alxhEOZhsBlduL7gIyyjQgAAxTc"], referer: https://thefriendlyspreadsheet.com/wp-login.php
[Sat Jul 18 23:30:56.812498 2026] [security2:error] [pid 897595:tid 897851] [client 4.194.24.143:18529] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/term.php"] [unique_id "alxhEOZhsBlduL7gIyyjRQAAAQI"]
[Sat Jul 18 23:30:57.053933 2026] [security2:error] [pid 897595:tid 897850] [client 4.194.24.143:23204] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/readme.php"] [unique_id "alxhEeZhsBlduL7gIyyjVAAAAQE"]
[Sat Jul 18 23:30:57.374153 2026] [security2:error] [pid 897595:tid 897749] [client 4.194.24.143:18531] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/test.php"] [unique_id "alxhEeZhsBlduL7gIyyjawAAAJw"]
[Sat Jul 18 23:30:57.628688 2026] [security2:error] [pid 897595:tid 897851] [client 4.194.24.143:23174] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/reze.php"] [unique_id "alxhEeZhsBlduL7gIyyjegAAAQI"]
[Sat Jul 18 23:30:57.632077 2026] [security2:error] [pid 897595:tid 897835] [client 223.228.182.224:24910] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhEeZhsBlduL7gIyyjewAAAPI"]
[Sat Jul 18 23:30:57.632175 2026] [security2:error] [pid 897595:tid 897835] [client 223.228.182.224:24910] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhEeZhsBlduL7gIyyjewAAAPI"]
[Sat Jul 18 23:30:57.916225 2026] [security2:error] [pid 897595:tid 897766] [client 4.194.24.143:24095] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/test1.php"] [unique_id "alxhEeZhsBlduL7gIyyjmQAAAK0"]
[Sat Jul 18 23:30:58.187739 2026] [security2:error] [pid 897595:tid 897781] [client 4.194.24.143:21797] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/rh.php"] [unique_id "alxhEuZhsBlduL7gIyyjrAAAALw"]
[Sat Jul 18 23:30:58.479853 2026] [security2:error] [pid 897595:tid 897833] [client 4.194.24.143:18761] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/tfm.php"] [unique_id "alxhEuZhsBlduL7gIyyjxwAAAPA"]
[Sat Jul 18 23:30:58.585077 2026] [security2:error] [pid 897595:tid 897767] [client 74.208.214.194:56514] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxhEuZhsBlduL7gIyyj0AAAAK4"]
[Sat Jul 18 23:30:58.747892 2026] [security2:error] [pid 897595:tid 897753] [client 4.194.24.143:42264] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/rip.php"] [unique_id "alxhEuZhsBlduL7gIyyj2QAAAKA"]
[Sat Jul 18 23:30:58.799442 2026] [security2:error] [pid 897595:tid 897723] [remote 31.42.184.154:36686] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nwcarvingacademy.com"] [uri "/wp-login.php"] [unique_id "alxhEuZhsBlduL7gIyyj3AAAiH4"]
[Sat Jul 18 23:30:59.035206 2026] [security2:error] [pid 897595:tid 897816] [client 4.194.24.143:18999] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/thebe.php"] [unique_id "alxhE-ZhsBlduL7gIyyj7AAAAN8"]
[Sat Jul 18 23:30:59.229706 2026] [security2:error] [pid 897595:tid 897609] [remote 31.42.184.154:36686] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nwcarvingacademy.com"] [uri "/wp-login.php"] [unique_id "alxhE-ZhsBlduL7gIyyj8gAA8Aw"], referer: https://nwcarvingacademy.com/wp-login.php
[Sat Jul 18 23:30:59.367693 2026] [security2:error] [pid 897595:tid 897848] [client 4.194.24.143:60010] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/root.php"] [unique_id "alxhE-ZhsBlduL7gIyyj-gAAAP8"]
[Sat Jul 18 23:30:59.464292 2026] [security2:error] [pid 897595:tid 897847] [client 4.194.24.143:10693] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/nine2code.php"] [unique_id "alxhE-ZhsBlduL7gIyykBAAAAP4"]
[Sat Jul 18 23:30:59.466991 2026] [security2:error] [pid 897595:tid 897612] [remote 97.74.93.24:43718] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxhE-ZhsBlduL7gIyykAQAAvw8"]
[Sat Jul 18 23:30:59.631938 2026] [security2:error] [pid 897595:tid 897765] [client 4.194.24.143:27090] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/themes.php"] [unique_id "alxhE-ZhsBlduL7gIyykFAAAAKw"]
[Sat Jul 18 23:30:59.867774 2026] [security2:error] [pid 897595:tid 897599] [remote 97.74.93.24:43718] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxhE-ZhsBlduL7gIyykIwAA3wI"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:30:59.911727 2026] [security2:error] [pid 897595:tid 897824] [client 4.194.24.143:21781] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/s.php"] [unique_id "alxhE-ZhsBlduL7gIyykJQAAAOc"]
[Sat Jul 18 23:31:00.073080 2026] [security2:error] [pid 897595:tid 897828] [client 4.194.24.143:53314] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/num.php"] [unique_id "alxhFOZhsBlduL7gIyykMQAAAOs"]
[Sat Jul 18 23:31:00.176574 2026] [security2:error] [pid 897595:tid 897743] [client 4.194.24.143:18557] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/tiny.php"] [unique_id "alxhFOZhsBlduL7gIyykOgAAAJY"]
[Sat Jul 18 23:31:00.262988 2026] [security2:error] [pid 897595:tid 897838] [client 163.61.1.17:56511] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhFOZhsBlduL7gIyykQQAAAPU"]
[Sat Jul 18 23:31:00.264838 2026] [security2:error] [pid 897595:tid 897838] [client 163.61.1.17:56511] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhFOZhsBlduL7gIyykQQAAAPU"]
[Sat Jul 18 23:31:00.346146 2026] [security2:error] [pid 897595:tid 897822] [client 47.128.110.180:28012] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "tmsteamer.com"] [uri "/robots.txt"] [unique_id "alxhFOZhsBlduL7gIyykRgAAAOU"]
[Sat Jul 18 23:31:00.478955 2026] [security2:error] [pid 897595:tid 897632] [remote 103.77.162.29:51274] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 29.162.77.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxhFOZhsBlduL7gIyykUQAAqiM"]
[Sat Jul 18 23:31:00.479091 2026] [security2:error] [pid 897595:tid 897763] [client 103.77.162.29:51274] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxhFOZhsBlduL7gIyykUQAAqiM"]
[Sat Jul 18 23:31:00.524211 2026] [security2:error] [pid 897595:tid 897749] [client 4.194.24.143:23169] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/sang.php"] [unique_id "alxhFOZhsBlduL7gIyykVAAAAJw"]
[Sat Jul 18 23:31:00.579868 2026] [security2:error] [pid 897595:tid 897761] [client 119.154.81.234:55382] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhFOZhsBlduL7gIyykWAAAAKg"]
[Sat Jul 18 23:31:00.579976 2026] [security2:error] [pid 897595:tid 897761] [client 119.154.81.234:55382] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhFOZhsBlduL7gIyykWAAAAKg"]
[Sat Jul 18 23:31:00.722019 2026] [security2:error] [pid 897595:tid 897798] [client 4.194.24.143:10696] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/odf7udtspqtpxzyxmw2rccdefault.php"] [unique_id "alxhFOZhsBlduL7gIyykYAAAAM0"]
[Sat Jul 18 23:31:00.727727 2026] [security2:error] [pid 897595:tid 897738] [client 4.194.24.143:18981] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesisventureglobal.com"] [uri "/tmp/byp.php"] [unique_id "alxhFOZhsBlduL7gIyykYQAAAJE"]
[Sat Jul 18 23:31:01.081237 2026] [security2:error] [pid 897595:tid 897796] [client 4.194.24.143:42261] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/scxy.php"] [unique_id "alxhFeZhsBlduL7gIyykeQAAAMs"]
[Sat Jul 18 23:31:01.258894 2026] [security2:error] [pid 897595:tid 897836] [client 190.245.146.99:58201] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhFeZhsBlduL7gIyykmQAAAPM"]
[Sat Jul 18 23:31:01.264956 2026] [security2:error] [pid 897595:tid 897836] [client 190.245.146.99:58201] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhFeZhsBlduL7gIyykmQAAAPM"]
[Sat Jul 18 23:31:01.449130 2026] [http2:info] [pid 898098:tid 898098] h2_workers: created with min=128 max=192 idle_ms=600000
[Sat Jul 18 23:31:01.560124 2026] [security2:error] [pid 897595:tid 897784] [client 4.194.24.143:10714] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/option.php"] [unique_id "alxhFeZhsBlduL7gIyyk1QAAAL8"]
[Sat Jul 18 23:31:01.680051 2026] [security2:error] [pid 897595:tid 897849] [client 4.194.24.143:42300] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/sd.php"] [unique_id "alxhFeZhsBlduL7gIyyk3gAAAQA"]
[Sat Jul 18 23:31:02.014076 2026] [security2:error] [pid 897595:tid 897673] [remote 163.227.186.27:37412] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxhFuZhsBlduL7gIyyk6gAAr0w"]
[Sat Jul 18 23:31:02.222850 2026] [security2:error] [pid 897595:tid 897822] [client 4.194.24.143:42273] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/sf.php"] [unique_id "alxhFuZhsBlduL7gIyyk8gAAAOU"]
[Sat Jul 18 23:31:02.241977 2026] [security2:error] [pid 897595:tid 897842] [client 4.194.24.143:63199] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/p.php"] [unique_id "alxhFuZhsBlduL7gIyyk9AAAAPk"]
[Sat Jul 18 23:31:02.371005 2026] [security2:error] [pid 897595:tid 897682] [remote 31.42.184.154:49180] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxhFuZhsBlduL7gIyyk_QAAmVU"]
[Sat Jul 18 23:31:02.489675 2026] [security2:error] [pid 897595:tid 897694] [remote 163.227.186.27:37412] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxhFuZhsBlduL7gIyylBAAA8GE"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:31:02.631958 2026] [security2:error] [pid 897595:tid 897841] [client 106.222.249.209:1559] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhFuZhsBlduL7gIyylCwAAAPg"]
[Sat Jul 18 23:31:02.632040 2026] [security2:error] [pid 897595:tid 897841] [client 106.222.249.209:1559] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhFuZhsBlduL7gIyylCwAAAPg"]
[Sat Jul 18 23:31:02.765844 2026] [security2:error] [pid 898098:tid 898267] [client 4.194.24.143:23187] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/shell.php"] [unique_id "alxhFkRK6WUoKc-ijTFpmAAAACM"]
[Sat Jul 18 23:31:02.799508 2026] [security2:error] [pid 897595:tid 897710] [remote 31.42.184.154:49180] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxhFuZhsBlduL7gIyylEgAA-nE"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:31:02.933690 2026] [security2:error] [pid 897595:tid 897815] [client 4.194.24.143:55306] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/past.php"] [unique_id "alxhFuZhsBlduL7gIyylFAAAAN4"]
[Sat Jul 18 23:31:03.076015 2026] [security2:error] [pid 898098:tid 898272] [client 34.73.232.127:45692] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "jndsupport.com"] [uri "/wp-json/batch/v1"] [unique_id "alxhF0RK6WUoKc-ijTFpoAAAACg"]
[Sat Jul 18 23:31:03.372194 2026] [security2:error] [pid 898098:tid 898308] [client 4.194.24.143:60407] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "adultdaycarereno.com"] [uri "/index.php"] [unique_id "alxhF0RK6WUoKc-ijTFpsAAAAEw"]
[Sat Jul 18 23:31:03.514510 2026] [security2:error] [pid 898098:tid 898327] [client 34.73.232.127:45692] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "jndsupport.com"] [uri "/"] [unique_id "alxhF0RK6WUoKc-ijTFptQAAAF8"]
[Sat Jul 18 23:31:03.552213 2026] [security2:error] [pid 898098:tid 898329] [client 4.194.24.143:60407] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/sid3.php"] [unique_id "alxhF0RK6WUoKc-ijTFptwAAAGE"]
[Sat Jul 18 23:31:03.795277 2026] [security2:error] [pid 897595:tid 897814] [client 4.194.24.143:10747] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/php.php"] [unique_id "alxhF-ZhsBlduL7gIyylLwAAAN0"]
[Sat Jul 18 23:31:04.096546 2026] [security2:error] [pid 897595:tid 897758] [client 4.194.24.143:23172] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/simple.php"] [unique_id "alxhGOZhsBlduL7gIyylOQAAAKU"]
[Sat Jul 18 23:31:04.364878 2026] [security2:error] [pid 898098:tid 898123] [remote 31.42.184.154:49182] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-login.php"] [unique_id "alxhGERK6WUoKc-ijTFp2gAAHxU"]
[Sat Jul 18 23:31:04.594699 2026] [security2:error] [pid 898098:tid 898277] [client 40.77.167.0:49385] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.guidehunting.com"] [uri "/index.php"] [unique_id "alxhGERK6WUoKc-ijTFp1AAALRM"]
[Sat Jul 18 23:31:04.598011 2026] [security2:error] [pid 898098:tid 898126] [remote 31.42.184.154:49182] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-login.php"] [unique_id "alxhGERK6WUoKc-ijTFp4AAARRg"], referer: https://swafforddetailing.com/wp-login.php
[Sat Jul 18 23:31:04.772883 2026] [security2:error] [pid 898098:tid 898300] [client 4.194.24.143:29862] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/sitemap.php"] [unique_id "alxhGERK6WUoKc-ijTFp5gAAAEQ"]
[Sat Jul 18 23:31:04.895285 2026] [security2:error] [pid 898098:tid 898331] [client 34.73.232.127:35360] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "jndsupport.com"] [uri "/wp-json/batch/v1"] [unique_id "alxhGERK6WUoKc-ijTFp6wAAAGM"]
[Sat Jul 18 23:31:04.924834 2026] [security2:error] [pid 898098:tid 898330] [client 185.213.174.141:17372] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "50.116.64.35"] [uri "/cgi-bin/luci/"] [unique_id "alxhGERK6WUoKc-ijTFp7gAAAGI"]
[Sat Jul 18 23:31:05.119407 2026] [security2:error] [pid 898098:tid 898136] [remote 97.74.93.24:43722] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/wp-login.php"] [unique_id "alxhGURK6WUoKc-ijTFp-QAAOiI"]
[Sat Jul 18 23:31:05.330660 2026] [security2:error] [pid 898098:tid 898356] [client 4.194.24.143:60014] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/size.php"] [unique_id "alxhGURK6WUoKc-ijTFp_wAAAHw"]
[Sat Jul 18 23:31:05.395088 2026] [security2:error] [pid 898098:tid 898253] [client 34.73.232.127:35360] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "jndsupport.com"] [uri "/"] [unique_id "alxhGURK6WUoKc-ijTFqBQAAABU"]
[Sat Jul 18 23:31:05.661560 2026] [security2:error] [pid 898098:tid 898146] [remote 97.74.93.24:43722] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/wp-login.php"] [unique_id "alxhGURK6WUoKc-ijTFqEQAAIiw"], referer: https://royalart-lb.com/wp-login.php
[Sat Jul 18 23:31:05.665757 2026] [security2:error] [pid 897595:tid 897791] [client 4.194.24.143:10719] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/php8.php"] [unique_id "alxhGeZhsBlduL7gIyylaAAAAMY"]
[Sat Jul 18 23:31:05.792934 2026] [security2:error] [pid 897595:tid 897599] [remote 216.73.216.174:25019] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.216.73.216.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/training/"] [unique_id "alxhGeZhsBlduL7gIyylagAA0QI"]
[Sat Jul 18 23:31:05.835788 2026] [security2:error] [pid 898098:tid 898149] [remote 120.72.98.5:1378] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "holistichealthmassagenz.com"] [uri "/wp-login.php"] [unique_id "alxhGURK6WUoKc-ijTFqFwAADy8"]
[Sat Jul 18 23:31:05.938807 2026] [security2:error] [pid 898098:tid 898292] [client 4.194.24.143:42242] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/sm.php"] [unique_id "alxhGURK6WUoKc-ijTFqGQAAADw"]
[Sat Jul 18 23:31:05.942457 2026] [security2:error] [pid 897595:tid 897758] [client 216.73.163.116:48829] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 116.163.73.216.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.hopestatebuilders.site"] [uri "/wp-login.php"] [unique_id "alxhGeZhsBlduL7gIyylawAAAKU"]
[Sat Jul 18 23:31:06.285203 2026] [security2:error] [pid 897595:tid 897851] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "mail.myspineworld.com"] [uri "/index.php"] [unique_id "alxhGOZhsBlduL7gIyylSAAAAQI"]
[Sat Jul 18 23:31:06.305668 2026] [security2:error] [pid 898098:tid 898157] [remote 120.72.98.5:1378] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "holistichealthmassagenz.com"] [uri "/wp-login.php"] [unique_id "alxhGkRK6WUoKc-ijTFqJwAAaDc"], referer: https://holistichealthmassagenz.com/wp-login.php
[Sat Jul 18 23:31:06.328238 2026] [security2:error] [pid 898098:tid 898307] [client 157.55.39.205:48796] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.bandsir.com"] [uri "/index.php"] [unique_id "alxhGkRK6WUoKc-ijTFqIQAAAEs"]
[Sat Jul 18 23:31:06.483855 2026] [security2:error] [pid 898098:tid 898334] [client 4.194.24.143:42275] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/sql.php"] [unique_id "alxhGkRK6WUoKc-ijTFqMAAAAGY"]
[Sat Jul 18 23:31:06.579492 2026] [security2:error] [pid 898098:tid 898333] [client 20.48.236.161:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.236.48.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "earle-brown.org"] [uri "/.well-known/about.php"] [unique_id "alxhGkRK6WUoKc-ijTFqMgAAAGU"]
[Sat Jul 18 23:31:06.579582 2026] [security2:error] [pid 898098:tid 898333] [client 20.48.236.161:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "earle-brown.org"] [uri "/.well-known/about.php"] [unique_id "alxhGkRK6WUoKc-ijTFqMgAAAGU"]
[Sat Jul 18 23:31:06.624974 2026] [security2:error] [pid 897595:tid 897849] [client 4.194.24.143:10703] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/phpinfo.php"] [unique_id "alxhGuZhsBlduL7gIyylfAAAAQA"]
[Sat Jul 18 23:31:07.027534 2026] [security2:error] [pid 898098:tid 898255] [client 4.194.24.143:42283] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/ss.php"] [unique_id "alxhG0RK6WUoKc-ijTFqTAAAABc"]
[Sat Jul 18 23:31:07.566958 2026] [security2:error] [pid 897595:tid 897842] [client 4.194.24.143:29834] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/stats.php"] [unique_id "alxhG-ZhsBlduL7gIyylkAAAAPk"]
[Sat Jul 18 23:31:07.770767 2026] [security2:error] [pid 898098:tid 898349] [client 4.194.24.143:53358] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/post.php"] [unique_id "alxhG0RK6WUoKc-ijTFqbQAAAHU"]
[Sat Jul 18 23:31:08.111455 2026] [security2:error] [pid 898098:tid 898239] [client 4.194.24.143:42287] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/sump1.php"] [unique_id "alxhHERK6WUoKc-ijTFqfQAAAAc"]
[Sat Jul 18 23:31:08.187356 2026] [security2:error] [pid 898098:tid 898246] [client 138.252.89.100:58181] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhHERK6WUoKc-ijTFqgwAAAA4"]
[Sat Jul 18 23:31:08.187556 2026] [security2:error] [pid 898098:tid 898246] [client 138.252.89.100:58181] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhHERK6WUoKc-ijTFqgwAAAA4"]
[Sat Jul 18 23:31:08.501811 2026] [security2:error] [pid 898098:tid 898331] [client 223.228.182.224:24647] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhHERK6WUoKc-ijTFqjgAAAGM"]
[Sat Jul 18 23:31:08.501932 2026] [security2:error] [pid 898098:tid 898331] [client 223.228.182.224:24647] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhHERK6WUoKc-ijTFqjgAAAGM"]
[Sat Jul 18 23:31:08.654307 2026] [security2:error] [pid 898098:tid 898294] [client 4.194.24.143:60006] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/system.php"] [unique_id "alxhHERK6WUoKc-ijTFqkQAAAD4"]
[Sat Jul 18 23:31:08.827655 2026] [security2:error] [pid 898098:tid 898254] [client 4.194.24.143:63229] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/public/assets/design_1/css/parts/course_cards/grid_card_1.min.php"] [unique_id "alxhHERK6WUoKc-ijTFqmQAAABY"]
[Sat Jul 18 23:31:09.195793 2026] [security2:error] [pid 897595:tid 897815] [client 4.194.24.143:21767] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/system/03n1hob7p03r2npdefault.php"] [unique_id "alxhHeZhsBlduL7gIyylwAAAAN4"]
[Sat Jul 18 23:31:09.748413 2026] [security2:error] [pid 898098:tid 898253] [client 4.194.24.143:60406] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/system/cj5ha2rah8lyiqqdefault.php"] [unique_id "alxhHURK6WUoKc-ijTFqvwAAABU"]
[Sat Jul 18 23:31:09.782802 2026] [security2:error] [pid 898098:tid 898324] [client 4.194.24.143:53335] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/public/css.php"] [unique_id "alxhHURK6WUoKc-ijTFqwwAAAFw"]
[Sat Jul 18 23:31:10.288812 2026] [security2:error] [pid 898098:tid 898285] [client 4.194.24.143:60376] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/system_log.php"] [unique_id "alxhHkRK6WUoKc-ijTFq3AAAADU"]
[Sat Jul 18 23:31:10.570198 2026] [security2:error] [pid 898098:tid 898229] [remote 160.187.68.132:38730] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.68.187.160.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxhHkRK6WUoKc-ijTFq6gAAPn4"]
[Sat Jul 18 23:31:10.762278 2026] [security2:error] [pid 897595:tid 897768] [client 163.61.1.17:56979] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhHuZhsBlduL7gIyyl3QAAAK8"]
[Sat Jul 18 23:31:10.762431 2026] [security2:error] [pid 897595:tid 897768] [client 163.61.1.17:56979] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhHuZhsBlduL7gIyyl3QAAAK8"]
[Sat Jul 18 23:31:10.832211 2026] [security2:error] [pid 898098:tid 898240] [client 4.194.24.143:60396] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/t.php"] [unique_id "alxhHkRK6WUoKc-ijTFq_QAAAAg"]
[Sat Jul 18 23:31:11.064341 2026] [security2:error] [pid 898098:tid 898108] [remote 160.187.68.132:38730] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.68.187.160.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxhH0RK6WUoKc-ijTFrCAAASAY"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:31:11.138404 2026] [security2:error] [pid 898098:tid 898317] [client 114.119.136.208:59959] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.californiaperfumecompany.com"] [uri "/people/cal_effie_miller_1912.html"] [unique_id "alxhH0RK6WUoKc-ijTFrDAAAAFU"], referer: https://www.californiaperfumecompany.com/people/cal_depot_managers.html
[Sat Jul 18 23:31:11.161243 2026] [security2:error] [pid 898098:tid 898251] [client 119.154.81.234:55839] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhH0RK6WUoKc-ijTFrDgAAABM"]
[Sat Jul 18 23:31:11.162136 2026] [security2:error] [pid 898098:tid 898251] [client 119.154.81.234:55839] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhH0RK6WUoKc-ijTFrDgAAABM"]
[Sat Jul 18 23:31:11.418155 2026] [security2:error] [pid 898098:tid 898285] [client 4.194.24.143:60360] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/term.php"] [unique_id "alxhH0RK6WUoKc-ijTFrGgAAADU"]
[Sat Jul 18 23:31:11.477026 2026] [security2:error] [pid 898098:tid 898280] [client 4.194.24.143:10956] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/r.php"] [unique_id "alxhH0RK6WUoKc-ijTFrJAAAADA"]
[Sat Jul 18 23:31:11.769560 2026] [security2:error] [pid 898098:tid 898296] [client 190.245.146.99:58712] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhH0RK6WUoKc-ijTFrMQAAAEA"]
[Sat Jul 18 23:31:11.775517 2026] [security2:error] [pid 898098:tid 898296] [client 190.245.146.99:58712] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhH0RK6WUoKc-ijTFrMQAAAEA"]
[Sat Jul 18 23:31:11.995028 2026] [security2:error] [pid 898098:tid 898246] [client 4.194.24.143:21822] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/test.php"] [unique_id "alxhH0RK6WUoKc-ijTFrPAAAAA4"]
[Sat Jul 18 23:31:12.491916 2026] [security2:error] [pid 898098:tid 898143] [remote 57.141.18.106:63550] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.18.141.57.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/product/4459097"] [unique_id "alxhIERK6WUoKc-ijTFrTgAASik"]
[Sat Jul 18 23:31:12.537435 2026] [security2:error] [pid 897595:tid 897803] [client 4.194.24.143:60020] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/test1.php"] [unique_id "alxhIOZhsBlduL7gIyyl_AAAANI"]
[Sat Jul 18 23:31:12.741573 2026] [security2:error] [pid 897595:tid 897775] [client 14.224.227.113:51404] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxhIOZhsBlduL7gIyymAQAAALY"]
[Sat Jul 18 23:31:12.777234 2026] [security2:error] [pid 898098:tid 898289] [client 14.224.227.113:51405] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxhIERK6WUoKc-ijTFrXgAAADk"]
[Sat Jul 18 23:31:12.996646 2026] [security2:error] [pid 897595:tid 897776] [client 74.7.227.179:57684] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxhIOZhsBlduL7gIyymAwAAt1c"], referer: https://tejasenvironmental.com/p=5881
[Sat Jul 18 23:31:13.012190 2026] [security2:error] [pid 898098:tid 898255] [client 4.194.24.143:42346] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/radio.php"] [unique_id "alxhIURK6WUoKc-ijTFrbAAAABc"]
[Sat Jul 18 23:31:13.088708 2026] [security2:error] [pid 898098:tid 898263] [client 4.194.24.143:59985] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/tfm.php"] [unique_id "alxhIURK6WUoKc-ijTFrcwAAAB8"]
[Sat Jul 18 23:31:13.446653 2026] [security2:error] [pid 898098:tid 898274] [client 106.222.249.209:24993] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhIURK6WUoKc-ijTFrgQAAACo"]
[Sat Jul 18 23:31:13.446756 2026] [security2:error] [pid 898098:tid 898274] [client 106.222.249.209:24993] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhIURK6WUoKc-ijTFrgQAAACo"]
[Sat Jul 18 23:31:13.630125 2026] [security2:error] [pid 897595:tid 897837] [client 4.194.24.143:60352] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/thebe.php"] [unique_id "alxhIeZhsBlduL7gIyymGwAAAPQ"]
[Sat Jul 18 23:31:13.665513 2026] [security2:error] [pid 898098:tid 898254] [client 13.42.250.172:64771] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 172.250.42.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "marketingonetoone.net"] [uri "/xmlrpc.php"] [unique_id "alxhIURK6WUoKc-ijTFrhgAAABY"]
[Sat Jul 18 23:31:13.665649 2026] [security2:error] [pid 898098:tid 898254] [client 13.42.250.172:64771] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "marketingonetoone.net"] [uri "/xmlrpc.php"] [unique_id "alxhIURK6WUoKc-ijTFrhgAAABY"]
[Sat Jul 18 23:31:14.001916 2026] [security2:error] [pid 897595:tid 897786] [client 40.77.167.67:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxhIeZhsBlduL7gIyymFgAAwWc"]
[Sat Jul 18 23:31:14.171204 2026] [security2:error] [pid 897595:tid 897823] [client 4.194.24.143:21776] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/themes.php"] [unique_id "alxhIuZhsBlduL7gIyymJQAAAOY"]
[Sat Jul 18 23:31:14.191920 2026] [security2:error] [pid 897595:tid 897768] [client 74.208.214.194:47774] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxhIuZhsBlduL7gIyymJwAAAK8"]
[Sat Jul 18 23:31:14.238235 2026] [security2:error] [pid 898098:tid 898289] [client 4.194.24.143:42328] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/randkeyword.php7"] [unique_id "alxhIkRK6WUoKc-ijTFroQAAADk"]
[Sat Jul 18 23:31:14.538028 2026] [security2:error] [pid 897595:tid 897810] [client 173.252.82.22:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.tacticaltreeoperations.com"] [uri "/index.php"] [unique_id "alxhIOZhsBlduL7gIyymAAAAANk"]
[Sat Jul 18 23:31:14.645281 2026] [security2:error] [pid 898098:tid 898327] [client 13.42.250.172:33511] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 172.250.42.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "marketingonetoone.net"] [uri "/xmlrpc.php"] [unique_id "alxhIkRK6WUoKc-ijTFrsQAAAF8"]
[Sat Jul 18 23:31:14.645390 2026] [security2:error] [pid 898098:tid 898327] [client 13.42.250.172:33511] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "marketingonetoone.net"] [uri "/xmlrpc.php"] [unique_id "alxhIkRK6WUoKc-ijTFrsQAAAF8"]
[Sat Jul 18 23:31:14.714655 2026] [security2:error] [pid 898098:tid 898295] [client 4.194.24.143:23205] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/tiny.php"] [unique_id "alxhIkRK6WUoKc-ijTFruQAAAD8"]
[Sat Jul 18 23:31:14.731445 2026] [security2:error] [pid 898098:tid 898187] [remote 152.53.111.131:60512] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.111.53.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "alaraycreative.com"] [uri "/wp-login.php"] [unique_id "alxhIkRK6WUoKc-ijTFrugAAT1Q"]
[Sat Jul 18 23:31:15.004955 2026] [security2:error] [pid 898098:tid 898189] [remote 152.53.111.131:60512] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.111.53.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "alaraycreative.com"] [uri "/wp-login.php"] [unique_id "alxhIkRK6WUoKc-ijTFryQAALFY"], referer: https://alaraycreative.com/wp-login.php
[Sat Jul 18 23:31:15.101524 2026] [security2:error] [pid 898098:tid 898353] [client 4.194.24.143:10737] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/readme.php"] [unique_id "alxhI0RK6WUoKc-ijTFr0QAAAHk"]
[Sat Jul 18 23:31:15.258066 2026] [security2:error] [pid 898098:tid 898260] [client 4.194.24.143:59996] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "adultdaycarereno.com"] [uri "/tmp/byp.php"] [unique_id "alxhI0RK6WUoKc-ijTFr3wAAABw"]
[Sat Jul 18 23:31:15.915235 2026] [security2:error] [pid 898098:tid 898354] [client 4.194.24.143:42362] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/reze.php"] [unique_id "alxhI0RK6WUoKc-ijTFsAAAAAHo"]
[Sat Jul 18 23:31:15.960307 2026] [security2:error] [pid 897595:tid 897769] [client 46.110.96.34:24478] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "wpad.tsctanks.com"] [uri "/wpad.dat"] [unique_id "alxhI-ZhsBlduL7gIyymTQAAALA"]
[Sat Jul 18 23:31:16.269547 2026] [security2:error] [pid 897595:tid 897744] [client 52.207.32.99:18198] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.32.207.52.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxhJOZhsBlduL7gIyymVwAAAJc"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:16.408228 2026] [security2:error] [pid 898098:tid 898276] [client 124.29.207.185:59771] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxhJERK6WUoKc-ijTFsFgAAACw"]
[Sat Jul 18 23:31:16.408343 2026] [security2:error] [pid 898098:tid 898276] [client 124.29.207.185:59771] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxhJERK6WUoKc-ijTFsFgAAACw"]
[Sat Jul 18 23:31:16.410583 2026] [security2:error] [pid 898098:tid 898340] [client 32.198.12.77:44684] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 77.12.198.32.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxhJERK6WUoKc-ijTFsFwAAAGw"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:16.558762 2026] [security2:error] [pid 898098:tid 898345] [client 98.82.181.200:31326] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 200.181.82.98.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxhJERK6WUoKc-ijTFsHwAAAHE"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:16.642819 2026] [security2:error] [pid 898098:tid 898323] [client 32.198.12.77:44686] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 77.12.198.32.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxhJERK6WUoKc-ijTFsJgAAAFs"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:16.665453 2026] [security2:error] [pid 898098:tid 898227] [remote 152.228.213.32:53154] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxhJERK6WUoKc-ijTFsLAAAMnw"]
[Sat Jul 18 23:31:16.666160 2026] [security2:error] [pid 898098:tid 898245] [client 18.232.92.172:49314] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 172.92.232.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxhJERK6WUoKc-ijTFsLQAAAA0"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:16.762871 2026] [security2:error] [pid 898098:tid 898332] [client 3.85.217.58:34368] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.217.85.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxhJERK6WUoKc-ijTFsMAAAAGQ"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:16.800343 2026] [security2:error] [pid 898098:tid 898325] [client 18.212.127.231:29564] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 231.127.212.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxhJERK6WUoKc-ijTFsNgAAAF0"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:17.004939 2026] [security2:error] [pid 897595:tid 897751] [client 4.194.24.143:63188] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/rh.php"] [unique_id "alxhJeZhsBlduL7gIyymYgAAAJ4"]
[Sat Jul 18 23:31:17.079916 2026] [security2:error] [pid 898098:tid 898103] [remote 152.228.213.32:53154] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxhJURK6WUoKc-ijTFsPQAAcgE"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:31:17.144099 2026] [security2:error] [pid 898098:tid 898354] [client 54.147.198.213:12404] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 213.198.147.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxhJURK6WUoKc-ijTFsQgAAAHo"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:17.146798 2026] [security2:error] [pid 898098:tid 898253] [client 54.145.191.230:27908] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.191.145.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxhJURK6WUoKc-ijTFsQAAAABU"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:17.158393 2026] [security2:error] [pid 898098:tid 898331] [client 34.207.130.29:61064] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 29.130.207.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxhJURK6WUoKc-ijTFsQwAAAGM"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:17.171949 2026] [security2:error] [pid 898098:tid 898344] [client 54.147.198.213:12412] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 213.198.147.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxhJURK6WUoKc-ijTFsRwAAAHA"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:17.387211 2026] [security2:error] [pid 897595:tid 897815] [client 18.212.127.231:29576] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 231.127.212.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxhJeZhsBlduL7gIyymbgAAAN4"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:17.429764 2026] [security2:error] [pid 897595:tid 897783] [client 13.221.201.234:56622] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.201.221.13.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxhJeZhsBlduL7gIyymbwAAAL4"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:17.558021 2026] [security2:error] [pid 898098:tid 898118] [remote 113.160.142.119:36250] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "gescontrols.com"] [uri "/wp-login.php"] [unique_id "alxhJURK6WUoKc-ijTFsVAAAXxA"]
[Sat Jul 18 23:31:17.572103 2026] [security2:error] [pid 898098:tid 898293] [client 13.221.201.234:56626] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.201.221.13.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxhJURK6WUoKc-ijTFsVgAAAD0"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:17.573611 2026] [security2:error] [pid 898098:tid 898251] [client 216.73.216.7:60564] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mail.lmgorman.com"] [uri "/index.php"] [unique_id "alxhJURK6WUoKc-ijTFsUgAAEwU"]
[Sat Jul 18 23:31:17.712970 2026] [security2:error] [pid 898098:tid 898358] [client 52.201.135.180:18360] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 180.135.201.52.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxhJURK6WUoKc-ijTFsYAAAAH4"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:17.798413 2026] [security2:error] [pid 898098:tid 898274] [client 98.82.181.200:31332] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 200.181.82.98.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxhJURK6WUoKc-ijTFsdQAAACo"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:17.810514 2026] [security2:error] [pid 898098:tid 898330] [client 4.194.24.143:42352] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/rip.php"] [unique_id "alxhJURK6WUoKc-ijTFsdgAAAGI"]
[Sat Jul 18 23:31:17.987025 2026] [security2:error] [pid 898098:tid 898268] [client 32.198.12.77:60212] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 77.12.198.32.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxhJURK6WUoKc-ijTFseQAAACQ"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:18.057743 2026] [security2:error] [pid 898098:tid 898116] [remote 113.160.142.119:36250] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "gescontrols.com"] [uri "/wp-login.php"] [unique_id "alxhJkRK6WUoKc-ijTFsfQAASw4"], referer: https://gescontrols.com/wp-login.php
[Sat Jul 18 23:31:18.215771 2026] [security2:error] [pid 897595:tid 897830] [client 3.85.217.58:34374] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.217.85.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxhJuZhsBlduL7gIyymhQAAAO0"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:18.453048 2026] [security2:error] [pid 898098:tid 898341] [client 4.194.24.143:10722] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/root.php"] [unique_id "alxhJkRK6WUoKc-ijTFsnwAAAG0"]
[Sat Jul 18 23:31:19.048465 2026] [security2:error] [pid 897595:tid 897610] [remote 41.186.86.12:51499] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "christiancountytrumpet.com"] [uri "/wp-login.php"] [unique_id "alxhJ-ZhsBlduL7gIyymlQAA1A0"]
[Sat Jul 18 23:31:19.096934 2026] [security2:error] [pid 897595:tid 897801] [client 4.194.24.143:63192] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/s.php"] [unique_id "alxhJ-ZhsBlduL7gIyymlgAAANA"]
[Sat Jul 18 23:31:19.303502 2026] [security2:error] [pid 898098:tid 898326] [client 34.210.88.185:61338] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.88.210.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxhJ0RK6WUoKc-ijTFsygAAAF4"]
[Sat Jul 18 23:31:19.542144 2026] [security2:error] [pid 897595:tid 897598] [remote 41.186.86.12:51499] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "christiancountytrumpet.com"] [uri "/wp-login.php"] [unique_id "alxhJ-ZhsBlduL7gIyymnAAAiAE"], referer: https://christiancountytrumpet.com/wp-login.php
[Sat Jul 18 23:31:19.568196 2026] [security2:error] [pid 898098:tid 898160] [remote 91.142.222.105:40484] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.transamericagrid.com"] [uri "/wp-login.php"] [unique_id "alxhJ0RK6WUoKc-ijTFs1wAAIDo"]
[Sat Jul 18 23:31:19.663151 2026] [security2:error] [pid 898098:tid 898235] [client 157.55.39.54:24153] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "bandsir.com"] [uri "/index.php"] [unique_id "alxhJ0RK6WUoKc-ijTFs0QAAAzM"]
[Sat Jul 18 23:31:19.726412 2026] [security2:error] [pid 898098:tid 898308] [client 4.194.24.143:42316] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/sang.php"] [unique_id "alxhJ0RK6WUoKc-ijTFs6gAAAEw"]
[Sat Jul 18 23:31:19.727822 2026] [security2:error] [pid 898098:tid 898250] [client 138.252.89.100:58677] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhJ0RK6WUoKc-ijTFs6QAAABI"]
[Sat Jul 18 23:31:19.727907 2026] [security2:error] [pid 898098:tid 898250] [client 138.252.89.100:58677] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhJ0RK6WUoKc-ijTFs6QAAABI"]
[Sat Jul 18 23:31:19.774881 2026] [security2:error] [pid 898098:tid 898159] [remote 98.70.32.248:35848] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.32.70.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxhJ0RK6WUoKc-ijTFs7AAAbTk"]
[Sat Jul 18 23:31:19.775024 2026] [security2:error] [pid 898098:tid 898341] [client 98.70.32.248:35848] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxhJ0RK6WUoKc-ijTFs7AAAbTk"]
[Sat Jul 18 23:31:20.352352 2026] [security2:error] [pid 898098:tid 898239] [client 4.194.24.143:10727] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/scxy.php"] [unique_id "alxhKERK6WUoKc-ijTFtCAAAAAc"]
[Sat Jul 18 23:31:20.388378 2026] [security2:error] [pid 898098:tid 898321] [client 34.210.88.185:27042] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.88.210.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxhKERK6WUoKc-ijTFtEgAAAFk"]
[Sat Jul 18 23:31:20.495210 2026] [security2:error] [pid 897595:tid 897841] [client 34.210.88.185:27052] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.88.210.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxhKOZhsBlduL7gIyymsAAAAPg"]
[Sat Jul 18 23:31:20.722055 2026] [security2:error] [pid 898098:tid 898278] [client 54.211.205.212:33830] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 212.205.211.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxhKERK6WUoKc-ijTFtIwAAAC4"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:20.941342 2026] [security2:error] [pid 897595:tid 897784] [client 3.85.217.58:34390] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.217.85.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxhKOZhsBlduL7gIyymvAAAAL8"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:20.998590 2026] [security2:error] [pid 897595:tid 897827] [client 18.232.92.172:49350] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 172.92.232.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxhKOZhsBlduL7gIyymwAAAAOo"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:21.025080 2026] [security2:error] [pid 897595:tid 897732] [client 4.194.24.143:63193] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/sd.php"] [unique_id "alxhKeZhsBlduL7gIyymwgAAAIs"]
[Sat Jul 18 23:31:21.070589 2026] [security2:error] [pid 897595:tid 897843] [client 52.201.135.180:18366] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 180.135.201.52.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxhKeZhsBlduL7gIyymxAAAAPo"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:21.202635 2026] [security2:error] [pid 898098:tid 898193] [remote 91.142.222.105:40484] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.transamericagrid.com"] [uri "/wp-login.php"] [unique_id "alxhKURK6WUoKc-ijTFtNQAAWVo"], referer: https://mail.transamericagrid.com/wp-login.php
[Sat Jul 18 23:31:21.255858 2026] [security2:error] [pid 898098:tid 898234] [client 34.210.88.185:27064] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.88.210.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxhKURK6WUoKc-ijTFtOAAAAAI"]
[Sat Jul 18 23:31:21.260554 2026] [security2:error] [pid 898098:tid 898284] [client 35.92.83.184:34120] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 184.83.92.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxhKURK6WUoKc-ijTFtOQAAADQ"]
[Sat Jul 18 23:31:21.284390 2026] [security2:error] [pid 897595:tid 897848] [client 13.221.201.234:56632] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.201.221.13.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxhKeZhsBlduL7gIyymygAAAP8"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:21.294703 2026] [security2:error] [pid 897595:tid 897780] [client 34.210.88.185:27080] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.88.210.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxhKeZhsBlduL7gIyymywAAALs"]
[Sat Jul 18 23:31:21.324634 2026] [security2:error] [pid 898098:tid 898288] [client 13.42.250.172:9292] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 172.250.42.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "marketingonetoone.net"] [uri "/xmlrpc.php"] [unique_id "alxhKURK6WUoKc-ijTFtOwAAADg"]
[Sat Jul 18 23:31:21.324761 2026] [security2:error] [pid 898098:tid 898288] [client 13.42.250.172:9292] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "marketingonetoone.net"] [uri "/xmlrpc.php"] [unique_id "alxhKURK6WUoKc-ijTFtOwAAADg"]
[Sat Jul 18 23:31:21.344616 2026] [security2:error] [pid 898098:tid 898320] [client 163.61.1.17:57454] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhKURK6WUoKc-ijTFtPAAAAFg"]
[Sat Jul 18 23:31:21.347813 2026] [security2:error] [pid 898098:tid 898320] [client 163.61.1.17:57454] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhKURK6WUoKc-ijTFtPAAAAFg"]
[Sat Jul 18 23:31:21.360447 2026] [security2:error] [pid 898098:tid 898247] [client 34.207.130.29:11194] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 29.130.207.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxhKURK6WUoKc-ijTFtPQAAAA8"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:21.482327 2026] [security2:error] [pid 897595:tid 897762] [client 35.92.83.184:34122] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 184.83.92.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxhKeZhsBlduL7gIyym0wAAAKk"]
[Sat Jul 18 23:31:21.693112 2026] [security2:error] [pid 898098:tid 898238] [client 119.154.81.234:56298] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhKURK6WUoKc-ijTFtVwAAAAY"]
[Sat Jul 18 23:31:21.693308 2026] [security2:error] [pid 898098:tid 898238] [client 119.154.81.234:56298] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhKURK6WUoKc-ijTFtVwAAAAY"]
[Sat Jul 18 23:31:21.736177 2026] [security2:error] [pid 898098:tid 898233] [client 4.194.24.143:10742] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/sf.php"] [unique_id "alxhKURK6WUoKc-ijTFtWgAAAAE"]
[Sat Jul 18 23:31:22.036804 2026] [security2:error] [pid 898098:tid 898341] [client 223.228.182.224:46106] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhKkRK6WUoKc-ijTFtaQAAAG0"]
[Sat Jul 18 23:31:22.036908 2026] [security2:error] [pid 898098:tid 898341] [client 223.228.182.224:46106] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhKkRK6WUoKc-ijTFtaQAAAG0"]
[Sat Jul 18 23:31:22.288566 2026] [security2:error] [pid 898098:tid 898267] [client 190.245.146.99:59222] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhKkRK6WUoKc-ijTFteAAAACM"]
[Sat Jul 18 23:31:22.288711 2026] [security2:error] [pid 898098:tid 898267] [client 190.245.146.99:59222] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhKkRK6WUoKc-ijTFteAAAACM"]
[Sat Jul 18 23:31:22.297521 2026] [security2:error] [pid 898098:tid 898253] [client 4.194.24.143:61610] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/shell.php"] [unique_id "alxhKkRK6WUoKc-ijTFtfAAAABU"]
[Sat Jul 18 23:31:22.337546 2026] [security2:error] [pid 897595:tid 897853] [client 13.42.250.172:18653] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 172.250.42.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "marketingonetoone.net"] [uri "/wp/xmlrpc.php"] [unique_id "alxhKuZhsBlduL7gIyym4QAAAQQ"]
[Sat Jul 18 23:31:22.337663 2026] [security2:error] [pid 897595:tid 897853] [client 13.42.250.172:18653] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "marketingonetoone.net"] [uri "/wp/xmlrpc.php"] [unique_id "alxhKuZhsBlduL7gIyym4QAAAQQ"]
[Sat Jul 18 23:31:23.062302 2026] [security2:error] [pid 898098:tid 898316] [client 4.194.24.143:10746] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/sid3.php"] [unique_id "alxhK0RK6WUoKc-ijTFtnwAAAFQ"]
[Sat Jul 18 23:31:23.161074 2026] [security2:error] [pid 898098:tid 898105] [remote 216.73.216.174:28215] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.216.73.216.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/contact-us/"] [unique_id "alxhK0RK6WUoKc-ijTFtqAAAGwM"]
[Sat Jul 18 23:31:23.331162 2026] [security2:error] [pid 898098:tid 898346] [client 216.73.216.53:18494] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "techexecutive.me"] [uri "/index.php"] [unique_id "alxhKURK6WUoKc-ijTFtXAAAcmQ"]
[Sat Jul 18 23:31:23.470886 2026] [security2:error] [pid 898098:tid 898356] [client 34.210.88.185:27088] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.88.210.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxhK0RK6WUoKc-ijTFttwAAAHw"]
[Sat Jul 18 23:31:23.725862 2026] [security2:error] [pid 898098:tid 898347] [client 13.42.250.172:31017] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 172.250.42.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "marketingonetoone.net"] [uri "/wordpress/xmlrpc.php"] [unique_id "alxhK0RK6WUoKc-ijTFtxQAAAHM"]
[Sat Jul 18 23:31:23.725974 2026] [security2:error] [pid 898098:tid 898347] [client 13.42.250.172:31017] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "marketingonetoone.net"] [uri "/wordpress/xmlrpc.php"] [unique_id "alxhK0RK6WUoKc-ijTFtxQAAAHM"]
[Sat Jul 18 23:31:23.729113 2026] [security2:error] [pid 898098:tid 898284] [client 4.194.24.143:10720] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/simple.php"] [unique_id "alxhK0RK6WUoKc-ijTFtxgAAADQ"]
[Sat Jul 18 23:31:23.774139 2026] [proxy:error] [pid 897595:tid 897783] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:31:23.774239 2026] [proxy_http:error] [pid 897595:tid 897783] [client 193.47.62.168:37648] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:31:23.775022 2026] [proxy:error] [pid 897595:tid 897783] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:31:23.775068 2026] [proxy_http:error] [pid 897595:tid 897783] [client 193.47.62.168:37648] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:31:23.828051 2026] [security2:error] [pid 898098:tid 898264] [client 216.244.66.231:52054] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.vfcthomasville.org"] [uri "/sermon-speaker/kobi-and-shani-ferguson/"] [unique_id "alxhK0RK6WUoKc-ijTFtzgAAACA"]
[Sat Jul 18 23:31:23.828202 2026] [security2:error] [pid 898098:tid 898264] [client 216.244.66.231:52054] ModSecurity: Warning. Matched phrase "Dotbot" at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "www.vfcthomasville.org"] [uri "/sermon-speaker/kobi-and-shani-ferguson/"] [unique_id "alxhK0RK6WUoKc-ijTFtzgAAACA"]
[Sat Jul 18 23:31:23.937660 2026] [security2:error] [pid 897595:tid 897660] [remote 188.138.102.156:56658] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.rvprintfactory.com"] [uri "/wp-login.php"] [unique_id "alxhK-ZhsBlduL7gIyym_QAA5j8"]
[Sat Jul 18 23:31:23.949769 2026] [security2:error] [pid 898098:tid 898253] [client 216.73.216.53:18494] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "techexecutive.me"] [uri "/index.php"] [unique_id "alxhK0RK6WUoKc-ijTFt0gAAFQc"]
[Sat Jul 18 23:31:24.061804 2026] [security2:error] [pid 898098:tid 898282] [client 106.222.249.209:12344] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhLERK6WUoKc-ijTFt5gAAADI"]
[Sat Jul 18 23:31:24.061980 2026] [security2:error] [pid 898098:tid 898282] [client 106.222.249.209:12344] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhLERK6WUoKc-ijTFt5gAAADI"]
[Sat Jul 18 23:31:24.136299 2026] [security2:error] [pid 897595:tid 897663] [remote 188.138.102.156:56658] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.rvprintfactory.com"] [uri "/wp-login.php"] [unique_id "alxhLOZhsBlduL7gIyynBAAA-UI"], referer: https://www.rvprintfactory.com/wp-login.php
[Sat Jul 18 23:31:24.202569 2026] [security2:error] [pid 898098:tid 898338] [client 37.59.21.100:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "mezzacraft.com"] [uri "/index.php"] [unique_id "alxhK0RK6WUoKc-ijTFt3QAAAGo"]
[Sat Jul 18 23:31:24.259633 2026] [security2:error] [pid 898098:tid 898297] [client 54.149.239.117:52724] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.239.149.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxhLERK6WUoKc-ijTFuAAAAAEE"]
[Sat Jul 18 23:31:24.430019 2026] [security2:error] [pid 898098:tid 898241] [client 4.194.24.143:42327] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/sitemap.php"] [unique_id "alxhLERK6WUoKc-ijTFuDAAAAAk"]
[Sat Jul 18 23:31:24.761883 2026] [security2:error] [pid 898098:tid 898249] [client 141.94.78.40:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxhLERK6WUoKc-ijTFuGAAAABE"]
[Sat Jul 18 23:31:24.802683 2026] [security2:error] [pid 897595:tid 897850] [client 51.38.115.13:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxhLOZhsBlduL7gIyynEQAAAQE"]
[Sat Jul 18 23:31:24.837880 2026] [security2:error] [pid 897595:tid 897791] [client 216.73.216.53:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "almaz-aura.com"] [uri "/index.php"] [unique_id "alxhLOZhsBlduL7gIyynFQAAxjw"]
[Sat Jul 18 23:31:24.896765 2026] [security2:error] [pid 898098:tid 898344] [client 220.181.108.94:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxhLERK6WUoKc-ijTFuJAAAAHA"]
[Sat Jul 18 23:31:25.022570 2026] [security2:error] [pid 898098:tid 898164] [remote 117.0.21.154:37732] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxhLURK6WUoKc-ijTFuKwAAXz4"]
[Sat Jul 18 23:31:25.022740 2026] [security2:error] [pid 898098:tid 898327] [client 117.0.21.154:37732] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxhLURK6WUoKc-ijTFuKwAAXz4"]
[Sat Jul 18 23:31:25.126080 2026] [security2:error] [pid 898098:tid 898265] [client 13.42.250.172:16172] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 172.250.42.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "marketingonetoone.net"] [uri "/site/xmlrpc.php"] [unique_id "alxhLURK6WUoKc-ijTFuMAAAACE"]
[Sat Jul 18 23:31:25.126197 2026] [security2:error] [pid 898098:tid 898265] [client 13.42.250.172:16172] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "marketingonetoone.net"] [uri "/site/xmlrpc.php"] [unique_id "alxhLURK6WUoKc-ijTFuMAAAACE"]
[Sat Jul 18 23:31:25.152734 2026] [security2:error] [pid 898098:tid 898340] [client 4.194.24.143:61594] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/size.php"] [unique_id "alxhLURK6WUoKc-ijTFuMgAAAGw"]
[Sat Jul 18 23:31:25.318551 2026] [security2:error] [pid 898098:tid 898333] [client 54.85.69.47:14666] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 47.69.85.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxhLURK6WUoKc-ijTFuPAAAAGU"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:25.561702 2026] [security2:error] [pid 898098:tid 898305] [client 54.211.205.212:33840] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 212.205.211.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxhLURK6WUoKc-ijTFuTQAAAEk"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:25.694961 2026] [security2:error] [pid 898098:tid 898323] [client 4.194.24.143:10697] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/sm.php"] [unique_id "alxhLURK6WUoKc-ijTFuUwAAAFs"]
[Sat Jul 18 23:31:26.237468 2026] [security2:error] [pid 897595:tid 897733] [client 13.42.250.172:44261] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 172.250.42.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "marketingonetoone.net"] [uri "/news/xmlrpc.php"] [unique_id "alxhLuZhsBlduL7gIyynPgAAAIw"]
[Sat Jul 18 23:31:26.237590 2026] [security2:error] [pid 897595:tid 897733] [client 13.42.250.172:44261] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "marketingonetoone.net"] [uri "/news/xmlrpc.php"] [unique_id "alxhLuZhsBlduL7gIyynPgAAAIw"]
[Sat Jul 18 23:31:26.271827 2026] [security2:error] [pid 898098:tid 898279] [client 4.194.24.143:10709] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/sql.php"] [unique_id "alxhLkRK6WUoKc-ijTFucgAAAC8"]
[Sat Jul 18 23:31:26.346809 2026] [security2:error] [pid 898098:tid 898277] [client 54.145.191.230:44774] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.191.145.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxhLkRK6WUoKc-ijTFueAAAAC0"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:26.590546 2026] [security2:error] [pid 898098:tid 898291] [client 32.198.12.77:60238] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 77.12.198.32.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxhLkRK6WUoKc-ijTFuggAAADs"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:27.009505 2026] [security2:error] [pid 897595:tid 897782] [client 4.194.24.143:42345] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/ss.php"] [unique_id "alxhL-ZhsBlduL7gIyynVwAAAL0"]
[Sat Jul 18 23:31:27.329106 2026] [security2:error] [pid 897595:tid 897696] [remote 152.53.111.131:44446] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.111.53.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxhL-ZhsBlduL7gIyynXwAAt2M"]
[Sat Jul 18 23:31:27.455561 2026] [security2:error] [pid 897595:tid 897833] [client 124.29.207.185:60219] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxhL-ZhsBlduL7gIyynYAAAAPA"]
[Sat Jul 18 23:31:27.455940 2026] [security2:error] [pid 897595:tid 897833] [client 124.29.207.185:60219] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxhL-ZhsBlduL7gIyynYAAAAPA"]
[Sat Jul 18 23:31:27.625698 2026] [security2:error] [pid 898098:tid 898243] [client 95.108.213.202:60358] ModSecurity: Access denied with code 429 (phase 2). Pattern match "Mozilla\\\\/5\\\\.0 \\\\(compatible; YandexBot\\\\/3\\\\.0; \\\\+http:\\\\/\\\\/yandex\\\\.com\\\\/bots\\\\)" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/othercrawler.conf"] [line "3"] [id "901008"] [msg "Yandex Crawler 429 ADDED BY MONITORING DO NOT WHITELIST"] [hostname "heroesoftomorrow.us"] [uri "/robots.txt"] [unique_id "alxhL0RK6WUoKc-ijTFuuQAAAAs"]
[Sat Jul 18 23:31:27.633887 2026] [security2:error] [pid 897595:tid 897713] [remote 152.53.111.131:44446] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.111.53.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxhL-ZhsBlduL7gIyynYgAAmnQ"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:31:27.833419 2026] [security2:error] [pid 898098:tid 898311] [client 13.42.250.172:19158] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 172.250.42.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "marketingonetoone.net"] [uri "/web/xmlrpc.php"] [unique_id "alxhL0RK6WUoKc-ijTFuyAAAAE8"]
[Sat Jul 18 23:31:27.833536 2026] [security2:error] [pid 898098:tid 898311] [client 13.42.250.172:19158] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "marketingonetoone.net"] [uri "/web/xmlrpc.php"] [unique_id "alxhL0RK6WUoKc-ijTFuyAAAAE8"]
[Sat Jul 18 23:31:27.877406 2026] [security2:error] [pid 898098:tid 898336] [client 4.194.24.143:63195] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/stats.php"] [unique_id "alxhL0RK6WUoKc-ijTFuzAAAAGg"]
[Sat Jul 18 23:31:28.421435 2026] [security2:error] [pid 898098:tid 898282] [client 5.175.146.7:28718] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "lifeisbetterlakeside.com"] [uri "/index.php"] [unique_id "alxhMERK6WUoKc-ijTFu3QAAADI"]
[Sat Jul 18 23:31:28.521064 2026] [security2:error] [pid 898098:tid 898329] [client 4.194.24.143:42319] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/sump1.php"] [unique_id "alxhMERK6WUoKc-ijTFu6QAAAGE"]
[Sat Jul 18 23:31:28.526236 2026] [security2:error] [pid 898098:tid 898312] [client 13.42.250.172:43206] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 172.250.42.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "marketingonetoone.net"] [uri "/main/xmlrpc.php"] [unique_id "alxhMERK6WUoKc-ijTFu6gAAAFA"]
[Sat Jul 18 23:31:28.526318 2026] [security2:error] [pid 898098:tid 898312] [client 13.42.250.172:43206] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "marketingonetoone.net"] [uri "/main/xmlrpc.php"] [unique_id "alxhMERK6WUoKc-ijTFu6gAAAFA"]
[Sat Jul 18 23:31:28.621811 2026] [security2:error] [pid 898098:tid 898114] [remote 98.70.32.248:38112] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.32.70.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "kromosenergy.com"] [uri "/wp-login.php"] [unique_id "alxhMERK6WUoKc-ijTFu7QAAEQw"]
[Sat Jul 18 23:31:29.175916 2026] [security2:error] [pid 898098:tid 898116] [remote 98.70.32.248:38112] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.32.70.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "kromosenergy.com"] [uri "/wp-login.php"] [unique_id "alxhMURK6WUoKc-ijTFvCQAAGg4"], referer: https://kromosenergy.com/wp-login.php
[Sat Jul 18 23:31:29.477761 2026] [security2:error] [pid 898098:tid 898120] [remote 152.228.213.32:48042] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mourgroup.com"] [uri "/wp-login.php"] [unique_id "alxhMURK6WUoKc-ijTFvFgAAahI"]
[Sat Jul 18 23:31:29.709490 2026] [security2:error] [pid 898098:tid 898130] [remote 152.228.213.32:48042] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mourgroup.com"] [uri "/wp-login.php"] [unique_id "alxhMURK6WUoKc-ijTFvJAAADRw"], referer: https://mourgroup.com/wp-login.php
[Sat Jul 18 23:31:29.832695 2026] [security2:error] [pid 897595:tid 897778] [client 13.42.250.172:47247] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 172.250.42.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "marketingonetoone.net"] [uri "/cms/xmlrpc.php"] [unique_id "alxhMeZhsBlduL7gIyyniAAAALk"]
[Sat Jul 18 23:31:29.832801 2026] [security2:error] [pid 897595:tid 897778] [client 13.42.250.172:47247] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "marketingonetoone.net"] [uri "/cms/xmlrpc.php"] [unique_id "alxhMeZhsBlduL7gIyyniAAAALk"]
[Sat Jul 18 23:31:29.904529 2026] [security2:error] [pid 897595:tid 897802] [client 65.0.26.70:32842] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.26.0.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxhMeZhsBlduL7gIyynigAAANE"]
[Sat Jul 18 23:31:29.904630 2026] [security2:error] [pid 897595:tid 897802] [client 65.0.26.70:32842] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxhMeZhsBlduL7gIyynigAAANE"]
[Sat Jul 18 23:31:30.892187 2026] [security2:error] [pid 898098:tid 898235] [client 3.64.55.230:65428] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.55.64.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxhMkRK6WUoKc-ijTFvWgAAAAM"]
[Sat Jul 18 23:31:30.892292 2026] [security2:error] [pid 898098:tid 898235] [client 3.64.55.230:65428] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxhMkRK6WUoKc-ijTFvWgAAAAM"]
[Sat Jul 18 23:31:31.030281 2026] [security2:error] [pid 898098:tid 898251] [client 13.42.250.172:11639] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 172.250.42.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "marketingonetoone.net"] [uri "/wp-site/xmlrpc.php"] [unique_id "alxhM0RK6WUoKc-ijTFvZwAAABM"]
[Sat Jul 18 23:31:31.030365 2026] [security2:error] [pid 898098:tid 898251] [client 13.42.250.172:11639] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "marketingonetoone.net"] [uri "/wp-site/xmlrpc.php"] [unique_id "alxhM0RK6WUoKc-ijTFvZwAAABM"]
[Sat Jul 18 23:31:31.321680 2026] [security2:error] [pid 898098:tid 898244] [client 138.252.89.100:59158] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhM0RK6WUoKc-ijTFvdQAAAAw"]
[Sat Jul 18 23:31:31.321816 2026] [security2:error] [pid 898098:tid 898244] [client 138.252.89.100:59158] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhM0RK6WUoKc-ijTFvdQAAAAw"]
[Sat Jul 18 23:31:31.539446 2026] [security2:error] [pid 897595:tid 897852] [client 223.228.182.224:34394] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhM-ZhsBlduL7gIyynoQAAAQM"]
[Sat Jul 18 23:31:31.539549 2026] [security2:error] [pid 897595:tid 897852] [client 223.228.182.224:34394] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhM-ZhsBlduL7gIyynoQAAAQM"]
[Sat Jul 18 23:31:31.756818 2026] [security2:error] [pid 898098:tid 898242] [client 74.208.214.194:37486] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxhM0RK6WUoKc-ijTFvlQAAAAo"]
[Sat Jul 18 23:31:31.855006 2026] [security2:error] [pid 898098:tid 898331] [client 163.61.1.17:57923] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhM0RK6WUoKc-ijTFvmwAAAGM"]
[Sat Jul 18 23:31:31.855154 2026] [security2:error] [pid 898098:tid 898331] [client 163.61.1.17:57923] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhM0RK6WUoKc-ijTFvmwAAAGM"]
[Sat Jul 18 23:31:31.967870 2026] [security2:error] [pid 898098:tid 898255] [client 52.167.144.236:34917] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.vfcthomasville.org"] [uri "/index.php"] [unique_id "alxhM0RK6WUoKc-ijTFvnQAAF04"]
[Sat Jul 18 23:31:32.131905 2026] [security2:error] [pid 898098:tid 898320] [client 13.42.250.172:7657] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 172.250.42.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "marketingonetoone.net"] [uri "/wpsite/xmlrpc.php"] [unique_id "alxhNERK6WUoKc-ijTFvrAAAAFg"]
[Sat Jul 18 23:31:32.131985 2026] [security2:error] [pid 898098:tid 898320] [client 13.42.250.172:7657] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "marketingonetoone.net"] [uri "/wpsite/xmlrpc.php"] [unique_id "alxhNERK6WUoKc-ijTFvrAAAAFg"]
[Sat Jul 18 23:31:32.301611 2026] [security2:error] [pid 898098:tid 898233] [client 119.154.81.234:56748] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhNERK6WUoKc-ijTFvswAAAAE"]
[Sat Jul 18 23:31:32.301718 2026] [security2:error] [pid 898098:tid 898233] [client 119.154.81.234:56748] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhNERK6WUoKc-ijTFvswAAAAE"]
[Sat Jul 18 23:31:32.446912 2026] [security2:error] [pid 898098:tid 898195] [remote 117.0.21.154:37756] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxhNERK6WUoKc-ijTFvugAAW1w"]
[Sat Jul 18 23:31:32.781405 2026] [security2:error] [pid 897595:tid 897840] [client 190.245.146.99:59731] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhNOZhsBlduL7gIyynsgAAAPc"]
[Sat Jul 18 23:31:32.787114 2026] [security2:error] [pid 897595:tid 897840] [client 190.245.146.99:59731] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhNOZhsBlduL7gIyynsgAAAPc"]
[Sat Jul 18 23:31:32.942958 2026] [security2:error] [pid 897595:tid 897849] [client 13.42.250.172:48574] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 172.250.42.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "marketingonetoone.net"] [uri "/old/xmlrpc.php"] [unique_id "alxhNOZhsBlduL7gIyynugAAAQA"]
[Sat Jul 18 23:31:32.943050 2026] [security2:error] [pid 897595:tid 897849] [client 13.42.250.172:48574] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "marketingonetoone.net"] [uri "/old/xmlrpc.php"] [unique_id "alxhNOZhsBlduL7gIyynugAAAQA"]
[Sat Jul 18 23:31:33.660325 2026] [security2:error] [pid 898098:tid 898220] [remote 117.0.21.154:37756] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxhNURK6WUoKc-ijTFv_QAAJXU"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:31:34.025059 2026] [security2:error] [pid 897595:tid 897814] [client 13.42.250.172:26543] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 172.250.42.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "marketingonetoone.net"] [uri "/new/xmlrpc.php"] [unique_id "alxhNuZhsBlduL7gIyynzgAAAN0"]
[Sat Jul 18 23:31:34.025150 2026] [security2:error] [pid 897595:tid 897814] [client 13.42.250.172:26543] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "marketingonetoone.net"] [uri "/new/xmlrpc.php"] [unique_id "alxhNuZhsBlduL7gIyynzgAAAN0"]
[Sat Jul 18 23:31:34.695492 2026] [security2:error] [pid 898098:tid 898278] [client 106.222.249.209:32793] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhNkRK6WUoKc-ijTFwLgAAAC4"]
[Sat Jul 18 23:31:34.695613 2026] [security2:error] [pid 898098:tid 898278] [client 106.222.249.209:32793] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhNkRK6WUoKc-ijTFwLgAAAC4"]
[Sat Jul 18 23:31:35.511003 2026] [security2:error] [pid 897595:tid 897644] [remote 202.51.202.242:44968] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 242.202.51.202.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxhN-ZhsBlduL7gIyyn3QAAty8"]
[Sat Jul 18 23:31:35.511148 2026] [security2:error] [pid 897595:tid 897776] [client 202.51.202.242:44968] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxhN-ZhsBlduL7gIyyn3QAAty8"]
[Sat Jul 18 23:31:36.578127 2026] [security2:error] [pid 897595:tid 897744] [client 47.128.119.88:52106] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "nevelow.com"] [uri "/robots.txt"] [unique_id "alxhOOZhsBlduL7gIyyn7gAAAJc"]
[Sat Jul 18 23:31:37.770936 2026] [security2:error] [pid 898098:tid 898291] [client 124.29.207.185:60666] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxhOURK6WUoKc-ijTFwugAAADs"]
[Sat Jul 18 23:31:37.771033 2026] [security2:error] [pid 898098:tid 898291] [client 124.29.207.185:60666] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxhOURK6WUoKc-ijTFwugAAADs"]
[Sat Jul 18 23:31:38.134771 2026] [security2:error] [pid 897595:tid 897751] [client 85.206.128.219:51460] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 219.128.206.85.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.marscafe.com"] [uri "/nav-toppers/internal.php"] [unique_id "alxhOuZhsBlduL7gIyyoBwAAAJ4"]
[Sat Jul 18 23:31:38.212169 2026] [security2:error] [pid 898098:tid 898153] [remote 216.73.216.174:28215] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.216.73.216.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/training-temp"] [unique_id "alxhOkRK6WUoKc-ijTFwyQAAUTM"]
[Sat Jul 18 23:31:38.622736 2026] [security2:error] [pid 898098:tid 898344] [client 13.42.250.172:46258] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 172.250.42.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "marketingonetoone.net"] [uri "/wp-login.php"] [unique_id "alxhOkRK6WUoKc-ijTFw2AAAAHA"], referer: https://marketingonetoone.net/wp-admin/
[Sat Jul 18 23:31:38.706973 2026] [security2:error] [pid 898098:tid 898172] [remote 31.42.184.154:37310] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxhOkRK6WUoKc-ijTFw2wAAX0Y"]
[Sat Jul 18 23:31:38.707150 2026] [security2:error] [pid 898098:tid 898327] [client 31.42.184.154:37310] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxhOkRK6WUoKc-ijTFw2wAAX0Y"]
[Sat Jul 18 23:31:39.233924 2026] [security2:error] [pid 898098:tid 898279] [client 13.42.250.172:36543] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 172.250.42.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "marketingonetoone.net"] [uri "/wp-login.php"] [unique_id "alxhO0RK6WUoKc-ijTFw-wAAAC8"]
[Sat Jul 18 23:31:40.545275 2026] [security2:error] [pid 898098:tid 898262] [client 4.194.24.143:42356] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/system.php"] [unique_id "alxhPERK6WUoKc-ijTFxNgAAAB4"]
[Sat Jul 18 23:31:41.089497 2026] [security2:error] [pid 897595:tid 897744] [client 4.194.24.143:42355] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/system/03n1hob7p03r2npdefault.php"] [unique_id "alxhPeZhsBlduL7gIyyoOgAAAJc"]
[Sat Jul 18 23:31:41.417594 2026] [security2:error] [pid 898098:tid 898351] [client 223.228.182.224:27050] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhPURK6WUoKc-ijTFxVwAAAHc"]
[Sat Jul 18 23:31:41.417705 2026] [security2:error] [pid 898098:tid 898351] [client 223.228.182.224:27050] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhPURK6WUoKc-ijTFxVwAAAHc"]
[Sat Jul 18 23:31:41.631341 2026] [security2:error] [pid 898098:tid 898315] [client 4.194.24.143:10559] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/system/cj5ha2rah8lyiqqdefault.php"] [unique_id "alxhPURK6WUoKc-ijTFxYgAAAFM"]
[Sat Jul 18 23:31:41.642775 2026] [security2:error] [pid 898098:tid 898282] [client 62.150.67.110:21744] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "ali-alghanim.net"] [uri "/index.php"] [unique_id "alxhPURK6WUoKc-ijTFxVAAAADI"]
[Sat Jul 18 23:31:41.820969 2026] [security2:error] [pid 897595:tid 897801] [client 216.73.163.152:65267] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 152.163.73.216.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.leapexinc.com"] [uri "/wp-login.php"] [unique_id "alxhPeZhsBlduL7gIyyoUgAAANA"]
[Sat Jul 18 23:31:42.173315 2026] [security2:error] [pid 898098:tid 898268] [client 4.194.24.143:61599] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/system_log.php"] [unique_id "alxhPkRK6WUoKc-ijTFxgAAAACQ"]
[Sat Jul 18 23:31:42.309507 2026] [security2:error] [pid 898098:tid 898332] [client 163.61.1.17:58391] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhPkRK6WUoKc-ijTFxhgAAAGQ"]
[Sat Jul 18 23:31:42.309600 2026] [security2:error] [pid 898098:tid 898332] [client 163.61.1.17:58391] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhPkRK6WUoKc-ijTFxhgAAAGQ"]
[Sat Jul 18 23:31:42.715064 2026] [security2:error] [pid 898098:tid 898339] [client 4.194.24.143:10553] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/t.php"] [unique_id "alxhPkRK6WUoKc-ijTFxnAAAAGs"]
[Sat Jul 18 23:31:42.811910 2026] [security2:error] [pid 898098:tid 898252] [client 119.154.81.234:57197] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhPkRK6WUoKc-ijTFxoAAAABQ"]
[Sat Jul 18 23:31:42.812035 2026] [security2:error] [pid 898098:tid 898252] [client 119.154.81.234:57197] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhPkRK6WUoKc-ijTFxoAAAABQ"]
[Sat Jul 18 23:31:42.970444 2026] [security2:error] [pid 898098:tid 898319] [client 138.252.89.100:59639] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhPkRK6WUoKc-ijTFxqwAAAFc"]
[Sat Jul 18 23:31:42.970541 2026] [security2:error] [pid 898098:tid 898319] [client 138.252.89.100:59639] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhPkRK6WUoKc-ijTFxqwAAAFc"]
[Sat Jul 18 23:31:43.265945 2026] [security2:error] [pid 897595:tid 897839] [client 4.194.24.143:61605] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/term.php"] [unique_id "alxhP-ZhsBlduL7gIyyobQAAAPY"]
[Sat Jul 18 23:31:43.277841 2026] [security2:error] [pid 898098:tid 898356] [client 190.245.146.99:60241] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhP0RK6WUoKc-ijTFxtQAAAHw"]
[Sat Jul 18 23:31:43.283933 2026] [security2:error] [pid 898098:tid 898356] [client 190.245.146.99:60241] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhP0RK6WUoKc-ijTFxtQAAAHw"]
[Sat Jul 18 23:31:43.358709 2026] [security2:error] [pid 898098:tid 898144] [remote 117.0.21.154:43468] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxhP0RK6WUoKc-ijTFxugAAGSo"]
[Sat Jul 18 23:31:43.807334 2026] [security2:error] [pid 898098:tid 898316] [client 4.194.24.143:42312] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/test.php"] [unique_id "alxhP0RK6WUoKc-ijTFxzgAAAFQ"]
[Sat Jul 18 23:31:43.827805 2026] [security2:error] [pid 898098:tid 898158] [remote 117.0.21.154:43468] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxhP0RK6WUoKc-ijTFxzwAACzg"], referer: https://sesamegreenbeans.com/wp-login.php
[Sat Jul 18 23:31:44.065191 2026] [security2:error] [pid 898098:tid 898122] [remote 97.74.93.24:54916] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxhQERK6WUoKc-ijTFx2gAAfhQ"]
[Sat Jul 18 23:31:44.222946 2026] [security2:error] [pid 898098:tid 898319] [client 95.26.251.96:24980] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "toddnielsen.com"] [uri "/index.php"] [unique_id "alxhQERK6WUoKc-ijTFx4QAAVz8"], referer: https://toddnielsen.com
[Sat Jul 18 23:31:44.381089 2026] [security2:error] [pid 898098:tid 898265] [client 4.194.24.143:42363] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/test1.php"] [unique_id "alxhQERK6WUoKc-ijTFx7gAAACE"]
[Sat Jul 18 23:31:44.495846 2026] [security2:error] [pid 898098:tid 898170] [remote 97.74.93.24:54916] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxhQERK6WUoKc-ijTFx8gAAVUQ"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:31:44.924120 2026] [security2:error] [pid 898098:tid 898346] [client 4.194.24.143:10532] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/tfm.php"] [unique_id "alxhQERK6WUoKc-ijTFyDQAAAHI"]
[Sat Jul 18 23:31:45.245713 2026] [security2:error] [pid 898098:tid 898263] [client 106.222.249.209:6735] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhQURK6WUoKc-ijTFyGwAAAB8"]
[Sat Jul 18 23:31:45.245848 2026] [security2:error] [pid 898098:tid 898263] [client 106.222.249.209:6735] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhQURK6WUoKc-ijTFyGwAAAB8"]
[Sat Jul 18 23:31:45.521316 2026] [security2:error] [pid 898098:tid 898283] [client 4.194.24.143:61568] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/thebe.php"] [unique_id "alxhQURK6WUoKc-ijTFyLQAAADM"]
[Sat Jul 18 23:31:45.885850 2026] [security2:error] [pid 898098:tid 898273] [client 171.245.26.255:48825] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxhQURK6WUoKc-ijTFyOgAAACk"]
[Sat Jul 18 23:31:46.062979 2026] [security2:error] [pid 898098:tid 898264] [client 4.194.24.143:40144] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/themes.php"] [unique_id "alxhQkRK6WUoKc-ijTFyTAAAACA"]
[Sat Jul 18 23:31:46.343153 2026] [security2:error] [pid 898098:tid 898348] [client 16.145.89.170:16204] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 170.89.145.16.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cryptomeaning.com"] [uri "/wp-cron.php"] [unique_id "alxhQkRK6WUoKc-ijTFyXgAAAHQ"]
[Sat Jul 18 23:31:46.388042 2026] [security2:error] [pid 898098:tid 898311] [client 3.109.49.224:57562] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "200"] [hostname "cryptomeaning.com"] [uri "/xmlrpc.php"] [unique_id "alxhQERK6WUoKc-ijTFx4gAAAE8"]
[Sat Jul 18 23:31:46.607288 2026] [security2:error] [pid 898098:tid 898321] [client 4.194.24.143:40138] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/tiny.php"] [unique_id "alxhQkRK6WUoKc-ijTFyawAAAFk"]
[Sat Jul 18 23:31:47.185022 2026] [security2:error] [pid 897595:tid 897735] [client 4.194.24.143:40156] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "pranavilla.com"] [uri "/tmp/byp.php"] [unique_id "alxhQ-ZhsBlduL7gIyyouAAAAI4"]
[Sat Jul 18 23:31:47.928612 2026] [security2:error] [pid 898098:tid 898259] [client 50.116.65.227:11374] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.fkconstructionfunding.com"] [uri "/wp-content/plugins/contact-form-7/includes/css/styles.css"] [unique_id "alxhQ0RK6WUoKc-ijTFypAAAABs"]
[Sat Jul 18 23:31:47.938580 2026] [security2:error] [pid 898098:tid 898338] [client 50.116.65.227:11384] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.fkconstructionfunding.com"] [uri "/wp-content/plugins/contact-form-7/includes/css/styles-rtl.css"] [unique_id "alxhQ0RK6WUoKc-ijTFypQAAAGo"]
[Sat Jul 18 23:31:48.994394 2026] [security2:error] [pid 898098:tid 898138] [remote 72.167.132.114:56530] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thelastgamestandingexp.com"] [uri "/wp-login.php"] [unique_id "alxhRERK6WUoKc-ijTFy0AAAHCQ"]
[Sat Jul 18 23:31:49.749398 2026] [security2:error] [pid 898098:tid 898162] [remote 216.73.216.174:28215] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.216.73.216.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/training-temp"] [unique_id "alxhRURK6WUoKc-ijTFy9wAACTw"]
[Sat Jul 18 23:31:49.999585 2026] [security2:error] [pid 898098:tid 898317] [client 124.29.207.185:61112] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxhRURK6WUoKc-ijTFy_QAAAFU"]
[Sat Jul 18 23:31:50.000113 2026] [security2:error] [pid 898098:tid 898317] [client 124.29.207.185:61112] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxhRURK6WUoKc-ijTFy_QAAAFU"]
[Sat Jul 18 23:31:50.581088 2026] [security2:error] [pid 898098:tid 898163] [remote 98.70.32.248:34912] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.32.70.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "intelligentengineeringsolutions.com"] [uri "/wp-login.php"] [unique_id "alxhRkRK6WUoKc-ijTFzFAAAMD0"]
[Sat Jul 18 23:31:50.786640 2026] [security2:error] [pid 898098:tid 898150] [remote 97.74.93.24:53292] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "39ishlife.com"] [uri "/wp-login.php"] [unique_id "alxhRkRK6WUoKc-ijTFzGgAAWzA"]
[Sat Jul 18 23:31:51.000340 2026] [security2:error] [pid 898098:tid 898173] [remote 98.70.32.248:34912] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.32.70.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "intelligentengineeringsolutions.com"] [uri "/wp-login.php"] [unique_id "alxhRkRK6WUoKc-ijTFzIwAAa0c"], referer: https://intelligentengineeringsolutions.com/wp-login.php
[Sat Jul 18 23:31:51.204139 2026] [security2:error] [pid 898098:tid 898171] [remote 97.74.93.24:53292] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "39ishlife.com"] [uri "/wp-login.php"] [unique_id "alxhR0RK6WUoKc-ijTFzKgAALEU"], referer: https://39ishlife.com/wp-login.php
[Sat Jul 18 23:31:51.297575 2026] [security2:error] [pid 897595:tid 897626] [remote 31.42.184.154:54222] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxhR-ZhsBlduL7gIyypDQAAqh0"]
[Sat Jul 18 23:31:51.563807 2026] [security2:error] [pid 897595:tid 897644] [remote 31.42.184.154:54222] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxhR-ZhsBlduL7gIyypFgAAri8"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:31:52.178028 2026] [security2:error] [pid 898098:tid 898282] [client 223.228.182.224:49199] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhSERK6WUoKc-ijTFzUwAAADI"]
[Sat Jul 18 23:31:52.178145 2026] [security2:error] [pid 898098:tid 898282] [client 223.228.182.224:49199] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhSERK6WUoKc-ijTFzUwAAADI"]
[Sat Jul 18 23:31:52.298981 2026] [security2:error] [pid 897595:tid 897842] [client 34.207.130.29:0] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "curlsnpearlsss.com"] [uri "/index.php"] [unique_id "alxhR-ZhsBlduL7gIyypEQAAAPk"]
[Sat Jul 18 23:31:52.343568 2026] [security2:error] [pid 898098:tid 898286] [client 34.207.130.29:44456] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "curlsnpearlsss.com"] [uri "/es/pollo-guisado-recipe/"] [unique_id "alxhR0RK6WUoKc-ijTFzMAAAADY"]
[Sat Jul 18 23:31:52.487523 2026] [security2:error] [pid 898098:tid 898200] [remote 72.167.132.114:56530] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thelastgamestandingexp.com"] [uri "/wp-login.php"] [unique_id "alxhSERK6WUoKc-ijTFzZgAAV2E"], referer: https://thelastgamestandingexp.com/wp-login.php
[Sat Jul 18 23:31:53.031676 2026] [security2:error] [pid 898098:tid 898329] [client 163.61.1.17:58865] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhSURK6WUoKc-ijTFzgQAAAGE"]
[Sat Jul 18 23:31:53.031782 2026] [security2:error] [pid 898098:tid 898329] [client 163.61.1.17:58865] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhSURK6WUoKc-ijTFzgQAAAGE"]
[Sat Jul 18 23:31:53.588062 2026] [security2:error] [pid 898098:tid 898260] [client 119.154.81.234:57648] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhSURK6WUoKc-ijTFzlQAAABw"]
[Sat Jul 18 23:31:53.588163 2026] [security2:error] [pid 898098:tid 898260] [client 119.154.81.234:57648] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhSURK6WUoKc-ijTFzlQAAABw"]
[Sat Jul 18 23:31:53.733110 2026] [security2:error] [pid 898098:tid 898285] [client 190.245.146.99:60755] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhSURK6WUoKc-ijTFznwAAADU"]
[Sat Jul 18 23:31:53.739068 2026] [security2:error] [pid 898098:tid 898285] [client 190.245.146.99:60755] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhSURK6WUoKc-ijTFznwAAADU"]
[Sat Jul 18 23:31:54.547448 2026] [security2:error] [pid 897595:tid 897785] [client 138.252.89.100:60222] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhSuZhsBlduL7gIyypQQAAAMA"]
[Sat Jul 18 23:31:54.547534 2026] [security2:error] [pid 897595:tid 897785] [client 138.252.89.100:60222] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhSuZhsBlduL7gIyypQQAAAMA"]
[Sat Jul 18 23:31:54.903999 2026] [ssl:error] [pid 898098:tid 898273] [client 54.86.115.253:45245] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname cpcalendars.kpb.qlr.mybluehost.me provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:31:55.179416 2026] [security2:error] [pid 898098:tid 898294] [client 13.232.206.133:14720] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.206.232.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxhS0RK6WUoKc-ijTFz1wAAAD4"]
[Sat Jul 18 23:31:55.710294 2026] [security2:error] [pid 898098:tid 898126] [remote 98.70.32.248:34924] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.32.70.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxhS0RK6WUoKc-ijTFz7AAAbBg"]
[Sat Jul 18 23:31:55.984993 2026] [security2:error] [pid 897595:tid 897845] [client 106.222.249.209:32915] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhS-ZhsBlduL7gIyypUQAAAPw"]
[Sat Jul 18 23:31:55.985296 2026] [security2:error] [pid 897595:tid 897845] [client 106.222.249.209:32915] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhS-ZhsBlduL7gIyypUQAAAPw"]
[Sat Jul 18 23:31:56.121702 2026] [security2:error] [pid 898098:tid 898125] [remote 98.70.32.248:34924] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.32.70.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxhTERK6WUoKc-ijTFz_QAAHRc"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:31:56.162899 2026] [security2:error] [pid 898098:tid 898134] [remote 31.42.184.154:54226] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "studio.xp-design.co"] [uri "/wp-login.php"] [unique_id "alxhTERK6WUoKc-ijTF0AQAAOiA"]
[Sat Jul 18 23:31:56.389147 2026] [security2:error] [pid 898098:tid 898135] [remote 31.42.184.154:54226] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "studio.xp-design.co"] [uri "/wp-login.php"] [unique_id "alxhTERK6WUoKc-ijTF0CQAANyE"], referer: https://studio.xp-design.co/wp-login.php
[Sat Jul 18 23:31:56.445992 2026] [security2:error] [pid 898098:tid 898119] [remote 152.228.213.32:50752] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxhTERK6WUoKc-ijTF0DgAAZRE"]
[Sat Jul 18 23:31:56.632912 2026] [security2:error] [pid 898098:tid 898219] [remote 152.228.213.32:50752] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxhTERK6WUoKc-ijTF0FgAABHQ"], referer: https://mezzacraft.com/wp-login.php
[Sat Jul 18 23:31:56.904781 2026] [security2:error] [pid 898098:tid 898271] [client 13.232.206.133:14726] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.206.232.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxhTERK6WUoKc-ijTF0JwAAACc"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:31:57.239623 2026] [security2:error] [pid 898098:tid 898325] [client 98.82.181.200:38342] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 200.181.82.98.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxhTURK6WUoKc-ijTF0NwAAAF0"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:57.472417 2026] [security2:error] [pid 898098:tid 898250] [client 3.85.217.58:29130] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.217.85.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxhTURK6WUoKc-ijTF0RAAAABI"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:58.288049 2026] [security2:error] [pid 898098:tid 898175] [remote 103.75.185.95:37610] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "inspirespublishing.com"] [uri "/wp-login.php"] [unique_id "alxhTkRK6WUoKc-ijTF0aAAAUEg"]
[Sat Jul 18 23:31:58.521003 2026] [security2:error] [pid 898098:tid 898323] [client 36.68.125.232:52376] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 232.125.68.36.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.tmsteamer.com"] [uri "/phpinfo.php"] [unique_id "alxhTkRK6WUoKc-ijTF0dQAAAFs"]
[Sat Jul 18 23:31:58.625028 2026] [security2:error] [pid 898098:tid 898326] [client 13.221.201.234:53894] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.201.221.13.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxhTkRK6WUoKc-ijTF0eQAAAF4"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:58.806241 2026] [security2:error] [pid 898098:tid 898161] [remote 103.75.185.95:37610] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "inspirespublishing.com"] [uri "/wp-login.php"] [unique_id "alxhTkRK6WUoKc-ijTF0hgAABzs"], referer: https://inspirespublishing.com/wp-login.php
[Sat Jul 18 23:31:58.857371 2026] [security2:error] [pid 898098:tid 898350] [client 54.145.191.230:49530] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.191.145.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxhTkRK6WUoKc-ijTF0iQAAAHY"], referer: https://curlsnpearlsss.com/es/pollo-guisado-recipe/
[Sat Jul 18 23:31:58.934739 2026] [security2:error] [pid 898098:tid 898297] [client 36.68.125.232:52752] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 232.125.68.36.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.tmsteamer.com"] [uri "/test.php"] [unique_id "alxhTkRK6WUoKc-ijTF0kQAAAEE"]
[Sat Jul 18 23:31:59.428056 2026] [security2:error] [pid 898098:tid 898356] [client 45.180.65.164:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "worbals.com"] [uri "/index.php"] [unique_id "alxhT0RK6WUoKc-ijTF0nAAAAHw"]
[Sat Jul 18 23:31:59.829892 2026] [security2:error] [pid 898098:tid 898236] [client 36.68.125.232:53525] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\.bak|\\\\.bak\\\\.php)$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1260"] [id "390582"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that nclude .bak)"] [severity "CRITICAL"] [hostname "webmail.tmsteamer.com"] [uri "/___proxy_subdomain_webmail/.env/.env.bak"] [unique_id "alxhT0RK6WUoKc-ijTF0swAAAAQ"]
[Sat Jul 18 23:32:00.743024 2026] [security2:error] [pid 897595:tid 897761] [client 36.68.125.232:54321] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 232.125.68.36.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.tmsteamer.com"] [uri "/index.php"] [unique_id "alxhUOZhsBlduL7gIyyppAAAAKg"]
[Sat Jul 18 23:32:02.800889 2026] [security2:error] [pid 898098:tid 898236] [client 143.244.57.88:36718] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "tejasenvironmental.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "alxhUkRK6WUoKc-ijTF1SQAAAAQ"]
[Sat Jul 18 23:32:03.074496 2026] [security2:error] [pid 898098:tid 898330] [client 223.228.182.224:28477] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhU0RK6WUoKc-ijTF1VAAAAGI"]
[Sat Jul 18 23:32:03.074673 2026] [security2:error] [pid 898098:tid 898330] [client 223.228.182.224:28477] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhU0RK6WUoKc-ijTF1VAAAAGI"]
[Sat Jul 18 23:32:03.324506 2026] [security2:error] [pid 897595:tid 897776] [client 114.119.144.42:62593] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "suretybonds-california.com"] [uri "/surety-bonds-blog/page/2"] [unique_id "alxhU-ZhsBlduL7gIyyp3gAAALc"], referer: https://suretybonds-california.com/surety-bonds-blog
[Sat Jul 18 23:32:03.385527 2026] [security2:error] [pid 898098:tid 898338] [client 163.61.1.17:59488] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhU0RK6WUoKc-ijTF1XQAAAGo"]
[Sat Jul 18 23:32:03.385641 2026] [security2:error] [pid 898098:tid 898338] [client 163.61.1.17:59488] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhU0RK6WUoKc-ijTF1XQAAAGo"]
[Sat Jul 18 23:32:03.392264 2026] [security2:error] [pid 898098:tid 898314] [client 143.244.57.88:36722] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 88.57.244.143.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tejasenvironmental.com"] [uri "/xmlrpc.php"] [unique_id "alxhU0RK6WUoKc-ijTF1XgAAAFI"]
[Sat Jul 18 23:32:03.404936 2026] [security2:error] [pid 898098:tid 898296] [client 113.237.108.171:47341] ModSecurity: Warning. Match of "ipMatch 127.0.0.1,::1" against "REMOTE_ADDR" required. [file "/etc/httpd/modsecurity.d/00_asl_zz_strict.conf"] [line "82"] [id "331030"] [rev "2"] [msg "Atomicorp.com WAF Rules: Suspicious activity detected - HTTP Request Missing a Host Header"] [severity "NOTICE"] [tag "no_ar"] [hostname "upositive-co.youpositive.co"] [uri "/boaform/admin/formLogin"] [unique_id "alxhU0RK6WUoKc-ijTF1YQAAAEA"]
[Sat Jul 18 23:32:03.405652 2026] [proxy:warn] [pid 898098:tid 898296] [client 113.237.108.171:47341] AH01092: no HTTP 0.9 request (with no host line) on incoming request and preserve host set forcing hostname to be upositive-co.youpositive.co for uri /boaform/admin/formLogin
[Sat Jul 18 23:32:03.417974 2026] [core:error] [pid 898098:tid 898307] [client 113.237.108.171:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:32:03.417988 2026] [core:error] [pid 898098:tid 898307] [client 113.237.108.171:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:32:03.418072 2026] [security2:error] [pid 898098:tid 898307] [client 113.237.108.171:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "500"] [hostname "upositive-co.youpositive.co"] [uri "/index.php"] [unique_id "alxhU0RK6WUoKc-ijTF1ZAAAAEs"]
[Sat Jul 18 23:32:03.420369 2026] [security2:error] [pid 898098:tid 898296] [client 113.237.108.171:47341] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "500"] [hostname "upositive-co.youpositive.co"] [uri "/boaform/admin/formLogin"] [unique_id "alxhU0RK6WUoKc-ijTF1YQAAAEA"]
[Sat Jul 18 23:32:04.198327 2026] [security2:error] [pid 898098:tid 898331] [client 119.154.81.234:58104] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhVERK6WUoKc-ijTF1iwAAAGM"]
[Sat Jul 18 23:32:04.198479 2026] [security2:error] [pid 898098:tid 898331] [client 119.154.81.234:58104] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhVERK6WUoKc-ijTF1iwAAAGM"]
[Sat Jul 18 23:32:04.234769 2026] [security2:error] [pid 898098:tid 898305] [client 190.245.146.99:61274] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhVERK6WUoKc-ijTF1jQAAAEk"]
[Sat Jul 18 23:32:04.240239 2026] [security2:error] [pid 898098:tid 898305] [client 190.245.146.99:61274] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhVERK6WUoKc-ijTF1jQAAAEk"]
[Sat Jul 18 23:32:04.377302 2026] [security2:error] [pid 898098:tid 898193] [remote 31.42.184.154:53174] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tntcatholic.com"] [uri "/wp-login.php"] [unique_id "alxhVERK6WUoKc-ijTF1lgAAclo"]
[Sat Jul 18 23:32:04.601316 2026] [security2:error] [pid 898098:tid 898190] [remote 31.42.184.154:53174] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tntcatholic.com"] [uri "/wp-login.php"] [unique_id "alxhVERK6WUoKc-ijTF1ogAAQFc"], referer: https://tntcatholic.com/wp-login.php
[Sat Jul 18 23:32:05.441564 2026] [security2:error] [pid 898098:tid 898279] [client 143.244.57.88:36732] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 88.57.244.143.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tejasenvironmental.com"] [uri "/xmlrpc.php"] [unique_id "alxhVURK6WUoKc-ijTF1xgAAAC8"]
[Sat Jul 18 23:32:05.441695 2026] [security2:error] [pid 898098:tid 898279] [client 143.244.57.88:36732] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "tejasenvironmental.com"] [uri "/xmlrpc.php"] [unique_id "alxhVURK6WUoKc-ijTF1xgAAAC8"]
[Sat Jul 18 23:32:05.791139 2026] [security2:error] [pid 898098:tid 898211] [remote 45.157.54.14:36127] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "timespans.org"] [uri "/xmlrpc.php"] [unique_id "alxhVURK6WUoKc-ijTF11QAAcmw"]
[Sat Jul 18 23:32:05.791284 2026] [security2:error] [pid 898098:tid 898346] [client 45.157.54.14:36127] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "timespans.org"] [uri "/xmlrpc.php"] [unique_id "alxhVURK6WUoKc-ijTF11QAAcmw"]
[Sat Jul 18 23:32:05.800681 2026] [security2:error] [pid 897595:tid 897708] [remote 45.157.54.14:36145] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "timespans.org"] [uri "/xmlrpc.php"] [unique_id "alxhVeZhsBlduL7gIyyqEAAAqm8"]
[Sat Jul 18 23:32:05.800836 2026] [security2:error] [pid 897595:tid 897763] [client 45.157.54.14:36145] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "timespans.org"] [uri "/xmlrpc.php"] [unique_id "alxhVeZhsBlduL7gIyyqEAAAqm8"]
[Sat Jul 18 23:32:05.848641 2026] [security2:error] [pid 897595:tid 897633] [remote 120.72.98.5:7330] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tntcatholic.com"] [uri "/wp-login.php"] [unique_id "alxhVeZhsBlduL7gIyyqEgAAqyQ"]
[Sat Jul 18 23:32:06.034505 2026] [security2:error] [pid 898098:tid 898307] [client 143.244.57.88:39748] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 88.57.244.143.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tejasenvironmental.com"] [uri "/xmlrpc.php"] [unique_id "alxhVkRK6WUoKc-ijTF15AAAAEs"]
[Sat Jul 18 23:32:06.034599 2026] [security2:error] [pid 898098:tid 898307] [client 143.244.57.88:39748] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "tejasenvironmental.com"] [uri "/xmlrpc.php"] [unique_id "alxhVkRK6WUoKc-ijTF15AAAAEs"]
[Sat Jul 18 23:32:06.088114 2026] [security2:error] [pid 898098:tid 898255] [client 138.252.89.100:60814] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhVkRK6WUoKc-ijTF16AAAABc"]
[Sat Jul 18 23:32:06.088212 2026] [security2:error] [pid 898098:tid 898255] [client 138.252.89.100:60814] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhVkRK6WUoKc-ijTF16AAAABc"]
[Sat Jul 18 23:32:06.182178 2026] [security2:error] [pid 898098:tid 898312] [client 64.233.173.101:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "littleaosta.nz"] [uri "/index.php"] [unique_id "alxhVURK6WUoKc-ijTF13wAAAFA"]
[Sat Jul 18 23:32:06.332659 2026] [security2:error] [pid 897595:tid 897624] [remote 120.72.98.5:7330] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tntcatholic.com"] [uri "/wp-login.php"] [unique_id "alxhVuZhsBlduL7gIyyqGQAAtxs"], referer: https://tntcatholic.com/wp-login.php
[Sat Jul 18 23:32:06.366544 2026] [security2:error] [pid 898098:tid 898347] [client 64.233.173.36:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "aosta.nz"] [uri "/index.php"] [unique_id "alxhVURK6WUoKc-ijTF14AAAAHM"]
[Sat Jul 18 23:32:06.397913 2026] [proxy:error] [pid 898098:tid 898247] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:32:06.397952 2026] [proxy_http:error] [pid 898098:tid 898247] [client 193.47.62.168:48104] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:32:06.398517 2026] [proxy:error] [pid 898098:tid 898247] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:32:06.398544 2026] [proxy_http:error] [pid 898098:tid 898247] [client 193.47.62.168:48104] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:32:06.809632 2026] [security2:error] [pid 898098:tid 898270] [client 106.222.249.209:14433] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhVkRK6WUoKc-ijTF2FQAAACY"]
[Sat Jul 18 23:32:06.809770 2026] [security2:error] [pid 898098:tid 898270] [client 106.222.249.209:14433] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhVkRK6WUoKc-ijTF2FQAAACY"]
[Sat Jul 18 23:32:08.099623 2026] [security2:error] [pid 898098:tid 898319] [client 192.254.250.171:58748] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "155"] [id "900406"] [msg "wp-login POST logging"] [data "200"] [hostname "secretkeynumerology.com"] [uri "/wp-login.php"] [unique_id "alxhWERK6WUoKc-ijTF2TQAAVyY"], referer: https://secretkeynumerology.com/wp-login.php
[Sat Jul 18 23:32:09.146922 2026] [security2:error] [pid 898098:tid 898326] [client 23.160.60.161:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxhWURK6WUoKc-ijTF2dQAAAF4"]
[Sat Jul 18 23:32:09.247901 2026] [security2:error] [pid 898098:tid 898164] [remote 31.42.184.154:53182] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxhWURK6WUoKc-ijTF2gAAAVD4"]
[Sat Jul 18 23:32:09.248041 2026] [security2:error] [pid 898098:tid 898316] [client 31.42.184.154:53182] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxhWURK6WUoKc-ijTF2gAAAVD4"]
[Sat Jul 18 23:32:09.402865 2026] [security2:error] [pid 897595:tid 897743] [client 124.29.246.106:62027] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.246.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxhWeZhsBlduL7gIyyqRgAAAJY"]
[Sat Jul 18 23:32:09.402984 2026] [security2:error] [pid 897595:tid 897743] [client 124.29.246.106:62027] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxhWeZhsBlduL7gIyyqRgAAAJY"]
[Sat Jul 18 23:32:09.675472 2026] [security2:error] [pid 898098:tid 898298] [client 57.141.18.103:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxhWURK6WUoKc-ijTF2kAAAAEI"]
[Sat Jul 18 23:32:10.742799 2026] [security2:error] [pid 898098:tid 898186] [remote 31.42.184.154:49592] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxhWkRK6WUoKc-ijTF20AAAXFM"]
[Sat Jul 18 23:32:10.977247 2026] [security2:error] [pid 898098:tid 898183] [remote 31.42.184.154:49592] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxhWkRK6WUoKc-ijTF22QAAIFA"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:32:10.988941 2026] [security2:error] [pid 898098:tid 898156] [remote 31.42.184.154:49610] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "longevityperformanceclinic.com"] [uri "/wp-login.php"] [unique_id "alxhWkRK6WUoKc-ijTF22gAAJDY"]
[Sat Jul 18 23:32:11.029391 2026] [security2:error] [pid 897595:tid 897680] [remote 72.167.132.114:46158] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "jndsupport.com"] [uri "/wp-login.php"] [unique_id "alxhW-ZhsBlduL7gIyyqVQAA1FM"]
[Sat Jul 18 23:32:11.211301 2026] [security2:error] [pid 898098:tid 898189] [remote 98.70.32.248:36818] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.32.70.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxhW0RK6WUoKc-ijTF24wAAR1Y"]
[Sat Jul 18 23:32:11.238943 2026] [security2:error] [pid 898098:tid 898199] [remote 31.42.184.154:49610] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "longevityperformanceclinic.com"] [uri "/wp-login.php"] [unique_id "alxhW0RK6WUoKc-ijTF25AAAd2A"], referer: https://longevityperformanceclinic.com/wp-login.php
[Sat Jul 18 23:32:11.604964 2026] [security2:error] [pid 898098:tid 898206] [remote 98.70.32.248:36818] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.32.70.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxhW0RK6WUoKc-ijTF29QAASGc"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:32:13.784999 2026] [security2:error] [pid 898098:tid 898235] [client 223.228.182.224:46082] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhXURK6WUoKc-ijTF3XgAAAAM"]
[Sat Jul 18 23:32:13.785110 2026] [security2:error] [pid 898098:tid 898235] [client 223.228.182.224:46082] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhXURK6WUoKc-ijTF3XgAAAAM"]
[Sat Jul 18 23:32:13.878817 2026] [security2:error] [pid 898098:tid 898342] [client 163.61.1.17:60183] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhXURK6WUoKc-ijTF3YQAAAG4"]
[Sat Jul 18 23:32:13.878953 2026] [security2:error] [pid 898098:tid 898342] [client 163.61.1.17:60183] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhXURK6WUoKc-ijTF3YQAAAG4"]
[Sat Jul 18 23:32:14.081977 2026] [security2:error] [pid 898098:tid 898203] [remote 97.74.93.24:44350] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "christiancountytrumpet.com"] [uri "/wp-login.php"] [unique_id "alxhXkRK6WUoKc-ijTF3ZQAAbGQ"]
[Sat Jul 18 23:32:14.249929 2026] [security2:error] [pid 898098:tid 898126] [remote 57.141.18.62:49580] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.18.141.57.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/product/5084931"] [unique_id "alxhXkRK6WUoKc-ijTF3dwAAJxg"]
[Sat Jul 18 23:32:14.491951 2026] [security2:error] [pid 898098:tid 898137] [remote 97.74.93.24:44350] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "christiancountytrumpet.com"] [uri "/wp-login.php"] [unique_id "alxhXkRK6WUoKc-ijTF3gQAADyM"], referer: https://christiancountytrumpet.com/wp-login.php
[Sat Jul 18 23:32:14.523307 2026] [security2:error] [pid 897595:tid 897808] [client 104.210.56.224:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "jenfarley.com"] [uri "/index.php"] [unique_id "alxhXuZhsBlduL7gIyyqiQAAANc"]
[Sat Jul 18 23:32:14.725848 2026] [security2:error] [pid 898098:tid 898290] [client 190.245.146.99:61790] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhXkRK6WUoKc-ijTF3iwAAADo"]
[Sat Jul 18 23:32:14.731811 2026] [security2:error] [pid 898098:tid 898290] [client 190.245.146.99:61790] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhXkRK6WUoKc-ijTF3iwAAADo"]
[Sat Jul 18 23:32:14.855216 2026] [security2:error] [pid 898098:tid 898295] [client 119.154.81.234:58559] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhXkRK6WUoKc-ijTF3lAAAAD8"]
[Sat Jul 18 23:32:14.855317 2026] [security2:error] [pid 898098:tid 898295] [client 119.154.81.234:58559] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhXkRK6WUoKc-ijTF3lAAAAD8"]
[Sat Jul 18 23:32:15.862417 2026] [security2:error] [pid 897595:tid 897720] [remote 195.26.253.119:53062] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.253.26.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxhX-ZhsBlduL7gIyyqvwAAk3s"]
[Sat Jul 18 23:32:16.036210 2026] [security2:error] [pid 897595:tid 897723] [remote 195.26.253.119:53062] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.253.26.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxhYOZhsBlduL7gIyyqwAAA7H4"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:32:16.578299 2026] [security2:error] [pid 897595:tid 897791] [client 74.7.227.179:37322] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxhYOZhsBlduL7gIyyqyQAAxnA"], referer: https://tejasenvironmental.com/p=2312772
[Sat Jul 18 23:32:17.051414 2026] [security2:error] [pid 898098:tid 898173] [remote 209.42.21.221:43742] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 221.21.42.209.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/wp-login.php"] [unique_id "alxhYURK6WUoKc-ijTF35gAAMkc"]
[Sat Jul 18 23:32:17.209767 2026] [security2:error] [pid 898098:tid 898177] [remote 209.42.21.221:43742] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 221.21.42.209.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/wp-login.php"] [unique_id "alxhYURK6WUoKc-ijTF38QAAWko"], referer: https://lmgorman.com/wp-login.php
[Sat Jul 18 23:32:17.270735 2026] [security2:error] [pid 898098:tid 898348] [client 57.141.18.40:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "bandsir.com"] [uri "/index.php"] [unique_id "alxhYURK6WUoKc-ijTF36QAAAHQ"]
[Sat Jul 18 23:32:17.351078 2026] [security2:error] [pid 898098:tid 898354] [client 106.222.249.209:10742] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhYURK6WUoKc-ijTF39wAAAHo"]
[Sat Jul 18 23:32:17.351612 2026] [security2:error] [pid 898098:tid 898354] [client 106.222.249.209:10742] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhYURK6WUoKc-ijTF39wAAAHo"]
[Sat Jul 18 23:32:17.614086 2026] [security2:error] [pid 898098:tid 898297] [client 138.252.89.100:61296] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhYURK6WUoKc-ijTF4BAAAAEE"]
[Sat Jul 18 23:32:17.614177 2026] [security2:error] [pid 898098:tid 898297] [client 138.252.89.100:61296] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhYURK6WUoKc-ijTF4BAAAAEE"]
[Sat Jul 18 23:32:17.691501 2026] [security2:error] [pid 898098:tid 898275] [client 20.220.225.223:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.225.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "inspirenetzero.org"] [uri "/.well-known/info.php"] [unique_id "alxhYURK6WUoKc-ijTF4BgAAACs"]
[Sat Jul 18 23:32:17.691598 2026] [security2:error] [pid 898098:tid 898275] [client 20.220.225.223:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "inspirenetzero.org"] [uri "/.well-known/info.php"] [unique_id "alxhYURK6WUoKc-ijTF4BgAAACs"]
[Sat Jul 18 23:32:17.904119 2026] [security2:error] [pid 898098:tid 898185] [remote 202.51.202.242:40828] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 242.202.51.202.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxhYURK6WUoKc-ijTF4EQAANVI"]
[Sat Jul 18 23:32:18.396200 2026] [security2:error] [pid 898098:tid 898198] [remote 202.51.202.242:40828] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 242.202.51.202.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxhYkRK6WUoKc-ijTF4LwAAAV8"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:32:18.676343 2026] [security2:error] [pid 898098:tid 898192] [remote 31.42.184.154:49642] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "talknutritionwithlesley.com"] [uri "/wp-login.php"] [unique_id "alxhYkRK6WUoKc-ijTF4OwAARFk"]
[Sat Jul 18 23:32:18.906876 2026] [security2:error] [pid 898098:tid 898214] [remote 31.42.184.154:49642] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "talknutritionwithlesley.com"] [uri "/wp-login.php"] [unique_id "alxhYkRK6WUoKc-ijTF4RQAAf28"], referer: https://talknutritionwithlesley.com/wp-login.php
[Sat Jul 18 23:32:19.194883 2026] [security2:error] [pid 897595:tid 897740] [client 34.172.185.49:44968] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "39ishlife.com"] [uri "/wp-json/batch/v1"] [unique_id "alxhY-ZhsBlduL7gIyyrDAAAAJM"]
[Sat Jul 18 23:32:19.412992 2026] [security2:error] [pid 897595:tid 897832] [client 34.172.185.49:44968] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "39ishlife.com"] [uri "/"] [unique_id "alxhY-ZhsBlduL7gIyyrEQAAAO8"]
[Sat Jul 18 23:32:19.443454 2026] [security2:error] [pid 898098:tid 898252] [client 124.29.207.185:39479] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxhY0RK6WUoKc-ijTF4XAAAABQ"]
[Sat Jul 18 23:32:19.443564 2026] [security2:error] [pid 898098:tid 898252] [client 124.29.207.185:39479] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxhY0RK6WUoKc-ijTF4XAAAABQ"]
[Sat Jul 18 23:32:20.572412 2026] [security2:error] [pid 898098:tid 898281] [client 110.249.202.187:48298] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.secretkeynumerology.com"] [uri "/robots.txt"] [unique_id "alxhZERK6WUoKc-ijTF4owAAADE"]
[Sat Jul 18 23:32:21.428915 2026] [core:error] [pid 898098:tid 898345] [client 94.154.43.184:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:32:21.428942 2026] [core:error] [pid 898098:tid 898345] [client 94.154.43.184:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:32:21.429204 2026] [core:error] [pid 898098:tid 898248] [client 94.154.43.229:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:32:21.429223 2026] [core:error] [pid 898098:tid 898248] [client 94.154.43.229:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:32:21.432590 2026] [core:error] [pid 897595:tid 897780] [client 94.154.43.188:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:32:21.432593 2026] [core:error] [pid 898098:tid 898285] [client 94.154.43.185:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:32:21.432617 2026] [core:error] [pid 897595:tid 897780] [client 94.154.43.188:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:32:21.432624 2026] [core:error] [pid 898098:tid 898285] [client 94.154.43.185:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:32:21.577051 2026] [core:error] [pid 898098:tid 898234] [client 94.154.43.185:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:32:21.577068 2026] [core:error] [pid 898098:tid 898234] [client 94.154.43.185:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:32:21.674734 2026] [security2:error] [pid 898098:tid 898250] [client 65.0.26.70:61078] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.26.0.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxhZURK6WUoKc-ijTF42wAAABI"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:32:22.122709 2026] [security2:error] [pid 897595:tid 897847] [client 34.172.185.49:44968] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "39ishlife.com"] [uri "/index.php"] [unique_id "alxhZOZhsBlduL7gIyyrJwAAAP4"], referer: http://39ishlife.com/wp-json/batch/v1
[Sat Jul 18 23:32:23.497071 2026] [security2:error] [pid 898098:tid 898242] [client 136.64.169.133:63394] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "floorsourcestock.com"] [uri "/wp-json/batch/v1"] [unique_id "alxhZ0RK6WUoKc-ijTF5PQAAAAo"]
[Sat Jul 18 23:32:23.604095 2026] [security2:error] [pid 898098:tid 898300] [client 136.64.169.133:63394] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "floorsourcestock.com"] [uri "/"] [unique_id "alxhZ0RK6WUoKc-ijTF5QgAAAEQ"]
[Sat Jul 18 23:32:23.779472 2026] [security2:error] [pid 898098:tid 898342] [client 20.220.225.223:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.225.220.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "inspirenetzero.org"] [uri "/.well-known/fm.php"] [unique_id "alxhZ0RK6WUoKc-ijTF5TQAAAG4"]
[Sat Jul 18 23:32:23.779607 2026] [security2:error] [pid 898098:tid 898342] [client 20.220.225.223:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "inspirenetzero.org"] [uri "/.well-known/fm.php"] [unique_id "alxhZ0RK6WUoKc-ijTF5TQAAAG4"]
[Sat Jul 18 23:32:24.471132 2026] [security2:error] [pid 898098:tid 898344] [client 163.61.1.17:60716] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhaERK6WUoKc-ijTF5kwAAAHA"]
[Sat Jul 18 23:32:24.471210 2026] [security2:error] [pid 898098:tid 898344] [client 163.61.1.17:60716] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhaERK6WUoKc-ijTF5kwAAAHA"]
[Sat Jul 18 23:32:25.294149 2026] [security2:error] [pid 898098:tid 898245] [client 190.245.146.99:62304] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhaURK6WUoKc-ijTF5uAAAAA0"]
[Sat Jul 18 23:32:25.294251 2026] [security2:error] [pid 898098:tid 898245] [client 190.245.146.99:62304] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhaURK6WUoKc-ijTF5uAAAAA0"]
[Sat Jul 18 23:32:25.486381 2026] [proxy:error] [pid 898098:tid 898332] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:32:25.486452 2026] [proxy_http:error] [pid 898098:tid 898332] [client 164.90.151.54:44840] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:32:25.486951 2026] [proxy:error] [pid 898098:tid 898332] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:32:25.486977 2026] [proxy_http:error] [pid 898098:tid 898332] [client 164.90.151.54:44840] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:32:25.574840 2026] [proxy:error] [pid 898098:tid 898330] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:32:25.574921 2026] [proxy_http:error] [pid 898098:tid 898330] [client 164.90.151.54:44848] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: http://cpcontacts.dotx.com/
[Sat Jul 18 23:32:25.575559 2026] [proxy:error] [pid 898098:tid 898330] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:32:25.575589 2026] [proxy_http:error] [pid 898098:tid 898330] [client 164.90.151.54:44848] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: http://cpcontacts.dotx.com/
[Sat Jul 18 23:32:25.694465 2026] [security2:error] [pid 898098:tid 898236] [client 119.154.81.234:59027] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhaURK6WUoKc-ijTF5zgAAAAQ"]
[Sat Jul 18 23:32:25.694776 2026] [security2:error] [pid 898098:tid 898236] [client 119.154.81.234:59027] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhaURK6WUoKc-ijTF5zgAAAAQ"]
[Sat Jul 18 23:32:25.782798 2026] [core:error] [pid 897595:tid 897729] [client 164.90.151.54:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:32:25.782819 2026] [core:error] [pid 897595:tid 897729] [client 164.90.151.54:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:32:26.059513 2026] [security2:error] [pid 898098:tid 898248] [client 223.228.182.224:43231] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhakRK6WUoKc-ijTF57AAAABA"]
[Sat Jul 18 23:32:26.059597 2026] [security2:error] [pid 898098:tid 898248] [client 223.228.182.224:43231] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhakRK6WUoKc-ijTF57AAAABA"]
[Sat Jul 18 23:32:26.315260 2026] [security2:error] [pid 898098:tid 898295] [client 18.195.15.81:34326] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 81.15.195.18.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxhakRK6WUoKc-ijTF59QAAAD8"]
[Sat Jul 18 23:32:26.315359 2026] [security2:error] [pid 898098:tid 898295] [client 18.195.15.81:34326] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxhakRK6WUoKc-ijTF59QAAAD8"]
[Sat Jul 18 23:32:26.417129 2026] [security2:error] [pid 897595:tid 897754] [client 74.208.214.194:45060] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxhauZhsBlduL7gIyyrpwAAAKE"]
[Sat Jul 18 23:32:26.852572 2026] [security2:error] [pid 898098:tid 898291] [client 136.64.169.133:63394] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "floorsourcestock.com"] [uri "/index.php"] [unique_id "alxhaERK6WUoKc-ijTF5fwAAADs"], referer: http://floorsourcestock.com/wp-json/batch/v1
[Sat Jul 18 23:32:27.395710 2026] [security2:error] [pid 898098:tid 898142] [remote 152.228.213.32:51028] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thierry-henry.fr"] [uri "/wp-login.php"] [unique_id "alxha0RK6WUoKc-ijTF6JwAAOCg"]
[Sat Jul 18 23:32:27.550716 2026] [security2:error] [pid 898098:tid 898351] [client 34.10.140.162:39346] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "goyalsatyam.com"] [uri "/wp-json/batch/v1"] [unique_id "alxha0RK6WUoKc-ijTF6LgAAAHc"]
[Sat Jul 18 23:32:27.573359 2026] [security2:error] [pid 898098:tid 898257] [client 57.141.18.65:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxha0RK6WUoKc-ijTF6JQAAABk"]
[Sat Jul 18 23:32:27.590671 2026] [security2:error] [pid 898098:tid 898125] [remote 152.228.213.32:51028] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thierry-henry.fr"] [uri "/wp-login.php"] [unique_id "alxha0RK6WUoKc-ijTF6NQAAIRc"], referer: https://thierry-henry.fr/wp-login.php
[Sat Jul 18 23:32:27.760286 2026] [security2:error] [pid 898098:tid 898285] [client 34.10.140.162:39346] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "goyalsatyam.com"] [uri "/"] [unique_id "alxha0RK6WUoKc-ijTF6PAAAADU"]
[Sat Jul 18 23:32:28.104262 2026] [security2:error] [pid 898098:tid 898241] [client 106.222.249.209:17485] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhbERK6WUoKc-ijTF6TAAAAAk"]
[Sat Jul 18 23:32:28.104364 2026] [security2:error] [pid 898098:tid 898241] [client 106.222.249.209:17485] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhbERK6WUoKc-ijTF6TAAAAAk"]
[Sat Jul 18 23:32:29.263334 2026] [security2:error] [pid 898098:tid 898235] [client 138.252.89.100:61783] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhbURK6WUoKc-ijTF6ZAAAAAM"]
[Sat Jul 18 23:32:29.264063 2026] [security2:error] [pid 898098:tid 898235] [client 138.252.89.100:61783] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhbURK6WUoKc-ijTF6ZAAAAAM"]
[Sat Jul 18 23:32:30.346435 2026] [security2:error] [pid 897595:tid 897816] [client 74.208.214.194:45070] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxhbuZhsBlduL7gIyyr9gAAAN8"]
[Sat Jul 18 23:32:30.823310 2026] [security2:error] [pid 897595:tid 897711] [remote 120.72.98.5:60536] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxhbuZhsBlduL7gIyysAwAAxHI"]
[Sat Jul 18 23:32:31.075687 2026] [security2:error] [pid 897595:tid 897757] [client 57.141.18.32:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxhbuZhsBlduL7gIyysBwAAAKQ"]
[Sat Jul 18 23:32:31.297231 2026] [security2:error] [pid 897595:tid 897607] [remote 120.72.98.5:60536] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxhb-ZhsBlduL7gIyysEAAAqwo"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:32:32.286443 2026] [security2:error] [pid 897595:tid 897617] [remote 54.64.35.240:52842] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.35.64.54.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.upf.ztf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxhcOZhsBlduL7gIyysKQAArBQ"]
[Sat Jul 18 23:32:32.306032 2026] [security2:error] [pid 898098:tid 898241] [client 124.29.207.185:63002] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxhcERK6WUoKc-ijTF62QAAAAk"]
[Sat Jul 18 23:32:32.306137 2026] [security2:error] [pid 898098:tid 898241] [client 124.29.207.185:63002] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxhcERK6WUoKc-ijTF62QAAAAk"]
[Sat Jul 18 23:32:32.625285 2026] [security2:error] [pid 898098:tid 898333] [client 149.13.10.32:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "packerjanitorial.com"] [uri "/index.php"] [unique_id "alxhb0RK6WUoKc-ijTF6ywAAZW4"], referer: https://packerjanitorial.com/
[Sat Jul 18 23:32:32.709688 2026] [security2:error] [pid 897595:tid 897605] [remote 54.64.35.240:52842] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.35.64.54.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.upf.ztf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxhcOZhsBlduL7gIyysMwAA3Ag"], referer: https://mail.upf.ztf.mybluehost.me/wp-login.php
[Sat Jul 18 23:32:32.761885 2026] [security2:error] [pid 897595:tid 897798] [client 57.141.18.66:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxhcOZhsBlduL7gIyysLwAAAM0"]
[Sat Jul 18 23:32:33.146190 2026] [security2:error] [pid 897595:tid 897625] [remote 31.42.184.154:51424] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "technicalseohouse.com"] [uri "/wp-login.php"] [unique_id "alxhceZhsBlduL7gIyysPgAA2xw"]
[Sat Jul 18 23:32:33.364511 2026] [security2:error] [pid 897595:tid 897627] [remote 31.42.184.154:51424] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "technicalseohouse.com"] [uri "/wp-login.php"] [unique_id "alxhceZhsBlduL7gIyysQQAA5B4"], referer: https://technicalseohouse.com/wp-login.php
[Sat Jul 18 23:32:33.719216 2026] [security2:error] [pid 898098:tid 898266] [client 50.116.65.227:13010] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Jin-Wee-Feature-Image.jpg"] [unique_id "alxhcURK6WUoKc-ijTF7EAAAACI"]
[Sat Jul 18 23:32:33.730193 2026] [security2:error] [pid 898098:tid 898330] [client 50.116.65.227:30834] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Jin-Wee-Feature-Image.jpg"] [unique_id "alxhcURK6WUoKc-ijTF7EQAAAE0"]
[Sat Jul 18 23:32:34.915814 2026] [security2:error] [pid 898098:tid 898249] [client 163.61.1.17:61181] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhckRK6WUoKc-ijTF7RQAAABE"]
[Sat Jul 18 23:32:34.915926 2026] [security2:error] [pid 898098:tid 898249] [client 163.61.1.17:61181] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhckRK6WUoKc-ijTF7RQAAABE"]
[Sat Jul 18 23:32:35.650102 2026] [security2:error] [pid 898098:tid 898307] [client 136.243.59.237:47662] ModSecurity: Warning. Matched phrase "DomainStatsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "www.ccsdifference.com"] [uri "/index.php"] [unique_id "alxhcURK6WUoKc-ijTF7EwAAAEs"]
[Sat Jul 18 23:32:35.795296 2026] [security2:error] [pid 898098:tid 898354] [client 190.245.146.99:62815] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhc0RK6WUoKc-ijTF7YgAAAHo"]
[Sat Jul 18 23:32:35.795415 2026] [security2:error] [pid 898098:tid 898354] [client 190.245.146.99:62815] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhc0RK6WUoKc-ijTF7YgAAAHo"]
[Sat Jul 18 23:32:36.351917 2026] [security2:error] [pid 898098:tid 898252] [client 119.154.81.234:59481] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhdERK6WUoKc-ijTF7gAAAABQ"]
[Sat Jul 18 23:32:36.352045 2026] [security2:error] [pid 898098:tid 898252] [client 119.154.81.234:59481] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhdERK6WUoKc-ijTF7gAAAABQ"]
[Sat Jul 18 23:32:36.589276 2026] [security2:error] [pid 898098:tid 898123] [remote 97.74.93.24:46366] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathybuffini.com"] [uri "/wp-login.php"] [unique_id "alxhdERK6WUoKc-ijTF7kwAAfRU"]
[Sat Jul 18 23:32:36.626480 2026] [security2:error] [pid 898098:tid 898170] [remote 31.42.184.154:60496] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxhdERK6WUoKc-ijTF7mgAAZ0Q"]
[Sat Jul 18 23:32:36.776571 2026] [security2:error] [pid 898098:tid 898153] [remote 103.133.214.160:60256] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.214.133.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxhdERK6WUoKc-ijTF7owAAUzM"]
[Sat Jul 18 23:32:36.887463 2026] [security2:error] [pid 898098:tid 898181] [remote 31.42.184.154:60496] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxhdERK6WUoKc-ijTF7qgAAC04"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:32:37.072657 2026] [security2:error] [pid 898098:tid 898131] [remote 97.74.93.24:46366] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathybuffini.com"] [uri "/wp-login.php"] [unique_id "alxhdURK6WUoKc-ijTF7sAAAOR0"], referer: https://cathybuffini.com/wp-login.php
[Sat Jul 18 23:32:37.251599 2026] [security2:error] [pid 898098:tid 898156] [remote 103.133.214.160:60256] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.214.133.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxhdURK6WUoKc-ijTF7vQAAGTY"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:32:37.263382 2026] [security2:error] [pid 898098:tid 898185] [remote 31.42.184.154:51446] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "maa.hws.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxhdURK6WUoKc-ijTF7wwAAclI"]
[Sat Jul 18 23:32:37.263489 2026] [security2:error] [pid 898098:tid 898346] [client 31.42.184.154:51446] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "maa.hws.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxhdURK6WUoKc-ijTF7wwAAclI"]
[Sat Jul 18 23:32:37.315610 2026] [security2:error] [pid 898098:tid 898244] [client 223.228.182.224:28464] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhdURK6WUoKc-ijTF7xwAAAAw"]
[Sat Jul 18 23:32:37.315854 2026] [security2:error] [pid 898098:tid 898244] [client 223.228.182.224:28464] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhdURK6WUoKc-ijTF7xwAAAAw"]
[Sat Jul 18 23:32:37.360199 2026] [proxy:error] [pid 898098:tid 898264] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:32:37.360265 2026] [proxy_http:error] [pid 898098:tid 898264] [client 193.47.62.168:51954] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:32:37.361437 2026] [proxy:error] [pid 898098:tid 898264] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:32:37.361470 2026] [proxy_http:error] [pid 898098:tid 898264] [client 193.47.62.168:51954] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:32:37.839058 2026] [security2:error] [pid 898098:tid 898197] [remote 97.74.93.24:36978] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxhdURK6WUoKc-ijTF72AAAXV4"]
[Sat Jul 18 23:32:38.213983 2026] [security2:error] [pid 898098:tid 898215] [remote 97.74.93.24:36978] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxhdkRK6WUoKc-ijTF8BAAAInA"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:32:38.240823 2026] [security2:error] [pid 898098:tid 898283] [client 34.10.140.162:47122] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "goyalsatyam.com"] [uri "/index.php"] [unique_id "alxhdERK6WUoKc-ijTF7cgAAADM"], referer: http://goyalsatyam.com/wp-json/batch/v1
[Sat Jul 18 23:32:38.900872 2026] [security2:error] [pid 897595:tid 897827] [client 106.222.249.209:18973] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhduZhsBlduL7gIyysngAAAOo"]
[Sat Jul 18 23:32:38.900985 2026] [security2:error] [pid 897595:tid 897827] [client 106.222.249.209:18973] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhduZhsBlduL7gIyysngAAAOo"]
[Sat Jul 18 23:32:41.021831 2026] [security2:error] [pid 898098:tid 898295] [client 138.252.89.100:62271] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxheURK6WUoKc-ijTF8nAAAAD8"]
[Sat Jul 18 23:32:41.021968 2026] [security2:error] [pid 898098:tid 898295] [client 138.252.89.100:62271] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxheURK6WUoKc-ijTF8nAAAAD8"]
[Sat Jul 18 23:32:42.225881 2026] [security2:error] [pid 897595:tid 897822] [client 34.123.137.137:40454] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "bbwipartnerconference.com"] [uri "/wp-json/batch/v1"] [unique_id "alxheuZhsBlduL7gIyys3AAAAOU"]
[Sat Jul 18 23:32:42.364266 2026] [security2:error] [pid 897595:tid 897752] [client 34.123.137.137:40454] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "bbwipartnerconference.com"] [uri "/"] [unique_id "alxheuZhsBlduL7gIyys4QAAAJ8"]
[Sat Jul 18 23:32:43.831723 2026] [security2:error] [pid 897595:tid 897712] [remote 31.42.184.154:60908] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.ait.afz.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxhe-ZhsBlduL7gIyytAQAAvnM"]
[Sat Jul 18 23:32:44.068082 2026] [security2:error] [pid 897595:tid 897703] [remote 31.42.184.154:60908] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.ait.afz.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxhfOZhsBlduL7gIyytCQAA3Wo"], referer: https://mail.ait.afz.mybluehost.me/wp-login.php
[Sat Jul 18 23:32:44.783325 2026] [security2:error] [pid 898098:tid 898235] [client 149.20.244.37:56739] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "www.sesamegreenbeans.com"] [uri "/wp-comments-post.php"] [unique_id "alxhfERK6WUoKc-ijTF9QwAAAAM"], referer: https://www.sesamegreenbeans.com/jin-wee-feastcoastroad/
[Sat Jul 18 23:32:45.519249 2026] [security2:error] [pid 898098:tid 898314] [client 163.61.1.17:61653] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhfURK6WUoKc-ijTF9ZQAAAFI"]
[Sat Jul 18 23:32:45.519355 2026] [security2:error] [pid 898098:tid 898314] [client 163.61.1.17:61653] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhfURK6WUoKc-ijTF9ZQAAAFI"]
[Sat Jul 18 23:32:45.673568 2026] [security2:error] [pid 898098:tid 898327] [client 184.154.36.177:0] ModSecurity: Warning. Matched phrase "SiteLockSpider" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "404"] [hostname "aosta.nz"] [uri "/cgi-sys/404.html"] [unique_id "alxhfURK6WUoKc-ijTF9bwAAAF8"]
[Sat Jul 18 23:32:45.676694 2026] [security2:error] [pid 898098:tid 898350] [client 184.154.36.177:38452] ModSecurity: Warning. Matched phrase "SiteLockSpider" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "404"] [hostname "aosta.nz"] [uri "/th1s_1s_a_4o4.html"] [unique_id "alxhfURK6WUoKc-ijTF9awAAAHY"]
[Sat Jul 18 23:32:45.970662 2026] [security2:error] [pid 898098:tid 898235] [client 149.20.244.37:56739] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "302"] [hostname "www.sesamegreenbeans.com"] [uri "/wp-comments-post.php"] [unique_id "alxhfERK6WUoKc-ijTF9QwAAAAM"], referer: https://www.sesamegreenbeans.com/jin-wee-feastcoastroad/
[Sat Jul 18 23:32:45.970710 2026] [security2:error] [pid 898098:tid 898235] [client 149.20.244.37:56739] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "www.sesamegreenbeans.com"] [uri "/wp-comments-post.php"] [unique_id "alxhfERK6WUoKc-ijTF9QwAAAAM"], referer: https://www.sesamegreenbeans.com/jin-wee-feastcoastroad/
[Sat Jul 18 23:32:46.047892 2026] [security2:error] [pid 897595:tid 897772] [client 34.123.137.137:40454] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "bbwipartnerconference.com"] [uri "/index.php"] [unique_id "alxhe-ZhsBlduL7gIyys7AAAALM"], referer: http://bbwipartnerconference.com/wp-json/batch/v1
[Sat Jul 18 23:32:46.145210 2026] [security2:error] [pid 897595:tid 897768] [client 223.228.182.224:32263] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhfuZhsBlduL7gIyytOAAAAK8"]
[Sat Jul 18 23:32:46.145316 2026] [security2:error] [pid 897595:tid 897768] [client 223.228.182.224:32263] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhfuZhsBlduL7gIyytOAAAAK8"]
[Sat Jul 18 23:32:46.225511 2026] [security2:error] [pid 898098:tid 898336] [client 184.154.36.177:0] ModSecurity: Warning. Matched phrase "SiteLockSpider" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "aosta.nz"] [uri "/index.php"] [unique_id "alxhfkRK6WUoKc-ijTF9lQAAAGg"]
[Sat Jul 18 23:32:46.225534 2026] [security2:error] [pid 898098:tid 898336] [client 184.154.36.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "aosta.nz"] [uri "/index.php"] [unique_id "alxhfkRK6WUoKc-ijTF9lQAAAGg"]
[Sat Jul 18 23:32:46.227335 2026] [security2:error] [pid 898098:tid 898301] [client 184.154.36.177:38824] ModSecurity: Warning. Matched phrase "SiteLockSpider" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "aosta.nz"] [uri "/our-story"] [unique_id "alxhfkRK6WUoKc-ijTF9kQAAAEU"]
[Sat Jul 18 23:32:46.296053 2026] [security2:error] [pid 898098:tid 898266] [client 190.245.146.99:63329] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhfkRK6WUoKc-ijTF9oAAAACI"]
[Sat Jul 18 23:32:46.296172 2026] [security2:error] [pid 898098:tid 898266] [client 190.245.146.99:63329] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhfkRK6WUoKc-ijTF9oAAAACI"]
[Sat Jul 18 23:32:46.647367 2026] [security2:error] [pid 898098:tid 898288] [client 114.119.159.17:34019] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "mazzucelli.com"] [uri "/the-syrian-refugee-exodus-needs-a-civil-society-response"] [unique_id "alxhfkRK6WUoKc-ijTF9tQAAADg"], referer: https://mazzucelli.com/category/archive
[Sat Jul 18 23:32:46.841896 2026] [security2:error] [pid 898098:tid 898314] [client 119.154.81.234:59936] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhfkRK6WUoKc-ijTF9vwAAAFI"]
[Sat Jul 18 23:32:46.841999 2026] [security2:error] [pid 898098:tid 898314] [client 119.154.81.234:59936] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhfkRK6WUoKc-ijTF9vwAAAFI"]
[Sat Jul 18 23:32:46.971091 2026] [security2:error] [pid 898098:tid 898355] [client 50.116.65.227:57136] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Jin-Wee-Feature-Image.jpg"] [unique_id "alxhfkRK6WUoKc-ijTF9wwAAAHs"]
[Sat Jul 18 23:32:46.980972 2026] [security2:error] [pid 898098:tid 898359] [client 50.116.65.227:22320] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Jin-Wee-Feature-Image.jpg"] [unique_id "alxhfkRK6WUoKc-ijTF9xAAAADk"]
[Sat Jul 18 23:32:48.281067 2026] [security2:error] [pid 898098:tid 898275] [client 52.15.147.27:16538] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "windowtx.com"] [uri "/index.php"] [unique_id "alxhf0RK6WUoKc-ijTF96AAAACs"], referer: https://windowtx.com
[Sat Jul 18 23:32:48.822245 2026] [security2:error] [pid 898098:tid 898211] [remote 113.160.142.119:49034] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxhgERK6WUoKc-ijTF-HwAAdWw"]
[Sat Jul 18 23:32:48.949980 2026] [security2:error] [pid 897595:tid 897822] [client 104.232.209.35:35643] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "reosportsboats.com"] [uri "/index.php"] [unique_id "alxhf-ZhsBlduL7gIyytXQAAAOU"], referer: http://reosportsboats.com/robots.txt
[Sat Jul 18 23:32:49.307805 2026] [security2:error] [pid 898098:tid 898230] [remote 113.160.142.119:49034] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxhgURK6WUoKc-ijTF-MwAADX8"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:32:49.372391 2026] [security2:error] [pid 898098:tid 898282] [client 184.154.36.177:0] ModSecurity: Warning. Matched phrase "SiteLockSpider" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "aosta.nz"] [uri "/xmlrpc.php"] [unique_id "alxhgURK6WUoKc-ijTF-MQAAADI"]
[Sat Jul 18 23:32:49.374042 2026] [security2:error] [pid 898098:tid 898288] [client 184.154.36.177:40772] ModSecurity: Warning. Matched phrase "SiteLockSpider" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "aosta.nz"] [uri "/xmlrpc.php"] [unique_id "alxhgURK6WUoKc-ijTF-LQAAADg"]
[Sat Jul 18 23:32:49.473110 2026] [security2:error] [pid 898098:tid 898320] [client 106.222.249.209:12423] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhgURK6WUoKc-ijTF-OgAAAFg"]
[Sat Jul 18 23:32:49.473249 2026] [security2:error] [pid 898098:tid 898320] [client 106.222.249.209:12423] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhgURK6WUoKc-ijTF-OgAAAFg"]
[Sat Jul 18 23:32:49.573684 2026] [security2:error] [pid 897595:tid 897852] [client 45.61.187.148:52566] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 148.187.61.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.betterbonddogtraining.com"] [uri "/wp-login.php"] [unique_id "alxhgeZhsBlduL7gIyytdgAAAQM"]
[Sat Jul 18 23:32:49.732853 2026] [security2:error] [pid 898098:tid 898345] [client 184.154.36.177:0] ModSecurity: Warning. Matched phrase "SiteLockSpider" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "aosta.nz"] [uri "/index.php"] [unique_id "alxhgURK6WUoKc-ijTF-SAAAAHE"]
[Sat Jul 18 23:32:49.732882 2026] [security2:error] [pid 898098:tid 898345] [client 184.154.36.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "aosta.nz"] [uri "/index.php"] [unique_id "alxhgURK6WUoKc-ijTF-SAAAAHE"]
[Sat Jul 18 23:32:49.735132 2026] [security2:error] [pid 898098:tid 898285] [client 184.154.36.177:41046] ModSecurity: Warning. Matched phrase "SiteLockSpider" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "aosta.nz"] [uri "/contact"] [unique_id "alxhgURK6WUoKc-ijTF-QwAAADU"]
[Sat Jul 18 23:32:50.867080 2026] [security2:error] [pid 898098:tid 898118] [remote 78.47.206.70:42318] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.206.47.78.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "willowbranchequines.org"] [uri "/wp-login.php"] [unique_id "alxhgkRK6WUoKc-ijTF-fwAAfhA"]
[Sat Jul 18 23:32:51.050554 2026] [security2:error] [pid 898098:tid 898207] [remote 78.47.206.70:42318] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.206.47.78.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "willowbranchequines.org"] [uri "/wp-login.php"] [unique_id "alxhg0RK6WUoKc-ijTF-iQAAL2g"], referer: https://willowbranchequines.org/wp-login.php
[Sat Jul 18 23:32:51.484982 2026] [ssl:error] [pid 898098:tid 898345] [client 98.84.1.175:41563] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname webdisk.pvy.iyy.mybluehost.me provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:32:51.549017 2026] [fcgid:warn] [pid 898098:tid 898314] (70014)End of file found: [client 198.235.24.25:63272] mod_fcgid: can't get data from http client
[Sat Jul 18 23:32:51.553569 2026] [security2:error] [pid 898098:tid 898142] [remote 113.160.142.119:49040] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "worbals.com"] [uri "/wp-login.php"] [unique_id "alxhg0RK6WUoKc-ijTF-oQAAVCg"]
[Sat Jul 18 23:32:51.825101 2026] [fcgid:warn] [pid 898098:tid 898301] (70014)End of file found: [client 198.235.24.25:63286] mod_fcgid: can't get data from http client
[Sat Jul 18 23:32:52.060250 2026] [security2:error] [pid 898098:tid 898139] [remote 113.160.142.119:49040] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "worbals.com"] [uri "/wp-login.php"] [unique_id "alxhhERK6WUoKc-ijTF-uAAAViU"], referer: https://worbals.com/wp-login.php
[Sat Jul 18 23:32:52.113970 2026] [security2:error] [pid 897595:tid 897765] [client 50.116.65.227:40490] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Jin-Wee-Feature-Image.jpg"] [unique_id "alxhhOZhsBlduL7gIyytrAAAAKw"]
[Sat Jul 18 23:32:52.124018 2026] [security2:error] [pid 897595:tid 897774] [client 50.116.65.227:21502] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Jin-Wee-Feature-Image.jpg"] [unique_id "alxhhOZhsBlduL7gIyytrQAAAJk"]
[Sat Jul 18 23:32:52.433957 2026] [security2:error] [pid 897595:tid 897822] [client 138.252.89.100:62755] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhhOZhsBlduL7gIyyttgAAAOU"]
[Sat Jul 18 23:32:52.434043 2026] [security2:error] [pid 897595:tid 897822] [client 138.252.89.100:62755] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhhOZhsBlduL7gIyyttgAAAOU"]
[Sat Jul 18 23:32:52.519912 2026] [security2:error] [pid 898098:tid 898329] [client 184.154.36.177:0] ModSecurity: Warning. Matched phrase "SiteLockSpider" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "aosta.nz"] [uri "/index.php"] [unique_id "alxhhERK6WUoKc-ijTF-xAAAAGE"]
[Sat Jul 18 23:32:52.519938 2026] [security2:error] [pid 898098:tid 898329] [client 184.154.36.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "aosta.nz"] [uri "/index.php"] [unique_id "alxhhERK6WUoKc-ijTF-xAAAAGE"]
[Sat Jul 18 23:32:52.521539 2026] [security2:error] [pid 897595:tid 897753] [client 184.154.36.177:42800] ModSecurity: Warning. Matched phrase "SiteLockSpider" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "aosta.nz"] [uri "/events-&-Functions"] [unique_id "alxhhOZhsBlduL7gIyyttQAAAKA"]
[Sat Jul 18 23:32:53.046623 2026] [security2:error] [pid 898098:tid 898247] [client 191.104.117.69:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxhhERK6WUoKc-ijTF-4AAAAA8"]
[Sat Jul 18 23:32:53.445886 2026] [security2:error] [pid 898098:tid 898321] [client 34.172.185.49:54292] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "3dprintrecycling.com"] [uri "/wp-json/batch/v1"] [unique_id "alxhhURK6WUoKc-ijTF_AwAAAFk"]
[Sat Jul 18 23:32:54.015198 2026] [security2:error] [pid 898098:tid 898330] [client 114.119.131.33:27613] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "hardman.international"] [uri "/robots.txt"] [unique_id "alxhhkRK6WUoKc-ijTF_HgAAAGI"], referer: https://hardman.international/robots.txt
[Sat Jul 18 23:32:54.120222 2026] [security2:error] [pid 898098:tid 898295] [client 34.172.185.49:54292] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "3dprintrecycling.com"] [uri "/"] [unique_id "alxhhkRK6WUoKc-ijTF_JAAAAD8"]
[Sat Jul 18 23:32:54.537349 2026] [security2:error] [pid 898098:tid 898315] [client 18.189.20.92:44450] ModSecurity: Access denied with code 406 (phase 1). Pattern match "^POST$" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "187"] [id "900401"] [msg "PHP Spam Botnet"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/"] [unique_id "alxhhkRK6WUoKc-ijTF_OQAAAFM"]
[Sat Jul 18 23:32:54.692648 2026] [security2:error] [pid 898098:tid 898253] [client 18.189.20.92:45244] ModSecurity: Access denied with code 406 (phase 1). Pattern match "^POST$" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "187"] [id "900401"] [msg "PHP Spam Botnet"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/"] [unique_id "alxhhkRK6WUoKc-ijTF_TAAAABU"]
[Sat Jul 18 23:32:54.841328 2026] [security2:error] [pid 898098:tid 898291] [client 184.154.36.177:44152] ModSecurity: Warning. Matched phrase "SiteLockSpider" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "aosta.nz"] [uri "/wp-content/uploads/elementor/css/post-5.css"] [unique_id "alxhhkRK6WUoKc-ijTF_UwAAADs"]
[Sat Jul 18 23:32:54.844108 2026] [security2:error] [pid 898098:tid 898299] [client 18.189.20.92:45260] ModSecurity: Access denied with code 406 (phase 1). Pattern match "^POST$" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "187"] [id "900401"] [msg "PHP Spam Botnet"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/"] [unique_id "alxhhkRK6WUoKc-ijTF_VAAAAEM"]
[Sat Jul 18 23:32:55.206769 2026] [security2:error] [pid 898098:tid 898275] [client 18.189.20.92:45270] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhhkRK6WUoKc-ijTF_VwAAACs"]
[Sat Jul 18 23:32:55.305506 2026] [security2:error] [pid 898098:tid 898325] [client 18.189.20.92:45270] ModSecurity: Access denied with code 406 (phase 1). Pattern match "^POST$" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "187"] [id "900401"] [msg "PHP Spam Botnet"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/"] [unique_id "alxhh0RK6WUoKc-ijTF_bAAAAF0"]
[Sat Jul 18 23:32:55.459820 2026] [security2:error] [pid 898098:tid 898315] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/.env"] [unique_id "alxhh0RK6WUoKc-ijTF_dAAAAFM"]
[Sat Jul 18 23:32:55.710275 2026] [security2:error] [pid 898098:tid 898323] [client 18.189.20.92:45272] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhh0RK6WUoKc-ijTF_eAAAAFs"]
[Sat Jul 18 23:32:55.836078 2026] [security2:error] [pid 897595:tid 897736] [client 18.189.20.92:44432] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhh-ZhsBlduL7gIyyt5QAAAI8"]
[Sat Jul 18 23:32:55.935768 2026] [security2:error] [pid 898098:tid 898328] [client 163.61.1.17:62119] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhh0RK6WUoKc-ijTF_kAAAAGA"]
[Sat Jul 18 23:32:55.937271 2026] [security2:error] [pid 898098:tid 898328] [client 163.61.1.17:62119] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhh0RK6WUoKc-ijTF_kAAAAGA"]
[Sat Jul 18 23:32:56.035037 2026] [security2:error] [pid 898098:tid 898349] [client 18.189.20.92:45272] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhh0RK6WUoKc-ijTF_igAAAHU"]
[Sat Jul 18 23:32:56.185728 2026] [security2:error] [pid 897595:tid 897838] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/.env"] [unique_id "alxhiOZhsBlduL7gIyyuAgAAAPU"]
[Sat Jul 18 23:32:56.307675 2026] [security2:error] [pid 898098:tid 898243] [client 18.189.20.92:45272] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhiERK6WUoKc-ijTF_kQAAAAs"]
[Sat Jul 18 23:32:56.448629 2026] [security2:error] [pid 897595:tid 897782] [client 18.189.20.92:44432] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhiOZhsBlduL7gIyyuCwAAAL0"]
[Sat Jul 18 23:32:56.551553 2026] [security2:error] [pid 898098:tid 898254] [client 18.189.20.92:45272] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhiERK6WUoKc-ijTF_mgAAABY"]
[Sat Jul 18 23:32:56.707739 2026] [security2:error] [pid 897595:tid 897762] [client 18.189.20.92:44432] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhiOZhsBlduL7gIyyuFAAAAKk"]
[Sat Jul 18 23:32:56.805422 2026] [security2:error] [pid 898098:tid 898340] [client 190.245.146.99:64011] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhiERK6WUoKc-ijTF_qwAAAGw"]
[Sat Jul 18 23:32:56.810230 2026] [security2:error] [pid 898098:tid 898340] [client 190.245.146.99:64011] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhiERK6WUoKc-ijTF_qwAAAGw"]
[Sat Jul 18 23:32:56.826959 2026] [security2:error] [pid 898098:tid 898302] [client 18.189.20.92:45272] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhiERK6WUoKc-ijTF_oQAAAEY"]
[Sat Jul 18 23:32:56.959351 2026] [security2:error] [pid 897595:tid 897740] [client 18.189.20.92:44432] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhiOZhsBlduL7gIyyuHQAAAJM"]
[Sat Jul 18 23:32:57.079775 2026] [security2:error] [pid 898098:tid 898187] [remote 31.42.184.154:53424] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.legallyknownaszacharyhoy999.com"] [uri "/wp-login.php"] [unique_id "alxhiURK6WUoKc-ijTF_sgAATFQ"]
[Sat Jul 18 23:32:57.095171 2026] [security2:error] [pid 898098:tid 898236] [client 18.189.20.92:45272] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhiERK6WUoKc-ijTF_rQAAAAQ"]
[Sat Jul 18 23:32:57.135962 2026] [security2:error] [pid 898098:tid 898329] [client 223.228.182.224:46108] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhiURK6WUoKc-ijTF_tQAAAGE"]
[Sat Jul 18 23:32:57.141464 2026] [security2:error] [pid 898098:tid 898329] [client 223.228.182.224:46108] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhiURK6WUoKc-ijTF_tQAAAGE"]
[Sat Jul 18 23:32:57.146506 2026] [security2:error] [pid 898098:tid 898263] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\.bak|\\\\.bak\\\\.php)$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1260"] [id "390582"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that nclude .bak)"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/.env.bak"] [unique_id "alxhiURK6WUoKc-ijTF_twAAAB8"]
[Sat Jul 18 23:32:57.157072 2026] [lsapi:warn] [pid 897595:tid 897674] [remote 51.15.80.24:0] [host ali-alghanim.com] Backend log: PHP Warning:  getimagesize(https://aasgroup.online/wp-content/uploads/2021/09/1291810.jpg): Failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden\r\n in /home2/aasgroup/public_html/alialghanim/wp-content/plugins/litespeed-cache/src/media.cls.php on line 860\n
[Sat Jul 18 23:32:57.204526 2026] [security2:error] [pid 898098:tid 898274] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.backup$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1279"] [id "390588"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .backup)"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/.env.backup"] [unique_id "alxhiURK6WUoKc-ijTF_vAAAACo"]
[Sat Jul 18 23:32:57.227131 2026] [security2:error] [pid 897595:tid 897760] [client 18.189.20.92:44432] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhieZhsBlduL7gIyyuIwAAAKc"]
[Sat Jul 18 23:32:57.339454 2026] [security2:error] [pid 898098:tid 898330] [client 146.190.63.248:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "lakelopezonline.com"] [uri "/index.php"] [unique_id "alxhiURK6WUoKc-ijTF_wQAAAGI"]
[Sat Jul 18 23:32:57.345998 2026] [security2:error] [pid 898098:tid 898226] [remote 31.42.184.154:53424] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.legallyknownaszacharyhoy999.com"] [uri "/wp-login.php"] [unique_id "alxhiURK6WUoKc-ijTF_xwAAdXs"], referer: https://mail.legallyknownaszacharyhoy999.com/wp-login.php
[Sat Jul 18 23:32:57.426417 2026] [security2:error] [pid 897595:tid 897800] [client 119.154.81.234:60390] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhieZhsBlduL7gIyyuMAAAAM8"]
[Sat Jul 18 23:32:57.426693 2026] [security2:error] [pid 897595:tid 897800] [client 119.154.81.234:60390] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhieZhsBlduL7gIyyuMAAAAM8"]
[Sat Jul 18 23:32:57.461388 2026] [security2:error] [pid 898098:tid 898241] [client 18.189.20.92:45272] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhiURK6WUoKc-ijTF_wgAAAAk"]
[Sat Jul 18 23:32:57.487183 2026] [security2:error] [pid 897595:tid 897794] [client 18.189.20.92:44432] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhieZhsBlduL7gIyyuKQAAAMk"]
[Sat Jul 18 23:32:57.513550 2026] [security2:error] [pid 898098:tid 898319] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.old$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1263"] [id "390583"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .old)"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/.env.old"] [unique_id "alxhiURK6WUoKc-ijTF_zQAAAFc"]
[Sat Jul 18 23:32:57.697851 2026] [security2:error] [pid 898098:tid 898358] [client 184.154.36.177:45554] ModSecurity: Warning. Matched phrase "SiteLockSpider" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "aosta.nz"] [uri "/wp-content/uploads/elementor/css/post-127.css"] [unique_id "alxhiURK6WUoKc-ijTF_1AAAAH4"]
[Sat Jul 18 23:32:57.730688 2026] [security2:error] [pid 897595:tid 897732] [client 18.189.20.92:44432] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhieZhsBlduL7gIyyuNQAAAIs"]
[Sat Jul 18 23:32:57.752944 2026] [security2:error] [pid 898098:tid 898332] [client 18.189.20.92:45272] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhiURK6WUoKc-ijTF_zgAAAGQ"]
[Sat Jul 18 23:32:57.783368 2026] [security2:error] [pid 897595:tid 897817] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\.bak|\\\\.bak\\\\.php)$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1260"] [id "390582"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that nclude .bak)"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/.env.bak"] [unique_id "alxhieZhsBlduL7gIyyuOwAAAOA"]
[Sat Jul 18 23:32:57.834593 2026] [security2:error] [pid 897595:tid 897804] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.backup$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1279"] [id "390588"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .backup)"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/.env.backup"] [unique_id "alxhieZhsBlduL7gIyyuPgAAANM"]
[Sat Jul 18 23:32:58.011870 2026] [security2:error] [pid 898098:tid 898335] [client 18.189.20.92:45272] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhiURK6WUoKc-ijTF_3QAAAGc"]
[Sat Jul 18 23:32:58.088194 2026] [security2:error] [pid 897595:tid 897778] [client 18.189.20.92:44432] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhieZhsBlduL7gIyyuQQAAALk"]
[Sat Jul 18 23:32:58.141137 2026] [security2:error] [pid 897595:tid 897820] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.old$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1263"] [id "390583"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .old)"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/.env.old"] [unique_id "alxhiuZhsBlduL7gIyyuSAAAAOM"]
[Sat Jul 18 23:32:58.212869 2026] [security2:error] [pid 898098:tid 898340] [client 49.13.167.123:54344] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "mtlegnews.gov"] [uri "/index.php"] [unique_id "alxhiURK6WUoKc-ijTF_7QAAAGw"], referer: https://mtlegnews.gov/
[Sat Jul 18 23:32:58.318051 2026] [security2:error] [pid 898098:tid 898263] [client 18.189.20.92:45272] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhikRK6WUoKc-ijTF_8gAAAB8"]
[Sat Jul 18 23:32:58.422293 2026] [security2:error] [pid 897595:tid 897844] [client 18.189.20.92:44432] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhiuZhsBlduL7gIyyuSwAAAPs"]
[Sat Jul 18 23:32:58.423400 2026] [security2:error] [pid 898098:tid 898275] [client 211.186.115.35:41004] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "50.116.65.227"] [uri "/"] [unique_id "alxhikRK6WUoKc-ijTGACwAAACs"]
[Sat Jul 18 23:32:58.443985 2026] [security2:error] [pid 898098:tid 898142] [remote 110.249.201.153:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "tiokubito.cl"] [uri "/robots.txt"] [unique_id "alxhikRK6WUoKc-ijTGADwAAfig"]
[Sat Jul 18 23:32:58.536157 2026] [security2:error] [pid 898098:tid 898332] [client 146.190.63.248:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "lakelopezonline.com"] [uri "/index.php"] [unique_id "alxhikRK6WUoKc-ijTGAEgAAAGQ"]
[Sat Jul 18 23:32:58.587315 2026] [security2:error] [pid 898098:tid 898314] [client 18.189.20.92:45272] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhikRK6WUoKc-ijTGABwAAAFI"]
[Sat Jul 18 23:32:58.605936 2026] [lsapi:warn] [pid 898098:tid 898278] [client 43.153.73.200:49274] [host oldracelimited.com] Backend log: PHP Warning:  Undefined array key "host" in /home2/oldracel/public_html/oldracelimited/wp-content/plugins/bluehost-wordpress-plugin/inc/YoastAI.php on line 54\n, referer: https://www.oldracelimited.com/
[Sat Jul 18 23:32:58.608955 2026] [lsapi:warn] [pid 898098:tid 898278] [client 43.153.73.200:49274] [host oldracelimited.com] Backend log: PHP Warning:  Undefined array key "host" in /home2/oldracel/public_html/oldracelimited/wp-content/plugins/bluehost-wordpress-plugin/inc/YoastAI.php on line 54\n, referer: https://www.oldracelimited.com/
[Sat Jul 18 23:32:58.626159 2026] [security2:error] [pid 898098:tid 898345] [client 211.186.115.35:41874] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "50.116.65.227"] [uri "/"] [unique_id "alxhikRK6WUoKc-ijTGAGQAAAHE"]
[Sat Jul 18 23:32:58.679871 2026] [security2:error] [pid 897595:tid 897830] [client 18.189.20.92:44432] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhiuZhsBlduL7gIyyuVgAAAO0"]
[Sat Jul 18 23:32:58.802457 2026] [security2:error] [pid 897595:tid 897779] [client 146.190.63.248:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "lakelopezonline.com"] [uri "/index.php"] [unique_id "alxhiuZhsBlduL7gIyyuXwAAALo"]
[Sat Jul 18 23:32:58.841695 2026] [security2:error] [pid 898098:tid 898253] [client 18.189.20.92:45272] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhikRK6WUoKc-ijTGAGgAAABU"]
[Sat Jul 18 23:32:58.933594 2026] [security2:error] [pid 897595:tid 897792] [client 18.189.20.92:44432] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhiuZhsBlduL7gIyyuXgAAAMc"]
[Sat Jul 18 23:32:58.973555 2026] [lsapi:warn] [pid 898098:tid 898207] [remote 51.15.80.24:0] [host ali-alghanim.com] Backend log: PHP Warning:  getimagesize(https://aasgroup.online/wp-content/uploads/2021/09/1291810.jpg): Failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden\r\n in /home2/aasgroup/public_html/alialghanim/wp-content/plugins/litespeed-cache/src/media.cls.php on line 860\n
[Sat Jul 18 23:32:59.095441 2026] [security2:error] [pid 898098:tid 898300] [client 18.189.20.92:45272] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhikRK6WUoKc-ijTGAKAAAAEQ"]
[Sat Jul 18 23:32:59.194121 2026] [security2:error] [pid 898098:tid 898328] [client 146.190.63.248:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "lakelopezonline.com"] [uri "/index.php"] [unique_id "alxhi0RK6WUoKc-ijTGAMwAAAGA"]
[Sat Jul 18 23:32:59.211030 2026] [security2:error] [pid 897595:tid 897729] [client 18.189.20.92:44432] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhiuZhsBlduL7gIyyuaQAAAIg"]
[Sat Jul 18 23:32:59.362809 2026] [security2:error] [pid 898098:tid 898233] [client 18.189.20.92:45272] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhi0RK6WUoKc-ijTGANAAAAAE"]
[Sat Jul 18 23:32:59.465727 2026] [security2:error] [pid 897595:tid 897814] [client 18.189.20.92:44432] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhi-ZhsBlduL7gIyyucAAAAN0"]
[Sat Jul 18 23:32:59.616531 2026] [security2:error] [pid 898098:tid 898246] [client 18.189.20.92:45272] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhi0RK6WUoKc-ijTGASgAAAA4"]
[Sat Jul 18 23:32:59.686055 2026] [security2:error] [pid 897595:tid 897618] [remote 152.228.213.32:60704] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxhi-ZhsBlduL7gIyyuhQAAthU"]
[Sat Jul 18 23:32:59.720989 2026] [security2:error] [pid 897595:tid 897736] [client 18.189.20.92:44432] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhi-ZhsBlduL7gIyyufQAAAI8"]
[Sat Jul 18 23:32:59.853933 2026] [security2:error] [pid 898098:tid 898325] [client 18.189.20.92:45272] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhi0RK6WUoKc-ijTGAXwAAAF0"]
[Sat Jul 18 23:32:59.874225 2026] [security2:error] [pid 897595:tid 897623] [remote 152.228.213.32:60704] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxhi-ZhsBlduL7gIyyujQABAxo"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:32:59.969009 2026] [security2:error] [pid 897595:tid 897777] [client 18.189.20.92:44432] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhi-ZhsBlduL7gIyyuiAAAALg"]
[Sat Jul 18 23:33:00.089986 2026] [security2:error] [pid 898098:tid 898339] [client 18.189.20.92:45272] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhi0RK6WUoKc-ijTGAZgAAAGs"]
[Sat Jul 18 23:33:00.092771 2026] [security2:error] [pid 898098:tid 898335] [client 106.222.249.209:1215] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhjERK6WUoKc-ijTGAbQAAAGc"]
[Sat Jul 18 23:33:00.092915 2026] [security2:error] [pid 898098:tid 898335] [client 106.222.249.209:1215] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhjERK6WUoKc-ijTGAbQAAAGc"]
[Sat Jul 18 23:33:00.205184 2026] [security2:error] [pid 897595:tid 897822] [client 18.189.20.92:44432] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhjOZhsBlduL7gIyyukQAAAOU"]
[Sat Jul 18 23:33:00.338191 2026] [security2:error] [pid 898098:tid 898285] [client 18.189.20.92:45272] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhjERK6WUoKc-ijTGAbgAAADU"]
[Sat Jul 18 23:33:00.389435 2026] [security2:error] [pid 898098:tid 898330] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.sw[a-z]$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1275"] [id "390587"] [rev "5"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .sw)"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/.env.swp"] [unique_id "alxhjERK6WUoKc-ijTGAdwAAAGI"]
[Sat Jul 18 23:33:00.440773 2026] [security2:error] [pid 898098:tid 898233] [client 146.190.63.248:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "lakelopezonline.com"] [uri "/index.php"] [unique_id "alxhjERK6WUoKc-ijTGAeAAAAAE"]
[Sat Jul 18 23:33:00.441849 2026] [security2:error] [pid 898098:tid 898358] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "[a-z0-9]~$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1257"] [id "390581"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data Leakage - attempt to access backup file (disable this rule if you require access to files that end with a tilde)"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/.env~"] [unique_id "alxhjERK6WUoKc-ijTGAegAAAH4"]
[Sat Jul 18 23:33:00.481478 2026] [security2:error] [pid 897595:tid 897850] [client 18.189.20.92:44432] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhjOZhsBlduL7gIyyulgAAAQE"]
[Sat Jul 18 23:33:00.687035 2026] [security2:error] [pid 898098:tid 898243] [client 18.189.20.92:45272] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhjERK6WUoKc-ijTGAfQAAAAs"]
[Sat Jul 18 23:33:00.741614 2026] [security2:error] [pid 897595:tid 897782] [client 18.189.20.92:44432] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhjOZhsBlduL7gIyyuqQAAAL0"]
[Sat Jul 18 23:33:00.929549 2026] [security2:error] [pid 898098:tid 898303] [client 18.189.20.92:45272] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhjERK6WUoKc-ijTGAhQAAAEc"]
[Sat Jul 18 23:33:01.009242 2026] [security2:error] [pid 897595:tid 897816] [client 18.189.20.92:44432] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhjOZhsBlduL7gIyyusAAAAN8"]
[Sat Jul 18 23:33:01.061289 2026] [security2:error] [pid 897595:tid 897737] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.sw[a-z]$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1275"] [id "390587"] [rev "5"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .sw)"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/.env.swp"] [unique_id "alxhjeZhsBlduL7gIyyuuQAAAJA"]
[Sat Jul 18 23:33:01.113612 2026] [security2:error] [pid 897595:tid 897847] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "[a-z0-9]~$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1257"] [id "390581"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data Leakage - attempt to access backup file (disable this rule if you require access to files that end with a tilde)"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/.env~"] [unique_id "alxhjeZhsBlduL7gIyyuuwAAAP4"]
[Sat Jul 18 23:33:01.173689 2026] [security2:error] [pid 898098:tid 898326] [client 18.189.20.92:45272] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhjERK6WUoKc-ijTGAiwAAAF4"]
[Sat Jul 18 23:33:01.374033 2026] [security2:error] [pid 898098:tid 898257] [client 184.154.36.177:0] ModSecurity: Warning. Matched phrase "SiteLockSpider" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "aosta.nz"] [uri "/index.php"] [unique_id "alxhjURK6WUoKc-ijTGAmwAAABk"]
[Sat Jul 18 23:33:01.374059 2026] [security2:error] [pid 898098:tid 898257] [client 184.154.36.177:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "aosta.nz"] [uri "/index.php"] [unique_id "alxhjURK6WUoKc-ijTGAmwAAABk"]
[Sat Jul 18 23:33:01.375734 2026] [security2:error] [pid 898098:tid 898248] [client 184.154.36.177:47382] ModSecurity: Warning. Matched phrase "SiteLockSpider" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "aosta.nz"] [uri "/gift-vouchers"] [unique_id "alxhjURK6WUoKc-ijTGAlgAAABA"]
[Sat Jul 18 23:33:01.384957 2026] [security2:error] [pid 897595:tid 897749] [client 18.189.20.92:44432] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhjeZhsBlduL7gIyyuvQAAAJw"]
[Sat Jul 18 23:33:01.453865 2026] [security2:error] [pid 898098:tid 898251] [client 18.189.20.92:45272] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhjURK6WUoKc-ijTGAlQAAABM"]
[Sat Jul 18 23:33:01.657972 2026] [security2:error] [pid 897595:tid 897764] [client 18.189.20.92:44432] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhjeZhsBlduL7gIyyuxgAAAKs"]
[Sat Jul 18 23:33:01.717493 2026] [security2:error] [pid 898098:tid 898283] [client 18.189.20.92:45272] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhjURK6WUoKc-ijTGApwAAADM"]
[Sat Jul 18 23:33:01.782999 2026] [security2:error] [pid 898098:tid 898267] [client 136.243.59.237:53150] ModSecurity: Warning. Matched phrase "DomainStatsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "www.ccsdifference.com"] [uri "/index.php"] [unique_id "alxhjURK6WUoKc-ijTGAoAAAACM"]
[Sat Jul 18 23:33:01.943481 2026] [security2:error] [pid 897595:tid 897758] [client 18.189.20.92:44432] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhjeZhsBlduL7gIyyu0QAAAKU"]
[Sat Jul 18 23:33:01.988203 2026] [security2:error] [pid 898098:tid 898301] [client 18.189.20.92:45272] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhjURK6WUoKc-ijTGAuAAAAEU"]
[Sat Jul 18 23:33:02.201289 2026] [security2:error] [pid 897595:tid 897828] [client 18.189.20.92:44432] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhjeZhsBlduL7gIyyu2gAAAOs"]
[Sat Jul 18 23:33:02.254947 2026] [security2:error] [pid 898098:tid 898356] [client 18.189.20.92:45272] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhjkRK6WUoKc-ijTGAxAAAAHw"]
[Sat Jul 18 23:33:02.306344 2026] [security2:error] [pid 898098:tid 898245] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/app/.env"] [unique_id "alxhjkRK6WUoKc-ijTGAzQAAAA0"]
[Sat Jul 18 23:33:02.358448 2026] [security2:error] [pid 898098:tid 898240] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/apps/.env"] [unique_id "alxhjkRK6WUoKc-ijTGAzgAAAAg"]
[Sat Jul 18 23:33:02.409884 2026] [security2:error] [pid 898098:tid 898339] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/api/.env"] [unique_id "alxhjkRK6WUoKc-ijTGAzwAAAGs"]
[Sat Jul 18 23:33:02.456507 2026] [security2:error] [pid 897595:tid 897750] [client 18.189.20.92:44432] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhjuZhsBlduL7gIyyu4wAAAJ0"]
[Sat Jul 18 23:33:02.461017 2026] [security2:error] [pid 898098:tid 898235] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/web/.env"] [unique_id "alxhjkRK6WUoKc-ijTGA0QAAAAM"]
[Sat Jul 18 23:33:02.516467 2026] [security2:error] [pid 898098:tid 898338] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/site/.env"] [unique_id "alxhjkRK6WUoKc-ijTGA1gAAAGo"]
[Sat Jul 18 23:33:02.567233 2026] [security2:error] [pid 898098:tid 898306] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/public/.env"] [unique_id "alxhjkRK6WUoKc-ijTGA4wAAAEo"]
[Sat Jul 18 23:33:02.717962 2026] [security2:error] [pid 897595:tid 897798] [client 18.189.20.92:44432] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhjuZhsBlduL7gIyyu7wAAAM0"]
[Sat Jul 18 23:33:02.819618 2026] [security2:error] [pid 898098:tid 898249] [client 18.189.20.92:45272] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhjkRK6WUoKc-ijTGA5AAAABE"]
[Sat Jul 18 23:33:02.869891 2026] [security2:error] [pid 898098:tid 898269] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/backend/.env"] [unique_id "alxhjkRK6WUoKc-ijTGBAAAAACU"]
[Sat Jul 18 23:33:02.920249 2026] [security2:error] [pid 898098:tid 898352] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/server/.env"] [unique_id "alxhjkRK6WUoKc-ijTGBAQAAAHg"]
[Sat Jul 18 23:33:02.972548 2026] [security2:error] [pid 898098:tid 898292] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/frontend/.env"] [unique_id "alxhjkRK6WUoKc-ijTGBBQAAADw"]
[Sat Jul 18 23:33:02.981535 2026] [security2:error] [pid 897595:tid 897845] [client 18.189.20.92:44432] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhjuZhsBlduL7gIyyu-gAAAPw"]
[Sat Jul 18 23:33:03.024125 2026] [security2:error] [pid 898098:tid 898297] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/src/.env"] [unique_id "alxhj0RK6WUoKc-ijTGBCAAAAEE"]
[Sat Jul 18 23:33:03.037793 2026] [security2:error] [pid 897595:tid 897742] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/app/.env"] [unique_id "alxhj-ZhsBlduL7gIyyvAwAAAJU"]
[Sat Jul 18 23:33:03.076591 2026] [security2:error] [pid 898098:tid 898239] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/core/.env"] [unique_id "alxhj0RK6WUoKc-ijTGBCgAAAAc"]
[Sat Jul 18 23:33:03.089608 2026] [security2:error] [pid 897595:tid 897749] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/apps/.env"] [unique_id "alxhj-ZhsBlduL7gIyyvBQAAAJw"]
[Sat Jul 18 23:33:03.128095 2026] [security2:error] [pid 898098:tid 898313] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/core/app/.env"] [unique_id "alxhj0RK6WUoKc-ijTGBCwAAAFE"]
[Sat Jul 18 23:33:03.140590 2026] [security2:error] [pid 897595:tid 897770] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/api/.env"] [unique_id "alxhj-ZhsBlduL7gIyyvCAAAALE"]
[Sat Jul 18 23:33:03.179956 2026] [security2:error] [pid 898098:tid 898241] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/config/.env"] [unique_id "alxhj0RK6WUoKc-ijTGBDgAAAAk"]
[Sat Jul 18 23:33:03.194061 2026] [security2:error] [pid 897595:tid 897793] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/web/.env"] [unique_id "alxhj-ZhsBlduL7gIyyvCgAAAMg"]
[Sat Jul 18 23:33:03.231512 2026] [security2:error] [pid 898098:tid 898301] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/private/.env"] [unique_id "alxhj0RK6WUoKc-ijTGBEQAAAEU"]
[Sat Jul 18 23:33:03.245206 2026] [security2:error] [pid 897595:tid 897849] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/site/.env"] [unique_id "alxhj-ZhsBlduL7gIyyvDAAAAQA"]
[Sat Jul 18 23:33:03.283259 2026] [security2:error] [pid 898098:tid 898329] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/application/.env"] [unique_id "alxhj0RK6WUoKc-ijTGBEgAAAGE"]
[Sat Jul 18 23:33:03.297046 2026] [security2:error] [pid 897595:tid 897729] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/public/.env"] [unique_id "alxhj-ZhsBlduL7gIyyvDwAAAIg"]
[Sat Jul 18 23:33:03.335612 2026] [security2:error] [pid 898098:tid 898336] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/bootstrap/.env"] [unique_id "alxhj0RK6WUoKc-ijTGBFwAAAGg"]
[Sat Jul 18 23:33:03.360000 2026] [security2:error] [pid 898098:tid 898293] [client 43.157.180.116:51478] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 116.180.157.43.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.aviationsynergy.aero"] [uri "/"] [unique_id "alxhj0RK6WUoKc-ijTGBFgAAAD0"]
[Sat Jul 18 23:33:03.387540 2026] [security2:error] [pid 898098:tid 898286] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/database/.env"] [unique_id "alxhj0RK6WUoKc-ijTGBGwAAADY"]
[Sat Jul 18 23:33:03.439031 2026] [security2:error] [pid 898098:tid 898294] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/storage/.env"] [unique_id "alxhj0RK6WUoKc-ijTGBHQAAAD4"]
[Sat Jul 18 23:33:03.490103 2026] [security2:error] [pid 898098:tid 898357] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/var/www/.env"] [unique_id "alxhj0RK6WUoKc-ijTGBHgAAAH0"]
[Sat Jul 18 23:33:03.540436 2026] [security2:error] [pid 897595:tid 897825] [client 18.189.20.92:44432] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhj-ZhsBlduL7gIyyvEAAAAOg"]
[Sat Jul 18 23:33:03.541642 2026] [security2:error] [pid 898098:tid 898340] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/var/www/html/.env"] [unique_id "alxhj0RK6WUoKc-ijTGBIAAAAGw"]
[Sat Jul 18 23:33:03.594530 2026] [security2:error] [pid 898098:tid 898326] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/current/.env"] [unique_id "alxhj0RK6WUoKc-ijTGBJAAAAF4"]
[Sat Jul 18 23:33:03.602521 2026] [security2:error] [pid 897595:tid 897767] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/backend/.env"] [unique_id "alxhj-ZhsBlduL7gIyyvGAAAAK4"]
[Sat Jul 18 23:33:03.645905 2026] [security2:error] [pid 898098:tid 898299] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/release/.env"] [unique_id "alxhj0RK6WUoKc-ijTGBMQAAAEM"]
[Sat Jul 18 23:33:03.653935 2026] [security2:error] [pid 897595:tid 897790] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/server/.env"] [unique_id "alxhj-ZhsBlduL7gIyyvGwAAAMU"]
[Sat Jul 18 23:33:03.680365 2026] [security2:error] [pid 897595:tid 897802] [client 47.130.151.169:48086] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 169.151.130.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxhj-ZhsBlduL7gIyyvHAAAANE"]
[Sat Jul 18 23:33:03.697038 2026] [security2:error] [pid 898098:tid 898339] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/releases/.env"] [unique_id "alxhj0RK6WUoKc-ijTGBNAAAAGs"]
[Sat Jul 18 23:33:03.705335 2026] [security2:error] [pid 897595:tid 897758] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/frontend/.env"] [unique_id "alxhj-ZhsBlduL7gIyyvHQAAAKU"]
[Sat Jul 18 23:33:03.747655 2026] [security2:error] [pid 898098:tid 898262] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/shared/.env"] [unique_id "alxhj0RK6WUoKc-ijTGBNQAAAB4"]
[Sat Jul 18 23:33:03.761319 2026] [security2:error] [pid 897595:tid 897803] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/src/.env"] [unique_id "alxhj-ZhsBlduL7gIyyvIQAAANI"]
[Sat Jul 18 23:33:03.798888 2026] [security2:error] [pid 898098:tid 898350] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/deploy/.env"] [unique_id "alxhj0RK6WUoKc-ijTGBOAAAAHY"]
[Sat Jul 18 23:33:03.811967 2026] [security2:error] [pid 897595:tid 897834] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/core/.env"] [unique_id "alxhj-ZhsBlduL7gIyyvIgAAAPE"]
[Sat Jul 18 23:33:03.850311 2026] [security2:error] [pid 898098:tid 898306] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/build/.env"] [unique_id "alxhj0RK6WUoKc-ijTGBPAAAAEo"]
[Sat Jul 18 23:33:03.854662 2026] [security2:error] [pid 898098:tid 898276] [client 184.154.36.177:48996] ModSecurity: Warning. Matched phrase "SiteLockSpider" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "aosta.nz"] [uri "/wp-content/uploads/elementor/css/custom-widget-icon-list.min.css"] [unique_id "alxhj0RK6WUoKc-ijTGBPQAAACw"]
[Sat Jul 18 23:33:03.863675 2026] [security2:error] [pid 897595:tid 897828] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/core/app/.env"] [unique_id "alxhj-ZhsBlduL7gIyyvKAAAAOs"]
[Sat Jul 18 23:33:03.902732 2026] [security2:error] [pid 898098:tid 898325] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/dist/.env"] [unique_id "alxhj0RK6WUoKc-ijTGBPgAAAF0"]
[Sat Jul 18 23:33:03.915615 2026] [security2:error] [pid 897595:tid 897730] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/config/.env"] [unique_id "alxhj-ZhsBlduL7gIyyvLAAAAIk"]
[Sat Jul 18 23:33:03.953896 2026] [security2:error] [pid 898098:tid 898258] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/public_html/.env"] [unique_id "alxhj0RK6WUoKc-ijTGBPwAAABo"]
[Sat Jul 18 23:33:03.966147 2026] [security2:error] [pid 897595:tid 897739] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/private/.env"] [unique_id "alxhj-ZhsBlduL7gIyyvLgAAAJI"]
[Sat Jul 18 23:33:03.967493 2026] [security2:error] [pid 897595:tid 897811] [client 138.252.89.100:63244] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhj-ZhsBlduL7gIyyvLwAAANo"]
[Sat Jul 18 23:33:03.967585 2026] [security2:error] [pid 897595:tid 897811] [client 138.252.89.100:63244] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhj-ZhsBlduL7gIyyvLwAAANo"]
[Sat Jul 18 23:33:04.004902 2026] [security2:error] [pid 898098:tid 898315] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/htdocs/.env"] [unique_id "alxhkERK6WUoKc-ijTGBTAAAAFM"]
[Sat Jul 18 23:33:04.017337 2026] [security2:error] [pid 897595:tid 897831] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/application/.env"] [unique_id "alxhkOZhsBlduL7gIyyvMgAAAO4"]
[Sat Jul 18 23:33:04.052203 2026] [security2:error] [pid 897595:tid 897769] [client 1.146.87.82:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "mezzacraft.com"] [uri "/index.php"] [unique_id "alxhj-ZhsBlduL7gIyyvJgAAALA"], referer: https://www.google.com/
[Sat Jul 18 23:33:04.057186 2026] [security2:error] [pid 898098:tid 898249] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/www/.env"] [unique_id "alxhkERK6WUoKc-ijTGBTwAAABE"]
[Sat Jul 18 23:33:04.069380 2026] [security2:error] [pid 897595:tid 897738] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/bootstrap/.env"] [unique_id "alxhkOZhsBlduL7gIyyvNgAAAJE"]
[Sat Jul 18 23:33:04.108666 2026] [security2:error] [pid 898098:tid 898285] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/html/.env"] [unique_id "alxhkERK6WUoKc-ijTGBUgAAADU"]
[Sat Jul 18 23:33:04.123511 2026] [security2:error] [pid 897595:tid 897809] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/database/.env"] [unique_id "alxhkOZhsBlduL7gIyyvOAAAANg"]
[Sat Jul 18 23:33:04.159985 2026] [security2:error] [pid 898098:tid 898298] [client 184.154.36.177:0] ModSecurity: Warning. Matched phrase "SiteLockSpider" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "aosta.nz"] [uri "/wp-content/plugins/jetpack/readme.txt"] [unique_id "alxhkERK6WUoKc-ijTGBVgAAAEI"]
[Sat Jul 18 23:33:04.160388 2026] [security2:error] [pid 898098:tid 898292] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/live/.env"] [unique_id "alxhkERK6WUoKc-ijTGBVwAAADw"]
[Sat Jul 18 23:33:04.163316 2026] [security2:error] [pid 898098:tid 898283] [client 184.154.36.177:49126] ModSecurity: Warning. Matched phrase "SiteLockSpider" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "aosta.nz"] [uri "/wp-content/plugins/jetpack/readme.txt"] [unique_id "alxhkERK6WUoKc-ijTGBUwAAADM"]
[Sat Jul 18 23:33:04.175727 2026] [security2:error] [pid 897595:tid 897766] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/storage/.env"] [unique_id "alxhkOZhsBlduL7gIyyvOgAAAK0"]
[Sat Jul 18 23:33:04.211729 2026] [security2:error] [pid 898098:tid 898351] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/prod/.env"] [unique_id "alxhkERK6WUoKc-ijTGBWQAAAHc"]
[Sat Jul 18 23:33:04.228838 2026] [security2:error] [pid 897595:tid 897753] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/var/www/.env"] [unique_id "alxhkOZhsBlduL7gIyyvPAAAAKA"]
[Sat Jul 18 23:33:04.263527 2026] [security2:error] [pid 898098:tid 898243] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/dev/.env"] [unique_id "alxhkERK6WUoKc-ijTGBWgAAAAs"]
[Sat Jul 18 23:33:04.280260 2026] [security2:error] [pid 897595:tid 897765] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/var/www/html/.env"] [unique_id "alxhkOZhsBlduL7gIyyvPwAAAKw"]
[Sat Jul 18 23:33:04.314966 2026] [security2:error] [pid 898098:tid 898286] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/staging/.env"] [unique_id "alxhkERK6WUoKc-ijTGBXgAAADY"]
[Sat Jul 18 23:33:04.331346 2026] [security2:error] [pid 897595:tid 897812] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/current/.env"] [unique_id "alxhkOZhsBlduL7gIyyvQAAAANs"]
[Sat Jul 18 23:33:04.367149 2026] [security2:error] [pid 898098:tid 898308] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/opt/.env"] [unique_id "alxhkERK6WUoKc-ijTGBXwAAAEw"]
[Sat Jul 18 23:33:04.382677 2026] [security2:error] [pid 897595:tid 897794] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/release/.env"] [unique_id "alxhkOZhsBlduL7gIyyvQgAAAMk"]
[Sat Jul 18 23:33:04.418874 2026] [security2:error] [pid 898098:tid 898320] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/laravel/.env"] [unique_id "alxhkERK6WUoKc-ijTGBYgAAAFg"]
[Sat Jul 18 23:33:04.422726 2026] [security2:error] [pid 898098:tid 898294] [client 184.154.36.177:0] ModSecurity: Warning. Matched phrase "SiteLockSpider" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "aosta.nz"] [uri "/wp-content/plugins/elementor-pro/changelog.txt"] [unique_id "alxhkERK6WUoKc-ijTGBYwAAAD4"]
[Sat Jul 18 23:33:04.433919 2026] [security2:error] [pid 897595:tid 897853] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/releases/.env"] [unique_id "alxhkOZhsBlduL7gIyyvQwAAAQQ"]
[Sat Jul 18 23:33:04.469438 2026] [security2:error] [pid 898098:tid 898340] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/symfony/.env"] [unique_id "alxhkERK6WUoKc-ijTGBaAAAAGw"]
[Sat Jul 18 23:33:04.485362 2026] [security2:error] [pid 897595:tid 897798] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/shared/.env"] [unique_id "alxhkOZhsBlduL7gIyyvRQAAAM0"]
[Sat Jul 18 23:33:04.520970 2026] [security2:error] [pid 898098:tid 898344] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/wordpress/.env"] [unique_id "alxhkERK6WUoKc-ijTGBaQAAAHA"]
[Sat Jul 18 23:33:04.536656 2026] [security2:error] [pid 897595:tid 897841] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/deploy/.env"] [unique_id "alxhkOZhsBlduL7gIyyvRwAAAPg"]
[Sat Jul 18 23:33:04.568858 2026] [security2:error] [pid 898098:tid 898347] [client 184.154.36.177:49272] ModSecurity: Warning. Matched phrase "SiteLockSpider" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "aosta.nz"] [uri "/wp-content/plugins/elementor-pro/changelog.txt"] [unique_id "alxhkERK6WUoKc-ijTGBYAAAAA8"]
[Sat Jul 18 23:33:04.572564 2026] [security2:error] [pid 898098:tid 898300] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/wp/.env"] [unique_id "alxhkERK6WUoKc-ijTGBbgAAAEQ"]
[Sat Jul 18 23:33:04.588551 2026] [security2:error] [pid 897595:tid 897813] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/build/.env"] [unique_id "alxhkOZhsBlduL7gIyyvSQAAANw"]
[Sat Jul 18 23:33:04.624349 2026] [security2:error] [pid 898098:tid 898334] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/cms/.env"] [unique_id "alxhkERK6WUoKc-ijTGBcQAAAGY"]
[Sat Jul 18 23:33:04.639859 2026] [security2:error] [pid 897595:tid 897816] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/dist/.env"] [unique_id "alxhkOZhsBlduL7gIyyvSwAAAN8"]
[Sat Jul 18 23:33:04.649952 2026] [security2:error] [pid 898098:tid 898256] [client 13.250.107.25:43090] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.107.250.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxhkERK6WUoKc-ijTGBcwAAABg"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:33:04.675908 2026] [security2:error] [pid 898098:tid 898319] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/drupal/.env"] [unique_id "alxhkERK6WUoKc-ijTGBdgAAAFc"]
[Sat Jul 18 23:33:04.691042 2026] [security2:error] [pid 897595:tid 897786] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/public_html/.env"] [unique_id "alxhkOZhsBlduL7gIyyvTwAAAME"]
[Sat Jul 18 23:33:04.727258 2026] [security2:error] [pid 898098:tid 898310] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/joomla/.env"] [unique_id "alxhkERK6WUoKc-ijTGBeAAAAE4"]
[Sat Jul 18 23:33:04.741979 2026] [security2:error] [pid 897595:tid 897843] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/htdocs/.env"] [unique_id "alxhkOZhsBlduL7gIyyvUQAAAPo"]
[Sat Jul 18 23:33:04.778612 2026] [security2:error] [pid 898098:tid 898339] [client 18.189.20.92:45272] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/magento/.env"] [unique_id "alxhkERK6WUoKc-ijTGBeQAAAGs"]
[Sat Jul 18 23:33:04.795883 2026] [security2:error] [pid 897595:tid 897740] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/www/.env"] [unique_id "alxhkOZhsBlduL7gIyyvUgAAAJM"]
[Sat Jul 18 23:33:04.826130 2026] [security2:error] [pid 898098:tid 898251] [client 184.154.36.177:0] ModSecurity: Warning. Matched phrase "SiteLockSpider" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "aosta.nz"] [uri "/wp-content/plugins/elementor/readme.txt"] [unique_id "alxhkERK6WUoKc-ijTGBfAAAABM"]
[Sat Jul 18 23:33:04.831586 2026] [security2:error] [pid 898098:tid 898236] [client 184.154.36.177:49468] ModSecurity: Warning. Matched phrase "SiteLockSpider" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "aosta.nz"] [uri "/wp-content/plugins/elementor/readme.txt"] [unique_id "alxhkERK6WUoKc-ijTGBegAAAAQ"]
[Sat Jul 18 23:33:04.848177 2026] [security2:error] [pid 897595:tid 897751] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/html/.env"] [unique_id "alxhkOZhsBlduL7gIyyvVAAAAJ4"]
[Sat Jul 18 23:33:04.898839 2026] [security2:error] [pid 897595:tid 897762] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/live/.env"] [unique_id "alxhkOZhsBlduL7gIyyvVQAAAKk"]
[Sat Jul 18 23:33:04.931027 2026] [security2:error] [pid 897595:tid 897845] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/shopify/.env"] [unique_id "alxhkOZhsBlduL7gIyyvVwAAAPw"]
[Sat Jul 18 23:33:04.949588 2026] [security2:error] [pid 897595:tid 897742] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/prod/.env"] [unique_id "alxhkOZhsBlduL7gIyyvWAAAAJU"]
[Sat Jul 18 23:33:04.983818 2026] [security2:error] [pid 897595:tid 897781] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/prestashop/.env"] [unique_id "alxhkOZhsBlduL7gIyyvWgAAALw"]
[Sat Jul 18 23:33:05.000416 2026] [security2:error] [pid 897595:tid 897847] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/dev/.env"] [unique_id "alxhkOZhsBlduL7gIyyvWwAAAP4"]
[Sat Jul 18 23:33:05.035798 2026] [security2:error] [pid 897595:tid 897819] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/codeigniter/.env"] [unique_id "alxhkeZhsBlduL7gIyyvXQAAAOI"]
[Sat Jul 18 23:33:05.051172 2026] [security2:error] [pid 897595:tid 897836] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/staging/.env"] [unique_id "alxhkeZhsBlduL7gIyyvXgAAAPM"]
[Sat Jul 18 23:33:05.086514 2026] [security2:error] [pid 897595:tid 897768] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/cakephp/.env"] [unique_id "alxhkeZhsBlduL7gIyyvYAAAAK8"]
[Sat Jul 18 23:33:05.102017 2026] [security2:error] [pid 897595:tid 897759] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/opt/.env"] [unique_id "alxhkeZhsBlduL7gIyyvYwAAAKY"]
[Sat Jul 18 23:33:05.137650 2026] [security2:error] [pid 897595:tid 897761] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/zend/.env"] [unique_id "alxhkeZhsBlduL7gIyyvZgAAAKg"]
[Sat Jul 18 23:33:05.153426 2026] [security2:error] [pid 897595:tid 897754] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/laravel/.env"] [unique_id "alxhkeZhsBlduL7gIyyvaAAAAKE"]
[Sat Jul 18 23:33:05.188773 2026] [security2:error] [pid 897595:tid 897785] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/yii/.env"] [unique_id "alxhkeZhsBlduL7gIyyvbAAAAMA"]
[Sat Jul 18 23:33:05.204200 2026] [security2:error] [pid 897595:tid 897732] [client 18.189.20.92:44432] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/symfony/.env"] [unique_id "alxhkeZhsBlduL7gIyyvbQAAAIs"]
[Sat Jul 18 23:33:05.240115 2026] [security2:error] [pid 897595:tid 897767] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/laravel5/.env"] [unique_id "alxhkeZhsBlduL7gIyyvbgAAAK4"]
[Sat Jul 18 23:33:05.291158 2026] [security2:error] [pid 897595:tid 897790] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/v1/.env"] [unique_id "alxhkeZhsBlduL7gIyyvcQAAAMU"]
[Sat Jul 18 23:33:05.342036 2026] [security2:error] [pid 897595:tid 897758] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/v2/.env"] [unique_id "alxhkeZhsBlduL7gIyyvcgAAAKU"]
[Sat Jul 18 23:33:05.360135 2026] [security2:error] [pid 897595:tid 897775] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/wordpress/.env"] [unique_id "alxhkeZhsBlduL7gIyyvcwAAALY"]
[Sat Jul 18 23:33:05.393652 2026] [security2:error] [pid 897595:tid 897846] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/v3/.env"] [unique_id "alxhkeZhsBlduL7gIyyvdQAAAP0"]
[Sat Jul 18 23:33:05.411028 2026] [security2:error] [pid 897595:tid 897735] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/wp/.env"] [unique_id "alxhkeZhsBlduL7gIyyvdwAAAI4"]
[Sat Jul 18 23:33:05.444851 2026] [security2:error] [pid 897595:tid 897804] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/api/v1/.env"] [unique_id "alxhkeZhsBlduL7gIyyveQAAANM"]
[Sat Jul 18 23:33:05.464054 2026] [security2:error] [pid 897595:tid 897746] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/cms/.env"] [unique_id "alxhkeZhsBlduL7gIyyvewAAAJk"]
[Sat Jul 18 23:33:05.496304 2026] [security2:error] [pid 897595:tid 897837] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/api/v2/.env"] [unique_id "alxhkeZhsBlduL7gIyyvfAAAAPQ"]
[Sat Jul 18 23:33:05.516391 2026] [security2:error] [pid 897595:tid 897817] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/drupal/.env"] [unique_id "alxhkeZhsBlduL7gIyyvfQAAAOA"]
[Sat Jul 18 23:33:05.548181 2026] [security2:error] [pid 897595:tid 897838] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/rest/.env"] [unique_id "alxhkeZhsBlduL7gIyyvfgAAAPU"]
[Sat Jul 18 23:33:05.568958 2026] [security2:error] [pid 897595:tid 897820] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/joomla/.env"] [unique_id "alxhkeZhsBlduL7gIyyvgAAAAOM"]
[Sat Jul 18 23:33:05.599957 2026] [security2:error] [pid 897595:tid 897730] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/graphql/.env"] [unique_id "alxhkeZhsBlduL7gIyyvggAAAIk"]
[Sat Jul 18 23:33:05.619912 2026] [security2:error] [pid 897595:tid 897787] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/magento/.env"] [unique_id "alxhkeZhsBlduL7gIyyvhQAAAMI"]
[Sat Jul 18 23:33:05.620160 2026] [security2:error] [pid 898098:tid 898255] [client 14.224.227.113:59306] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxhkURK6WUoKc-ijTGBkAAAABc"]
[Sat Jul 18 23:33:05.650814 2026] [security2:error] [pid 897595:tid 897811] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/gateway/.env"] [unique_id "alxhkeZhsBlduL7gIyyvhwAAANo"]
[Sat Jul 18 23:33:05.671447 2026] [security2:error] [pid 897595:tid 897831] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/shopify/.env"] [unique_id "alxhkeZhsBlduL7gIyyviAAAAO4"]
[Sat Jul 18 23:33:05.701834 2026] [security2:error] [pid 897595:tid 897818] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/microservice/.env"] [unique_id "alxhkeZhsBlduL7gIyyvigAAAOE"]
[Sat Jul 18 23:33:05.722678 2026] [security2:error] [pid 897595:tid 897850] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/prestashop/.env"] [unique_id "alxhkeZhsBlduL7gIyyvjAAAAQE"]
[Sat Jul 18 23:33:05.753693 2026] [security2:error] [pid 897595:tid 897738] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/service/.env"] [unique_id "alxhkeZhsBlduL7gIyyvjgAAAJE"]
[Sat Jul 18 23:33:05.774775 2026] [security2:error] [pid 897595:tid 897726] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/codeigniter/.env"] [unique_id "alxhkeZhsBlduL7gIyyvjwAAAIU"]
[Sat Jul 18 23:33:05.805132 2026] [security2:error] [pid 897595:tid 897727] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/api/v3/.env"] [unique_id "alxhkeZhsBlduL7gIyyvkAAAAIY"]
[Sat Jul 18 23:33:05.826099 2026] [security2:error] [pid 897595:tid 897791] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/cakephp/.env"] [unique_id "alxhkeZhsBlduL7gIyyvkgAAAMY"]
[Sat Jul 18 23:33:05.856818 2026] [security2:error] [pid 897595:tid 897766] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/api/dev/.env"] [unique_id "alxhkeZhsBlduL7gIyyvkwAAAK0"]
[Sat Jul 18 23:33:05.876830 2026] [security2:error] [pid 897595:tid 897829] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/zend/.env"] [unique_id "alxhkeZhsBlduL7gIyyvlAAAAOw"]
[Sat Jul 18 23:33:05.908507 2026] [security2:error] [pid 897595:tid 897753] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/api/staging/.env"] [unique_id "alxhkeZhsBlduL7gIyyvlQAAAKA"]
[Sat Jul 18 23:33:05.928451 2026] [security2:error] [pid 897595:tid 897772] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/yii/.env"] [unique_id "alxhkeZhsBlduL7gIyyvlwAAALM"]
[Sat Jul 18 23:33:05.960676 2026] [security2:error] [pid 897595:tid 897822] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/vendor/.env"] [unique_id "alxhkeZhsBlduL7gIyyvmAAAAOU"]
[Sat Jul 18 23:33:05.979955 2026] [security2:error] [pid 897595:tid 897765] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/laravel5/.env"] [unique_id "alxhkeZhsBlduL7gIyyvmQAAAKw"]
[Sat Jul 18 23:33:06.012406 2026] [security2:error] [pid 897595:tid 897848] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/lib/.env"] [unique_id "alxhkuZhsBlduL7gIyyvmwAAAP8"]
[Sat Jul 18 23:33:06.031295 2026] [security2:error] [pid 897595:tid 897815] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/v1/.env"] [unique_id "alxhkuZhsBlduL7gIyyvnAAAAN4"]
[Sat Jul 18 23:33:06.064658 2026] [security2:error] [pid 897595:tid 897844] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/resources/.env"] [unique_id "alxhkuZhsBlduL7gIyyvnQAAAPs"]
[Sat Jul 18 23:33:06.082952 2026] [security2:error] [pid 897595:tid 897812] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/v2/.env"] [unique_id "alxhkuZhsBlduL7gIyyvngAAANs"]
[Sat Jul 18 23:33:06.116319 2026] [security2:error] [pid 897595:tid 897853] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/assets/.env"] [unique_id "alxhkuZhsBlduL7gIyyvoQAAAQQ"]
[Sat Jul 18 23:33:06.133655 2026] [security2:error] [pid 897595:tid 897734] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/v3/.env"] [unique_id "alxhkuZhsBlduL7gIyyvogAAAI0"]
[Sat Jul 18 23:33:06.170104 2026] [security2:error] [pid 897595:tid 897743] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/uploads/.env"] [unique_id "alxhkuZhsBlduL7gIyyvowAAAJY"]
[Sat Jul 18 23:33:06.185340 2026] [security2:error] [pid 897595:tid 897835] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/api/v1/.env"] [unique_id "alxhkuZhsBlduL7gIyyvpAAAAPI"]
[Sat Jul 18 23:33:06.221622 2026] [security2:error] [pid 897595:tid 897779] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/internal/.env"] [unique_id "alxhkuZhsBlduL7gIyyvpwAAALo"]
[Sat Jul 18 23:33:06.236513 2026] [security2:error] [pid 897595:tid 897813] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/api/v2/.env"] [unique_id "alxhkuZhsBlduL7gIyyvqAAAANw"]
[Sat Jul 18 23:33:06.272474 2026] [security2:error] [pid 897595:tid 897816] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/tools/.env"] [unique_id "alxhkuZhsBlduL7gIyyvqgAAAN8"]
[Sat Jul 18 23:33:06.287341 2026] [security2:error] [pid 897595:tid 897786] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/rest/.env"] [unique_id "alxhkuZhsBlduL7gIyyvrAAAAME"]
[Sat Jul 18 23:33:06.323908 2026] [security2:error] [pid 897595:tid 897807] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/scripts/.env"] [unique_id "alxhkuZhsBlduL7gIyyvrQAAANY"]
[Sat Jul 18 23:33:06.337940 2026] [security2:error] [pid 897595:tid 897745] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/graphql/.env"] [unique_id "alxhkuZhsBlduL7gIyyvrgAAAJg"]
[Sat Jul 18 23:33:06.374692 2026] [security2:error] [pid 897595:tid 897830] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/bin/.env"] [unique_id "alxhkuZhsBlduL7gIyyvsAAAAO0"]
[Sat Jul 18 23:33:06.389248 2026] [security2:error] [pid 897595:tid 897737] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/gateway/.env"] [unique_id "alxhkuZhsBlduL7gIyyvsQAAAJA"]
[Sat Jul 18 23:33:06.426326 2026] [security2:error] [pid 897595:tid 897843] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/sbin/.env"] [unique_id "alxhkuZhsBlduL7gIyyvsgAAAPo"]
[Sat Jul 18 23:33:06.440164 2026] [security2:error] [pid 897595:tid 897805] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/microservice/.env"] [unique_id "alxhkuZhsBlduL7gIyyvswAAANQ"]
[Sat Jul 18 23:33:06.479103 2026] [security2:error] [pid 897595:tid 897740] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/local/.env"] [unique_id "alxhkuZhsBlduL7gIyyvtQAAAJM"]
[Sat Jul 18 23:33:06.491459 2026] [security2:error] [pid 897595:tid 897751] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/service/.env"] [unique_id "alxhkuZhsBlduL7gIyyvtgAAAJ4"]
[Sat Jul 18 23:33:06.530788 2026] [security2:error] [pid 897595:tid 897748] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/portal/.env"] [unique_id "alxhkuZhsBlduL7gIyyvuAAAAJs"]
[Sat Jul 18 23:33:06.532249 2026] [security2:error] [pid 897595:tid 897757] [client 163.61.1.17:62592] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhkuZhsBlduL7gIyyvuQAAAKQ"]
[Sat Jul 18 23:33:06.532344 2026] [security2:error] [pid 897595:tid 897757] [client 163.61.1.17:62592] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhkuZhsBlduL7gIyyvuQAAAKQ"]
[Sat Jul 18 23:33:06.541903 2026] [security2:error] [pid 897595:tid 897845] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/api/v3/.env"] [unique_id "alxhkuZhsBlduL7gIyyvugAAAPw"]
[Sat Jul 18 23:33:06.582103 2026] [security2:error] [pid 897595:tid 897832] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/dashboard/.env"] [unique_id "alxhkuZhsBlduL7gIyyvvAAAAO8"]
[Sat Jul 18 23:33:06.593582 2026] [security2:error] [pid 897595:tid 897760] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/api/dev/.env"] [unique_id "alxhkuZhsBlduL7gIyyvvQAAAKc"]
[Sat Jul 18 23:33:06.632653 2026] [security2:error] [pid 897595:tid 897768] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/panel/.env"] [unique_id "alxhkuZhsBlduL7gIyyvwAAAAK8"]
[Sat Jul 18 23:33:06.643733 2026] [security2:error] [pid 897595:tid 897747] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/api/staging/.env"] [unique_id "alxhkuZhsBlduL7gIyyvwwAAAJo"]
[Sat Jul 18 23:33:06.683523 2026] [security2:error] [pid 897595:tid 897826] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/crm/.env"] [unique_id "alxhkuZhsBlduL7gIyyvxQAAAOk"]
[Sat Jul 18 23:33:06.695626 2026] [security2:error] [pid 897595:tid 897842] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/vendor/.env"] [unique_id "alxhkuZhsBlduL7gIyyvxgAAAPk"]
[Sat Jul 18 23:33:06.734525 2026] [security2:error] [pid 897595:tid 897821] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/erp/.env"] [unique_id "alxhkuZhsBlduL7gIyyvywAAAOQ"]
[Sat Jul 18 23:33:06.746524 2026] [security2:error] [pid 897595:tid 897825] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/lib/.env"] [unique_id "alxhkuZhsBlduL7gIyyvzAAAAOg"]
[Sat Jul 18 23:33:06.785301 2026] [security2:error] [pid 897595:tid 897764] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/shop/.env"] [unique_id "alxhkuZhsBlduL7gIyyv0gAAAKs"]
[Sat Jul 18 23:33:06.798070 2026] [security2:error] [pid 897595:tid 897731] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/resources/.env"] [unique_id "alxhkuZhsBlduL7gIyyv1AAAAIo"]
[Sat Jul 18 23:33:06.836868 2026] [security2:error] [pid 897595:tid 897780] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/store/.env"] [unique_id "alxhkuZhsBlduL7gIyyv1wAAALs"]
[Sat Jul 18 23:33:06.849231 2026] [security2:error] [pid 897595:tid 897799] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/assets/.env"] [unique_id "alxhkuZhsBlduL7gIyyv2AAAAM4"]
[Sat Jul 18 23:33:06.888697 2026] [security2:error] [pid 897595:tid 897736] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/saas/.env"] [unique_id "alxhkuZhsBlduL7gIyyv2QAAAI8"]
[Sat Jul 18 23:33:06.901510 2026] [security2:error] [pid 897595:tid 897846] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/uploads/.env"] [unique_id "alxhkuZhsBlduL7gIyyv2gAAAP0"]
[Sat Jul 18 23:33:06.939482 2026] [security2:error] [pid 897595:tid 897804] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/client/.env"] [unique_id "alxhkuZhsBlduL7gIyyv3QAAANM"]
[Sat Jul 18 23:33:06.951724 2026] [security2:error] [pid 897595:tid 897817] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/internal/.env"] [unique_id "alxhkuZhsBlduL7gIyyv3gAAAOA"]
[Sat Jul 18 23:33:06.991036 2026] [security2:error] [pid 897595:tid 897838] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/project/.env"] [unique_id "alxhkuZhsBlduL7gIyyv4AAAAPU"]
[Sat Jul 18 23:33:07.003918 2026] [security2:error] [pid 897595:tid 897828] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/tools/.env"] [unique_id "alxhk-ZhsBlduL7gIyyv4QAAAOs"]
[Sat Jul 18 23:33:07.041631 2026] [security2:error] [pid 897595:tid 897730] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/admin-panel/.env"] [unique_id "alxhk-ZhsBlduL7gIyyv4wAAAIk"]
[Sat Jul 18 23:33:07.056937 2026] [security2:error] [pid 897595:tid 897787] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/scripts/.env"] [unique_id "alxhk-ZhsBlduL7gIyyv5AAAAMI"]
[Sat Jul 18 23:33:07.092593 2026] [security2:error] [pid 897595:tid 897811] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/control-panel/.env"] [unique_id "alxhk-ZhsBlduL7gIyyv5QAAANo"]
[Sat Jul 18 23:33:07.109538 2026] [security2:error] [pid 897595:tid 897783] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/bin/.env"] [unique_id "alxhk-ZhsBlduL7gIyyv5wAAAL4"]
[Sat Jul 18 23:33:07.143059 2026] [security2:error] [pid 897595:tid 897771] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/user-panel/.env"] [unique_id "alxhk-ZhsBlduL7gIyyv6AAAALI"]
[Sat Jul 18 23:33:07.161161 2026] [security2:error] [pid 897595:tid 897831] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/sbin/.env"] [unique_id "alxhk-ZhsBlduL7gIyyv6QAAAO4"]
[Sat Jul 18 23:33:07.193508 2026] [security2:error] [pid 897595:tid 897818] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/node/.env"] [unique_id "alxhk-ZhsBlduL7gIyyv7AAAAOE"]
[Sat Jul 18 23:33:07.212023 2026] [security2:error] [pid 897595:tid 897739] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/local/.env"] [unique_id "alxhk-ZhsBlduL7gIyyv7gAAAJI"]
[Sat Jul 18 23:33:07.243929 2026] [security2:error] [pid 897595:tid 897809] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/express/.env"] [unique_id "alxhk-ZhsBlduL7gIyyv8wAAANg"]
[Sat Jul 18 23:33:07.266835 2026] [security2:error] [pid 897595:tid 897727] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/portal/.env"] [unique_id "alxhk-ZhsBlduL7gIyyv9AAAAIY"]
[Sat Jul 18 23:33:07.294707 2026] [security2:error] [pid 897595:tid 897744] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/next/.env"] [unique_id "alxhk-ZhsBlduL7gIyyv-AAAAJc"]
[Sat Jul 18 23:33:07.318122 2026] [security2:error] [pid 897595:tid 897750] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/dashboard/.env"] [unique_id "alxhk-ZhsBlduL7gIyyv-gAAAJ0"]
[Sat Jul 18 23:33:07.347021 2026] [security2:error] [pid 897595:tid 897766] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/nuxt/.env"] [unique_id "alxhk-ZhsBlduL7gIyyv-wAAAK0"]
[Sat Jul 18 23:33:07.348333 2026] [security2:error] [pid 897595:tid 897803] [client 190.245.146.99:64700] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhk-ZhsBlduL7gIyyv_AAAANI"]
[Sat Jul 18 23:33:07.355806 2026] [security2:error] [pid 897595:tid 897803] [client 190.245.146.99:64700] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhk-ZhsBlduL7gIyyv_AAAANI"]
[Sat Jul 18 23:33:07.370417 2026] [security2:error] [pid 897595:tid 897772] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/panel/.env"] [unique_id "alxhk-ZhsBlduL7gIyyv_gAAALM"]
[Sat Jul 18 23:33:07.380643 2026] [security2:error] [pid 898098:tid 898153] [remote 31.42.184.154:47348] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxhk0RK6WUoKc-ijTGB7QAAMzM"]
[Sat Jul 18 23:33:07.399301 2026] [security2:error] [pid 897595:tid 897822] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/nest/.env"] [unique_id "alxhk-ZhsBlduL7gIyyv_wAAAOU"]
[Sat Jul 18 23:33:07.422299 2026] [security2:error] [pid 897595:tid 897848] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/crm/.env"] [unique_id "alxhk-ZhsBlduL7gIyywAAAAAP8"]
[Sat Jul 18 23:33:07.450936 2026] [security2:error] [pid 897595:tid 897810] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/react/.env"] [unique_id "alxhk-ZhsBlduL7gIyywAQAAANk"]
[Sat Jul 18 23:33:07.473016 2026] [security2:error] [pid 897595:tid 897844] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/erp/.env"] [unique_id "alxhk-ZhsBlduL7gIyywBAAAAPs"]
[Sat Jul 18 23:33:07.502212 2026] [security2:error] [pid 897595:tid 897812] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/vue/.env"] [unique_id "alxhk-ZhsBlduL7gIyywBQAAANs"]
[Sat Jul 18 23:33:07.526278 2026] [security2:error] [pid 897595:tid 897776] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/shop/.env"] [unique_id "alxhk-ZhsBlduL7gIyywBgAAALc"]
[Sat Jul 18 23:33:07.555318 2026] [security2:error] [pid 897595:tid 897734] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/angular/.env"] [unique_id "alxhk-ZhsBlduL7gIyywCAAAAI0"]
[Sat Jul 18 23:33:07.577361 2026] [security2:error] [pid 897595:tid 897794] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/store/.env"] [unique_id "alxhk-ZhsBlduL7gIyywCQAAAMk"]
[Sat Jul 18 23:33:07.607174 2026] [security2:error] [pid 897595:tid 897816] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/svelte/.env"] [unique_id "alxhk-ZhsBlduL7gIyywCgAAAN8"]
[Sat Jul 18 23:33:07.629274 2026] [security2:error] [pid 897595:tid 897807] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/saas/.env"] [unique_id "alxhk-ZhsBlduL7gIyywCwAAANY"]
[Sat Jul 18 23:33:07.638636 2026] [security2:error] [pid 898098:tid 898157] [remote 31.42.184.154:47348] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxhk0RK6WUoKc-ijTGB8AAAGzc"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:33:07.658248 2026] [security2:error] [pid 897595:tid 897830] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/vite/.env"] [unique_id "alxhk-ZhsBlduL7gIyywDQAAAO0"]
[Sat Jul 18 23:33:07.680521 2026] [security2:error] [pid 897595:tid 897733] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/client/.env"] [unique_id "alxhk-ZhsBlduL7gIyywDgAAAIw"]
[Sat Jul 18 23:33:07.708916 2026] [security2:error] [pid 897595:tid 897801] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/backup/.env"] [unique_id "alxhk-ZhsBlduL7gIyywEQAAANA"]
[Sat Jul 18 23:33:07.732057 2026] [security2:error] [pid 897595:tid 897728] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/project/.env"] [unique_id "alxhk-ZhsBlduL7gIyywEwAAAIc"]
[Sat Jul 18 23:33:07.760371 2026] [security2:error] [pid 897595:tid 897751] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/backups/.env"] [unique_id "alxhk-ZhsBlduL7gIyywFQAAAJ4"]
[Sat Jul 18 23:33:07.783143 2026] [security2:error] [pid 897595:tid 897796] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/admin-panel/.env"] [unique_id "alxhk-ZhsBlduL7gIyywGAAAAMs"]
[Sat Jul 18 23:33:07.810646 2026] [security2:error] [pid 897595:tid 897770] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/old/.env"] [unique_id "alxhk-ZhsBlduL7gIyywHgAAALE"]
[Sat Jul 18 23:33:07.834816 2026] [security2:error] [pid 897595:tid 897761] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/control-panel/.env"] [unique_id "alxhk-ZhsBlduL7gIyywIQAAAKg"]
[Sat Jul 18 23:33:07.863735 2026] [security2:error] [pid 897595:tid 897759] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/tmp/.env"] [unique_id "alxhk-ZhsBlduL7gIyywIwAAAKY"]
[Sat Jul 18 23:33:07.886273 2026] [security2:error] [pid 897595:tid 897800] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/user-panel/.env"] [unique_id "alxhk-ZhsBlduL7gIyywJAAAAM8"]
[Sat Jul 18 23:33:07.916007 2026] [security2:error] [pid 897595:tid 897731] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/temp/.env"] [unique_id "alxhk-ZhsBlduL7gIyywJgAAAIo"]
[Sat Jul 18 23:33:07.937863 2026] [security2:error] [pid 897595:tid 897785] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/node/.env"] [unique_id "alxhk-ZhsBlduL7gIyywJwAAAMA"]
[Sat Jul 18 23:33:07.966660 2026] [security2:error] [pid 897595:tid 897849] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/lab/.env"] [unique_id "alxhk-ZhsBlduL7gIyywKQAAAQA"]
[Sat Jul 18 23:33:07.988622 2026] [security2:error] [pid 897595:tid 897789] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/express/.env"] [unique_id "alxhk-ZhsBlduL7gIyywKwAAAMQ"]
[Sat Jul 18 23:33:08.021411 2026] [security2:error] [pid 897595:tid 897799] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/cronlab/.env"] [unique_id "alxhlOZhsBlduL7gIyywLgAAAM4"]
[Sat Jul 18 23:33:08.022104 2026] [security2:error] [pid 897595:tid 897765] [client 119.154.81.234:60847] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhlOZhsBlduL7gIyywLwAAAKw"]
[Sat Jul 18 23:33:08.022197 2026] [security2:error] [pid 897595:tid 897765] [client 119.154.81.234:60847] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhlOZhsBlduL7gIyywLwAAAKw"]
[Sat Jul 18 23:33:08.039722 2026] [security2:error] [pid 897595:tid 897793] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/next/.env"] [unique_id "alxhlOZhsBlduL7gIyywMAAAAMg"]
[Sat Jul 18 23:33:08.073107 2026] [security2:error] [pid 897595:tid 897758] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/cron/.env"] [unique_id "alxhlOZhsBlduL7gIyywMQAAAKU"]
[Sat Jul 18 23:33:08.093476 2026] [security2:error] [pid 897595:tid 897732] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/nuxt/.env"] [unique_id "alxhlOZhsBlduL7gIyywMgAAAIs"]
[Sat Jul 18 23:33:08.124855 2026] [security2:error] [pid 897595:tid 897736] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/en/.env"] [unique_id "alxhlOZhsBlduL7gIyywNAAAAI8"]
[Sat Jul 18 23:33:08.145837 2026] [security2:error] [pid 897595:tid 897840] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/nest/.env"] [unique_id "alxhlOZhsBlduL7gIyywNQAAAPc"]
[Sat Jul 18 23:33:08.196663 2026] [security2:error] [pid 897595:tid 897804] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/react/.env"] [unique_id "alxhlOZhsBlduL7gIyywOgAAANM"]
[Sat Jul 18 23:33:08.239408 2026] [security2:error] [pid 897595:tid 897735] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/administrator/.env"] [unique_id "alxhlOZhsBlduL7gIyywNwAAAI4"]
[Sat Jul 18 23:33:08.247364 2026] [security2:error] [pid 897595:tid 897817] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/vue/.env"] [unique_id "alxhlOZhsBlduL7gIyywPAAAAOA"]
[Sat Jul 18 23:33:08.290124 2026] [security2:error] [pid 897595:tid 897811] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/psnlink/.env"] [unique_id "alxhlOZhsBlduL7gIyywPgAAANo"]
[Sat Jul 18 23:33:08.298050 2026] [security2:error] [pid 897595:tid 897851] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/angular/.env"] [unique_id "alxhlOZhsBlduL7gIyywPwAAAQI"]
[Sat Jul 18 23:33:08.341534 2026] [security2:error] [pid 897595:tid 897806] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/exapi/.env"] [unique_id "alxhlOZhsBlduL7gIyywQAAAANU"]
[Sat Jul 18 23:33:08.349065 2026] [security2:error] [pid 897595:tid 897834] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/svelte/.env"] [unique_id "alxhlOZhsBlduL7gIyywQQAAAPE"]
[Sat Jul 18 23:33:08.392715 2026] [security2:error] [pid 897595:tid 897774] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/sitemaps/.env"] [unique_id "alxhlOZhsBlduL7gIyywRAAAALU"]
[Sat Jul 18 23:33:08.400495 2026] [security2:error] [pid 897595:tid 897791] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/vite/.env"] [unique_id "alxhlOZhsBlduL7gIyywRQAAAMY"]
[Sat Jul 18 23:33:08.452104 2026] [security2:error] [pid 897595:tid 897829] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/backup/.env"] [unique_id "alxhlOZhsBlduL7gIyywSgAAAOw"]
[Sat Jul 18 23:33:08.504622 2026] [security2:error] [pid 897595:tid 897753] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/backups/.env"] [unique_id "alxhlOZhsBlduL7gIyywTQAAAKA"]
[Sat Jul 18 23:33:08.555276 2026] [security2:error] [pid 897595:tid 897810] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/old/.env"] [unique_id "alxhlOZhsBlduL7gIyywTwAAANk"]
[Sat Jul 18 23:33:08.606859 2026] [security2:error] [pid 897595:tid 897815] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/tmp/.env"] [unique_id "alxhlOZhsBlduL7gIyywUQAAAN4"]
[Sat Jul 18 23:33:08.650564 2026] [security2:error] [pid 897595:tid 897823] [client 18.189.20.92:48398] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhlOZhsBlduL7gIyywSQAAAOY"]
[Sat Jul 18 23:33:08.658914 2026] [security2:error] [pid 897595:tid 897734] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/temp/.env"] [unique_id "alxhlOZhsBlduL7gIyywVQAAAI0"]
[Sat Jul 18 23:33:08.709743 2026] [security2:error] [pid 897595:tid 897853] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/lab/.env"] [unique_id "alxhlOZhsBlduL7gIyywVgAAAQQ"]
[Sat Jul 18 23:33:08.764302 2026] [security2:error] [pid 897595:tid 897816] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/cronlab/.env"] [unique_id "alxhlOZhsBlduL7gIyywWwAAAN8"]
[Sat Jul 18 23:33:08.806105 2026] [proxy:error] [pid 897595:tid 897833] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:33:08.806170 2026] [proxy_http:error] [pid 897595:tid 897833] [client 193.47.62.168:59306] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:33:08.806925 2026] [proxy:error] [pid 897595:tid 897833] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:33:08.806956 2026] [proxy_http:error] [pid 897595:tid 897833] [client 193.47.62.168:59306] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:33:08.816101 2026] [security2:error] [pid 897595:tid 897786] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/cron/.env"] [unique_id "alxhlOZhsBlduL7gIyywXQAAAME"]
[Sat Jul 18 23:33:08.867932 2026] [security2:error] [pid 897595:tid 897807] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/en/.env"] [unique_id "alxhlOZhsBlduL7gIyywXwAAANY"]
[Sat Jul 18 23:33:08.920840 2026] [security2:error] [pid 897595:tid 897728] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/administrator/.env"] [unique_id "alxhlOZhsBlduL7gIyywZAAAAIc"]
[Sat Jul 18 23:33:08.950913 2026] [security2:error] [pid 897595:tid 897813] [client 18.189.20.92:48398] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhlOZhsBlduL7gIyywWgAAANw"]
[Sat Jul 18 23:33:08.973399 2026] [security2:error] [pid 897595:tid 897805] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/psnlink/.env"] [unique_id "alxhlOZhsBlduL7gIyywZgAAANQ"]
[Sat Jul 18 23:33:09.002744 2026] [security2:error] [pid 897595:tid 897843] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/logs/.env"] [unique_id "alxhleZhsBlduL7gIyywaAAAAPo"]
[Sat Jul 18 23:33:09.024997 2026] [security2:error] [pid 897595:tid 897752] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/exapi/.env"] [unique_id "alxhleZhsBlduL7gIyywagAAAJ8"]
[Sat Jul 18 23:33:09.048913 2026] [security2:error] [pid 898098:tid 898279] [client 57.141.18.93:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxhlERK6WUoKc-ijTGCHQAAAC8"]
[Sat Jul 18 23:33:09.054023 2026] [security2:error] [pid 897595:tid 897770] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/cache/.env"] [unique_id "alxhleZhsBlduL7gIyywbAAAALE"]
[Sat Jul 18 23:33:09.077352 2026] [security2:error] [pid 897595:tid 897768] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/sitemaps/.env"] [unique_id "alxhleZhsBlduL7gIyywbQAAAK8"]
[Sat Jul 18 23:33:09.107468 2026] [security2:error] [pid 897595:tid 897760] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/mailer/.env"] [unique_id "alxhleZhsBlduL7gIyywbwAAAKc"]
[Sat Jul 18 23:33:09.159469 2026] [security2:error] [pid 897595:tid 897781] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/mail/.env"] [unique_id "alxhleZhsBlduL7gIyywcgAAALw"]
[Sat Jul 18 23:33:09.211162 2026] [security2:error] [pid 897595:tid 897759] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/email/.env"] [unique_id "alxhleZhsBlduL7gIyywdAAAAKY"]
[Sat Jul 18 23:33:09.231283 2026] [security2:error] [pid 898098:tid 898176] [remote 31.42.184.154:47372] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "christiancountytrumpet.com"] [uri "/wp-login.php"] [unique_id "alxhlURK6WUoKc-ijTGCKgAAEEk"]
[Sat Jul 18 23:33:09.262700 2026] [security2:error] [pid 897595:tid 897836] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/smtp/.env"] [unique_id "alxhleZhsBlduL7gIyywdgAAAPM"]
[Sat Jul 18 23:33:09.314415 2026] [security2:error] [pid 897595:tid 897821] [client 18.189.20.92:48398] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/mailing/.env"] [unique_id "alxhleZhsBlduL7gIyyweAAAAOQ"]
[Sat Jul 18 23:33:09.331039 2026] [security2:error] [pid 897595:tid 897761] [client 18.189.20.92:48412] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhleZhsBlduL7gIyywcQAAAKg"]
[Sat Jul 18 23:33:09.364987 2026] [security2:error] [pid 898098:tid 898103] [remote 103.75.185.95:33280] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.commonsensesf.com"] [uri "/wp-login.php"] [unique_id "alxhlURK6WUoKc-ijTGCLQAAeAE"]
[Sat Jul 18 23:33:09.468010 2026] [security2:error] [pid 898098:tid 898263] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/notifications/.env"] [unique_id "alxhlURK6WUoKc-ijTGCNAAAAB8"]
[Sat Jul 18 23:33:09.520925 2026] [security2:error] [pid 898098:tid 898255] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/notify/.env"] [unique_id "alxhlURK6WUoKc-ijTGCNQAAABc"]
[Sat Jul 18 23:33:09.529804 2026] [security2:error] [pid 898098:tid 898173] [remote 31.42.184.154:47372] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "christiancountytrumpet.com"] [uri "/wp-login.php"] [unique_id "alxhlURK6WUoKc-ijTGCNwAAf0c"], referer: https://christiancountytrumpet.com/wp-login.php
[Sat Jul 18 23:33:09.571873 2026] [security2:error] [pid 898098:tid 898293] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/sender/.env"] [unique_id "alxhlURK6WUoKc-ijTGCOwAAAD0"]
[Sat Jul 18 23:33:09.623240 2026] [security2:error] [pid 897595:tid 897819] [client 18.189.20.92:48412] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhleZhsBlduL7gIyywfAAAAOI"]
[Sat Jul 18 23:33:09.625460 2026] [security2:error] [pid 898098:tid 898276] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/campaign/.env"] [unique_id "alxhlURK6WUoKc-ijTGCPQAAACw"]
[Sat Jul 18 23:33:09.674381 2026] [security2:error] [pid 897595:tid 897732] [client 18.189.20.92:48412] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/logs/.env"] [unique_id "alxhleZhsBlduL7gIyywhQAAAIs"]
[Sat Jul 18 23:33:09.676453 2026] [security2:error] [pid 898098:tid 898239] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/newsletter/.env"] [unique_id "alxhlURK6WUoKc-ijTGCPgAAAAc"]
[Sat Jul 18 23:33:09.727944 2026] [security2:error] [pid 898098:tid 898282] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/ses/.env"] [unique_id "alxhlURK6WUoKc-ijTGCQAAAADI"]
[Sat Jul 18 23:33:09.779427 2026] [security2:error] [pid 898098:tid 898311] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/sendgrid/.env"] [unique_id "alxhlURK6WUoKc-ijTGCQgAAAE8"]
[Sat Jul 18 23:33:09.828962 2026] [security2:error] [pid 897595:tid 897777] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/cache/.env"] [unique_id "alxhleZhsBlduL7gIyywiQAAALg"]
[Sat Jul 18 23:33:09.830779 2026] [security2:error] [pid 898098:tid 898285] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/sparkpost/.env"] [unique_id "alxhlURK6WUoKc-ijTGCQwAAADU"]
[Sat Jul 18 23:33:09.879961 2026] [security2:error] [pid 897595:tid 897837] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/mailer/.env"] [unique_id "alxhleZhsBlduL7gIyywigAAAPQ"]
[Sat Jul 18 23:33:09.882479 2026] [security2:error] [pid 898098:tid 898336] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/postmark/.env"] [unique_id "alxhlURK6WUoKc-ijTGCRQAAAGg"]
[Sat Jul 18 23:33:09.884513 2026] [security2:error] [pid 898098:tid 898205] [remote 103.75.185.95:33280] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.commonsensesf.com"] [uri "/wp-login.php"] [unique_id "alxhlURK6WUoKc-ijTGCRAAANmY"], referer: https://mail.commonsensesf.com/wp-login.php
[Sat Jul 18 23:33:09.931464 2026] [security2:error] [pid 897595:tid 897838] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/mail/.env"] [unique_id "alxhleZhsBlduL7gIyywjQAAAPU"]
[Sat Jul 18 23:33:09.932909 2026] [security2:error] [pid 898098:tid 898283] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/mailgun/.env"] [unique_id "alxhlURK6WUoKc-ijTGCSwAAADM"]
[Sat Jul 18 23:33:09.983207 2026] [security2:error] [pid 897595:tid 897746] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/email/.env"] [unique_id "alxhleZhsBlduL7gIyywjwAAAJk"]
[Sat Jul 18 23:33:09.983893 2026] [security2:error] [pid 898098:tid 898340] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/mandrill/.env"] [unique_id "alxhlURK6WUoKc-ijTGCTQAAAGw"]
[Sat Jul 18 23:33:10.037095 2026] [security2:error] [pid 898098:tid 898256] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/mailjet/.env"] [unique_id "alxhlkRK6WUoKc-ijTGCUwAAABg"]
[Sat Jul 18 23:33:10.037921 2026] [security2:error] [pid 897595:tid 897820] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/smtp/.env"] [unique_id "alxhluZhsBlduL7gIyywkQAAAOM"]
[Sat Jul 18 23:33:10.088862 2026] [security2:error] [pid 898098:tid 898259] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/brevo/.env"] [unique_id "alxhlkRK6WUoKc-ijTGCVQAAABs"]
[Sat Jul 18 23:33:10.089639 2026] [security2:error] [pid 897595:tid 897730] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/mailing/.env"] [unique_id "alxhluZhsBlduL7gIyywkgAAAIk"]
[Sat Jul 18 23:33:10.142983 2026] [security2:error] [pid 898098:tid 898350] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/transactional/.env"] [unique_id "alxhlkRK6WUoKc-ijTGCVgAAAHY"]
[Sat Jul 18 23:33:10.143989 2026] [security2:error] [pid 897595:tid 897787] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/notifications/.env"] [unique_id "alxhluZhsBlduL7gIyywlAAAAMI"]
[Sat Jul 18 23:33:10.193515 2026] [security2:error] [pid 898098:tid 898264] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/bulk/.env"] [unique_id "alxhlkRK6WUoKc-ijTGCXwAAACA"]
[Sat Jul 18 23:33:10.195052 2026] [security2:error] [pid 897595:tid 897771] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/notify/.env"] [unique_id "alxhluZhsBlduL7gIyywlwAAALI"]
[Sat Jul 18 23:33:10.244050 2026] [security2:error] [pid 898098:tid 898240] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/aws/.env"] [unique_id "alxhlkRK6WUoKc-ijTGCZAAAAAg"]
[Sat Jul 18 23:33:10.245542 2026] [security2:error] [pid 897595:tid 897818] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/sender/.env"] [unique_id "alxhluZhsBlduL7gIyywmQAAAOE"]
[Sat Jul 18 23:33:10.295986 2026] [security2:error] [pid 898098:tid 898332] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/azure/.env"] [unique_id "alxhlkRK6WUoKc-ijTGCaQAAAGQ"]
[Sat Jul 18 23:33:10.297012 2026] [security2:error] [pid 897595:tid 897834] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/campaign/.env"] [unique_id "alxhluZhsBlduL7gIyywnAAAAPE"]
[Sat Jul 18 23:33:10.347872 2026] [security2:error] [pid 898098:tid 898333] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/gcp/.env"] [unique_id "alxhlkRK6WUoKc-ijTGCagAAAGU"]
[Sat Jul 18 23:33:10.348627 2026] [security2:error] [pid 897595:tid 897809] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/newsletter/.env"] [unique_id "alxhluZhsBlduL7gIyywnQAAANg"]
[Sat Jul 18 23:33:10.398905 2026] [security2:error] [pid 898098:tid 898284] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/cloud/.env"] [unique_id "alxhlkRK6WUoKc-ijTGCbQAAADQ"]
[Sat Jul 18 23:33:10.401025 2026] [security2:error] [pid 897595:tid 897774] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/ses/.env"] [unique_id "alxhluZhsBlduL7gIyywnwAAALU"]
[Sat Jul 18 23:33:10.450728 2026] [security2:error] [pid 898098:tid 898263] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/infrastructure/.env"] [unique_id "alxhlkRK6WUoKc-ijTGCcgAAAB8"]
[Sat Jul 18 23:33:10.451957 2026] [security2:error] [pid 897595:tid 897744] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/sendgrid/.env"] [unique_id "alxhluZhsBlduL7gIyywoAAAAJc"]
[Sat Jul 18 23:33:10.503904 2026] [security2:error] [pid 897595:tid 897753] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/sparkpost/.env"] [unique_id "alxhluZhsBlduL7gIyywpAAAAKA"]
[Sat Jul 18 23:33:10.505313 2026] [security2:error] [pid 898098:tid 898325] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/docker/.env"] [unique_id "alxhlkRK6WUoKc-ijTGCdgAAAF0"]
[Sat Jul 18 23:33:10.555974 2026] [security2:error] [pid 897595:tid 897738] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/postmark/.env"] [unique_id "alxhluZhsBlduL7gIyywpgAAAJE"]
[Sat Jul 18 23:33:10.557205 2026] [security2:error] [pid 898098:tid 898293] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/k8s/.env"] [unique_id "alxhlkRK6WUoKc-ijTGCeAAAAD0"]
[Sat Jul 18 23:33:10.608056 2026] [security2:error] [pid 897595:tid 897756] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/mailgun/.env"] [unique_id "alxhluZhsBlduL7gIyywpwAAAKM"]
[Sat Jul 18 23:33:10.610702 2026] [security2:error] [pid 898098:tid 898289] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/kubernetes/.env"] [unique_id "alxhlkRK6WUoKc-ijTGCewAAADk"]
[Sat Jul 18 23:33:10.642766 2026] [security2:error] [pid 898098:tid 898338] [client 57.141.18.111:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxhlkRK6WUoKc-ijTGCcQAAAGo"]
[Sat Jul 18 23:33:10.659655 2026] [security2:error] [pid 897595:tid 897772] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/mandrill/.env"] [unique_id "alxhluZhsBlduL7gIyywqgAAALM"]
[Sat Jul 18 23:33:10.662113 2026] [security2:error] [pid 898098:tid 898345] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/terraform/.env"] [unique_id "alxhlkRK6WUoKc-ijTGCfwAAAHE"]
[Sat Jul 18 23:33:10.711308 2026] [security2:error] [pid 897595:tid 897846] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/mailjet/.env"] [unique_id "alxhluZhsBlduL7gIyywqwAAAP0"]
[Sat Jul 18 23:33:10.715105 2026] [security2:error] [pid 898098:tid 898331] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/ansible/.env"] [unique_id "alxhlkRK6WUoKc-ijTGCgQAAAGM"]
[Sat Jul 18 23:33:10.716884 2026] [security2:error] [pid 898098:tid 898322] [client 106.222.249.209:14982] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhlkRK6WUoKc-ijTGCggAAAFo"]
[Sat Jul 18 23:33:10.716968 2026] [security2:error] [pid 898098:tid 898322] [client 106.222.249.209:14982] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhlkRK6WUoKc-ijTGCggAAAFo"]
[Sat Jul 18 23:33:10.762713 2026] [security2:error] [pid 897595:tid 897815] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/brevo/.env"] [unique_id "alxhluZhsBlduL7gIyywrQAAAN4"]
[Sat Jul 18 23:33:10.766110 2026] [security2:error] [pid 898098:tid 898262] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/.git/.env"] [unique_id "alxhlkRK6WUoKc-ijTGChwAAAB4"]
[Sat Jul 18 23:33:10.814130 2026] [security2:error] [pid 897595:tid 897812] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/transactional/.env"] [unique_id "alxhluZhsBlduL7gIyywsAAAANs"]
[Sat Jul 18 23:33:10.818023 2026] [security2:error] [pid 898098:tid 898329] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/ci/.env"] [unique_id "alxhlkRK6WUoKc-ijTGCiQAAAGE"]
[Sat Jul 18 23:33:10.865616 2026] [security2:error] [pid 897595:tid 897853] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/bulk/.env"] [unique_id "alxhluZhsBlduL7gIyywsgAAAQQ"]
[Sat Jul 18 23:33:10.868939 2026] [security2:error] [pid 898098:tid 898278] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/cd/.env"] [unique_id "alxhlkRK6WUoKc-ijTGCiwAAAC4"]
[Sat Jul 18 23:33:10.876503 2026] [security2:error] [pid 898098:tid 898351] [client 173.239.196.163:62163] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/bless.php"] [unique_id "alxhlkRK6WUoKc-ijTGCigAAAHc"]
[Sat Jul 18 23:33:10.917499 2026] [security2:error] [pid 897595:tid 897769] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/aws/.env"] [unique_id "alxhluZhsBlduL7gIyywswAAALA"]
[Sat Jul 18 23:33:10.921827 2026] [security2:error] [pid 898098:tid 898313] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/jenkins/.env"] [unique_id "alxhlkRK6WUoKc-ijTGCjAAAAFE"]
[Sat Jul 18 23:33:10.968461 2026] [security2:error] [pid 897595:tid 897778] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/azure/.env"] [unique_id "alxhluZhsBlduL7gIyywtgAAALk"]
[Sat Jul 18 23:33:10.972160 2026] [security2:error] [pid 898098:tid 898288] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/gitlab/.env"] [unique_id "alxhlkRK6WUoKc-ijTGClgAAADg"]
[Sat Jul 18 23:33:11.019503 2026] [security2:error] [pid 897595:tid 897833] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/gcp/.env"] [unique_id "alxhl-ZhsBlduL7gIyywuQAAAPA"]
[Sat Jul 18 23:33:11.022937 2026] [security2:error] [pid 898098:tid 898333] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/github/.env"] [unique_id "alxhl0RK6WUoKc-ijTGCmwAAAGU"]
[Sat Jul 18 23:33:11.071352 2026] [security2:error] [pid 897595:tid 897792] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/cloud/.env"] [unique_id "alxhl-ZhsBlduL7gIyywuwAAAMc"]
[Sat Jul 18 23:33:11.076180 2026] [security2:error] [pid 898098:tid 898258] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/actions/.env"] [unique_id "alxhl0RK6WUoKc-ijTGCnwAAABo"]
[Sat Jul 18 23:33:11.122841 2026] [security2:error] [pid 897595:tid 897807] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/infrastructure/.env"] [unique_id "alxhl-ZhsBlduL7gIyywvQAAANY"]
[Sat Jul 18 23:33:11.127544 2026] [security2:error] [pid 898098:tid 898252] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/circleci/.env"] [unique_id "alxhl0RK6WUoKc-ijTGCoAAAABQ"]
[Sat Jul 18 23:33:11.174788 2026] [security2:error] [pid 897595:tid 897794] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/docker/.env"] [unique_id "alxhl-ZhsBlduL7gIyywvgAAAMk"]
[Sat Jul 18 23:33:11.179379 2026] [security2:error] [pid 898098:tid 898235] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/travis/.env"] [unique_id "alxhl0RK6WUoKc-ijTGCoQAAAAM"]
[Sat Jul 18 23:33:11.226269 2026] [security2:error] [pid 897595:tid 897801] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/k8s/.env"] [unique_id "alxhl-ZhsBlduL7gIyywwAAAANA"]
[Sat Jul 18 23:33:11.231116 2026] [security2:error] [pid 898098:tid 898255] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/buildkite/.env"] [unique_id "alxhl0RK6WUoKc-ijTGCogAAABc"]
[Sat Jul 18 23:33:11.277280 2026] [security2:error] [pid 897595:tid 897740] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/kubernetes/.env"] [unique_id "alxhl-ZhsBlduL7gIyywwgAAAJM"]
[Sat Jul 18 23:33:11.281556 2026] [security2:error] [pid 898098:tid 898293] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/mysql/.env"] [unique_id "alxhl0RK6WUoKc-ijTGCpAAAAD0"]
[Sat Jul 18 23:33:11.328499 2026] [security2:error] [pid 897595:tid 897748] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/terraform/.env"] [unique_id "alxhl-ZhsBlduL7gIyywxQAAAJs"]
[Sat Jul 18 23:33:11.332707 2026] [security2:error] [pid 898098:tid 898338] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/postgres/.env"] [unique_id "alxhl0RK6WUoKc-ijTGCrAAAAGo"]
[Sat Jul 18 23:33:11.342662 2026] [security2:error] [pid 898098:tid 898259] [client 138.0.206.230:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxhl0RK6WUoKc-ijTGCnQAAG2k"]
[Sat Jul 18 23:33:11.380305 2026] [security2:error] [pid 897595:tid 897843] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/ansible/.env"] [unique_id "alxhl-ZhsBlduL7gIyywxwAAAPo"]
[Sat Jul 18 23:33:11.384701 2026] [security2:error] [pid 898098:tid 898232] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/mongodb/.env"] [unique_id "alxhl0RK6WUoKc-ijTGCrgAAAAA"]
[Sat Jul 18 23:33:11.434276 2026] [security2:error] [pid 897595:tid 897737] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/.git/.env"] [unique_id "alxhl-ZhsBlduL7gIyywyAAAAJA"]
[Sat Jul 18 23:33:11.436626 2026] [security2:error] [pid 898098:tid 898297] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/redis/.env"] [unique_id "alxhl0RK6WUoKc-ijTGCrwAAAEE"]
[Sat Jul 18 23:33:11.485829 2026] [security2:error] [pid 897595:tid 897752] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/ci/.env"] [unique_id "alxhl-ZhsBlduL7gIyywygAAAJ8"]
[Sat Jul 18 23:33:11.488249 2026] [security2:error] [pid 898098:tid 898322] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/elasticsearch/.env"] [unique_id "alxhl0RK6WUoKc-ijTGCsAAAAFo"]
[Sat Jul 18 23:33:11.537478 2026] [security2:error] [pid 897595:tid 897768] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/cd/.env"] [unique_id "alxhl-ZhsBlduL7gIyyw0AAAAK8"]
[Sat Jul 18 23:33:11.539444 2026] [security2:error] [pid 898098:tid 898296] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/rabbitmq/.env"] [unique_id "alxhl0RK6WUoKc-ijTGCtAAAAEA"]
[Sat Jul 18 23:33:11.589037 2026] [security2:error] [pid 897595:tid 897781] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/jenkins/.env"] [unique_id "alxhl-ZhsBlduL7gIyyw0gAAALw"]
[Sat Jul 18 23:33:11.591105 2026] [security2:error] [pid 898098:tid 898249] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/kafka/.env"] [unique_id "alxhl0RK6WUoKc-ijTGCtgAAABE"]
[Sat Jul 18 23:33:11.640397 2026] [security2:error] [pid 897595:tid 897762] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/gitlab/.env"] [unique_id "alxhl-ZhsBlduL7gIyyw0wAAAKk"]
[Sat Jul 18 23:33:11.642921 2026] [security2:error] [pid 898098:tid 898312] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/queue/.env"] [unique_id "alxhl0RK6WUoKc-ijTGCuQAAAFA"]
[Sat Jul 18 23:33:11.692419 2026] [security2:error] [pid 897595:tid 897759] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/github/.env"] [unique_id "alxhl-ZhsBlduL7gIyyw1QAAAKY"]
[Sat Jul 18 23:33:11.693249 2026] [security2:error] [pid 898098:tid 898353] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/worker/.env"] [unique_id "alxhl0RK6WUoKc-ijTGCugAAAHk"]
[Sat Jul 18 23:33:11.743423 2026] [security2:error] [pid 897595:tid 897832] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/actions/.env"] [unique_id "alxhl-ZhsBlduL7gIyyw1wAAAO8"]
[Sat Jul 18 23:33:11.745331 2026] [security2:error] [pid 898098:tid 898265] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/job/.env"] [unique_id "alxhl0RK6WUoKc-ijTGCvQAAACE"]
[Sat Jul 18 23:33:11.794523 2026] [security2:error] [pid 897595:tid 897761] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/circleci/.env"] [unique_id "alxhl-ZhsBlduL7gIyyw2QAAAKg"]
[Sat Jul 18 23:33:11.796108 2026] [security2:error] [pid 897595:tid 897821] [client 173.239.196.167:63789] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/O-Simple.php"] [unique_id "alxhl-ZhsBlduL7gIyyw2AAAAOQ"]
[Sat Jul 18 23:33:11.796609 2026] [security2:error] [pid 898098:tid 898302] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/test/.env"] [unique_id "alxhl0RK6WUoKc-ijTGCvgAAAEY"]
[Sat Jul 18 23:33:11.827815 2026] [security2:error] [pid 898098:tid 898332] [client 223.228.182.224:52527] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhl0RK6WUoKc-ijTGCvwAAAGQ"]
[Sat Jul 18 23:33:11.828002 2026] [security2:error] [pid 898098:tid 898332] [client 223.228.182.224:52527] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhl0RK6WUoKc-ijTGCvwAAAGQ"]
[Sat Jul 18 23:33:11.845543 2026] [security2:error] [pid 897595:tid 897796] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/travis/.env"] [unique_id "alxhl-ZhsBlduL7gIyyw3QAAAMs"]
[Sat Jul 18 23:33:11.847293 2026] [security2:error] [pid 898098:tid 898278] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/qa/.env"] [unique_id "alxhl0RK6WUoKc-ijTGCwgAAAC4"]
[Sat Jul 18 23:33:11.897775 2026] [security2:error] [pid 897595:tid 897790] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/buildkite/.env"] [unique_id "alxhl-ZhsBlduL7gIyyw3wAAAMU"]
[Sat Jul 18 23:33:11.898622 2026] [security2:error] [pid 898098:tid 898349] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/preview/.env"] [unique_id "alxhl0RK6WUoKc-ijTGCxgAAAHU"]
[Sat Jul 18 23:33:11.949634 2026] [security2:error] [pid 897595:tid 897797] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/mysql/.env"] [unique_id "alxhl-ZhsBlduL7gIyyw4QAAAMw"]
[Sat Jul 18 23:33:11.950178 2026] [security2:error] [pid 898098:tid 898280] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/beta/.env"] [unique_id "alxhl0RK6WUoKc-ijTGCyQAAADA"]
[Sat Jul 18 23:33:12.000621 2026] [security2:error] [pid 897595:tid 897729] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/postgres/.env"] [unique_id "alxhl-ZhsBlduL7gIyyw4wAAAIg"]
[Sat Jul 18 23:33:12.003120 2026] [security2:error] [pid 898098:tid 898254] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/uat/.env"] [unique_id "alxhmERK6WUoKc-ijTGCzgAAABY"]
[Sat Jul 18 23:33:12.054447 2026] [security2:error] [pid 897595:tid 897819] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/mongodb/.env"] [unique_id "alxhmOZhsBlduL7gIyyw6AAAAOI"]
[Sat Jul 18 23:33:12.056002 2026] [security2:error] [pid 898098:tid 898335] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/stage/.env"] [unique_id "alxhmERK6WUoKc-ijTGC0gAAAGc"]
[Sat Jul 18 23:33:12.105366 2026] [security2:error] [pid 897595:tid 897732] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/redis/.env"] [unique_id "alxhmOZhsBlduL7gIyyw6gAAAIs"]
[Sat Jul 18 23:33:12.106568 2026] [security2:error] [pid 898098:tid 898266] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/development/.env"] [unique_id "alxhmERK6WUoKc-ijTGC1AAAACI"]
[Sat Jul 18 23:33:12.157123 2026] [security2:error] [pid 897595:tid 897736] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/elasticsearch/.env"] [unique_id "alxhmOZhsBlduL7gIyyw6wAAAI8"]
[Sat Jul 18 23:33:12.158415 2026] [security2:error] [pid 898098:tid 898284] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/production/.env"] [unique_id "alxhmERK6WUoKc-ijTGC1QAAADQ"]
[Sat Jul 18 23:33:12.209368 2026] [security2:error] [pid 897595:tid 897804] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/rabbitmq/.env"] [unique_id "alxhmOZhsBlduL7gIyyw7QAAANM"]
[Sat Jul 18 23:33:12.211072 2026] [security2:error] [pid 898098:tid 898274] [client 18.189.20.92:48418] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/config/app/.env"] [unique_id "alxhmERK6WUoKc-ijTGC1gAAACo"]
[Sat Jul 18 23:33:12.261719 2026] [security2:error] [pid 897595:tid 897838] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/kafka/.env"] [unique_id "alxhmOZhsBlduL7gIyyw8wAAAPU"]
[Sat Jul 18 23:33:12.313075 2026] [security2:error] [pid 897595:tid 897839] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/queue/.env"] [unique_id "alxhmOZhsBlduL7gIyyw9QAAAPY"]
[Sat Jul 18 23:33:12.364970 2026] [security2:error] [pid 897595:tid 897852] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/worker/.env"] [unique_id "alxhmOZhsBlduL7gIyyw9wAAAQM"]
[Sat Jul 18 23:33:12.416710 2026] [security2:error] [pid 897595:tid 897795] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/job/.env"] [unique_id "alxhmOZhsBlduL7gIyyw-QAAAMo"]
[Sat Jul 18 23:33:12.468063 2026] [security2:error] [pid 897595:tid 897818] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/test/.env"] [unique_id "alxhmOZhsBlduL7gIyyw-wAAAOE"]
[Sat Jul 18 23:33:12.495227 2026] [security2:error] [pid 898098:tid 898258] [client 18.189.20.92:48418] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhmERK6WUoKc-ijTGC2AAAABo"]
[Sat Jul 18 23:33:12.519825 2026] [security2:error] [pid 897595:tid 897806] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/qa/.env"] [unique_id "alxhmOZhsBlduL7gIyyw_QAAANU"]
[Sat Jul 18 23:33:12.571603 2026] [security2:error] [pid 897595:tid 897727] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/preview/.env"] [unique_id "alxhmOZhsBlduL7gIyyw_wAAAIY"]
[Sat Jul 18 23:33:12.623595 2026] [security2:error] [pid 897595:tid 897744] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/beta/.env"] [unique_id "alxhmOZhsBlduL7gIyyxAQAAAJc"]
[Sat Jul 18 23:33:12.675662 2026] [security2:error] [pid 897595:tid 897788] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/uat/.env"] [unique_id "alxhmOZhsBlduL7gIyyxBAAAAMM"]
[Sat Jul 18 23:33:12.724476 2026] [security2:error] [pid 898098:tid 898285] [client 173.239.196.161:40473] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/lock360.php"] [unique_id "alxhmERK6WUoKc-ijTGC5AAAADU"]
[Sat Jul 18 23:33:12.727867 2026] [security2:error] [pid 897595:tid 897738] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/stage/.env"] [unique_id "alxhmOZhsBlduL7gIyyxBwAAAJE"]
[Sat Jul 18 23:33:12.767199 2026] [security2:error] [pid 898098:tid 898292] [client 18.189.20.92:48418] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhmERK6WUoKc-ijTGC3gAAADw"]
[Sat Jul 18 23:33:12.779242 2026] [security2:error] [pid 897595:tid 897773] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/development/.env"] [unique_id "alxhmOZhsBlduL7gIyyxCwAAALQ"]
[Sat Jul 18 23:33:12.830508 2026] [security2:error] [pid 897595:tid 897782] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/production/.env"] [unique_id "alxhmOZhsBlduL7gIyyxDQAAAL0"]
[Sat Jul 18 23:33:12.882617 2026] [security2:error] [pid 897595:tid 897810] [client 18.189.20.92:48422] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.bigwormfishing.com"] [uri "/config/app/.env"] [unique_id "alxhmOZhsBlduL7gIyyxEAAAANk"]
[Sat Jul 18 23:33:12.923358 2026] [security2:error] [pid 898098:tid 898306] [client 35.227.39.208:22384] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "samdothan.org"] [uri "/wp-json/batch/v1"] [unique_id "alxhmERK6WUoKc-ijTGC9AAAAEo"]
[Sat Jul 18 23:33:13.008470 2026] [security2:error] [pid 898098:tid 898296] [client 18.189.20.92:48418] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhmERK6WUoKc-ijTGC7gAAAEA"]
[Sat Jul 18 23:33:13.144239 2026] [security2:error] [pid 897595:tid 897823] [client 18.189.20.92:48422] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhmOZhsBlduL7gIyyxEwAAAOY"]
[Sat Jul 18 23:33:13.251992 2026] [security2:error] [pid 898098:tid 898349] [client 18.189.20.92:48418] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhmURK6WUoKc-ijTGC-wAAAHU"]
[Sat Jul 18 23:33:13.451689 2026] [security2:error] [pid 897595:tid 897779] [client 18.189.20.92:48422] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhmeZhsBlduL7gIyyxGgAAALo"]
[Sat Jul 18 23:33:13.508669 2026] [security2:error] [pid 898098:tid 898247] [client 18.189.20.92:48418] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhmURK6WUoKc-ijTGDCgAAAA8"]
[Sat Jul 18 23:33:13.528558 2026] [security2:error] [pid 898098:tid 898267] [client 35.227.39.208:22384] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "samdothan.org"] [uri "/"] [unique_id "alxhmURK6WUoKc-ijTGDDQAAACM"]
[Sat Jul 18 23:33:13.610626 2026] [security2:error] [pid 898098:tid 898293] [client 173.239.196.161:61031] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/zwso.php"] [unique_id "alxhmURK6WUoKc-ijTGDEQAAAD0"]
[Sat Jul 18 23:33:13.700955 2026] [security2:error] [pid 897595:tid 897801] [client 18.189.20.92:48422] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhmeZhsBlduL7gIyyxIAAAANA"]
[Sat Jul 18 23:33:13.753950 2026] [security2:error] [pid 898098:tid 898235] [client 18.189.20.92:48418] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhmURK6WUoKc-ijTGDDgAAAAM"]
[Sat Jul 18 23:33:13.951193 2026] [security2:error] [pid 897595:tid 897770] [client 18.189.20.92:48422] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhmeZhsBlduL7gIyyxKAAAALE"]
[Sat Jul 18 23:33:14.000724 2026] [security2:error] [pid 898098:tid 898259] [client 18.189.20.92:48418] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhmURK6WUoKc-ijTGDGgAAABs"]
[Sat Jul 18 23:33:14.062518 2026] [security2:error] [pid 898098:tid 898250] [client 18.189.20.92:48418] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/phpinfo.php"] [unique_id "alxhmkRK6WUoKc-ijTGDJQAAABI"]
[Sat Jul 18 23:33:14.201096 2026] [security2:error] [pid 897595:tid 897762] [client 18.189.20.92:48422] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhmuZhsBlduL7gIyyxLQAAAKk"]
[Sat Jul 18 23:33:14.216580 2026] [security2:error] [pid 898098:tid 898345] [client 18.189.20.92:48424] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/info.php"] [unique_id "alxhmkRK6WUoKc-ijTGDMQAAAHE"]
[Sat Jul 18 23:33:14.371902 2026] [security2:error] [pid 897595:tid 897797] [client 18.189.20.92:36736] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/php.php"] [unique_id "alxhmuZhsBlduL7gIyyxNwAAAMw"]
[Sat Jul 18 23:33:14.449189 2026] [security2:error] [pid 897595:tid 897757] [client 18.189.20.92:48422] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhmuZhsBlduL7gIyyxNQAAAKQ"]
[Sat Jul 18 23:33:14.525669 2026] [security2:error] [pid 898098:tid 898358] [client 18.189.20.92:36740] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/i.php"] [unique_id "alxhmkRK6WUoKc-ijTGDOwAAAH4"]
[Sat Jul 18 23:33:14.559078 2026] [security2:error] [pid 898098:tid 898247] [client 173.239.196.162:46709] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/chosen.php"] [unique_id "alxhmkRK6WUoKc-ijTGDOQAAAA8"]
[Sat Jul 18 23:33:14.653968 2026] [security2:error] [pid 898098:tid 898149] [remote 68.183.43.38:39376] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 38.43.183.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxhmkRK6WUoKc-ijTGDQQAAYC8"]
[Sat Jul 18 23:33:14.683470 2026] [security2:error] [pid 898098:tid 898293] [client 18.189.20.92:36756] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/pi.php"] [unique_id "alxhmkRK6WUoKc-ijTGDQwAAAD0"]
[Sat Jul 18 23:33:14.718304 2026] [security2:error] [pid 897595:tid 897793] [client 18.189.20.92:48422] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhmuZhsBlduL7gIyyxOwAAAMg"]
[Sat Jul 18 23:33:14.768991 2026] [security2:error] [pid 897595:tid 897775] [client 18.189.20.92:48422] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/phpinfo.php"] [unique_id "alxhmuZhsBlduL7gIyyxRgAAALY"]
[Sat Jul 18 23:33:14.837679 2026] [security2:error] [pid 897595:tid 897839] [client 18.189.20.92:36760] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/pinfo.php"] [unique_id "alxhmuZhsBlduL7gIyyxSQAAAPY"]
[Sat Jul 18 23:33:14.869229 2026] [security2:error] [pid 898098:tid 898109] [remote 68.183.43.38:39376] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 38.43.183.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxhmkRK6WUoKc-ijTGDSAAABQc"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:33:14.924702 2026] [security2:error] [pid 898098:tid 898244] [client 18.189.20.92:36764] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/info.php"] [unique_id "alxhmkRK6WUoKc-ijTGDSgAAAAw"]
[Sat Jul 18 23:33:14.991803 2026] [security2:error] [pid 898098:tid 898331] [client 18.189.20.92:36780] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/test.php"] [unique_id "alxhmkRK6WUoKc-ijTGDTgAAAGM"]
[Sat Jul 18 23:33:15.080678 2026] [security2:error] [pid 897595:tid 897806] [client 18.189.20.92:36782] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/php.php"] [unique_id "alxhm-ZhsBlduL7gIyyxUQAAANU"]
[Sat Jul 18 23:33:15.233829 2026] [security2:error] [pid 898098:tid 898332] [client 18.189.20.92:36804] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/i.php"] [unique_id "alxhm0RK6WUoKc-ijTGDXAAAAGQ"]
[Sat Jul 18 23:33:15.357411 2026] [security2:error] [pid 898098:tid 898307] [client 18.189.20.92:36798] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhm0RK6WUoKc-ijTGDWgAAAEs"]
[Sat Jul 18 23:33:15.391496 2026] [security2:error] [pid 898098:tid 898284] [client 18.189.20.92:36818] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/pi.php"] [unique_id "alxhm0RK6WUoKc-ijTGDbQAAADQ"]
[Sat Jul 18 23:33:15.456436 2026] [security2:error] [pid 898098:tid 898315] [client 18.189.20.92:36798] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/p.php"] [unique_id "alxhm0RK6WUoKc-ijTGDcgAAAFM"]
[Sat Jul 18 23:33:15.457992 2026] [security2:error] [pid 898098:tid 898346] [client 173.239.196.164:22063] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/about.php"] [unique_id "alxhm0RK6WUoKc-ijTGDcQAAAHI"]
[Sat Jul 18 23:33:15.544305 2026] [security2:error] [pid 897595:tid 897844] [client 18.189.20.92:36820] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/pinfo.php"] [unique_id "alxhm-ZhsBlduL7gIyyxdgAAAPs"]
[Sat Jul 18 23:33:15.609118 2026] [security2:error] [pid 898098:tid 898239] [client 18.189.20.92:36832] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/debug.php"] [unique_id "alxhm0RK6WUoKc-ijTGDfQAAAAc"]
[Sat Jul 18 23:33:15.648490 2026] [security2:error] [pid 898098:tid 898257] [client 138.252.89.100:63734] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhm0RK6WUoKc-ijTGDfgAAABk"]
[Sat Jul 18 23:33:15.648589 2026] [security2:error] [pid 898098:tid 898257] [client 138.252.89.100:63734] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhm0RK6WUoKc-ijTGDfgAAABk"]
[Sat Jul 18 23:33:15.699618 2026] [security2:error] [pid 898098:tid 898326] [client 18.189.20.92:36834] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/test.php"] [unique_id "alxhm0RK6WUoKc-ijTGDfwAAAF4"]
[Sat Jul 18 23:33:15.764374 2026] [security2:error] [pid 898098:tid 898357] [client 18.189.20.92:36838] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/admin/phpinfo.php"] [unique_id "alxhm0RK6WUoKc-ijTGDhAAAAH0"]
[Sat Jul 18 23:33:15.918247 2026] [security2:error] [pid 898098:tid 898270] [client 18.189.20.92:36854] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/test/phpinfo.php"] [unique_id "alxhm0RK6WUoKc-ijTGDjAAAACY"]
[Sat Jul 18 23:33:16.049380 2026] [security2:error] [pid 898098:tid 898331] [client 18.189.20.92:36848] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhm0RK6WUoKc-ijTGDigAAAGM"]
[Sat Jul 18 23:33:16.072211 2026] [security2:error] [pid 898098:tid 898308] [client 18.189.20.92:36860] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/dev/phpinfo.php"] [unique_id "alxhnERK6WUoKc-ijTGDkAAAAEw"]
[Sat Jul 18 23:33:16.148533 2026] [security2:error] [pid 898098:tid 898279] [client 18.189.20.92:36848] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/p.php"] [unique_id "alxhnERK6WUoKc-ijTGDlAAAAC8"]
[Sat Jul 18 23:33:16.224129 2026] [security2:error] [pid 898098:tid 898327] [client 18.189.20.92:36864] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/old/phpinfo.php"] [unique_id "alxhnERK6WUoKc-ijTGDlQAAAF8"]
[Sat Jul 18 23:33:16.301346 2026] [security2:error] [pid 898098:tid 898295] [client 18.189.20.92:36876] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/debug.php"] [unique_id "alxhnERK6WUoKc-ijTGDnQAAAD8"]
[Sat Jul 18 23:33:16.305033 2026] [security2:error] [pid 898098:tid 898305] [client 173.239.196.164:48027] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/admin.php"] [unique_id "alxhnERK6WUoKc-ijTGDnwAAAEk"]
[Sat Jul 18 23:33:16.379177 2026] [security2:error] [pid 898098:tid 898301] [client 18.189.20.92:36878] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/tmp/phpinfo.php"] [unique_id "alxhnERK6WUoKc-ijTGDpwAAAEU"]
[Sat Jul 18 23:33:16.455931 2026] [security2:error] [pid 898098:tid 898251] [client 18.189.20.92:36894] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/admin/phpinfo.php"] [unique_id "alxhnERK6WUoKc-ijTGDqAAAABM"]
[Sat Jul 18 23:33:16.530478 2026] [security2:error] [pid 898098:tid 898297] [client 18.189.20.92:36904] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/public/phpinfo.php"] [unique_id "alxhnERK6WUoKc-ijTGDqwAAAEE"]
[Sat Jul 18 23:33:16.608136 2026] [security2:error] [pid 898098:tid 898355] [client 18.189.20.92:36908] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/test/phpinfo.php"] [unique_id "alxhnERK6WUoKc-ijTGDrgAAAHs"]
[Sat Jul 18 23:33:16.764281 2026] [security2:error] [pid 897595:tid 897759] [client 18.189.20.92:36918] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/dev/phpinfo.php"] [unique_id "alxhnOZhsBlduL7gIyyxkgAAAKY"]
[Sat Jul 18 23:33:16.883658 2026] [security2:error] [pid 897595:tid 897751] [client 18.189.20.92:36910] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhnOZhsBlduL7gIyyxjgAAAJ4"]
[Sat Jul 18 23:33:16.919562 2026] [security2:error] [pid 898098:tid 898345] [client 18.189.20.92:36932] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/old/phpinfo.php"] [unique_id "alxhnERK6WUoKc-ijTGDtwAAAHE"]
[Sat Jul 18 23:33:16.933555 2026] [security2:error] [pid 898098:tid 898245] [client 3.109.49.224:62992] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "200"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxhnERK6WUoKc-ijTGDlgAAAA0"]
[Sat Jul 18 23:33:16.981314 2026] [security2:error] [pid 897595:tid 897837] [client 18.189.20.92:36910] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/php-info.php"] [unique_id "alxhnOZhsBlduL7gIyyxoAAAAPQ"]
[Sat Jul 18 23:33:17.071084 2026] [security2:error] [pid 897595:tid 897735] [client 18.189.20.92:36934] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/tmp/phpinfo.php"] [unique_id "alxhneZhsBlduL7gIyyxowAAAI4"]
[Sat Jul 18 23:33:17.138360 2026] [security2:error] [pid 898098:tid 898332] [client 18.189.20.92:36940] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/phpversion.php"] [unique_id "alxhnURK6WUoKc-ijTGDwAAAAGQ"]
[Sat Jul 18 23:33:17.152483 2026] [security2:error] [pid 898098:tid 898269] [client 173.239.196.164:33871] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/mah.php"] [unique_id "alxhnURK6WUoKc-ijTGDwQAAACU"]
[Sat Jul 18 23:33:17.187739 2026] [security2:error] [pid 898098:tid 898277] [client 163.61.1.17:63063] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhnURK6WUoKc-ijTGDwgAAAC0"]
[Sat Jul 18 23:33:17.187857 2026] [security2:error] [pid 898098:tid 898277] [client 163.61.1.17:63063] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhnURK6WUoKc-ijTGDwgAAAC0"]
[Sat Jul 18 23:33:17.225280 2026] [security2:error] [pid 897595:tid 897731] [client 18.189.20.92:36956] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/public/phpinfo.php"] [unique_id "alxhneZhsBlduL7gIyyxqAAAAIo"]
[Sat Jul 18 23:33:17.298691 2026] [security2:error] [pid 897595:tid 897851] [client 18.189.20.92:36968] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/_phpinfo.php"] [unique_id "alxhneZhsBlduL7gIyyxqwAAAQI"]
[Sat Jul 18 23:33:17.450730 2026] [security2:error] [pid 897595:tid 897788] [client 18.189.20.92:36994] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/old_phpinfo.php"] [unique_id "alxhneZhsBlduL7gIyyxsQAAAMM"]
[Sat Jul 18 23:33:17.508741 2026] [security2:error] [pid 898098:tid 898338] [client 18.189.20.92:36984] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhnURK6WUoKc-ijTGDzgAAAGo"]
[Sat Jul 18 23:33:17.603139 2026] [security2:error] [pid 897595:tid 897810] [client 18.189.20.92:37006] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/server-info.php"] [unique_id "alxhneZhsBlduL7gIyyxtQAAANk"]
[Sat Jul 18 23:33:17.754523 2026] [security2:error] [pid 897595:tid 897835] [client 18.189.20.92:37020] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/server-status.php"] [unique_id "alxhneZhsBlduL7gIyyxuwAAAPI"]
[Sat Jul 18 23:33:17.850726 2026] [security2:error] [pid 898098:tid 898324] [client 57.141.18.46:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxhnURK6WUoKc-ijTGD3gAAAFw"]
[Sat Jul 18 23:33:17.876166 2026] [security2:error] [pid 898098:tid 898233] [client 197.249.236.242:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxhnURK6WUoKc-ijTGD2QAAAAE"]
[Sat Jul 18 23:33:17.892508 2026] [security2:error] [pid 898098:tid 898282] [client 18.189.20.92:36984] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/php-info.php"] [unique_id "alxhnURK6WUoKc-ijTGD4QAAADI"]
[Sat Jul 18 23:33:17.900708 2026] [security2:error] [pid 898098:tid 898179] [remote 31.42.184.154:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/wp-login.php"] [unique_id "alxhnURK6WUoKc-ijTGD4wAAK0w"]
[Sat Jul 18 23:33:17.910706 2026] [security2:error] [pid 897595:tid 897726] [client 190.245.146.99:65265] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhneZhsBlduL7gIyyxwwAAAIU"]
[Sat Jul 18 23:33:17.910820 2026] [security2:error] [pid 897595:tid 897726] [client 190.245.146.99:65265] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhneZhsBlduL7gIyyxwwAAAIU"]
[Sat Jul 18 23:33:18.029940 2026] [security2:error] [pid 898098:tid 898278] [client 173.239.196.165:26681] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.wp/wso.php"] [unique_id "alxhnURK6WUoKc-ijTGD6AAAAC4"]
[Sat Jul 18 23:33:18.045251 2026] [security2:error] [pid 898098:tid 898256] [client 18.189.20.92:37026] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/phpversion.php"] [unique_id "alxhnkRK6WUoKc-ijTGD7QAAABg"]
[Sat Jul 18 23:33:18.108132 2026] [security2:error] [pid 898098:tid 898240] [client 18.189.20.92:37024] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhnURK6WUoKc-ijTGD5AAAAAg"]
[Sat Jul 18 23:33:18.144858 2026] [security2:error] [pid 898098:tid 898169] [remote 31.42.184.154:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory.com"] [uri "/wp-login.php"] [unique_id "alxhnkRK6WUoKc-ijTGD8gAALUM"], referer: https://nzfoodstory.com/wp-login.php
[Sat Jul 18 23:33:18.204016 2026] [security2:error] [pid 898098:tid 898359] [client 18.189.20.92:37028] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/_phpinfo.php"] [unique_id "alxhnkRK6WUoKc-ijTGD9wAAAH8"]
[Sat Jul 18 23:33:18.362088 2026] [security2:error] [pid 898098:tid 898293] [client 18.189.20.92:37040] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/old_phpinfo.php"] [unique_id "alxhnkRK6WUoKc-ijTGD_gAAAD0"]
[Sat Jul 18 23:33:18.420886 2026] [security2:error] [pid 898098:tid 898307] [client 18.189.20.92:37024] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/index.php"] [unique_id "alxhnkRK6WUoKc-ijTGD-AAAAEs"]
[Sat Jul 18 23:33:18.471636 2026] [security2:error] [pid 898098:tid 898339] [client 18.189.20.92:37024] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/webroot/index.php/_environment"] [unique_id "alxhnkRK6WUoKc-ijTGEBQAAAGs"]
[Sat Jul 18 23:33:18.485134 2026] [security2:error] [pid 898098:tid 898302] [client 74.7.227.179:59256] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxhnkRK6WUoKc-ijTGD_QAARkQ"], referer: https://tejasenvironmental.com/p=756099
[Sat Jul 18 23:33:18.486013 2026] [security2:error] [pid 898098:tid 898341] [client 35.227.39.208:22384] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "samdothan.org"] [uri "/index.php"] [unique_id "alxhnERK6WUoKc-ijTGDuQAAAG0"], referer: http://samdothan.org/wp-json/batch/v1
[Sat Jul 18 23:33:18.514597 2026] [security2:error] [pid 898098:tid 898294] [client 18.189.20.92:37050] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/server-info.php"] [unique_id "alxhnkRK6WUoKc-ijTGEBgAAAD4"]
[Sat Jul 18 23:33:18.597179 2026] [security2:error] [pid 898098:tid 898283] [client 119.154.81.234:61297] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhnkRK6WUoKc-ijTGEDwAAADM"]
[Sat Jul 18 23:33:18.597280 2026] [security2:error] [pid 898098:tid 898283] [client 119.154.81.234:61297] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhnkRK6WUoKc-ijTGEDwAAADM"]
[Sat Jul 18 23:33:18.626363 2026] [security2:error] [pid 898098:tid 898318] [client 18.189.20.92:37062] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/mail/phpinfo.php"] [unique_id "alxhnkRK6WUoKc-ijTGEEAAAAFY"]
[Sat Jul 18 23:33:18.667530 2026] [security2:error] [pid 898098:tid 898259] [client 18.189.20.92:37072] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/server-status.php"] [unique_id "alxhnkRK6WUoKc-ijTGEEQAAABs"]
[Sat Jul 18 23:33:18.783057 2026] [security2:error] [pid 897595:tid 897826] [client 18.189.20.92:37084] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/cpanel/phpinfo.php"] [unique_id "alxhnuZhsBlduL7gIyyx1wAAAOk"]
[Sat Jul 18 23:33:18.820026 2026] [security2:error] [pid 898098:tid 898185] [remote 120.72.98.5:43902] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxhnkRK6WUoKc-ijTGEFAAANFI"]
[Sat Jul 18 23:33:18.820250 2026] [security2:error] [pid 898098:tid 898284] [client 120.72.98.5:43902] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxhnkRK6WUoKc-ijTGEFAAANFI"]
[Sat Jul 18 23:33:18.916576 2026] [security2:error] [pid 898098:tid 898308] [client 223.228.182.224:43219] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhnkRK6WUoKc-ijTGEGQAAAEw"]
[Sat Jul 18 23:33:18.916741 2026] [security2:error] [pid 898098:tid 898308] [client 223.228.182.224:43219] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhnkRK6WUoKc-ijTGEGQAAAEw"]
[Sat Jul 18 23:33:18.937219 2026] [security2:error] [pid 898098:tid 898232] [client 18.189.20.92:37094] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/hosting/phpinfo.php"] [unique_id "alxhnkRK6WUoKc-ijTGEGwAAAAA"]
[Sat Jul 18 23:33:19.030465 2026] [security2:error] [pid 898098:tid 898246] [client 18.189.20.92:37088] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhnkRK6WUoKc-ijTGEFQAAAA4"]
[Sat Jul 18 23:33:19.089783 2026] [security2:error] [pid 898098:tid 898356] [client 18.189.20.92:37110] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/webmail/phpinfo.php"] [unique_id "alxhn0RK6WUoKc-ijTGEIgAAAHw"]
[Sat Jul 18 23:33:19.254152 2026] [security2:error] [pid 898098:tid 898286] [client 18.189.20.92:37112] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/smtp/phpinfo.php"] [unique_id "alxhn0RK6WUoKc-ijTGELQAAADY"]
[Sat Jul 18 23:33:19.322395 2026] [security2:error] [pid 898098:tid 898320] [client 18.189.20.92:37088] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.bigwormfishing.com"] [uri "/index.php"] [unique_id "alxhn0RK6WUoKc-ijTGEJwAAAFg"]
[Sat Jul 18 23:33:19.372583 2026] [security2:error] [pid 898098:tid 898302] [client 18.189.20.92:37088] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/webroot/index.php/_environment"] [unique_id "alxhn0RK6WUoKc-ijTGEMwAAAEY"]
[Sat Jul 18 23:33:19.408689 2026] [security2:error] [pid 898098:tid 898235] [client 18.189.20.92:37122] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/phpinfo.php.bak"] [unique_id "alxhn0RK6WUoKc-ijTGENQAAAAM"]
[Sat Jul 18 23:33:19.479634 2026] [security2:error] [pid 898098:tid 898183] [remote 31.42.184.154:45860] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxhn0RK6WUoKc-ijTGEOgAAUlA"]
[Sat Jul 18 23:33:19.479779 2026] [security2:error] [pid 898098:tid 898314] [client 31.42.184.154:45860] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxhn0RK6WUoKc-ijTGEOgAAUlA"]
[Sat Jul 18 23:33:19.526838 2026] [security2:error] [pid 898098:tid 898275] [client 18.189.20.92:37136] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/mail/phpinfo.php"] [unique_id "alxhn0RK6WUoKc-ijTGEPgAAACs"]
[Sat Jul 18 23:33:19.560816 2026] [security2:error] [pid 898098:tid 898271] [client 18.189.20.92:37138] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/phpinfo.php.old"] [unique_id "alxhn0RK6WUoKc-ijTGEQQAAACc"]
[Sat Jul 18 23:33:19.680260 2026] [security2:error] [pid 898098:tid 898348] [client 18.189.20.92:37142] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/cpanel/phpinfo.php"] [unique_id "alxhn0RK6WUoKc-ijTGESAAAAHQ"]
[Sat Jul 18 23:33:19.712604 2026] [security2:error] [pid 898098:tid 898263] [client 18.189.20.92:37152] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/phpinfo.php~"] [unique_id "alxhn0RK6WUoKc-ijTGESQAAAB8"]
[Sat Jul 18 23:33:19.832945 2026] [security2:error] [pid 898098:tid 898326] [client 18.189.20.92:37164] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/hosting/phpinfo.php"] [unique_id "alxhn0RK6WUoKc-ijTGETAAAAF4"]
[Sat Jul 18 23:33:19.864537 2026] [security2:error] [pid 898098:tid 898309] [client 18.189.20.92:37170] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/info.php.bak"] [unique_id "alxhn0RK6WUoKc-ijTGETgAAAE0"]
[Sat Jul 18 23:33:19.984086 2026] [security2:error] [pid 898098:tid 898345] [client 18.189.20.92:37180] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/webmail/phpinfo.php"] [unique_id "alxhn0RK6WUoKc-ijTGEWQAAAHE"]
[Sat Jul 18 23:33:20.017661 2026] [security2:error] [pid 897595:tid 897829] [client 18.189.20.92:37194] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/phpinfo.php.save"] [unique_id "alxhoOZhsBlduL7gIyyx-gAAAOw"]
[Sat Jul 18 23:33:20.072584 2026] [security2:error] [pid 897595:tid 897782] [client 173.239.196.160:49207] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/core.php"] [unique_id "alxhoOZhsBlduL7gIyyx_QAAAL0"]
[Sat Jul 18 23:33:20.136975 2026] [security2:error] [pid 898098:tid 898317] [client 18.189.20.92:37200] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/smtp/phpinfo.php"] [unique_id "alxhoERK6WUoKc-ijTGEWwAAAFU"]
[Sat Jul 18 23:33:20.170905 2026] [security2:error] [pid 897595:tid 897738] [client 18.189.20.92:37204] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/staging/phpinfo.php"] [unique_id "alxhoOZhsBlduL7gIyyx_wAAAJE"]
[Sat Jul 18 23:33:20.288982 2026] [security2:error] [pid 898098:tid 898257] [client 18.189.20.92:37210] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/phpinfo.php.bak"] [unique_id "alxhoERK6WUoKc-ijTGEYQAAABk"]
[Sat Jul 18 23:33:20.324658 2026] [security2:error] [pid 898098:tid 898272] [client 18.189.20.92:37214] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/beta/phpinfo.php"] [unique_id "alxhoERK6WUoKc-ijTGEYgAAACg"]
[Sat Jul 18 23:33:20.443532 2026] [security2:error] [pid 897595:tid 897844] [client 18.189.20.92:37226] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/phpinfo.php.old"] [unique_id "alxhoOZhsBlduL7gIyyyCAAAAPs"]
[Sat Jul 18 23:33:20.476106 2026] [security2:error] [pid 898098:tid 898343] [client 18.189.20.92:37234] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/uat/phpinfo.php"] [unique_id "alxhoERK6WUoKc-ijTGEZgAAAG8"]
[Sat Jul 18 23:33:20.597139 2026] [security2:error] [pid 897595:tid 897777] [client 18.189.20.92:37242] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/phpinfo.php~"] [unique_id "alxhoOZhsBlduL7gIyyyEQAAALg"]
[Sat Jul 18 23:33:20.630152 2026] [security2:error] [pid 897595:tid 897733] [client 18.189.20.92:37252] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/qa/phpinfo.php"] [unique_id "alxhoOZhsBlduL7gIyyyEgAAAIw"]
[Sat Jul 18 23:33:20.750388 2026] [security2:error] [pid 897595:tid 897743] [client 18.189.20.92:37266] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/info.php.bak"] [unique_id "alxhoOZhsBlduL7gIyyyFQAAAJY"]
[Sat Jul 18 23:33:20.782142 2026] [security2:error] [pid 898098:tid 898250] [client 18.189.20.92:37282] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/preview/phpinfo.php"] [unique_id "alxhoERK6WUoKc-ijTGEbwAAABI"]
[Sat Jul 18 23:33:20.903678 2026] [security2:error] [pid 897595:tid 897747] [client 18.189.20.92:37284] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/phpinfo.php.save"] [unique_id "alxhoOZhsBlduL7gIyyyHAAAAJo"]
[Sat Jul 18 23:33:20.935720 2026] [security2:error] [pid 898098:tid 898267] [client 18.189.20.92:37286] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/www/phpinfo.php"] [unique_id "alxhoERK6WUoKc-ijTGEegAAACM"]
[Sat Jul 18 23:33:20.965850 2026] [security2:error] [pid 897595:tid 897825] [client 173.239.196.166:25185] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/robots.php"] [unique_id "alxhoOZhsBlduL7gIyyyHgAAAOg"]
[Sat Jul 18 23:33:21.055933 2026] [security2:error] [pid 898098:tid 898290] [client 18.189.20.92:37288] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/staging/phpinfo.php"] [unique_id "alxhoURK6WUoKc-ijTGEfAAAADo"]
[Sat Jul 18 23:33:21.091863 2026] [security2:error] [pid 898098:tid 898333] [client 18.189.20.92:37304] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/htdocs/phpinfo.php"] [unique_id "alxhoURK6WUoKc-ijTGEfQAAAGU"]
[Sat Jul 18 23:33:21.210284 2026] [security2:error] [pid 898098:tid 898315] [client 18.189.20.92:37316] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/beta/phpinfo.php"] [unique_id "alxhoURK6WUoKc-ijTGEfgAAAFM"]
[Sat Jul 18 23:33:21.242984 2026] [security2:error] [pid 898098:tid 898287] [client 18.189.20.92:37332] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/public_html/phpinfo.php"] [unique_id "alxhoURK6WUoKc-ijTGEfwAAADc"]
[Sat Jul 18 23:33:21.363460 2026] [security2:error] [pid 897595:tid 897767] [client 18.189.20.92:37334] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/uat/phpinfo.php"] [unique_id "alxhoeZhsBlduL7gIyyyKAAAAK4"]
[Sat Jul 18 23:33:21.395266 2026] [security2:error] [pid 898098:tid 898338] [client 18.189.20.92:37338] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/site/phpinfo.php"] [unique_id "alxhoURK6WUoKc-ijTGEhgAAAGo"]
[Sat Jul 18 23:33:21.477484 2026] [security2:error] [pid 898098:tid 898306] [client 106.222.249.209:14167] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhoURK6WUoKc-ijTGEiAAAAEo"]
[Sat Jul 18 23:33:21.478545 2026] [security2:error] [pid 898098:tid 898306] [client 106.222.249.209:14167] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhoURK6WUoKc-ijTGEiAAAAEo"]
[Sat Jul 18 23:33:21.508327 2026] [security2:error] [pid 897595:tid 897849] [client 74.208.214.194:37470] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxhoeZhsBlduL7gIyyyLgAAAQA"]
[Sat Jul 18 23:33:21.515728 2026] [security2:error] [pid 897595:tid 897797] [client 18.189.20.92:37348] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/qa/phpinfo.php"] [unique_id "alxhoeZhsBlduL7gIyyyMQAAAMw"]
[Sat Jul 18 23:33:21.521319 2026] [security2:error] [pid 898098:tid 898258] [client 83.43.88.164:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "sergnotes.com"] [uri "/index.php"] [unique_id "alxhn0RK6WUoKc-ijTGEVgAAABo"]
[Sat Jul 18 23:33:21.547606 2026] [security2:error] [pid 897595:tid 897838] [client 18.189.20.92:37354] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/docs/phpinfo.php"] [unique_id "alxhoeZhsBlduL7gIyyyNAAAAPU"]
[Sat Jul 18 23:33:21.667189 2026] [security2:error] [pid 898098:tid 898233] [client 18.189.20.92:37370] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/preview/phpinfo.php"] [unique_id "alxhoURK6WUoKc-ijTGEjgAAAAE"]
[Sat Jul 18 23:33:21.695987 2026] [proxy:error] [pid 897595:tid 897818] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:33:21.696076 2026] [proxy_http:error] [pid 897595:tid 897818] [client 193.47.62.168:44450] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:33:21.696708 2026] [proxy:error] [pid 897595:tid 897818] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:33:21.696737 2026] [proxy_http:error] [pid 897595:tid 897818] [client 193.47.62.168:44450] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:33:21.698587 2026] [security2:error] [pid 897595:tid 897783] [client 18.189.20.92:37374] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/wp-admin/phpinfo.php"] [unique_id "alxhoeZhsBlduL7gIyyyOgAAAL4"]
[Sat Jul 18 23:33:21.821595 2026] [security2:error] [pid 897595:tid 897727] [client 18.189.20.92:37376] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/www/phpinfo.php"] [unique_id "alxhoeZhsBlduL7gIyyyPwAAAIY"]
[Sat Jul 18 23:33:21.850691 2026] [security2:error] [pid 898098:tid 898314] [client 18.189.20.92:37386] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/administrator/phpinfo.php"] [unique_id "alxhoURK6WUoKc-ijTGEkgAAAFI"]
[Sat Jul 18 23:33:21.852823 2026] [security2:error] [pid 898098:tid 898296] [client 173.239.196.166:24051] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/inputs.php"] [unique_id "alxhoURK6WUoKc-ijTGEkwAAAEA"]
[Sat Jul 18 23:33:21.863548 2026] [security2:error] [pid 897595:tid 897689] [remote 20.153.140.50:33864] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "superiorcopywriting.com"] [uri "/wp-login.php"] [unique_id "alxhoeZhsBlduL7gIyyyQAAA71w"]
[Sat Jul 18 23:33:21.978768 2026] [security2:error] [pid 898098:tid 898271] [client 18.189.20.92:37400] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/htdocs/phpinfo.php"] [unique_id "alxhoURK6WUoKc-ijTGElwAAACc"]
[Sat Jul 18 23:33:22.007241 2026] [security2:error] [pid 897595:tid 897788] [client 18.189.20.92:37410] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/core/phpinfo.php"] [unique_id "alxhouZhsBlduL7gIyyyRAAAAMM"]
[Sat Jul 18 23:33:22.135808 2026] [security2:error] [pid 898098:tid 898256] [client 18.189.20.92:37418] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/public_html/phpinfo.php"] [unique_id "alxhokRK6WUoKc-ijTGEoQAAABg"]
[Sat Jul 18 23:33:22.158595 2026] [security2:error] [pid 897595:tid 897846] [client 18.189.20.92:37426] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.guidehunting.com"] [uri "/includes/phpinfo.php"] [unique_id "alxhouZhsBlduL7gIyyySQAAAP0"]
[Sat Jul 18 23:33:22.261382 2026] [security2:error] [pid 897595:tid 897653] [remote 20.153.140.50:33864] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "superiorcopywriting.com"] [uri "/wp-login.php"] [unique_id "alxhouZhsBlduL7gIyyySwABBDg"], referer: https://superiorcopywriting.com/wp-login.php
[Sat Jul 18 23:33:22.289662 2026] [security2:error] [pid 898098:tid 898277] [client 18.189.20.92:37434] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/site/phpinfo.php"] [unique_id "alxhokRK6WUoKc-ijTGEpQAAAC0"]
[Sat Jul 18 23:33:22.446352 2026] [security2:error] [pid 898098:tid 898270] [client 18.189.20.92:37442] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/docs/phpinfo.php"] [unique_id "alxhokRK6WUoKc-ijTGErgAAACY"]
[Sat Jul 18 23:33:22.602374 2026] [security2:error] [pid 898098:tid 898287] [client 18.189.20.92:37458] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/wp-admin/phpinfo.php"] [unique_id "alxhokRK6WUoKc-ijTGEuAAAADc"]
[Sat Jul 18 23:33:22.710841 2026] [security2:error] [pid 897595:tid 897794] [client 173.239.196.167:26221] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/mini.php"] [unique_id "alxhouZhsBlduL7gIyyyVwAAAMk"]
[Sat Jul 18 23:33:22.753860 2026] [security2:error] [pid 897595:tid 897740] [client 18.189.20.92:37474] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/administrator/phpinfo.php"] [unique_id "alxhouZhsBlduL7gIyyyWQAAAJM"]
[Sat Jul 18 23:33:22.905193 2026] [security2:error] [pid 898098:tid 898238] [client 18.189.20.92:37486] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/core/phpinfo.php"] [unique_id "alxhokRK6WUoKc-ijTGEywAAAAY"]
[Sat Jul 18 23:33:23.057019 2026] [security2:error] [pid 897595:tid 897760] [client 18.189.20.92:37498] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.20.189.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.bigwormfishing.com"] [uri "/includes/phpinfo.php"] [unique_id "alxho-ZhsBlduL7gIyyyZAAAAKc"]
[Sat Jul 18 23:33:23.192959 2026] [security2:error] [pid 898098:tid 898294] [client 124.29.207.185:65493] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.207.29.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxho0RK6WUoKc-ijTGE1AAAAD4"]
[Sat Jul 18 23:33:23.193093 2026] [security2:error] [pid 898098:tid 898294] [client 124.29.207.185:65493] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "factsandminds.com"] [uri "/xmlrpc.php"] [unique_id "alxho0RK6WUoKc-ijTGE1AAAAD4"]
[Sat Jul 18 23:33:23.271033 2026] [security2:error] [pid 898098:tid 898271] [client 57.141.18.67:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxho0RK6WUoKc-ijTGEzgAAACc"]
[Sat Jul 18 23:33:23.599287 2026] [security2:error] [pid 898098:tid 898286] [client 173.239.196.163:60697] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/goods.php"] [unique_id "alxho0RK6WUoKc-ijTGE5gAAADY"]
[Sat Jul 18 23:33:24.246416 2026] [security2:error] [pid 898098:tid 898339] [client 85.204.70.98:51708] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 98.70.204.85.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "verdunestate.com"] [uri "/xmlrpc.php"] [unique_id "alxhpERK6WUoKc-ijTGE8wAAAGs"]
[Sat Jul 18 23:33:24.246517 2026] [security2:error] [pid 898098:tid 898339] [client 85.204.70.98:51708] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "verdunestate.com"] [uri "/xmlrpc.php"] [unique_id "alxhpERK6WUoKc-ijTGE8wAAAGs"]
[Sat Jul 18 23:33:24.506734 2026] [security2:error] [pid 897595:tid 897730] [client 173.239.196.161:47657] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/file5.php"] [unique_id "alxhpOZhsBlduL7gIyyyigAAAIk"]
[Sat Jul 18 23:33:24.564094 2026] [security2:error] [pid 897595:tid 897832] [client 85.204.70.98:35376] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 98.70.204.85.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "verdunestate.com"] [uri "/xmlrpc.php"] [unique_id "alxhpOZhsBlduL7gIyyyjAAAAO8"]
[Sat Jul 18 23:33:24.564232 2026] [security2:error] [pid 897595:tid 897832] [client 85.204.70.98:35376] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "verdunestate.com"] [uri "/xmlrpc.php"] [unique_id "alxhpOZhsBlduL7gIyyyjAAAAO8"]
[Sat Jul 18 23:33:25.407785 2026] [security2:error] [pid 897595:tid 897786] [client 173.239.196.164:29477] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/ahax.php"] [unique_id "alxhpeZhsBlduL7gIyyyqQAAAME"]
[Sat Jul 18 23:33:25.660984 2026] [ssl:error] [pid 898098:tid 898288] [client 104.48.69.105:46240] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname blog.danwolfe.us provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:33:26.292071 2026] [security2:error] [pid 898098:tid 898264] [client 173.239.196.163:30567] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/f35.php"] [unique_id "alxhpkRK6WUoKc-ijTGFJgAAACA"]
[Sat Jul 18 23:33:26.731202 2026] [security2:error] [pid 898098:tid 898357] [client 16.145.89.170:29902] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 170.89.145.16.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxhpkRK6WUoKc-ijTGFNAAAAH0"]
[Sat Jul 18 23:33:27.150376 2026] [security2:error] [pid 898098:tid 898222] [remote 41.76.213.235:42336] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tntcatholic.com"] [uri "/wp-login.php"] [unique_id "alxhp0RK6WUoKc-ijTGFQQAAKXc"]
[Sat Jul 18 23:33:27.194356 2026] [security2:error] [pid 898098:tid 898291] [client 173.239.196.162:53013] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/simple.php"] [unique_id "alxhp0RK6WUoKc-ijTGFSgAAADs"]
[Sat Jul 18 23:33:27.253144 2026] [security2:error] [pid 898098:tid 898332] [client 138.252.89.100:64218] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhp0RK6WUoKc-ijTGFTQAAAGQ"]
[Sat Jul 18 23:33:27.253902 2026] [security2:error] [pid 898098:tid 898332] [client 138.252.89.100:64218] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhp0RK6WUoKc-ijTGFTQAAAGQ"]
[Sat Jul 18 23:33:27.471075 2026] [security2:error] [pid 898098:tid 898237] [client 91.230.225.164:56373] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/ms-themes.php"] [unique_id "alxhp0RK6WUoKc-ijTGFUgAAAAU"]
[Sat Jul 18 23:33:27.611481 2026] [security2:error] [pid 898098:tid 898316] [client 163.61.1.17:63536] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhp0RK6WUoKc-ijTGFVQAAAFQ"]
[Sat Jul 18 23:33:27.613257 2026] [security2:error] [pid 898098:tid 898316] [client 163.61.1.17:63536] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhp0RK6WUoKc-ijTGFVQAAAFQ"]
[Sat Jul 18 23:33:27.638779 2026] [security2:error] [pid 897595:tid 897727] [client 185.92.25.92:25719] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/ms-themes.php"] [unique_id "alxhp-ZhsBlduL7gIyyy2gAAAIY"]
[Sat Jul 18 23:33:27.651903 2026] [security2:error] [pid 898098:tid 898227] [remote 41.76.213.235:42336] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tntcatholic.com"] [uri "/wp-login.php"] [unique_id "alxhp0RK6WUoKc-ijTGFVwAAcnw"], referer: https://tntcatholic.com/wp-login.php
[Sat Jul 18 23:33:27.652493 2026] [security2:error] [pid 898098:tid 898268] [client 185.92.25.134:30435] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/ms-themes.php"] [unique_id "alxhp0RK6WUoKc-ijTGFWAAAACQ"]
[Sat Jul 18 23:33:27.791979 2026] [security2:error] [pid 898098:tid 898263] [client 185.92.25.87:26419] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/ms-themes.php"] [unique_id "alxhp0RK6WUoKc-ijTGFWgAAAB8"]
[Sat Jul 18 23:33:27.855711 2026] [security2:error] [pid 897595:tid 897832] [client 57.141.18.27:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxhp-ZhsBlduL7gIyyy3gAAAO8"]
[Sat Jul 18 23:33:28.009835 2026] [security2:error] [pid 897595:tid 897822] [client 185.92.25.79:52679] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/ms-themes.php"] [unique_id "alxhqOZhsBlduL7gIyyy6wAAAOU"]
[Sat Jul 18 23:33:28.028035 2026] [security2:error] [pid 897595:tid 897734] [client 185.92.25.79:33231] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/ms-themes.php"] [unique_id "alxhqOZhsBlduL7gIyyy7AAAAI0"]
[Sat Jul 18 23:33:28.059038 2026] [security2:error] [pid 898098:tid 898277] [client 173.239.196.162:26527] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/amax.php"] [unique_id "alxhqERK6WUoKc-ijTGFXQAAAC0"]
[Sat Jul 18 23:33:28.083347 2026] [security2:error] [pid 898098:tid 898356] [client 185.192.71.220:60927] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/ms-themes.php"] [unique_id "alxhqERK6WUoKc-ijTGFYAAAAHw"]
[Sat Jul 18 23:33:28.194101 2026] [security2:error] [pid 897595:tid 897812] [client 91.230.225.162:53871] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/ms-themes.php"] [unique_id "alxhqOZhsBlduL7gIyyy8gAAANs"]
[Sat Jul 18 23:33:28.463463 2026] [security2:error] [pid 898098:tid 898357] [client 190.245.146.99:49403] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhqERK6WUoKc-ijTGFcwAAAH0"]
[Sat Jul 18 23:33:28.463556 2026] [security2:error] [pid 898098:tid 898357] [client 190.245.146.99:49403] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhqERK6WUoKc-ijTGFcwAAAH0"]
[Sat Jul 18 23:33:28.627449 2026] [security2:error] [pid 898098:tid 898247] [client 185.92.25.79:64873] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/chosen.php"] [unique_id "alxhqERK6WUoKc-ijTGFeQAAAA8"]
[Sat Jul 18 23:33:28.673287 2026] [security2:error] [pid 898098:tid 898339] [client 91.230.225.155:55267] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/chosen.php"] [unique_id "alxhqERK6WUoKc-ijTGFegAAAGs"]
[Sat Jul 18 23:33:28.782648 2026] [security2:error] [pid 898098:tid 898264] [client 185.92.25.82:55035] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/chosen.php"] [unique_id "alxhqERK6WUoKc-ijTGFgQAAACA"]
[Sat Jul 18 23:33:28.807463 2026] [security2:error] [pid 898098:tid 898252] [client 91.230.225.158:51737] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/chosen.php"] [unique_id "alxhqERK6WUoKc-ijTGFgwAAABQ"]
[Sat Jul 18 23:33:28.852549 2026] [security2:error] [pid 898098:tid 898266] [client 185.92.25.85:41625] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/chosen.php"] [unique_id "alxhqERK6WUoKc-ijTGFiAAAACI"]
[Sat Jul 18 23:33:28.924419 2026] [security2:error] [pid 898098:tid 898263] [client 173.239.196.167:47329] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/update/f35.php"] [unique_id "alxhqERK6WUoKc-ijTGFiQAAAB8"]
[Sat Jul 18 23:33:28.933656 2026] [security2:error] [pid 898098:tid 898353] [client 91.230.225.154:33041] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/chosen.php"] [unique_id "alxhqERK6WUoKc-ijTGFigAAAHk"]
[Sat Jul 18 23:33:28.991486 2026] [security2:error] [pid 898098:tid 898351] [client 185.192.71.222:44435] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/chosen.php"] [unique_id "alxhqERK6WUoKc-ijTGFiwAAAHc"]
[Sat Jul 18 23:33:29.120014 2026] [security2:error] [pid 898098:tid 898258] [client 91.230.225.156:45939] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/chosen.php"] [unique_id "alxhqURK6WUoKc-ijTGFjQAAABo"]
[Sat Jul 18 23:33:29.292929 2026] [security2:error] [pid 898098:tid 898295] [client 119.154.81.234:61772] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhqURK6WUoKc-ijTGFkgAAAD8"]
[Sat Jul 18 23:33:29.293090 2026] [security2:error] [pid 898098:tid 898295] [client 119.154.81.234:61772] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhqURK6WUoKc-ijTGFkgAAAD8"]
[Sat Jul 18 23:33:29.326020 2026] [security2:error] [pid 898098:tid 898334] [client 50.116.65.227:47156] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "lifeisbetterlakeside.com"] [uri "/wp-content/uploads/2024/08/IMG_8766.jpeg"] [unique_id "alxhqURK6WUoKc-ijTGFkwAAAG8"]
[Sat Jul 18 23:33:29.369998 2026] [security2:error] [pid 898098:tid 898335] [client 185.92.25.135:65371] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/file.php"] [unique_id "alxhqURK6WUoKc-ijTGFlgAAAGc"]
[Sat Jul 18 23:33:29.380710 2026] [security2:error] [pid 898098:tid 898344] [client 185.92.25.82:59895] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/file.php"] [unique_id "alxhqURK6WUoKc-ijTGFmwAAAHA"]
[Sat Jul 18 23:33:29.483463 2026] [security2:error] [pid 898098:tid 898342] [client 185.192.71.209:27995] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/file.php"] [unique_id "alxhqURK6WUoKc-ijTGFpAAAAG4"]
[Sat Jul 18 23:33:29.525012 2026] [ssl:error] [pid 898098:tid 898357] [client 104.48.69.105:45960] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname www.bandsir.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:33:29.637353 2026] [security2:error] [pid 898098:tid 898128] [remote 31.42.184.154:47090] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.qix.pfz.mybluehost.me"] [uri "/wp/wp-login.php"] [unique_id "alxhqURK6WUoKc-ijTGFpgAANxo"]
[Sat Jul 18 23:33:29.642789 2026] [security2:error] [pid 898098:tid 898243] [client 91.230.225.162:57867] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/file.php"] [unique_id "alxhqURK6WUoKc-ijTGFpwAAAAs"]
[Sat Jul 18 23:33:29.721278 2026] [security2:error] [pid 898098:tid 898237] [client 185.92.25.80:25385] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/file.php"] [unique_id "alxhqURK6WUoKc-ijTGFqgAAAAU"]
[Sat Jul 18 23:33:29.731983 2026] [security2:error] [pid 897595:tid 897793] [client 185.92.25.84:63313] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/file.php"] [unique_id "alxhqeZhsBlduL7gIyyzHAAAAMg"]
[Sat Jul 18 23:33:29.781483 2026] [security2:error] [pid 897595:tid 897785] [client 185.92.25.91:50449] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/file.php"] [unique_id "alxhqeZhsBlduL7gIyyzHwAAAMA"]
[Sat Jul 18 23:33:29.812617 2026] [security2:error] [pid 897595:tid 897731] [client 173.239.196.160:56713] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/hello.php"] [unique_id "alxhqeZhsBlduL7gIyyzIwAAAIo"]
[Sat Jul 18 23:33:29.873992 2026] [security2:error] [pid 898098:tid 898172] [remote 31.42.184.154:47090] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.qix.pfz.mybluehost.me"] [uri "/wp/wp-login.php"] [unique_id "alxhqURK6WUoKc-ijTGFsQAATEY"], referer: https://mail.qix.pfz.mybluehost.me/wp/wp-login.php
[Sat Jul 18 23:33:29.914446 2026] [security2:error] [pid 897595:tid 897834] [client 91.230.225.155:42275] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/file.php"] [unique_id "alxhqeZhsBlduL7gIyyzKwAAAPE"]
[Sat Jul 18 23:33:30.010500 2026] [security2:error] [pid 898098:tid 898329] [client 185.192.71.223:51047] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/flower.php"] [unique_id "alxhqkRK6WUoKc-ijTGFswAAAGE"]
[Sat Jul 18 23:33:30.029680 2026] [security2:error] [pid 897595:tid 897806] [client 185.192.71.215:31155] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/flower.php"] [unique_id "alxhquZhsBlduL7gIyyzMAAAANU"]
[Sat Jul 18 23:33:30.092387 2026] [security2:error] [pid 897595:tid 897738] [client 185.192.71.208:21533] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/flower.php"] [unique_id "alxhquZhsBlduL7gIyyzMwAAAJE"]
[Sat Jul 18 23:33:30.146838 2026] [security2:error] [pid 898098:tid 898286] [client 185.192.71.225:44309] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/flower.php"] [unique_id "alxhqkRK6WUoKc-ijTGFtQAAADY"]
[Sat Jul 18 23:33:30.208730 2026] [security2:error] [pid 898098:tid 898274] [client 185.92.25.80:62607] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/flower.php"] [unique_id "alxhqkRK6WUoKc-ijTGFtwAAACo"]
[Sat Jul 18 23:33:30.244328 2026] [security2:error] [pid 898098:tid 898340] [client 185.192.71.215:58397] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/flower.php"] [unique_id "alxhqkRK6WUoKc-ijTGFuAAAAGw"]
[Sat Jul 18 23:33:30.353307 2026] [security2:error] [pid 898098:tid 898275] [client 91.230.225.156:24589] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/flower.php"] [unique_id "alxhqkRK6WUoKc-ijTGFwAAAACs"]
[Sat Jul 18 23:33:30.511418 2026] [security2:error] [pid 898098:tid 898291] [client 91.230.225.153:43355] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/flower.php"] [unique_id "alxhqkRK6WUoKc-ijTGFyAAAADs"]
[Sat Jul 18 23:33:30.533502 2026] [security2:error] [pid 898098:tid 898292] [client 185.192.71.220:43927] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/gifclass.php"] [unique_id "alxhqkRK6WUoKc-ijTGFygAAADw"]
[Sat Jul 18 23:33:30.537722 2026] [security2:error] [pid 898098:tid 898320] [client 185.92.25.84:51503] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/gifclass.php"] [unique_id "alxhqkRK6WUoKc-ijTGFzAAAAFg"]
[Sat Jul 18 23:33:30.607979 2026] [security2:error] [pid 898098:tid 898332] [client 185.92.25.84:31931] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/gifclass.php"] [unique_id "alxhqkRK6WUoKc-ijTGF0gAAAGQ"]
[Sat Jul 18 23:33:30.648680 2026] [security2:error] [pid 898098:tid 898283] [client 185.92.25.91:22279] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/gifclass.php"] [unique_id "alxhqkRK6WUoKc-ijTGF1AAAADM"]
[Sat Jul 18 23:33:30.679520 2026] [security2:error] [pid 898098:tid 898315] [client 173.239.196.166:40757] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/maint/bootstrap.php"] [unique_id "alxhqkRK6WUoKc-ijTGF1QAAAFM"]
[Sat Jul 18 23:33:30.715669 2026] [security2:error] [pid 898098:tid 898358] [client 91.230.225.162:45411] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/gifclass.php"] [unique_id "alxhqkRK6WUoKc-ijTGF1gAAAH4"]
[Sat Jul 18 23:33:30.739988 2026] [security2:error] [pid 897595:tid 897757] [client 91.230.225.163:23041] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/gifclass.php"] [unique_id "alxhquZhsBlduL7gIyyzPwAAAKQ"]
[Sat Jul 18 23:33:30.986145 2026] [security2:error] [pid 898098:tid 898322] [client 185.92.25.86:54363] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/bless.php"] [unique_id "alxhqkRK6WUoKc-ijTGF5gAAAFo"]
[Sat Jul 18 23:33:30.986828 2026] [security2:error] [pid 898098:tid 898345] [client 185.92.25.134:65217] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/gifclass.php"] [unique_id "alxhqkRK6WUoKc-ijTGF5wAAAHE"]
[Sat Jul 18 23:33:31.018078 2026] [security2:error] [pid 898098:tid 898347] [client 185.192.71.209:30445] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/bless.php"] [unique_id "alxhq0RK6WUoKc-ijTGF6gAAAHM"]
[Sat Jul 18 23:33:31.131844 2026] [security2:error] [pid 898098:tid 898259] [client 185.92.25.81:22565] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/bless.php"] [unique_id "alxhq0RK6WUoKc-ijTGF8AAAABs"]
[Sat Jul 18 23:33:31.132036 2026] [security2:error] [pid 897595:tid 897784] [client 185.92.25.89:63815] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/bless.php"] [unique_id "alxhq-ZhsBlduL7gIyyzSQAAAL8"]
[Sat Jul 18 23:33:31.170817 2026] [security2:error] [pid 898098:tid 898285] [client 185.92.25.135:52903] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/bless.php"] [unique_id "alxhq0RK6WUoKc-ijTGF8gAAADU"]
[Sat Jul 18 23:33:31.176698 2026] [security2:error] [pid 898098:tid 898295] [client 91.230.225.155:58537] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/bless.php"] [unique_id "alxhq0RK6WUoKc-ijTGF8wAAAD8"]
[Sat Jul 18 23:33:31.546632 2026] [security2:error] [pid 897595:tid 897752] [client 173.239.196.166:46749] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/themes/zMousse/otuz1.php"] [unique_id "alxhq-ZhsBlduL7gIyyzVwAAAJ8"]
[Sat Jul 18 23:33:31.575771 2026] [security2:error] [pid 898098:tid 898288] [client 185.92.25.88:49633] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/bless.php"] [unique_id "alxhq0RK6WUoKc-ijTGGBQAAADg"]
[Sat Jul 18 23:33:31.583108 2026] [security2:error] [pid 897595:tid 897750] [client 91.230.225.154:46123] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/class-t.api.php"] [unique_id "alxhq-ZhsBlduL7gIyyzWQAAAJ0"]
[Sat Jul 18 23:33:31.647436 2026] [security2:error] [pid 897595:tid 897781] [client 185.92.25.92:36153] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/class-t.api.php"] [unique_id "alxhq-ZhsBlduL7gIyyzXQAAALw"]
[Sat Jul 18 23:33:31.669541 2026] [security2:error] [pid 897595:tid 897844] [client 185.192.71.225:20123] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/class-t.api.php"] [unique_id "alxhq-ZhsBlduL7gIyyzXwAAAPs"]
[Sat Jul 18 23:33:31.669633 2026] [security2:error] [pid 897595:tid 897762] [client 185.92.25.93:60233] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/class-t.api.php"] [unique_id "alxhq-ZhsBlduL7gIyyzYAAAAKk"]
[Sat Jul 18 23:33:31.674336 2026] [security2:error] [pid 897595:tid 897764] [client 91.230.225.157:49793] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/gifclass.php"] [unique_id "alxhq-ZhsBlduL7gIyyzYgAAAKs"]
[Sat Jul 18 23:33:31.674477 2026] [security2:error] [pid 897595:tid 897824] [client 91.230.225.150:33597] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/class-t.api.php"] [unique_id "alxhq-ZhsBlduL7gIyyzYQAAAOc"]
[Sat Jul 18 23:33:31.728255 2026] [security2:error] [pid 898098:tid 898326] [client 185.92.25.87:52669] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/class-t.api.php"] [unique_id "alxhq0RK6WUoKc-ijTGGBwAAAF4"]
[Sat Jul 18 23:33:31.938642 2026] [security2:error] [pid 898098:tid 898266] [client 185.192.71.212:42007] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/class-t.api.php"] [unique_id "alxhq0RK6WUoKc-ijTGGDwAAACI"]
[Sat Jul 18 23:33:31.960053 2026] [security2:error] [pid 898098:tid 898232] [client 91.230.225.151:53229] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/blurbs.php"] [unique_id "alxhq0RK6WUoKc-ijTGGEAAAAAA"]
[Sat Jul 18 23:33:32.131838 2026] [security2:error] [pid 898098:tid 898274] [client 185.92.25.89:58649] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/blurbs.php"] [unique_id "alxhrERK6WUoKc-ijTGGGAAAACo"]
[Sat Jul 18 23:33:32.138083 2026] [security2:error] [pid 898098:tid 898249] [client 106.222.249.209:9256] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhrERK6WUoKc-ijTGGGQAAABE"]
[Sat Jul 18 23:33:32.138181 2026] [security2:error] [pid 898098:tid 898249] [client 106.222.249.209:9256] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhrERK6WUoKc-ijTGGGQAAABE"]
[Sat Jul 18 23:33:32.143736 2026] [security2:error] [pid 897595:tid 897779] [client 185.192.71.217:41665] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/blurbs.php"] [unique_id "alxhrOZhsBlduL7gIyyzcQAAALo"]
[Sat Jul 18 23:33:32.144056 2026] [security2:error] [pid 898098:tid 898277] [client 185.92.25.92:57933] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/bless.php"] [unique_id "alxhrERK6WUoKc-ijTGGGgAAAC0"]
[Sat Jul 18 23:33:32.160974 2026] [security2:error] [pid 897595:tid 897834] [client 91.230.225.162:26687] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/blurbs.php"] [unique_id "alxhrOZhsBlduL7gIyyzcwAAAPE"]
[Sat Jul 18 23:33:32.409771 2026] [security2:error] [pid 898098:tid 898245] [client 91.230.225.159:20387] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/blurbs.php"] [unique_id "alxhrERK6WUoKc-ijTGGUAAAAA0"]
[Sat Jul 18 23:33:32.453400 2026] [security2:error] [pid 897595:tid 897829] [client 173.239.196.162:25571] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/edit-wolf.php"] [unique_id "alxhrOZhsBlduL7gIyyzewAAAOw"]
[Sat Jul 18 23:33:32.583227 2026] [security2:error] [pid 898098:tid 898236] [client 91.230.225.157:39667] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/blurbs.php"] [unique_id "alxhrERK6WUoKc-ijTGGVwAAAAQ"]
[Sat Jul 18 23:33:32.723507 2026] [security2:error] [pid 898098:tid 898326] [client 185.192.71.206:40795] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/akcc.php"] [unique_id "alxhrERK6WUoKc-ijTGGZQAAAF4"]
[Sat Jul 18 23:33:32.869612 2026] [security2:error] [pid 898098:tid 898322] [client 185.192.71.222:30787] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/blurbs.php"] [unique_id "alxhrERK6WUoKc-ijTGGcgAAAFo"]
[Sat Jul 18 23:33:33.004357 2026] [security2:error] [pid 897595:tid 897729] [client 91.230.225.163:44757] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/akcc.php"] [unique_id "alxhreZhsBlduL7gIyyzqQAAAIg"]
[Sat Jul 18 23:33:33.020483 2026] [security2:error] [pid 898098:tid 898309] [client 185.192.71.225:52915] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/class-t.api.php"] [unique_id "alxhrURK6WUoKc-ijTGGdwAAAE0"]
[Sat Jul 18 23:33:33.027002 2026] [security2:error] [pid 898098:tid 898286] [client 185.92.25.84:25283] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/akcc.php"] [unique_id "alxhrURK6WUoKc-ijTGGeAAAADY"]
[Sat Jul 18 23:33:33.046307 2026] [security2:error] [pid 898098:tid 898279] [client 91.230.225.161:56655] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/akcc.php"] [unique_id "alxhrURK6WUoKc-ijTGGegAAAC8"]
[Sat Jul 18 23:33:33.063369 2026] [security2:error] [pid 898098:tid 898310] [client 185.92.25.80:48911] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/akcc.php"] [unique_id "alxhrURK6WUoKc-ijTGGewAAAE4"]
[Sat Jul 18 23:33:33.064198 2026] [security2:error] [pid 898098:tid 898347] [client 91.230.225.153:63357] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/akcc.php"] [unique_id "alxhrURK6WUoKc-ijTGGfAAAAHM"]
[Sat Jul 18 23:33:33.131119 2026] [security2:error] [pid 897595:tid 897737] [client 117.5.194.1:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "koaconsultants.com"] [uri "/index.php"] [unique_id "alxhq-ZhsBlduL7gIyyzRwAAAJA"]
[Sat Jul 18 23:33:33.147286 2026] [security2:error] [pid 898098:tid 898277] [client 91.230.225.162:54681] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/abcd.php"] [unique_id "alxhrURK6WUoKc-ijTGGfQAAAC0"]
[Sat Jul 18 23:33:33.238581 2026] [security2:error] [pid 898098:tid 898356] [client 185.192.71.216:35537] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/akcc.php"] [unique_id "alxhrURK6WUoKc-ijTGGggAAAHw"]
[Sat Jul 18 23:33:33.355768 2026] [security2:error] [pid 898098:tid 898359] [client 173.239.196.167:63835] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/ubh/up.php"] [unique_id "alxhrURK6WUoKc-ijTGGgwAAAH8"]
[Sat Jul 18 23:33:33.464043 2026] [security2:error] [pid 898098:tid 898302] [client 91.230.225.151:40169] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/abcd.php"] [unique_id "alxhrURK6WUoKc-ijTGGhQAAAEY"]
[Sat Jul 18 23:33:33.507006 2026] [security2:error] [pid 897595:tid 897755] [client 185.92.25.83:36947] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/blurbs.php"] [unique_id "alxhreZhsBlduL7gIyyzvQAAAKI"]
[Sat Jul 18 23:33:33.563249 2026] [security2:error] [pid 897595:tid 897849] [client 185.192.71.211:20125] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/shelp.php"] [unique_id "alxhreZhsBlduL7gIyyzvwAAAQA"]
[Sat Jul 18 23:33:33.569365 2026] [security2:error] [pid 898098:tid 898300] [client 185.192.71.214:39739] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/abcd.php"] [unique_id "alxhrURK6WUoKc-ijTGGiAAAAEQ"]
[Sat Jul 18 23:33:33.586218 2026] [security2:error] [pid 897595:tid 897805] [client 185.192.71.207:36719] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/abcd.php"] [unique_id "alxhreZhsBlduL7gIyyzwAAAANQ"]
[Sat Jul 18 23:33:33.641881 2026] [security2:error] [pid 897595:tid 897751] [client 91.230.225.152:33329] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/abcd.php"] [unique_id "alxhreZhsBlduL7gIyyzxAAAAJ4"]
[Sat Jul 18 23:33:33.665985 2026] [security2:error] [pid 897595:tid 897843] [client 185.192.71.222:63263] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/abcd.php"] [unique_id "alxhreZhsBlduL7gIyyzxgAAAPo"]
[Sat Jul 18 23:33:33.798291 2026] [security2:error] [pid 898098:tid 898241] [client 185.192.71.213:60991] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/akcc.php"] [unique_id "alxhrURK6WUoKc-ijTGGmwAAAAk"]
[Sat Jul 18 23:33:33.941519 2026] [security2:error] [pid 898098:tid 898327] [client 185.192.71.211:40321] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/shelp.php"] [unique_id "alxhrURK6WUoKc-ijTGGpgAAAF8"]
[Sat Jul 18 23:33:33.976004 2026] [security2:error] [pid 897595:tid 897735] [client 185.92.25.93:60187] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/cord.php"] [unique_id "alxhreZhsBlduL7gIyyzzQAAAI4"]
[Sat Jul 18 23:33:33.981635 2026] [security2:error] [pid 898098:tid 898336] [client 185.192.71.221:58555] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/shelp.php"] [unique_id "alxhrURK6WUoKc-ijTGGqQAAAGg"]
[Sat Jul 18 23:33:33.981840 2026] [security2:error] [pid 898098:tid 898322] [client 185.92.25.86:52215] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/shelp.php"] [unique_id "alxhrURK6WUoKc-ijTGGqgAAAFo"]
[Sat Jul 18 23:33:34.026158 2026] [security2:error] [pid 897595:tid 897851] [client 185.192.71.209:46935] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/shelp.php"] [unique_id "alxhruZhsBlduL7gIyyz0AAAAQI"]
[Sat Jul 18 23:33:34.214683 2026] [security2:error] [pid 898098:tid 898352] [client 185.92.25.135:54691] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/shelp.php"] [unique_id "alxhrkRK6WUoKc-ijTGGswAAAHg"]
[Sat Jul 18 23:33:34.231927 2026] [security2:error] [pid 898098:tid 898305] [client 173.239.196.164:35735] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/images/bootstrap.php"] [unique_id "alxhrkRK6WUoKc-ijTGGuQAAAEk"]
[Sat Jul 18 23:33:34.426722 2026] [security2:error] [pid 898098:tid 898311] [client 185.192.71.221:28635] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/cord.php"] [unique_id "alxhrkRK6WUoKc-ijTGGwwAAAE8"]
[Sat Jul 18 23:33:34.492353 2026] [security2:error] [pid 898098:tid 898324] [client 185.192.71.209:63519] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/abcd.php"] [unique_id "alxhrkRK6WUoKc-ijTGGxgAAAFw"]
[Sat Jul 18 23:33:34.533261 2026] [security2:error] [pid 898098:tid 898246] [client 185.92.25.84:42949] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/dex.php"] [unique_id "alxhrkRK6WUoKc-ijTGGyQAAAA4"]
[Sat Jul 18 23:33:34.539190 2026] [security2:error] [pid 897595:tid 897734] [client 91.230.225.156:60327] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/cord.php"] [unique_id "alxhruZhsBlduL7gIyyz8gAAAI0"]
[Sat Jul 18 23:33:34.559352 2026] [security2:error] [pid 898098:tid 898328] [client 91.230.225.150:52273] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/cord.php"] [unique_id "alxhrkRK6WUoKc-ijTGGzQAAAGA"]
[Sat Jul 18 23:33:34.633966 2026] [security2:error] [pid 897595:tid 897822] [client 185.192.71.221:36139] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/cord.php"] [unique_id "alxhruZhsBlduL7gIyyz-AAAAOU"]
[Sat Jul 18 23:33:34.679172 2026] [security2:error] [pid 898098:tid 898266] [client 185.92.25.86:22895] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/cord.php"] [unique_id "alxhrkRK6WUoKc-ijTGG7wAAACI"]
[Sat Jul 18 23:33:34.751017 2026] [security2:error] [pid 898098:tid 898264] [client 91.230.225.159:50829] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/dex.php"] [unique_id "alxhrkRK6WUoKc-ijTGG8QAAACA"]
[Sat Jul 18 23:33:34.856403 2026] [security2:error] [pid 897595:tid 897846] [client 185.192.71.212:46751] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/shelp.php"] [unique_id "alxhruZhsBlduL7gIyyz_AAAAP0"]
[Sat Jul 18 23:33:34.896678 2026] [security2:error] [pid 898098:tid 898286] [client 91.230.225.159:36183] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/dex.php"] [unique_id "alxhrkRK6WUoKc-ijTGG9AAAADY"]
[Sat Jul 18 23:33:34.907058 2026] [security2:error] [pid 898098:tid 898353] [client 185.92.25.83:49469] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/dex.php"] [unique_id "alxhrkRK6WUoKc-ijTGG9QAAAHk"]
[Sat Jul 18 23:33:34.912269 2026] [security2:error] [pid 898098:tid 898347] [client 91.230.225.153:44469] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxhrkRK6WUoKc-ijTGG9wAAAHM"]
[Sat Jul 18 23:33:35.013614 2026] [security2:error] [pid 898098:tid 898207] [remote 20.226.60.151:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 151.60.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "assasalnazaha.com"] [uri "/.well-known/about.php"] [unique_id "alxhr0RK6WUoKc-ijTGG_QAAfWg"]
[Sat Jul 18 23:33:35.013935 2026] [security2:error] [pid 898098:tid 898357] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "assasalnazaha.com"] [uri "/.well-known/about.php"] [unique_id "alxhr0RK6WUoKc-ijTGG_QAAfWg"]
[Sat Jul 18 23:33:35.030394 2026] [security2:error] [pid 898098:tid 898352] [client 185.192.71.220:51631] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/dex.php"] [unique_id "alxhr0RK6WUoKc-ijTGHAAAAAHg"]
[Sat Jul 18 23:33:35.049589 2026] [security2:error] [pid 898098:tid 898297] [client 185.92.25.80:44599] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/dex.php"] [unique_id "alxhr0RK6WUoKc-ijTGHAgAAAEE"]
[Sat Jul 18 23:33:35.060502 2026] [security2:error] [pid 898098:tid 898323] [client 74.208.214.194:39632] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxhr0RK6WUoKc-ijTGHBAAAAFs"]
[Sat Jul 18 23:33:35.065042 2026] [security2:error] [pid 897595:tid 897740] [client 185.92.25.89:30105] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxhr-ZhsBlduL7gIyy0AgAAAJM"]
[Sat Jul 18 23:33:35.087825 2026] [security2:error] [pid 897595:tid 897813] [client 173.239.196.161:55819] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/images/upload.php"] [unique_id "alxhr-ZhsBlduL7gIyy0BQAAANw"]
[Sat Jul 18 23:33:35.216974 2026] [ssl:error] [pid 898098:tid 898282] [client 104.48.69.105:45976] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname www.icemarc.org provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:33:35.324653 2026] [security2:error] [pid 897595:tid 897760] [client 91.230.225.155:46361] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/abcd.php"] [unique_id "alxhr-ZhsBlduL7gIyy0DQAAAKc"]
[Sat Jul 18 23:33:35.466387 2026] [security2:error] [pid 898098:tid 898324] [client 91.230.225.151:60933] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/cord.php"] [unique_id "alxhr0RK6WUoKc-ijTGHGAAAAFw"]
[Sat Jul 18 23:33:35.537938 2026] [security2:error] [pid 898098:tid 898267] [client 185.192.71.220:37445] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/zwso.php"] [unique_id "alxhr0RK6WUoKc-ijTGHGgAAACM"]
[Sat Jul 18 23:33:35.562107 2026] [security2:error] [pid 897595:tid 897765] [client 185.92.25.86:49049] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxhr-ZhsBlduL7gIyy0EwAAAKw"]
[Sat Jul 18 23:33:35.562308 2026] [security2:error] [pid 898098:tid 898238] [client 185.192.71.214:29821] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxhr0RK6WUoKc-ijTGHGwAAAAY"]
[Sat Jul 18 23:33:35.628695 2026] [security2:error] [pid 898098:tid 898260] [client 185.192.71.220:54997] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/zwso.php"] [unique_id "alxhr0RK6WUoKc-ijTGHIQAAABw"]
[Sat Jul 18 23:33:35.644011 2026] [security2:error] [pid 898098:tid 898292] [client 91.230.225.161:34831] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxhr0RK6WUoKc-ijTGHIgAAADw"]
[Sat Jul 18 23:33:35.669090 2026] [security2:error] [pid 898098:tid 898349] [client 185.92.25.135:40259] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxhr0RK6WUoKc-ijTGHJAAAAHU"]
[Sat Jul 18 23:33:35.934907 2026] [security2:error] [pid 898098:tid 898347] [client 91.230.225.161:58285] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxhr0RK6WUoKc-ijTGHNAAAAHM"]
[Sat Jul 18 23:33:35.947947 2026] [security2:error] [pid 897595:tid 897838] [client 185.92.25.91:21389] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/zwso.php"] [unique_id "alxhr-ZhsBlduL7gIyy0HQAAAPU"]
[Sat Jul 18 23:33:35.985834 2026] [security2:error] [pid 897595:tid 897819] [client 173.239.196.165:21339] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/seoplugins/db.php"] [unique_id "alxhr-ZhsBlduL7gIyy0HwAAAOI"]
[Sat Jul 18 23:33:36.084684 2026] [security2:error] [pid 898098:tid 898249] [client 185.92.25.134:56159] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxhsERK6WUoKc-ijTGHOQAAABE"]
[Sat Jul 18 23:33:36.098512 2026] [security2:error] [pid 898098:tid 898316] [client 185.192.71.221:53651] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/zwso.php"] [unique_id "alxhsERK6WUoKc-ijTGHPAAAAFQ"]
[Sat Jul 18 23:33:36.099230 2026] [security2:error] [pid 898098:tid 898272] [client 185.192.71.209:58607] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/zwso.php"] [unique_id "alxhsERK6WUoKc-ijTGHPQAAACg"]
[Sat Jul 18 23:33:36.362566 2026] [security2:error] [pid 898098:tid 898321] [client 185.92.25.81:27905] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/bolt.php"] [unique_id "alxhsERK6WUoKc-ijTGHTQAAAFk"]
[Sat Jul 18 23:33:36.377590 2026] [security2:error] [pid 898098:tid 898324] [client 185.192.71.218:32763] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxhsERK6WUoKc-ijTGHUwAAAFw"]
[Sat Jul 18 23:33:36.384783 2026] [security2:error] [pid 898098:tid 898319] [client 185.92.25.86:38831] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/bolt.php"] [unique_id "alxhsERK6WUoKc-ijTGHVQAAAFc"]
[Sat Jul 18 23:33:36.505588 2026] [security2:error] [pid 898098:tid 898238] [client 185.92.25.84:47457] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxhsERK6WUoKc-ijTGHXgAAAAY"]
[Sat Jul 18 23:33:36.725932 2026] [security2:error] [pid 898098:tid 898255] [client 185.192.71.206:51843] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/cjfuns.php"] [unique_id "alxhsERK6WUoKc-ijTGHawAAABc"]
[Sat Jul 18 23:33:36.726338 2026] [security2:error] [pid 897595:tid 897852] [client 185.192.71.209:45967] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/cjfuns.php"] [unique_id "alxhsOZhsBlduL7gIyy0NgAAAQM"]
[Sat Jul 18 23:33:36.736318 2026] [security2:error] [pid 898098:tid 898284] [client 185.192.71.208:51877] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/shelp.php"] [unique_id "alxhsERK6WUoKc-ijTGHbAAAADQ"]
[Sat Jul 18 23:33:36.749269 2026] [security2:error] [pid 897595:tid 897828] [client 185.92.25.80:55333] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/bolt.php"] [unique_id "alxhsOZhsBlduL7gIyy0OAAAAOs"]
[Sat Jul 18 23:33:36.767153 2026] [security2:error] [pid 897595:tid 897832] [client 185.92.25.90:35761] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/dex.php"] [unique_id "alxhsOZhsBlduL7gIyy0OQAAAO8"]
[Sat Jul 18 23:33:36.849338 2026] [security2:error] [pid 897595:tid 897753] [client 173.239.196.161:25519] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/pridmag/db.php"] [unique_id "alxhsOZhsBlduL7gIyy0PQAAAKA"]
[Sat Jul 18 23:33:36.882822 2026] [security2:error] [pid 898098:tid 898277] [client 185.92.25.135:43081] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/bolt.php"] [unique_id "alxhsERK6WUoKc-ijTGHdQAAAC0"]
[Sat Jul 18 23:33:36.989503 2026] [security2:error] [pid 898098:tid 898159] [remote 41.76.213.235:55152] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "hedgerow-crafts.com"] [uri "/wp-login.php"] [unique_id "alxhsERK6WUoKc-ijTGHeAAAYzk"]
[Sat Jul 18 23:33:37.014231 2026] [security2:error] [pid 897595:tid 897808] [client 185.92.25.93:27225] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/zwso.php"] [unique_id "alxhseZhsBlduL7gIyy0QQAAANc"]
[Sat Jul 18 23:33:37.192867 2026] [security2:error] [pid 898098:tid 898245] [client 185.192.71.208:26327] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/cjfuns.php"] [unique_id "alxhsURK6WUoKc-ijTGHfQAAAA0"]
[Sat Jul 18 23:33:37.199932 2026] [security2:error] [pid 898098:tid 898334] [client 91.230.225.154:28619] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/cord.php"] [unique_id "alxhsURK6WUoKc-ijTGHfwAAAGY"]
[Sat Jul 18 23:33:37.209552 2026] [security2:error] [pid 898098:tid 898294] [client 185.92.25.83:63981] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxhsURK6WUoKc-ijTGHgwAAAD4"]
[Sat Jul 18 23:33:37.235675 2026] [security2:error] [pid 897595:tid 897798] [client 185.92.25.86:25043] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxhseZhsBlduL7gIyy0TwAAAM0"]
[Sat Jul 18 23:33:37.261563 2026] [security2:error] [pid 898098:tid 898285] [client 91.230.225.151:34483] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/cjfuns.php"] [unique_id "alxhsURK6WUoKc-ijTGHhgAAADU"]
[Sat Jul 18 23:33:37.325894 2026] [proxy:error] [pid 897595:tid 897770] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:33:37.325992 2026] [proxy_http:error] [pid 897595:tid 897770] [client 193.47.62.168:52286] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:33:37.326951 2026] [proxy:error] [pid 897595:tid 897770] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:33:37.327008 2026] [proxy_http:error] [pid 897595:tid 897770] [client 193.47.62.168:52286] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:33:37.381101 2026] [security2:error] [pid 897595:tid 897847] [client 185.192.71.217:59111] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxhseZhsBlduL7gIyy0VQAAAP4"]
[Sat Jul 18 23:33:37.482965 2026] [security2:error] [pid 898098:tid 898205] [remote 41.76.213.235:55152] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "hedgerow-crafts.com"] [uri "/wp-login.php"] [unique_id "alxhsURK6WUoKc-ijTGHiQAAMGY"], referer: https://hedgerow-crafts.com/wp-login.php
[Sat Jul 18 23:33:37.541315 2026] [security2:error] [pid 897595:tid 897844] [client 185.192.71.206:24405] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxhseZhsBlduL7gIyy0WAAAAPs"]
[Sat Jul 18 23:33:37.677438 2026] [security2:error] [pid 897595:tid 897819] [client 185.192.71.214:32579] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxhseZhsBlduL7gIyy0ZgAAAOI"]
[Sat Jul 18 23:33:37.677466 2026] [security2:error] [pid 897595:tid 897751] [client 91.230.225.154:36889] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxhseZhsBlduL7gIyy0ZQAAAJ4"]
[Sat Jul 18 23:33:37.677867 2026] [security2:error] [pid 897595:tid 897811] [client 185.192.71.222:43939] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxhseZhsBlduL7gIyy0ZwAAANo"]
[Sat Jul 18 23:33:37.683184 2026] [security2:error] [pid 897595:tid 897843] [client 185.192.71.206:20245] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/dex.php"] [unique_id "alxhseZhsBlduL7gIyy0aAAAAPo"]
[Sat Jul 18 23:33:37.697084 2026] [security2:error] [pid 897595:tid 897785] [client 185.192.71.208:38311] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/zwso.php"] [unique_id "alxhseZhsBlduL7gIyy0awAAAMA"]
[Sat Jul 18 23:33:37.701188 2026] [security2:error] [pid 897595:tid 897817] [client 173.239.196.161:33591] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/linkpreview/db.php"] [unique_id "alxhseZhsBlduL7gIyy0bAAAAOA"]
[Sat Jul 18 23:33:37.747631 2026] [security2:error] [pid 897595:tid 897849] [client 185.92.25.92:40977] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/bolt.php"] [unique_id "alxhseZhsBlduL7gIyy0bgAAAQA"]
[Sat Jul 18 23:33:37.912183 2026] [security2:error] [pid 897595:tid 897738] [client 185.92.25.79:39773] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/bolt.php"] [unique_id "alxhseZhsBlduL7gIyy0eQAAAJE"]
[Sat Jul 18 23:33:37.954858 2026] [security2:error] [pid 898098:tid 898241] [client 114.119.133.1:40743] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.thecreole.com"] [uri "/"] [unique_id "alxhsURK6WUoKc-ijTGHlQAAAAk"], referer: https://newstral.com/en/people/24404637/marty-maley
[Sat Jul 18 23:33:38.181943 2026] [security2:error] [pid 898098:tid 898264] [client 51.195.248.115:65022] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "autodiscover.ogx.sbv.mybluehost.me"] [uri "/.env"] [unique_id "alxhskRK6WUoKc-ijTGHmwAAACA"]
[Sat Jul 18 23:33:38.219899 2026] [security2:error] [pid 898098:tid 898242] [client 34.73.105.183:25476] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "uritems.net"] [uri "/wp-json/batch/v1"] [unique_id "alxhskRK6WUoKc-ijTGHnAAAAAo"]
[Sat Jul 18 23:33:38.229104 2026] [security2:error] [pid 898098:tid 898330] [client 185.92.25.92:26211] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxhskRK6WUoKc-ijTGHnwAAAGI"]
[Sat Jul 18 23:33:38.322044 2026] [security2:error] [pid 897595:tid 897846] [client 91.230.225.154:30691] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxhsuZhsBlduL7gIyy0igAAAP0"]
[Sat Jul 18 23:33:38.326026 2026] [security2:error] [pid 897595:tid 897803] [client 91.230.225.155:51893] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/wp-content/index.php"] [unique_id "alxhsuZhsBlduL7gIyy0iwAAANI"]
[Sat Jul 18 23:33:38.326987 2026] [security2:error] [pid 897595:tid 897798] [client 185.192.71.223:21485] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxhsuZhsBlduL7gIyy0jAAAAM0"]
[Sat Jul 18 23:33:38.342595 2026] [security2:error] [pid 898098:tid 898273] [client 185.92.25.88:39143] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxhskRK6WUoKc-ijTGHpQAAACk"]
[Sat Jul 18 23:33:38.412769 2026] [security2:error] [pid 897595:tid 897770] [client 185.92.25.85:46685] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/cjfuns.php"] [unique_id "alxhsuZhsBlduL7gIyy0kAAAALE"]
[Sat Jul 18 23:33:38.594391 2026] [security2:error] [pid 898098:tid 898323] [client 34.73.105.183:25476] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "uritems.net"] [uri "/"] [unique_id "alxhskRK6WUoKc-ijTGHswAAAFs"]
[Sat Jul 18 23:33:38.596516 2026] [security2:error] [pid 897595:tid 897762] [client 163.61.1.17:64004] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhsuZhsBlduL7gIyy0mAAAAKk"]
[Sat Jul 18 23:33:38.596616 2026] [security2:error] [pid 897595:tid 897762] [client 163.61.1.17:64004] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhsuZhsBlduL7gIyy0mAAAAKk"]
[Sat Jul 18 23:33:38.731446 2026] [security2:error] [pid 898098:tid 898243] [client 91.230.225.158:30097] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/cjfuns.php"] [unique_id "alxhskRK6WUoKc-ijTGHtQAAAAs"]
[Sat Jul 18 23:33:38.794630 2026] [security2:error] [pid 898098:tid 898331] [client 138.252.89.100:64704] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhskRK6WUoKc-ijTGHtgAAAGM"]
[Sat Jul 18 23:33:38.794719 2026] [security2:error] [pid 898098:tid 898331] [client 138.252.89.100:64704] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhskRK6WUoKc-ijTGHtgAAAGM"]
[Sat Jul 18 23:33:38.816912 2026] [security2:error] [pid 898098:tid 898259] [client 91.230.225.164:53203] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxhskRK6WUoKc-ijTGHtwAAABs"]
[Sat Jul 18 23:33:38.826082 2026] [security2:error] [pid 898098:tid 898232] [client 113.160.97.242:62604] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxhskRK6WUoKc-ijTGHuAAAAAA"]
[Sat Jul 18 23:33:38.834980 2026] [security2:error] [pid 898098:tid 898295] [client 91.230.225.160:20159] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/bolt.php"] [unique_id "alxhskRK6WUoKc-ijTGHuQAAAD8"]
[Sat Jul 18 23:33:38.871639 2026] [security2:error] [pid 898098:tid 898321] [client 185.192.71.221:32365] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/ioxi-o.php"] [unique_id "alxhskRK6WUoKc-ijTGHvQAAAFk"]
[Sat Jul 18 23:33:38.903937 2026] [security2:error] [pid 898098:tid 898319] [client 185.92.25.84:29723] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/wp-content/index.php"] [unique_id "alxhskRK6WUoKc-ijTGHwgAAAFc"]
[Sat Jul 18 23:33:38.928091 2026] [security2:error] [pid 898098:tid 898297] [client 190.245.146.99:49939] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhskRK6WUoKc-ijTGHwwAAAEE"]
[Sat Jul 18 23:33:38.928211 2026] [security2:error] [pid 898098:tid 898297] [client 190.245.146.99:49939] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhskRK6WUoKc-ijTGHwwAAAEE"]
[Sat Jul 18 23:33:38.960826 2026] [security2:error] [pid 898098:tid 898238] [client 185.192.71.220:20747] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxhskRK6WUoKc-ijTGHxgAAAAY"]
[Sat Jul 18 23:33:38.981928 2026] [security2:error] [pid 898098:tid 898237] [client 185.192.71.212:34403] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/zwso.php"] [unique_id "alxhskRK6WUoKc-ijTGHxwAAAAU"]
[Sat Jul 18 23:33:39.017979 2026] [security2:error] [pid 897595:tid 897836] [client 173.239.196.167:35487] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/modules/mod_simplefileuploadv1.3/elements/udd.php"] [unique_id "alxhs-ZhsBlduL7gIyy0qwAAAPM"]
[Sat Jul 18 23:33:39.084883 2026] [security2:error] [pid 898098:tid 898286] [client 83.32.200.98:39874] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "sergnotes.com"] [uri "/"] [unique_id "alxhs0RK6WUoKc-ijTGHzwAAADY"]
[Sat Jul 18 23:33:39.167017 2026] [security2:error] [pid 897595:tid 897783] [client 91.230.225.157:51501] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxhs-ZhsBlduL7gIyy0rgAAAL4"]
[Sat Jul 18 23:33:39.316631 2026] [security2:error] [pid 897595:tid 897833] [client 91.230.225.158:46559] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/wp-content/index.php"] [unique_id "alxhs-ZhsBlduL7gIyy0tAAAAPA"]
[Sat Jul 18 23:33:39.375300 2026] [security2:error] [pid 897595:tid 897845] [client 185.92.25.135:24747] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/cjfuns.php"] [unique_id "alxhs-ZhsBlduL7gIyy0tQAAAPw"]
[Sat Jul 18 23:33:39.489353 2026] [security2:error] [pid 898098:tid 898352] [client 185.92.25.88:50585] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxhs0RK6WUoKc-ijTGH4QAAAHg"]
[Sat Jul 18 23:33:39.543887 2026] [security2:error] [pid 897595:tid 897774] [client 185.192.71.217:22777] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/insc.php"] [unique_id "alxhs-ZhsBlduL7gIyy0vwAAALU"]
[Sat Jul 18 23:33:39.583299 2026] [security2:error] [pid 897595:tid 897755] [client 185.192.71.224:39349] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/ioxi-o.php"] [unique_id "alxhs-ZhsBlduL7gIyy0wQAAAKI"]
[Sat Jul 18 23:33:39.609540 2026] [security2:error] [pid 897595:tid 897753] [client 185.92.25.87:23685] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxhs-ZhsBlduL7gIyy0wgAAAKA"]
[Sat Jul 18 23:33:39.610455 2026] [security2:error] [pid 898098:tid 898306] [client 185.92.25.86:29065] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxhs0RK6WUoKc-ijTGH4wAAAEo"]
[Sat Jul 18 23:33:39.633685 2026] [security2:error] [pid 898098:tid 898290] [client 91.230.225.154:35705] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxhs0RK6WUoKc-ijTGH5AAAADo"]
[Sat Jul 18 23:33:39.662647 2026] [security2:error] [pid 897595:tid 897782] [client 185.192.71.219:34359] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/ioxi-o.php"] [unique_id "alxhs-ZhsBlduL7gIyy0xQAAAL0"]
[Sat Jul 18 23:33:39.696934 2026] [security2:error] [pid 898098:tid 898338] [client 91.230.225.156:26011] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxhs0RK6WUoKc-ijTGH6QAAAGo"]
[Sat Jul 18 23:33:39.792504 2026] [security2:error] [pid 897595:tid 897795] [client 185.192.71.222:61995] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/wp-content/index.php"] [unique_id "alxhs-ZhsBlduL7gIyy0ygAAAMo"]
[Sat Jul 18 23:33:39.886708 2026] [security2:error] [pid 898098:tid 898328] [client 173.239.196.164:39213] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "alxhs0RK6WUoKc-ijTGH9wAAAGA"]
[Sat Jul 18 23:33:39.909431 2026] [security2:error] [pid 898098:tid 898280] [client 91.230.225.151:53771] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/classwithtostring.php"] [unique_id "alxhs0RK6WUoKc-ijTGH-AAAADA"]
[Sat Jul 18 23:33:39.930709 2026] [security2:error] [pid 898098:tid 898270] [client 185.192.71.224:32529] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/insc.php"] [unique_id "alxhs0RK6WUoKc-ijTGH-QAAACY"]
[Sat Jul 18 23:33:39.934613 2026] [security2:error] [pid 897595:tid 897768] [client 185.92.25.93:33179] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/bolt.php"] [unique_id "alxhs-ZhsBlduL7gIyy0zQAAAK8"]
[Sat Jul 18 23:33:39.937929 2026] [security2:error] [pid 898098:tid 898238] [client 185.92.25.83:55367] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/wp-content/index.php"] [unique_id "alxhs0RK6WUoKc-ijTGH-wAAAAY"]
[Sat Jul 18 23:33:39.950008 2026] [security2:error] [pid 898098:tid 898237] [client 185.92.25.85:50871] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/wp-content/index.php"] [unique_id "alxhs0RK6WUoKc-ijTGH_AAAAAU"]
[Sat Jul 18 23:33:39.955548 2026] [security2:error] [pid 898098:tid 898349] [client 185.92.25.81:22665] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/insc.php"] [unique_id "alxhs0RK6WUoKc-ijTGH_gAAAHU"]
[Sat Jul 18 23:33:39.970393 2026] [security2:error] [pid 898098:tid 898257] [client 119.154.81.234:62237] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhs0RK6WUoKc-ijTGH_wAAABk"]
[Sat Jul 18 23:33:39.970484 2026] [security2:error] [pid 898098:tid 898257] [client 119.154.81.234:62237] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhs0RK6WUoKc-ijTGH_wAAABk"]
[Sat Jul 18 23:33:40.010156 2026] [security2:error] [pid 898098:tid 898268] [client 185.92.25.91:34687] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxhtERK6WUoKc-ijTGIAgAAACQ"]
[Sat Jul 18 23:33:40.237158 2026] [security2:error] [pid 897595:tid 897781] [client 91.230.225.153:31605] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/ioxi-o.php"] [unique_id "alxhtOZhsBlduL7gIyy02QAAALw"]
[Sat Jul 18 23:33:40.593035 2026] [security2:error] [pid 898098:tid 898262] [client 34.147.22.160:49152] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "cpcalendars.mha.oqw.mybluehost.me"] [uri "/"] [unique_id "alxhtERK6WUoKc-ijTGIGAAAAB4"]
[Sat Jul 18 23:33:40.593137 2026] [security2:error] [pid 898098:tid 898262] [client 34.147.22.160:49152] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "cpcalendars.mha.oqw.mybluehost.me"] [uri "/"] [unique_id "alxhtERK6WUoKc-ijTGIGAAAAB4"]
[Sat Jul 18 23:33:40.690691 2026] [security2:error] [pid 898098:tid 898351] [client 223.228.182.224:34397] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhtERK6WUoKc-ijTGIGwAAAHc"]
[Sat Jul 18 23:33:40.690823 2026] [security2:error] [pid 898098:tid 898351] [client 223.228.182.224:34397] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhtERK6WUoKc-ijTGIGwAAAHc"]
[Sat Jul 18 23:33:40.783071 2026] [security2:error] [pid 898098:tid 898263] [client 173.239.196.163:25905] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/pwnd-1/pwnd.php"] [unique_id "alxhtERK6WUoKc-ijTGIHQAAAB8"]
[Sat Jul 18 23:33:40.872804 2026] [security2:error] [pid 898098:tid 898290] [client 24.245.232.89:55482] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "sergnotes.com"] [uri "/wp-includes/fonts/dashicons.ttf"] [unique_id "alxhtERK6WUoKc-ijTGIIgAAADo"]
[Sat Jul 18 23:33:41.546055 2026] [security2:error] [pid 898098:tid 898276] [client 91.230.225.158:53127] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/classwithtostring.php"] [unique_id "alxhtURK6WUoKc-ijTGINAAAACw"]
[Sat Jul 18 23:33:41.570683 2026] [security2:error] [pid 897595:tid 897771] [client 185.192.71.216:52707] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/cjfuns.php"] [unique_id "alxhteZhsBlduL7gIyy1DAAAALI"]
[Sat Jul 18 23:33:41.598280 2026] [security2:error] [pid 898098:tid 898298] [client 46.6.118.29:54990] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "sergnotes.com"] [uri "/wp-includes/fonts/dashicons.eot"] [unique_id "alxhtURK6WUoKc-ijTGINQAAAEI"]
[Sat Jul 18 23:33:41.655324 2026] [security2:error] [pid 898098:tid 898293] [client 173.239.196.165:55973] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "655"] [id "900155"] [msg "WP Brute UA block"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/midnight/admin.php"] [unique_id "alxhtURK6WUoKc-ijTGINwAAAD0"]
[Sat Jul 18 23:33:41.681829 2026] [security2:error] [pid 898098:tid 898300] [client 34.73.105.183:25476] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "uritems.net"] [uri "/index.php"] [unique_id "alxhtERK6WUoKc-ijTGIIQAAAEQ"], referer: http://uritems.net/wp-json/batch/v1
[Sat Jul 18 23:33:41.740840 2026] [security2:error] [pid 898098:tid 898242] [client 185.192.71.224:44073] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/ioxi-o.php"] [unique_id "alxhtURK6WUoKc-ijTGIOAAAAAo"]
[Sat Jul 18 23:33:41.741241 2026] [security2:error] [pid 898098:tid 898284] [client 185.192.71.211:43941] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/wp-content/index.php"] [unique_id "alxhtURK6WUoKc-ijTGIOQAAADQ"]
[Sat Jul 18 23:33:41.742475 2026] [security2:error] [pid 898098:tid 898336] [client 185.192.71.224:57879] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/insc.php"] [unique_id "alxhtURK6WUoKc-ijTGIOgAAAGg"]
[Sat Jul 18 23:33:41.745387 2026] [security2:error] [pid 898098:tid 898332] [client 91.230.225.153:33161] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/ioxi-o.php"] [unique_id "alxhtURK6WUoKc-ijTGIOwAAAGQ"]
[Sat Jul 18 23:33:41.747660 2026] [security2:error] [pid 898098:tid 898330] [client 91.230.225.158:57845] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/classwithtostring.php"] [unique_id "alxhtURK6WUoKc-ijTGIPAAAAGI"]
[Sat Jul 18 23:33:41.782487 2026] [security2:error] [pid 898098:tid 898317] [client 91.230.225.160:58473] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/txets.php"] [unique_id "alxhtURK6WUoKc-ijTGIPgAAAFU"]
[Sat Jul 18 23:33:42.045352 2026] [proxy:error] [pid 898098:tid 898232] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:33:42.045422 2026] [proxy_http:error] [pid 898098:tid 898232] [client 185.247.137.210:56439] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:33:42.046007 2026] [proxy:error] [pid 898098:tid 898232] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:33:42.046035 2026] [proxy_http:error] [pid 898098:tid 898232] [client 185.247.137.210:56439] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:33:42.104917 2026] [security2:error] [pid 898098:tid 898327] [client 185.92.25.89:27901] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/txets.php"] [unique_id "alxhtkRK6WUoKc-ijTGITgAAAF8"]
[Sat Jul 18 23:33:42.110031 2026] [security2:error] [pid 898098:tid 898290] [client 91.230.225.162:37455] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxhtkRK6WUoKc-ijTGITwAAADo"]
[Sat Jul 18 23:33:42.118971 2026] [security2:error] [pid 898098:tid 898353] [client 185.92.25.79:28363] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/insc.php"] [unique_id "alxhtkRK6WUoKc-ijTGIUAAAAHk"]
[Sat Jul 18 23:33:42.129234 2026] [security2:error] [pid 898098:tid 898302] [client 185.92.25.79:56583] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/insc.php"] [unique_id "alxhtkRK6WUoKc-ijTGIUQAAAEY"]
[Sat Jul 18 23:33:42.129337 2026] [security2:error] [pid 898098:tid 898295] [client 185.192.71.209:26763] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/classwithtostring.php"] [unique_id "alxhtkRK6WUoKc-ijTGIUgAAAD8"]
[Sat Jul 18 23:33:42.134536 2026] [security2:error] [pid 898098:tid 898321] [client 91.230.225.150:42067] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/ioxi-o.php"] [unique_id "alxhtkRK6WUoKc-ijTGIUwAAAFk"]
[Sat Jul 18 23:33:42.135127 2026] [security2:error] [pid 897595:tid 897765] [client 91.230.225.155:35363] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxhtuZhsBlduL7gIyy1KgAAAKw"]
[Sat Jul 18 23:33:42.144510 2026] [security2:error] [pid 897595:tid 897787] [client 185.92.25.135:49949] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/txets.php"] [unique_id "alxhtuZhsBlduL7gIyy1KwAAAMI"]
[Sat Jul 18 23:33:42.417281 2026] [security2:error] [pid 898098:tid 898273] [client 79.116.11.139:55778] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "sergnotes.com"] [uri "/wp-includes/fonts/dashicons.eot"] [unique_id "alxhtkRK6WUoKc-ijTGIWAAAACk"]
[Sat Jul 18 23:33:42.515096 2026] [security2:error] [pid 897595:tid 897766] [client 173.239.196.167:29301] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/kill.php"] [unique_id "alxhtuZhsBlduL7gIyy1OAAAAK0"]
[Sat Jul 18 23:33:42.769036 2026] [security2:error] [pid 898098:tid 898270] [client 106.222.249.209:26347] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhtkRK6WUoKc-ijTGIYgAAACY"]
[Sat Jul 18 23:33:42.769164 2026] [security2:error] [pid 898098:tid 898270] [client 106.222.249.209:26347] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhtkRK6WUoKc-ijTGIYgAAACY"]
[Sat Jul 18 23:33:43.386804 2026] [security2:error] [pid 898098:tid 898277] [client 173.239.196.166:43503] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "alxht0RK6WUoKc-ijTGIcgAAAC0"]
[Sat Jul 18 23:33:43.409813 2026] [security2:error] [pid 897595:tid 897733] [client 185.92.25.88:64171] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/classwithtostring.php"] [unique_id "alxht-ZhsBlduL7gIyy1UAAAAIw"]
[Sat Jul 18 23:33:43.416194 2026] [security2:error] [pid 898098:tid 898272] [client 185.92.25.88:35583] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/classwithtostring.php"] [unique_id "alxht0RK6WUoKc-ijTGIdAAAACg"]
[Sat Jul 18 23:33:43.416314 2026] [security2:error] [pid 898098:tid 898315] [client 185.192.71.224:23357] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxht0RK6WUoKc-ijTGIdQAAAFM"]
[Sat Jul 18 23:33:43.422290 2026] [security2:error] [pid 897595:tid 897813] [client 185.92.25.85:24693] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxht-ZhsBlduL7gIyy1UQAAANw"]
[Sat Jul 18 23:33:43.423184 2026] [security2:error] [pid 897595:tid 897795] [client 185.192.71.221:57313] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/wp-admin/txets.php"] [unique_id "alxht-ZhsBlduL7gIyy1UgAAAMo"]
[Sat Jul 18 23:33:43.423514 2026] [security2:error] [pid 898098:tid 898307] [client 185.92.25.88:29205] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/insc.php"] [unique_id "alxht0RK6WUoKc-ijTGIdgAAAEs"]
[Sat Jul 18 23:33:43.423713 2026] [security2:error] [pid 898098:tid 898334] [client 91.230.225.152:54655] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/txets.php"] [unique_id "alxht0RK6WUoKc-ijTGIdwAAAGY"]
[Sat Jul 18 23:33:43.476617 2026] [security2:error] [pid 897595:tid 897818] [client 185.92.25.91:64413] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxht-ZhsBlduL7gIyy1VQAAAOE"]
[Sat Jul 18 23:33:43.635447 2026] [security2:error] [pid 898098:tid 898206] [remote 212.80.9.235:57004] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.9.80.212.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mourgroup.com"] [uri "/wp-login.php"] [unique_id "alxht0RK6WUoKc-ijTGIfQAAEWc"]
[Sat Jul 18 23:33:43.801282 2026] [security2:error] [pid 897595:tid 897798] [client 91.230.225.150:38275] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxht-ZhsBlduL7gIyy1YgAAAM0"]
[Sat Jul 18 23:33:43.887246 2026] [security2:error] [pid 897595:tid 897843] [client 185.92.25.82:28047] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/txets.php"] [unique_id "alxht-ZhsBlduL7gIyy1ZgAAAPo"]
[Sat Jul 18 23:33:43.887248 2026] [security2:error] [pid 897595:tid 897802] [client 185.92.25.79:37933] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/wp-includes/txets.php"] [unique_id "alxht-ZhsBlduL7gIyy1ZQAAANE"]
[Sat Jul 18 23:33:43.887366 2026] [security2:error] [pid 897595:tid 897746] [client 185.92.25.134:39583] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/wp-admin/txets.php"] [unique_id "alxht-ZhsBlduL7gIyy1ZAAAAJk"]
[Sat Jul 18 23:33:43.908260 2026] [security2:error] [pid 897595:tid 897785] [client 185.92.25.83:21235] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/wp-content/index.php"] [unique_id "alxht-ZhsBlduL7gIyy1ZwAAAMA"]
[Sat Jul 18 23:33:43.908438 2026] [security2:error] [pid 897595:tid 897805] [client 185.192.71.217:28079] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/txets.php"] [unique_id "alxht-ZhsBlduL7gIyy1aAAAANQ"]
[Sat Jul 18 23:33:43.909757 2026] [security2:error] [pid 897595:tid 897790] [client 185.92.25.89:37361] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/classwithtostring.php"] [unique_id "alxht-ZhsBlduL7gIyy1aQAAAMU"]
[Sat Jul 18 23:33:43.984870 2026] [security2:error] [pid 897595:tid 897811] [client 185.92.25.84:22127] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/wp-admin/txets.php"] [unique_id "alxht-ZhsBlduL7gIyy1bwAAANo"]
[Sat Jul 18 23:33:44.260317 2026] [security2:error] [pid 897595:tid 897766] [client 173.239.196.167:45967] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "alxhuOZhsBlduL7gIyy1egAAAK0"]
[Sat Jul 18 23:33:44.615137 2026] [security2:error] [pid 897595:tid 897657] [remote 209.42.18.223:42656] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.18.42.209.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxhuOZhsBlduL7gIyy1gAAA5Dw"]
[Sat Jul 18 23:33:44.629222 2026] [security2:error] [pid 898098:tid 898239] [client 185.92.25.85:20035] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/wp-admin/txets.php"] [unique_id "alxhuERK6WUoKc-ijTGIlAAAAAc"]
[Sat Jul 18 23:33:44.847619 2026] [security2:error] [pid 897595:tid 897689] [remote 209.42.18.223:42656] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.18.42.209.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxhuOZhsBlduL7gIyy1jAAA8lw"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:33:44.850424 2026] [security2:error] [pid 897595:tid 897832] [client 185.192.71.220:35569] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/goods.php"] [unique_id "alxhuOZhsBlduL7gIyy1jQAAAO8"]
[Sat Jul 18 23:33:44.850706 2026] [security2:error] [pid 898098:tid 898323] [client 185.192.71.224:51241] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxhuERK6WUoKc-ijTGImQAAAFs"]
[Sat Jul 18 23:33:44.850714 2026] [security2:error] [pid 897595:tid 897851] [client 185.192.71.209:57427] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/txets.php"] [unique_id "alxhuOZhsBlduL7gIyy1jgAAAQI"]
[Sat Jul 18 23:33:44.852473 2026] [security2:error] [pid 898098:tid 898260] [client 185.192.71.217:35179] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/ioxi-o.php"] [unique_id "alxhuERK6WUoKc-ijTGImgAAABw"]
[Sat Jul 18 23:33:44.855931 2026] [security2:error] [pid 897595:tid 897773] [client 91.230.225.151:59221] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxhuOZhsBlduL7gIyy1jwAAALQ"]
[Sat Jul 18 23:33:44.859250 2026] [security2:error] [pid 898098:tid 898303] [client 91.230.225.156:51211] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/wp-includes/txets.php"] [unique_id "alxhuERK6WUoKc-ijTGImwAAAEc"]
[Sat Jul 18 23:33:44.918191 2026] [security2:error] [pid 897595:tid 897813] [client 185.92.25.135:34189] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/wp-includes/txets.php"] [unique_id "alxhuOZhsBlduL7gIyy1kwAAANw"]
[Sat Jul 18 23:33:45.112279 2026] [security2:error] [pid 898098:tid 898350] [client 91.230.225.163:20231] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/wp-includes/txets.php"] [unique_id "alxhuURK6WUoKc-ijTGIogAAAHY"]
[Sat Jul 18 23:33:45.131341 2026] [security2:error] [pid 898098:tid 898351] [client 173.239.196.160:45253] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/core-plugin/include.php"] [unique_id "alxhuURK6WUoKc-ijTGIpAAAAHc"]
[Sat Jul 18 23:33:45.236957 2026] [security2:error] [pid 897595:tid 897844] [client 43.153.80.190:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxhueZhsBlduL7gIyy1mgAA-10"], referer: https://www.aleishapenny.ca/listing/page/589?paged=1&view=grid&posts_per_page=48
[Sat Jul 18 23:33:45.562312 2026] [security2:error] [pid 897595:tid 897746] [client 185.192.71.218:57033] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/insc.php"] [unique_id "alxhueZhsBlduL7gIyy1qgAAAJk"]
[Sat Jul 18 23:33:45.568839 2026] [security2:error] [pid 898098:tid 898353] [client 91.230.225.156:50511] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/wp-admin/txets.php"] [unique_id "alxhuURK6WUoKc-ijTGIuQAAAHk"]
[Sat Jul 18 23:33:45.677787 2026] [security2:error] [pid 898098:tid 898257] [client 185.192.71.215:59041] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/goods.php"] [unique_id "alxhuURK6WUoKc-ijTGIvwAAABk"]
[Sat Jul 18 23:33:45.821505 2026] [security2:error] [pid 898098:tid 898322] [client 185.192.71.221:46423] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/wp-editor.php"] [unique_id "alxhuURK6WUoKc-ijTGIwgAAAFo"]
[Sat Jul 18 23:33:45.822185 2026] [security2:error] [pid 898098:tid 898316] [client 185.92.25.134:50201] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/wp-admin/txets.php"] [unique_id "alxhuURK6WUoKc-ijTGIwwAAAFQ"]
[Sat Jul 18 23:33:45.846182 2026] [security2:error] [pid 898098:tid 898287] [client 185.192.71.215:57663] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxhuURK6WUoKc-ijTGIxQAAADc"]
[Sat Jul 18 23:33:45.867838 2026] [security2:error] [pid 898098:tid 898292] [client 185.192.71.210:21291] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/goods.php"] [unique_id "alxhuURK6WUoKc-ijTGIxwAAADw"]
[Sat Jul 18 23:33:46.011208 2026] [security2:error] [pid 897595:tid 897787] [client 173.239.196.160:53919] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/envato-css.php"] [unique_id "alxhuuZhsBlduL7gIyy1tQAAAMI"]
[Sat Jul 18 23:33:46.068600 2026] [security2:error] [pid 897595:tid 897730] [client 185.192.71.221:26973] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/goods.php"] [unique_id "alxhuuZhsBlduL7gIyy1uwAAAIk"]
[Sat Jul 18 23:33:46.485617 2026] [security2:error] [pid 897595:tid 897728] [client 91.230.225.160:59383] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/classwithtostring.php"] [unique_id "alxhuuZhsBlduL7gIyy1ywAAAIc"]
[Sat Jul 18 23:33:46.542924 2026] [security2:error] [pid 898098:tid 898262] [client 91.230.225.150:62285] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/wp-includes/txets.php"] [unique_id "alxhukRK6WUoKc-ijTGI3wAAAB4"]
[Sat Jul 18 23:33:46.723043 2026] [security2:error] [pid 897595:tid 897808] [client 185.192.71.221:41833] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/wp-editor.php"] [unique_id "alxhuuZhsBlduL7gIyy11QAAANc"]
[Sat Jul 18 23:33:46.838976 2026] [proxy:error] [pid 898098:tid 898353] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:33:46.839041 2026] [proxy_http:error] [pid 898098:tid 898353] [client 45.91.189.98:39108] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:33:46.839454 2026] [proxy:error] [pid 898098:tid 898353] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:33:46.839481 2026] [proxy_http:error] [pid 898098:tid 898353] [client 45.91.189.98:39108] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:33:46.846565 2026] [security2:error] [pid 898098:tid 898356] [client 185.192.71.209:45337] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/lufix.php"] [unique_id "alxhukRK6WUoKc-ijTGI6AAAAHw"]
[Sat Jul 18 23:33:46.848761 2026] [security2:error] [pid 897595:tid 897733] [client 185.92.25.86:59453] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/wp-editor.php"] [unique_id "alxhuuZhsBlduL7gIyy12QAAAIw"]
[Sat Jul 18 23:33:46.854946 2026] [security2:error] [pid 897595:tid 897786] [client 91.230.225.155:26531] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/wp-includes/txets.php"] [unique_id "alxhuuZhsBlduL7gIyy12wAAAME"]
[Sat Jul 18 23:33:46.892472 2026] [security2:error] [pid 898098:tid 898339] [client 173.239.196.165:58539] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/classwithtostring.php"] [unique_id "alxhukRK6WUoKc-ijTGI6gAAAGs"]
[Sat Jul 18 23:33:46.977721 2026] [security2:error] [pid 898098:tid 898319] [client 91.230.225.152:58781] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/wp-editor.php"] [unique_id "alxhukRK6WUoKc-ijTGI7QAAAFc"]
[Sat Jul 18 23:33:46.978549 2026] [security2:error] [pid 898098:tid 898254] [client 91.230.225.159:65313] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/goods.php"] [unique_id "alxhukRK6WUoKc-ijTGI7gAAABY"]
[Sat Jul 18 23:33:47.213924 2026] [security2:error] [pid 897595:tid 897796] [client 185.92.25.89:56401] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/lufix.php"] [unique_id "alxhu-ZhsBlduL7gIyy14gAAAMs"]
[Sat Jul 18 23:33:47.685488 2026] [security2:error] [pid 898098:tid 898336] [client 185.192.71.218:60415] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.grecaalma.com"] [uri "/style.php"] [unique_id "alxhu0RK6WUoKc-ijTGJBwAAAGg"]
[Sat Jul 18 23:33:47.689699 2026] [security2:error] [pid 898098:tid 898351] [client 185.92.25.135:58429] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/lufix.php"] [unique_id "alxhu0RK6WUoKc-ijTGJCAAAAHc"]
[Sat Jul 18 23:33:47.735167 2026] [security2:error] [pid 898098:tid 898303] [client 3.64.55.230:42344] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.55.64.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxhu0RK6WUoKc-ijTGJCgAAAEc"]
[Sat Jul 18 23:33:47.735276 2026] [security2:error] [pid 898098:tid 898303] [client 3.64.55.230:42344] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxhu0RK6WUoKc-ijTGJCgAAAEc"]
[Sat Jul 18 23:33:47.785254 2026] [security2:error] [pid 898098:tid 898275] [client 185.192.71.225:40201] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/wp-admin/txets.php"] [unique_id "alxhu0RK6WUoKc-ijTGJEAAAACs"]
[Sat Jul 18 23:33:47.808398 2026] [security2:error] [pid 898098:tid 898125] [remote 20.153.140.50:46584] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxhu0RK6WUoKc-ijTGJEQAAMhc"]
[Sat Jul 18 23:33:47.808537 2026] [security2:error] [pid 898098:tid 898282] [client 20.153.140.50:46584] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxhu0RK6WUoKc-ijTGJEQAAMhc"]
[Sat Jul 18 23:33:47.822821 2026] [security2:error] [pid 898098:tid 898241] [client 185.92.25.85:64967] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/goods.php"] [unique_id "alxhu0RK6WUoKc-ijTGJFAAAAAk"]
[Sat Jul 18 23:33:48.106914 2026] [security2:error] [pid 898098:tid 898254] [client 185.92.25.82:59305] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/lufix.php"] [unique_id "alxhvERK6WUoKc-ijTGJHAAAABY"]
[Sat Jul 18 23:33:48.123574 2026] [security2:error] [pid 897595:tid 897802] [client 185.192.71.207:61481] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/txets.php"] [unique_id "alxhvOZhsBlduL7gIyy19wAAANE"]
[Sat Jul 18 23:33:48.234440 2026] [security2:error] [pid 898098:tid 898245] [client 173.239.196.165:22117] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/index/function.php"] [unique_id "alxhvERK6WUoKc-ijTGJJgAAAA0"]
[Sat Jul 18 23:33:48.262264 2026] [security2:error] [pid 898098:tid 898335] [client 185.192.71.206:25811] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.grecaalma.com"] [uri "/style.php"] [unique_id "alxhvERK6WUoKc-ijTGJKQAAAGc"]
[Sat Jul 18 23:33:48.316778 2026] [security2:error] [pid 898098:tid 898246] [client 185.92.25.92:25813] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/wp-editor.php"] [unique_id "alxhvERK6WUoKc-ijTGJLQAAAA4"]
[Sat Jul 18 23:33:48.698912 2026] [security2:error] [pid 898098:tid 898261] [client 185.92.25.83:41057] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/wp-editor.php"] [unique_id "alxhvERK6WUoKc-ijTGJNwAAAB0"]
[Sat Jul 18 23:33:48.705151 2026] [security2:error] [pid 898098:tid 898262] [client 91.230.225.158:50511] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/wp-includes/txets.php"] [unique_id "alxhvERK6WUoKc-ijTGJOAAAAB4"]
[Sat Jul 18 23:33:48.705151 2026] [security2:error] [pid 897595:tid 897810] [client 91.230.225.154:28163] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.grecaalma.com"] [uri "/style.php"] [unique_id "alxhvOZhsBlduL7gIyy2CAAAANk"]
[Sat Jul 18 23:33:48.775612 2026] [security2:error] [pid 898098:tid 898355] [client 163.61.1.17:64478] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhvERK6WUoKc-ijTGJOwAAAHs"]
[Sat Jul 18 23:33:48.777348 2026] [security2:error] [pid 898098:tid 898355] [client 163.61.1.17:64478] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhvERK6WUoKc-ijTGJOwAAAHs"]
[Sat Jul 18 23:33:48.931962 2026] [security2:error] [pid 897595:tid 897738] [client 185.192.71.213:20015] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.grecaalma.com"] [uri "/style.php"] [unique_id "alxhvOZhsBlduL7gIyy2DwAAAJE"]
[Sat Jul 18 23:33:48.943404 2026] [security2:error] [pid 898098:tid 898269] [client 185.192.71.223:61077] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/wp-content/themes/txets.php"] [unique_id "alxhvERK6WUoKc-ijTGJQQAAACU"]
[Sat Jul 18 23:33:49.075409 2026] [security2:error] [pid 898098:tid 898257] [client 91.230.225.153:34451] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/lufix.php"] [unique_id "alxhvURK6WUoKc-ijTGJRAAAABk"]
[Sat Jul 18 23:33:49.098186 2026] [security2:error] [pid 898098:tid 898298] [client 173.239.196.166:45047] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/tinyfilemanager.php"] [unique_id "alxhvURK6WUoKc-ijTGJRgAAAEI"]
[Sat Jul 18 23:33:49.349162 2026] [security2:error] [pid 897595:tid 897755] [client 91.230.225.157:58325] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/goods.php"] [unique_id "alxhveZhsBlduL7gIyy2FwAAAKI"]
[Sat Jul 18 23:33:49.443941 2026] [security2:error] [pid 898098:tid 898299] [client 190.245.146.99:50458] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhvURK6WUoKc-ijTGJUgAAAEM"]
[Sat Jul 18 23:33:49.444032 2026] [security2:error] [pid 898098:tid 898299] [client 190.245.146.99:50458] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhvURK6WUoKc-ijTGJUgAAAEM"]
[Sat Jul 18 23:33:49.670107 2026] [security2:error] [pid 898098:tid 898247] [client 91.230.225.152:33003] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/wp-admin/txets.php"] [unique_id "alxhvURK6WUoKc-ijTGJVAAAAA8"]
[Sat Jul 18 23:33:49.821471 2026] [security2:error] [pid 897595:tid 897729] [client 91.230.225.155:61855] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/wp-editor.php"] [unique_id "alxhveZhsBlduL7gIyy2KwAAAIg"]
[Sat Jul 18 23:33:49.919236 2026] [security2:error] [pid 898098:tid 898280] [client 185.192.71.212:54561] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/lufix.php"] [unique_id "alxhvURK6WUoKc-ijTGJWgAAADA"]
[Sat Jul 18 23:33:49.974384 2026] [security2:error] [pid 897595:tid 897844] [client 173.239.196.167:52125] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/js/bas.php"] [unique_id "alxhveZhsBlduL7gIyy2MgAAAPs"]
[Sat Jul 18 23:33:50.034488 2026] [security2:error] [pid 898098:tid 898336] [client 185.92.25.87:36709] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.grecaalma.com"] [uri "/style.php"] [unique_id "alxhvkRK6WUoKc-ijTGJXwAAAGg"]
[Sat Jul 18 23:33:50.357772 2026] [security2:error] [pid 897595:tid 897777] [client 91.230.225.164:62079] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/wp-includes/txets.php"] [unique_id "alxhvuZhsBlduL7gIyy2PQAAALg"]
[Sat Jul 18 23:33:50.405941 2026] [security2:error] [pid 898098:tid 898310] [client 138.252.89.100:65187] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhvkRK6WUoKc-ijTGJbwAAAE4"]
[Sat Jul 18 23:33:50.406048 2026] [security2:error] [pid 898098:tid 898310] [client 138.252.89.100:65187] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhvkRK6WUoKc-ijTGJbwAAAE4"]
[Sat Jul 18 23:33:50.633308 2026] [security2:error] [pid 897595:tid 897811] [client 185.92.25.89:55055] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.grecaalma.com"] [uri "/style.php"] [unique_id "alxhvuZhsBlduL7gIyy2RgAAANo"]
[Sat Jul 18 23:33:50.738770 2026] [security2:error] [pid 898098:tid 898286] [client 119.154.81.234:62707] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhvkRK6WUoKc-ijTGJeAAAADY"]
[Sat Jul 18 23:33:50.738922 2026] [security2:error] [pid 898098:tid 898286] [client 119.154.81.234:62707] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhvkRK6WUoKc-ijTGJeAAAADY"]
[Sat Jul 18 23:33:50.794402 2026] [security2:error] [pid 898098:tid 898309] [client 185.192.71.222:30973] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/lufix.php"] [unique_id "alxhvkRK6WUoKc-ijTGJegAAAE0"]
[Sat Jul 18 23:33:50.850214 2026] [security2:error] [pid 898098:tid 898316] [client 173.239.196.161:48925] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/pki-validation/moon.php"] [unique_id "alxhvkRK6WUoKc-ijTGJfwAAAFQ"]
[Sat Jul 18 23:33:50.918404 2026] [security2:error] [pid 897595:tid 897744] [client 185.92.25.88:29233] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/goods.php"] [unique_id "alxhvuZhsBlduL7gIyy2SwAAAJc"]
[Sat Jul 18 23:33:51.587440 2026] [security2:error] [pid 898098:tid 898238] [client 223.228.182.224:28405] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhv0RK6WUoKc-ijTGJoAAAAAY"]
[Sat Jul 18 23:33:51.587531 2026] [security2:error] [pid 898098:tid 898238] [client 223.228.182.224:28405] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhv0RK6WUoKc-ijTGJoAAAAAY"]
[Sat Jul 18 23:33:51.739584 2026] [security2:error] [pid 898098:tid 898257] [client 173.239.196.164:46933] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/file.php"] [unique_id "alxhv0RK6WUoKc-ijTGJoQAAABk"]
[Sat Jul 18 23:33:51.776673 2026] [security2:error] [pid 897595:tid 897849] [client 185.192.71.214:30419] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.grecaalma.com"] [uri "/style.php"] [unique_id "alxhv-ZhsBlduL7gIyy2XAAAAQA"]
[Sat Jul 18 23:33:52.026388 2026] [security2:error] [pid 898098:tid 898247] [client 185.192.71.210:58101] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/wp-editor.php"] [unique_id "alxhwERK6WUoKc-ijTGJrQAAAA8"]
[Sat Jul 18 23:33:52.589181 2026] [security2:error] [pid 898098:tid 898251] [client 13.232.206.133:16228] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.206.232.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cryptomeaning.com"] [uri "/xmlrpc.php"] [unique_id "alxhwERK6WUoKc-ijTGJwQAAABM"]
[Sat Jul 18 23:33:52.589289 2026] [security2:error] [pid 898098:tid 898251] [client 13.232.206.133:16228] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cryptomeaning.com"] [uri "/xmlrpc.php"] [unique_id "alxhwERK6WUoKc-ijTGJwQAAABM"]
[Sat Jul 18 23:33:52.632231 2026] [security2:error] [pid 897595:tid 897828] [client 173.239.196.164:25953] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/js/index.php"] [unique_id "alxhwOZhsBlduL7gIyy2bQAAAOs"]
[Sat Jul 18 23:33:52.653906 2026] [core:error] [pid 898098:tid 898269] [client 87.58.197.43:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:33:52.653930 2026] [core:error] [pid 898098:tid 898269] [client 87.58.197.43:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:33:52.686246 2026] [security2:error] [pid 898098:tid 898136] [remote 194.164.170.191:49482] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 191.170.164.194.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ksands.co.uk"] [uri "/wp-login.php"] [unique_id "alxhwERK6WUoKc-ijTGJygAAHSI"]
[Sat Jul 18 23:33:52.828128 2026] [security2:error] [pid 898098:tid 898103] [remote 113.160.142.119:45764] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "worbals.com"] [uri "/wp-login.php"] [unique_id "alxhwERK6WUoKc-ijTGJ0AAAPAE"]
[Sat Jul 18 23:33:52.905200 2026] [security2:error] [pid 898098:tid 898161] [remote 194.164.170.191:49482] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 191.170.164.194.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ksands.co.uk"] [uri "/wp-login.php"] [unique_id "alxhwERK6WUoKc-ijTGJ1wAAZTs"], referer: https://ksands.co.uk/wp-login.php
[Sat Jul 18 23:33:53.006405 2026] [security2:error] [pid 898098:tid 898288] [client 185.92.25.83:29239] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/lufix.php"] [unique_id "alxhwURK6WUoKc-ijTGJ2wAAADg"]
[Sat Jul 18 23:33:53.184850 2026] [security2:error] [pid 897595:tid 897839] [client 3.109.49.224:11436] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "200"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxhwOZhsBlduL7gIyy2aQAAAPY"]
[Sat Jul 18 23:33:53.327372 2026] [security2:error] [pid 898098:tid 898210] [remote 113.160.142.119:45764] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "worbals.com"] [uri "/wp-login.php"] [unique_id "alxhwURK6WUoKc-ijTGJ6AAAd2s"], referer: https://worbals.com/wp-login.php
[Sat Jul 18 23:33:53.420103 2026] [security2:error] [pid 898098:tid 898249] [client 57.141.18.113:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxhwURK6WUoKc-ijTGJ5AAAABE"]
[Sat Jul 18 23:33:53.475693 2026] [security2:error] [pid 898098:tid 898322] [client 106.222.249.209:16134] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhwURK6WUoKc-ijTGJ8wAAAFo"]
[Sat Jul 18 23:33:53.475835 2026] [security2:error] [pid 898098:tid 898322] [client 106.222.249.209:16134] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhwURK6WUoKc-ijTGJ8wAAAFo"]
[Sat Jul 18 23:33:53.531529 2026] [security2:error] [pid 898098:tid 898310] [client 173.239.196.160:45993] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/upgrade/item.php"] [unique_id "alxhwURK6WUoKc-ijTGJ9QAAAE4"]
[Sat Jul 18 23:33:54.410937 2026] [security2:error] [pid 898098:tid 898282] [client 185.92.25.81:48137] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "grecaalma.com"] [uri "/style.php"] [unique_id "alxhwkRK6WUoKc-ijTGKIgAAADI"]
[Sat Jul 18 23:33:54.412980 2026] [security2:error] [pid 898098:tid 898271] [client 173.239.196.165:38147] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/buy.php"] [unique_id "alxhwkRK6WUoKc-ijTGKIwAAACc"]
[Sat Jul 18 23:33:55.288314 2026] [security2:error] [pid 898098:tid 898321] [client 173.239.196.167:33321] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/languages/wp-conflg.php"] [unique_id "alxhw0RK6WUoKc-ijTGKVAAAAFk"]
[Sat Jul 18 23:33:55.404021 2026] [autoindex:error] [pid 898098:tid 898274] [client 188.166.170.146:0] AH01276: Cannot serve directory /home3/varmathc/public_html/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:33:55.529030 2026] [security2:error] [pid 898098:tid 898309] [client 152.42.242.202:64221] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "olearyplumbingllc.com"] [uri "/"] [unique_id "alxhw0RK6WUoKc-ijTGKZgAAAE0"]
[Sat Jul 18 23:33:56.128597 2026] [security2:error] [pid 898098:tid 898305] [client 173.239.196.166:29037] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/classwithtostring.php"] [unique_id "alxhxERK6WUoKc-ijTGKgAAAAEk"]
[Sat Jul 18 23:33:56.315861 2026] [security2:error] [pid 898098:tid 898267] [client 62.45.36.212:40300] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxhxERK6WUoKc-ijTGKgQAAACM"]
[Sat Jul 18 23:33:56.734825 2026] [security2:error] [pid 898098:tid 898140] [remote 167.71.132.111:55944] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.132.71.167.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxhxERK6WUoKc-ijTGKlgAACiY"]
[Sat Jul 18 23:33:56.917420 2026] [security2:error] [pid 898098:tid 898207] [remote 167.71.132.111:55944] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.132.71.167.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxhxERK6WUoKc-ijTGKnQAAAGg"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:33:56.977814 2026] [security2:error] [pid 898098:tid 898289] [client 173.239.196.165:48169] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/elementor/wp-wjvngrh.php"] [unique_id "alxhxERK6WUoKc-ijTGKngAAADk"]
[Sat Jul 18 23:33:57.139333 2026] [security2:error] [pid 898098:tid 898125] [remote 152.228.213.32:57512] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/wp-login.php"] [unique_id "alxhxURK6WUoKc-ijTGKpQAAKRc"]
[Sat Jul 18 23:33:57.340933 2026] [security2:error] [pid 898098:tid 898147] [remote 152.228.213.32:57512] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/wp-login.php"] [unique_id "alxhxURK6WUoKc-ijTGKqwAABC0"], referer: https://youpositive.co/wp-login.php
[Sat Jul 18 23:33:57.844044 2026] [security2:error] [pid 898098:tid 898262] [client 173.239.196.165:29221] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/IXR/fix.php7"] [unique_id "alxhxURK6WUoKc-ijTGKyQAAAB4"]
[Sat Jul 18 23:33:58.165728 2026] [security2:error] [pid 898098:tid 898302] [client 50.116.65.227:41070] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.fkconstructionfunding.com"] [uri "/wp-content/plugins/contact-form-7/includes/css/styles.css"] [unique_id "alxhxkRK6WUoKc-ijTGK2gAAAEY"]
[Sat Jul 18 23:33:58.177729 2026] [security2:error] [pid 898098:tid 898278] [client 50.116.65.227:41072] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.fkconstructionfunding.com"] [uri "/wp-content/plugins/contact-form-7/includes/css/styles-rtl.css"] [unique_id "alxhxkRK6WUoKc-ijTGK3AAAAC4"]
[Sat Jul 18 23:33:58.554705 2026] [security2:error] [pid 898098:tid 898339] [client 63.179.105.113:16686] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.105.179.63.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxhxkRK6WUoKc-ijTGK8AAAAGs"]
[Sat Jul 18 23:33:58.554833 2026] [security2:error] [pid 898098:tid 898339] [client 63.179.105.113:16686] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxhxkRK6WUoKc-ijTGK8AAAAGs"]
[Sat Jul 18 23:33:58.686439 2026] [security2:error] [pid 898098:tid 898295] [client 173.239.196.165:33591] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "alxhxkRK6WUoKc-ijTGK_AAAAD8"]
[Sat Jul 18 23:33:58.712385 2026] [security2:error] [pid 898098:tid 898269] [client 50.116.65.227:41092] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.fkconstructionfunding.com"] [uri "/index.php"] [unique_id "alxhxkRK6WUoKc-ijTGK8QAAACU"]
[Sat Jul 18 23:33:58.890286 2026] [security2:error] [pid 898098:tid 898301] [client 50.116.65.227:41100] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.fkconstructionfunding.com"] [uri "/index.php"] [unique_id "alxhxkRK6WUoKc-ijTGLAQAAAEU"]
[Sat Jul 18 23:33:59.150113 2026] [security2:error] [pid 898098:tid 898326] [client 103.100.176.212:33913] ModSecurity: Access denied with code 406 (phase 1). Pattern match "python-requests|python-urllib" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "1460"] [id "909111"] [msg "Python UA brute"] [hostname "mtlegnews.gov"] [uri "/"] [unique_id "alxhx0RK6WUoKc-ijTGLHgAAAF4"]
[Sat Jul 18 23:33:59.167568 2026] [security2:error] [pid 898098:tid 898298] [client 103.100.176.212:45863] ModSecurity: Access denied with code 406 (phase 1). Pattern match "python-requests|python-urllib" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "1460"] [id "909111"] [msg "Python UA brute"] [hostname "mtredistricting.gov"] [uri "/"] [unique_id "alxhx0RK6WUoKc-ijTGLIQAAAEI"]
[Sat Jul 18 23:33:59.346682 2026] [security2:error] [pid 897595:tid 897782] [client 163.61.1.17:64949] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhx-ZhsBlduL7gIyy21AAAAL0"]
[Sat Jul 18 23:33:59.346799 2026] [security2:error] [pid 897595:tid 897782] [client 163.61.1.17:64949] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxhx-ZhsBlduL7gIyy21AAAAL0"]
[Sat Jul 18 23:33:59.525173 2026] [security2:error] [pid 898098:tid 898358] [client 173.239.196.163:52771] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/admin/function.php"] [unique_id "alxhx0RK6WUoKc-ijTGLOAAAAH4"]
[Sat Jul 18 23:33:59.985926 2026] [security2:error] [pid 898098:tid 898266] [client 190.245.146.99:50983] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhx0RK6WUoKc-ijTGLTAAAACI"]
[Sat Jul 18 23:33:59.986030 2026] [security2:error] [pid 898098:tid 898266] [client 190.245.146.99:50983] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxhx0RK6WUoKc-ijTGLTAAAACI"]
[Sat Jul 18 23:34:00.394174 2026] [security2:error] [pid 897595:tid 897822] [client 173.239.196.161:28835] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "alxhyOZhsBlduL7gIyy26AAAAOU"]
[Sat Jul 18 23:34:01.087642 2026] [security2:error] [pid 897595:tid 897768] [client 103.100.176.212:39925] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "mtredistricting.gov"] [uri "/"] [unique_id "alxhyeZhsBlduL7gIyy2-wAAAK8"]
[Sat Jul 18 23:34:01.246130 2026] [security2:error] [pid 897595:tid 897754] [client 173.239.196.166:40887] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "alxhyeZhsBlduL7gIyy3AAAAAKE"]
[Sat Jul 18 23:34:01.259774 2026] [security2:error] [pid 898098:tid 898276] [client 103.100.176.212:41505] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "mtlegnews.gov"] [uri "/"] [unique_id "alxhyURK6WUoKc-ijTGLfwAAACw"]
[Sat Jul 18 23:34:01.531853 2026] [security2:error] [pid 898098:tid 898275] [client 119.154.81.234:63175] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhyURK6WUoKc-ijTGLigAAACs"]
[Sat Jul 18 23:34:01.531947 2026] [security2:error] [pid 898098:tid 898275] [client 119.154.81.234:63175] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxhyURK6WUoKc-ijTGLigAAACs"]
[Sat Jul 18 23:34:01.972670 2026] [security2:error] [pid 898098:tid 898308] [client 138.252.89.100:49290] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhyURK6WUoKc-ijTGLmQAAAEw"]
[Sat Jul 18 23:34:01.972777 2026] [security2:error] [pid 898098:tid 898308] [client 138.252.89.100:49290] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxhyURK6WUoKc-ijTGLmQAAAEw"]
[Sat Jul 18 23:34:02.098945 2026] [security2:error] [pid 897595:tid 897626] [remote 144.76.61.188:36018] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 188.61.76.144.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxhyuZhsBlduL7gIyy3CAABAx0"]
[Sat Jul 18 23:34:02.099601 2026] [security2:error] [pid 898098:tid 898344] [client 173.239.196.164:58253] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "alxhykRK6WUoKc-ijTGLogAAAHA"]
[Sat Jul 18 23:34:02.320710 2026] [security2:error] [pid 898098:tid 898240] [client 40.77.177.58:21572] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "vfcthomasville.org"] [uri "/index.php"] [unique_id "alxhykRK6WUoKc-ijTGLrQAACGQ"]
[Sat Jul 18 23:34:02.326414 2026] [security2:error] [pid 897595:tid 897649] [remote 144.76.61.188:36018] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 188.61.76.144.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxhyuZhsBlduL7gIyy3FAAA5jQ"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:34:02.629050 2026] [security2:error] [pid 898098:tid 898241] [client 223.228.182.224:49202] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhykRK6WUoKc-ijTGLvAAAAAk"]
[Sat Jul 18 23:34:02.633208 2026] [security2:error] [pid 898098:tid 898241] [client 223.228.182.224:49202] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxhykRK6WUoKc-ijTGLvAAAAAk"]
[Sat Jul 18 23:34:02.964373 2026] [security2:error] [pid 898098:tid 898317] [client 173.239.196.161:56693] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "alxhykRK6WUoKc-ijTGLywAAAFU"]
[Sat Jul 18 23:34:03.884156 2026] [security2:error] [pid 898098:tid 898280] [client 173.239.196.167:35543] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "alxhy0RK6WUoKc-ijTGL8gAAADA"]
[Sat Jul 18 23:34:03.935709 2026] [security2:error] [pid 898098:tid 898162] [remote 31.42.184.154:57762] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxhy0RK6WUoKc-ijTGL-AAAKTw"]
[Sat Jul 18 23:34:04.179258 2026] [security2:error] [pid 898098:tid 898179] [remote 31.42.184.154:57762] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxhzERK6WUoKc-ijTGMAwAANkw"], referer: https://mezzacraft.com/wp-login.php
[Sat Jul 18 23:34:04.194675 2026] [security2:error] [pid 898098:tid 898310] [client 106.222.249.209:15833] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhzERK6WUoKc-ijTGMBAAAAE4"]
[Sat Jul 18 23:34:04.194773 2026] [security2:error] [pid 898098:tid 898310] [client 106.222.249.209:15833] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxhzERK6WUoKc-ijTGMBAAAAE4"]
[Sat Jul 18 23:34:04.762862 2026] [security2:error] [pid 897595:tid 897799] [client 173.239.196.166:40645] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/files/index.php"] [unique_id "alxhzOZhsBlduL7gIyy3PAAAAM4"]
[Sat Jul 18 23:34:05.648392 2026] [security2:error] [pid 898098:tid 898358] [client 173.239.196.164:57309] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "alxhzURK6WUoKc-ijTGMQgAAAH4"]
[Sat Jul 18 23:34:05.869404 2026] [security2:error] [pid 898098:tid 898301] [client 50.116.65.227:21798] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "lifeisbetterlakeside.com"] [uri "/wp-content/uploads/2025/02/IMG_9124.jpeg"] [unique_id "alxhzURK6WUoKc-ijTGMUgAAAAs"]
[Sat Jul 18 23:34:05.900398 2026] [security2:error] [pid 898098:tid 898268] [client 50.116.65.227:21814] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.fkconstructionfunding.com"] [uri "/wp-content/plugins/contact-form-7/includes/css/styles.css"] [unique_id "alxhzURK6WUoKc-ijTGMVQAAACQ"]
[Sat Jul 18 23:34:05.909403 2026] [security2:error] [pid 898098:tid 898339] [client 50.116.65.227:21820] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.fkconstructionfunding.com"] [uri "/wp-content/plugins/contact-form-7/includes/css/styles-rtl.css"] [unique_id "alxhzURK6WUoKc-ijTGMVwAAAGs"]
[Sat Jul 18 23:34:06.504712 2026] [security2:error] [pid 898098:tid 898239] [client 173.239.196.166:41793] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/inc.php"] [unique_id "alxhzkRK6WUoKc-ijTGMdAAAAAc"]
[Sat Jul 18 23:34:06.605414 2026] [security2:error] [pid 898098:tid 898357] [client 3.108.60.216:39324] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxhzkRK6WUoKc-ijTGMdwAAAH0"]
[Sat Jul 18 23:34:06.923954 2026] [security2:error] [pid 898098:tid 898232] [client 57.141.18.26:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxhzkRK6WUoKc-ijTGMfgAAAAA"]
[Sat Jul 18 23:34:07.170694 2026] [security2:error] [pid 898098:tid 898211] [remote 97.74.93.24:51502] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxhz0RK6WUoKc-ijTGMmwAAamw"]
[Sat Jul 18 23:34:07.381096 2026] [security2:error] [pid 898098:tid 898236] [client 173.239.196.163:46631] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/index.php"] [unique_id "alxhz0RK6WUoKc-ijTGMoQAAAAQ"]
[Sat Jul 18 23:34:07.603312 2026] [security2:error] [pid 898098:tid 898143] [remote 97.74.93.24:51502] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxhz0RK6WUoKc-ijTGMqwAABik"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:34:07.624953 2026] [security2:error] [pid 898098:tid 898218] [remote 20.153.140.50:44340] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxhz0RK6WUoKc-ijTGMrwAAZXM"]
[Sat Jul 18 23:34:08.063373 2026] [security2:error] [pid 898098:tid 898225] [remote 20.153.140.50:44340] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxh0ERK6WUoKc-ijTGMwwAAAHo"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:34:08.253231 2026] [security2:error] [pid 898098:tid 898353] [client 173.239.196.160:51645] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/filemanager.php"] [unique_id "alxh0ERK6WUoKc-ijTGMzAAAAHk"]
[Sat Jul 18 23:34:08.473052 2026] [access_compat:error] [pid 897595:tid 897729] [client 66.198.240.43:0] AH01797: client denied by server configuration: /home1/deltattw/public_html/wp-cron.php
[Sat Jul 18 23:34:08.677190 2026] [security2:error] [pid 898098:tid 898351] [client 103.221.67.241:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.maxenengineering.com"] [uri "/maxenengineering/index.php"] [unique_id "alxhzkRK6WUoKc-ijTGMiwAAAHc"]
[Sat Jul 18 23:34:09.158872 2026] [security2:error] [pid 898098:tid 898321] [client 173.239.196.161:63927] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/cgi-bin/bypass.php"] [unique_id "alxh0URK6WUoKc-ijTGM8AAAAFk"]
[Sat Jul 18 23:34:09.273824 2026] [security2:error] [pid 898098:tid 898243] [client 74.208.214.194:47136] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxh0URK6WUoKc-ijTGM9wAAAAs"]
[Sat Jul 18 23:34:09.481235 2026] [security2:error] [pid 898098:tid 898226] [remote 168.138.197.172:58208] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 172.197.138.168.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxh0URK6WUoKc-ijTGM_AAAFHs"]
[Sat Jul 18 23:34:09.840179 2026] [security2:error] [pid 897595:tid 897826] [client 163.61.1.17:65427] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxh0eZhsBlduL7gIyy3nAAAAOk"]
[Sat Jul 18 23:34:09.840305 2026] [security2:error] [pid 897595:tid 897826] [client 163.61.1.17:65427] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxh0eZhsBlduL7gIyy3nAAAAOk"]
[Sat Jul 18 23:34:09.960992 2026] [security2:error] [pid 898098:tid 898254] [client 37.139.53.80:49715] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.53.139.37.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "faadenergy.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxh0URK6WUoKc-ijTGNCwAAABY"], referer: https://faadenergy.com/?page_id=30
[Sat Jul 18 23:34:10.033883 2026] [security2:error] [pid 898098:tid 898155] [remote 168.138.197.172:58208] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 172.197.138.168.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxh0kRK6WUoKc-ijTGNDQAAMTU"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:34:10.049413 2026] [security2:error] [pid 898098:tid 898315] [client 173.239.196.160:25629] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/pki-validation/admin.php"] [unique_id "alxh0kRK6WUoKc-ijTGNDwAAAFM"]
[Sat Jul 18 23:34:10.426599 2026] [security2:error] [pid 898098:tid 898267] [client 3.109.49.224:42686] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "155"] [id "900406"] [msg "wp-login POST logging"] [data "200"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxh0URK6WUoKc-ijTGNBgAAACM"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:34:10.462537 2026] [security2:error] [pid 898098:tid 898349] [client 190.245.146.99:51508] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxh0kRK6WUoKc-ijTGNHwAAAHU"]
[Sat Jul 18 23:34:10.462622 2026] [security2:error] [pid 898098:tid 898349] [client 190.245.146.99:51508] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxh0kRK6WUoKc-ijTGNHwAAAHU"]
[Sat Jul 18 23:34:10.517725 2026] [security2:error] [pid 898098:tid 898166] [remote 54.64.35.240:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.35.64.54.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "premiumoverhead.com"] [uri "/xmlrpc.php"] [unique_id "alxh0kRK6WUoKc-ijTGNIQAAZ0A"]
[Sat Jul 18 23:34:10.517861 2026] [security2:error] [pid 898098:tid 898335] [client 54.64.35.240:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "premiumoverhead.com"] [uri "/xmlrpc.php"] [unique_id "alxh0kRK6WUoKc-ijTGNIQAAZ0A"]
[Sat Jul 18 23:34:10.909490 2026] [security2:error] [pid 897595:tid 897839] [client 173.239.196.161:53753] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/IXR/admin.php"] [unique_id "alxh0uZhsBlduL7gIyy3swAAAPY"]
[Sat Jul 18 23:34:11.789807 2026] [security2:error] [pid 898098:tid 898345] [client 173.239.196.165:45081] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/js/index.php"] [unique_id "alxh00RK6WUoKc-ijTGNYAAAAHE"]
[Sat Jul 18 23:34:12.053471 2026] [security2:error] [pid 898098:tid 898169] [remote 20.153.140.50:43548] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxh1ERK6WUoKc-ijTGNaAAANEM"]
[Sat Jul 18 23:34:12.283640 2026] [security2:error] [pid 897595:tid 897852] [client 136.64.169.133:6492] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "fluidtemple.org"] [uri "/"] [unique_id "alxh1OZhsBlduL7gIyy36QAAAQM"]
[Sat Jul 18 23:34:12.329404 2026] [security2:error] [pid 897595:tid 897785] [client 119.154.81.234:63646] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxh1OZhsBlduL7gIyy36gAAAMA"]
[Sat Jul 18 23:34:12.329533 2026] [security2:error] [pid 897595:tid 897785] [client 119.154.81.234:63646] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxh1OZhsBlduL7gIyy36gAAAMA"]
[Sat Jul 18 23:34:12.458302 2026] [security2:error] [pid 898098:tid 898156] [remote 20.153.140.50:43548] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxh1ERK6WUoKc-ijTGNewAAdzY"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:34:12.646379 2026] [security2:error] [pid 898098:tid 898272] [client 173.239.196.166:35853] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "alxh1ERK6WUoKc-ijTGNfwAAACg"]
[Sat Jul 18 23:34:13.520405 2026] [security2:error] [pid 898098:tid 898356] [client 136.158.33.23:62429] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "collectingrealestate.com"] [uri "/index.php"] [unique_id "alxh1URK6WUoKc-ijTGNpgAAAHw"]
[Sat Jul 18 23:34:13.540486 2026] [security2:error] [pid 898098:tid 898281] [client 173.239.196.165:49603] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/function.php"] [unique_id "alxh1URK6WUoKc-ijTGNqgAAADE"]
[Sat Jul 18 23:34:13.543064 2026] [security2:error] [pid 898098:tid 898269] [client 223.228.182.224:11233] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxh1URK6WUoKc-ijTGNqwAAACU"]
[Sat Jul 18 23:34:13.547272 2026] [security2:error] [pid 898098:tid 898269] [client 223.228.182.224:11233] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxh1URK6WUoKc-ijTGNqwAAACU"]
[Sat Jul 18 23:34:13.606779 2026] [security2:error] [pid 898098:tid 898249] [client 138.252.89.100:49853] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxh1URK6WUoKc-ijTGNrwAAABE"]
[Sat Jul 18 23:34:13.607547 2026] [security2:error] [pid 898098:tid 898249] [client 138.252.89.100:49853] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxh1URK6WUoKc-ijTGNrwAAABE"]
[Sat Jul 18 23:34:13.639862 2026] [proxy:error] [pid 898098:tid 898264] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:34:13.639925 2026] [proxy_http:error] [pid 898098:tid 898264] [client 193.47.62.168:54032] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:34:13.640337 2026] [proxy:error] [pid 898098:tid 898264] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:34:13.640359 2026] [proxy_http:error] [pid 898098:tid 898264] [client 193.47.62.168:54032] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:34:14.281143 2026] [security2:error] [pid 898098:tid 898224] [remote 31.42.184.154:44826] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "website-3c1c9eb1.nextlvlmarketingco.com"] [uri "/wp-login.php"] [unique_id "alxh1kRK6WUoKc-ijTGNzAAAcHk"]
[Sat Jul 18 23:34:14.387634 2026] [security2:error] [pid 898098:tid 898321] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxh1kRK6WUoKc-ijTGNygAAAFk"]
[Sat Jul 18 23:34:14.429074 2026] [security2:error] [pid 897595:tid 897750] [client 173.239.196.167:63911] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "alxh1uZhsBlduL7gIyy4JwAAAJ0"]
[Sat Jul 18 23:34:14.527617 2026] [security2:error] [pid 898098:tid 898229] [remote 31.42.184.154:44826] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "website-3c1c9eb1.nextlvlmarketingco.com"] [uri "/wp-login.php"] [unique_id "alxh1kRK6WUoKc-ijTGN2AAAYn4"], referer: https://website-3c1c9eb1.nextlvlmarketingco.com/wp-login.php
[Sat Jul 18 23:34:14.759724 2026] [security2:error] [pid 898098:tid 898339] [client 106.222.249.209:9690] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxh1kRK6WUoKc-ijTGN4QAAAGs"]
[Sat Jul 18 23:34:14.759927 2026] [security2:error] [pid 898098:tid 898339] [client 106.222.249.209:9690] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxh1kRK6WUoKc-ijTGN4QAAAGs"]
[Sat Jul 18 23:34:14.794122 2026] [security2:error] [pid 897595:tid 897790] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxh1uZhsBlduL7gIyy4MwAAAMU"]
[Sat Jul 18 23:34:15.015234 2026] [security2:error] [pid 898098:tid 898214] [remote 31.42.184.154:44830] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "processorstudio.com"] [uri "/wp-login.php"] [unique_id "alxh10RK6WUoKc-ijTGN5wAAb28"]
[Sat Jul 18 23:34:15.165634 2026] [security2:error] [pid 898098:tid 898298] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxh10RK6WUoKc-ijTGN6wAAAEI"]
[Sat Jul 18 23:34:15.184194 2026] [security2:error] [pid 897595:tid 897710] [remote 41.186.86.12:62866] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/wp-login.php"] [unique_id "alxh1-ZhsBlduL7gIyy4XgAA_XE"]
[Sat Jul 18 23:34:15.258081 2026] [security2:error] [pid 898098:tid 898209] [remote 31.42.184.154:44830] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "processorstudio.com"] [uri "/wp-login.php"] [unique_id "alxh10RK6WUoKc-ijTGN_AAAP2o"], referer: https://processorstudio.com/wp-login.php
[Sat Jul 18 23:34:15.329811 2026] [security2:error] [pid 898098:tid 898317] [client 173.239.196.161:42103] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-signup.php"] [unique_id "alxh10RK6WUoKc-ijTGOAwAAAFU"]
[Sat Jul 18 23:34:15.672972 2026] [security2:error] [pid 897595:tid 897723] [remote 41.186.86.12:62866] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/wp-login.php"] [unique_id "alxh1-ZhsBlduL7gIyy4bAAA8H4"], referer: https://nevelow.com/wp-login.php
[Sat Jul 18 23:34:16.026258 2026] [ssl:error] [pid 897595:tid 897791] [client 3.233.59.216:6216] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname webdisk.rhg.qtb.mybluehost.me provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:34:16.745121 2026] [security2:error] [pid 897595:tid 897612] [remote 41.76.213.235:34666] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxh2OZhsBlduL7gIyy4jgAAhg8"]
[Sat Jul 18 23:34:16.893227 2026] [security2:error] [pid 898098:tid 898268] [client 190.49.10.191:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.thescarystory.com"] [uri "/index.php"] [unique_id "alxh2ERK6WUoKc-ijTGOMwAAACQ"]
[Sat Jul 18 23:34:16.993129 2026] [security2:error] [pid 897595:tid 897738] [client 136.64.169.133:6492] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "fluidtemple.org"] [uri "/index.php"] [unique_id "alxh1OZhsBlduL7gIyy38wAAAJE"], referer: http://fluidtemple.org/wp-json/batch/v1
[Sat Jul 18 23:34:17.195078 2026] [security2:error] [pid 898098:tid 898333] [client 173.239.196.165:20921] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/network/network.php"] [unique_id "alxh2URK6WUoKc-ijTGOUAAAAGU"]
[Sat Jul 18 23:34:17.319335 2026] [security2:error] [pid 897595:tid 897721] [remote 41.76.213.235:34666] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxh2eZhsBlduL7gIyy4nAAAtHw"], referer: https://mezzacraft.com/wp-login.php
[Sat Jul 18 23:34:17.552455 2026] [security2:error] [pid 898098:tid 898257] [client 190.49.10.191:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.thescarystory.com"] [uri "/index.php"] [unique_id "alxh2URK6WUoKc-ijTGOWAAAABk"]
[Sat Jul 18 23:34:18.051887 2026] [security2:error] [pid 898098:tid 898235] [client 173.239.196.161:44395] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/admin/upload/css.php"] [unique_id "alxh2kRK6WUoKc-ijTGObQAAAAM"]
[Sat Jul 18 23:34:18.705115 2026] [security2:error] [pid 897595:tid 897763] [client 57.141.18.103:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxh2uZhsBlduL7gIyy4vgAAAKo"]
[Sat Jul 18 23:34:18.939312 2026] [security2:error] [pid 898098:tid 898270] [client 173.239.196.162:51661] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-blog.php"] [unique_id "alxh2kRK6WUoKc-ijTGOlwAAACY"]
[Sat Jul 18 23:34:19.085280 2026] [security2:error] [pid 898098:tid 898286] [client 34.91.213.89:49152] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "www.zyy.eeo.mybluehost.me"] [uri "/"] [unique_id "alxh20RK6WUoKc-ijTGOnwAAADY"]
[Sat Jul 18 23:34:19.085348 2026] [security2:error] [pid 898098:tid 898286] [client 34.91.213.89:49152] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "www.zyy.eeo.mybluehost.me"] [uri "/"] [unique_id "alxh20RK6WUoKc-ijTGOnwAAADY"]
[Sat Jul 18 23:34:19.792729 2026] [security2:error] [pid 898098:tid 898177] [remote 134.209.147.209:47562] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.147.209.134.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.idf.ldc.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxh20RK6WUoKc-ijTGOwwAAcEo"]
[Sat Jul 18 23:34:19.792940 2026] [security2:error] [pid 898098:tid 898344] [client 134.209.147.209:47562] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "mail.idf.ldc.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxh20RK6WUoKc-ijTGOwwAAcEo"]
[Sat Jul 18 23:34:19.862631 2026] [security2:error] [pid 898098:tid 898346] [client 173.239.196.166:65155] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/file.php"] [unique_id "alxh20RK6WUoKc-ijTGOyQAAAHI"]
[Sat Jul 18 23:34:19.863277 2026] [security2:error] [pid 898098:tid 898256] [client 74.7.227.179:52578] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxh20RK6WUoKc-ijTGOwQAAGFo"], referer: https://tejasenvironmental.com/p=125187
[Sat Jul 18 23:34:20.335283 2026] [security2:error] [pid 898098:tid 898281] [client 163.61.1.17:49515] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxh3ERK6WUoKc-ijTGO4AAAADE"]
[Sat Jul 18 23:34:20.337101 2026] [security2:error] [pid 898098:tid 898281] [client 163.61.1.17:49515] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxh3ERK6WUoKc-ijTGO4AAAADE"]
[Sat Jul 18 23:34:20.612216 2026] [security2:error] [pid 898098:tid 898251] [client 148.103.124.115:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "areitoproducciones.com"] [uri "/index.php"] [unique_id "alxh2kRK6WUoKc-ijTGOmAAAABM"], referer: https://areitoproducciones.com/librerias-samples-loops/ritmo-merengue/merengue/
[Sat Jul 18 23:34:20.745887 2026] [security2:error] [pid 898098:tid 898241] [client 173.239.196.165:64747] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/admin.php"] [unique_id "alxh3ERK6WUoKc-ijTGO7AAAAAk"]
[Sat Jul 18 23:34:20.779831 2026] [security2:error] [pid 897595:tid 897789] [client 65.0.26.70:19934] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.26.0.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxh3OZhsBlduL7gIyy46QAAAMQ"]
[Sat Jul 18 23:34:20.928725 2026] [security2:error] [pid 898098:tid 898302] [client 190.245.146.99:52025] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxh3ERK6WUoKc-ijTGO9QAAAEY"]
[Sat Jul 18 23:34:20.928833 2026] [security2:error] [pid 898098:tid 898302] [client 190.245.146.99:52025] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxh3ERK6WUoKc-ijTGO9QAAAEY"]
[Sat Jul 18 23:34:21.636148 2026] [security2:error] [pid 898098:tid 898357] [client 173.239.196.163:56749] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "alxh3URK6WUoKc-ijTGPFwAAAH0"]
[Sat Jul 18 23:34:21.822811 2026] [security2:error] [pid 898098:tid 898295] [client 45.61.187.50:59524] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.187.61.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.coachpops.org"] [uri "/wp-login.php"] [unique_id "alxh3URK6WUoKc-ijTGPIwAAAD8"]
[Sat Jul 18 23:34:21.926898 2026] [security2:error] [pid 898098:tid 898301] [client 34.90.69.83:49152] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "cpcontacts.vip.mhv.mybluehost.me"] [uri "/"] [unique_id "alxh3URK6WUoKc-ijTGPJgAAAEU"]
[Sat Jul 18 23:34:21.926981 2026] [security2:error] [pid 898098:tid 898301] [client 34.90.69.83:49152] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "cpcontacts.vip.mhv.mybluehost.me"] [uri "/"] [unique_id "alxh3URK6WUoKc-ijTGPJgAAAEU"]
[Sat Jul 18 23:34:21.961352 2026] [security2:error] [pid 897595:tid 897795] [client 65.0.26.70:19950] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.26.0.65.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxh3eZhsBlduL7gIyy5AgAAAMo"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:34:22.201310 2026] [security2:error] [pid 897595:tid 897651] [remote 97.74.93.24:50066] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxh3uZhsBlduL7gIyy5BwAApDY"]
[Sat Jul 18 23:34:22.553367 2026] [security2:error] [pid 898098:tid 898268] [client 173.239.196.160:31349] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-l0gin.php"] [unique_id "alxh3kRK6WUoKc-ijTGPOAAAACQ"]
[Sat Jul 18 23:34:22.607361 2026] [security2:error] [pid 897595:tid 897640] [remote 97.74.93.24:50066] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxh3uZhsBlduL7gIyy5CwAA4Ss"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:34:23.035298 2026] [security2:error] [pid 898098:tid 898351] [client 119.154.81.234:64111] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxh30RK6WUoKc-ijTGPSAAAAHc"]
[Sat Jul 18 23:34:23.035407 2026] [security2:error] [pid 898098:tid 898351] [client 119.154.81.234:64111] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxh30RK6WUoKc-ijTGPSAAAAHc"]
[Sat Jul 18 23:34:23.408771 2026] [proxy:error] [pid 898098:tid 898339] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:34:23.408853 2026] [proxy_http:error] [pid 898098:tid 898339] [client 193.47.62.168:49618] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:34:23.409358 2026] [proxy:error] [pid 898098:tid 898339] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:34:23.409390 2026] [proxy_http:error] [pid 898098:tid 898339] [client 193.47.62.168:49618] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:34:23.434706 2026] [security2:error] [pid 898098:tid 898293] [client 173.239.196.166:40703] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "alxh30RK6WUoKc-ijTGPWQAAAD0"]
[Sat Jul 18 23:34:24.317326 2026] [security2:error] [pid 898098:tid 898318] [client 173.239.196.161:28271] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/new.php"] [unique_id "alxh4ERK6WUoKc-ijTGPhwAAAFY"]
[Sat Jul 18 23:34:24.526512 2026] [security2:error] [pid 898098:tid 898239] [client 223.228.182.224:28395] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxh4ERK6WUoKc-ijTGPjgAAAAc"]
[Sat Jul 18 23:34:24.531382 2026] [security2:error] [pid 898098:tid 898239] [client 223.228.182.224:28395] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxh4ERK6WUoKc-ijTGPjgAAAAc"]
[Sat Jul 18 23:34:24.699502 2026] [security2:error] [pid 897595:tid 897840] [client 35.227.39.208:9988] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "samueldcohen.com"] [uri "/"] [unique_id "alxh4OZhsBlduL7gIyy5KQAAAPc"]
[Sat Jul 18 23:34:25.122172 2026] [security2:error] [pid 898098:tid 898299] [client 136.108.4.202:12892] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "iagdevelopments.com"] [uri "/wp-json/batch/v1"] [unique_id "alxh4URK6WUoKc-ijTGPoQAAAEM"]
[Sat Jul 18 23:34:25.124979 2026] [security2:error] [pid 898098:tid 898308] [client 110.249.201.161:41654] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.ccsdifference.com"] [uri "/robots.txt"] [unique_id "alxh4URK6WUoKc-ijTGPogAAAEw"]
[Sat Jul 18 23:34:25.145630 2026] [security2:error] [pid 898098:tid 898248] [client 138.252.89.100:50500] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxh4URK6WUoKc-ijTGPowAAABA"]
[Sat Jul 18 23:34:25.145739 2026] [security2:error] [pid 898098:tid 898248] [client 138.252.89.100:50500] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxh4URK6WUoKc-ijTGPowAAABA"]
[Sat Jul 18 23:34:25.197586 2026] [security2:error] [pid 898098:tid 898254] [client 173.239.196.166:33893] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/pwnd-1/admin.php"] [unique_id "alxh4URK6WUoKc-ijTGPpgAAABY"]
[Sat Jul 18 23:34:25.354999 2026] [security2:error] [pid 898098:tid 898306] [client 136.108.4.202:12892] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "iagdevelopments.com"] [uri "/"] [unique_id "alxh4URK6WUoKc-ijTGPrgAAAEo"]
[Sat Jul 18 23:34:25.459576 2026] [security2:error] [pid 898098:tid 898334] [client 106.222.249.209:3046] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxh4URK6WUoKc-ijTGPtQAAAGY"]
[Sat Jul 18 23:34:25.459705 2026] [security2:error] [pid 898098:tid 898334] [client 106.222.249.209:3046] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxh4URK6WUoKc-ijTGPtQAAAGY"]
[Sat Jul 18 23:34:25.598198 2026] [security2:error] [pid 897595:tid 897833] [client 110.249.202.120:14128] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "ccsdifference.com"] [uri "/robots.txt"] [unique_id "alxh4eZhsBlduL7gIyy5OgAAAPA"]
[Sat Jul 18 23:34:26.064847 2026] [security2:error] [pid 897595:tid 897827] [client 173.239.196.167:59695] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/defaults.php"] [unique_id "alxh4uZhsBlduL7gIyy5RAAAAOo"]
[Sat Jul 18 23:34:26.977441 2026] [security2:error] [pid 897595:tid 897792] [client 173.239.196.162:33927] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/images/DJP9.php"] [unique_id "alxh4uZhsBlduL7gIyy5VwAAAMc"]
[Sat Jul 18 23:34:27.874714 2026] [security2:error] [pid 897595:tid 897848] [client 173.239.196.165:35329] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/customize/index.php"] [unique_id "alxh4-ZhsBlduL7gIyy5bwAAAP8"]
[Sat Jul 18 23:34:28.347704 2026] [security2:error] [pid 898098:tid 898235] [client 136.108.4.202:12892] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "iagdevelopments.com"] [uri "/index.php"] [unique_id "alxh4kRK6WUoKc-ijTGP7QAAAAM"], referer: http://iagdevelopments.com/wp-json/batch/v1
[Sat Jul 18 23:34:28.782668 2026] [security2:error] [pid 898098:tid 898233] [client 173.239.196.161:30161] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/shell20211028.php"] [unique_id "alxh5ERK6WUoKc-ijTGQTAAAAAE"]
[Sat Jul 18 23:34:29.667424 2026] [security2:error] [pid 898098:tid 898330] [client 173.239.196.160:61921] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/natural.php"] [unique_id "alxh5URK6WUoKc-ijTGQdAAAAGI"]
[Sat Jul 18 23:34:30.391738 2026] [security2:error] [pid 898098:tid 898225] [remote 120.72.98.5:46286] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "smithfamilyfoundationsunshine.org"] [uri "/wp-login.php"] [unique_id "alxh5kRK6WUoKc-ijTGQlAAAS3o"]
[Sat Jul 18 23:34:30.533769 2026] [security2:error] [pid 898098:tid 898310] [client 173.239.196.164:26589] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/item.php"] [unique_id "alxh5kRK6WUoKc-ijTGQoAAAAE4"]
[Sat Jul 18 23:34:30.771141 2026] [security2:error] [pid 898098:tid 898330] [client 50.116.65.227:52264] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "recruitinginsight.us"] [uri "/wp-cron.php"] [unique_id "alxh5kRK6WUoKc-ijTGQqQAAAGI"]
[Sat Jul 18 23:34:30.910590 2026] [security2:error] [pid 898098:tid 898242] [client 163.61.1.17:50005] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxh5kRK6WUoKc-ijTGQswAAAAo"]
[Sat Jul 18 23:34:30.910702 2026] [security2:error] [pid 898098:tid 898242] [client 163.61.1.17:50005] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxh5kRK6WUoKc-ijTGQswAAAAo"]
[Sat Jul 18 23:34:30.977269 2026] [security2:error] [pid 898098:tid 898124] [remote 120.72.98.5:46286] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "smithfamilyfoundationsunshine.org"] [uri "/wp-login.php"] [unique_id "alxh5kRK6WUoKc-ijTGQtgAAMRY"], referer: https://smithfamilyfoundationsunshine.org/wp-login.php
[Sat Jul 18 23:34:31.397012 2026] [security2:error] [pid 898098:tid 898297] [client 173.239.196.161:58453] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/function/function.php"] [unique_id "alxh50RK6WUoKc-ijTGQywAAAEE"]
[Sat Jul 18 23:34:31.427006 2026] [security2:error] [pid 898098:tid 898148] [remote 31.42.184.154:45032] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.upf.ztf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxh50RK6WUoKc-ijTGQzgAAES4"]
[Sat Jul 18 23:34:31.427146 2026] [security2:error] [pid 898098:tid 898249] [client 31.42.184.154:45032] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "mail.upf.ztf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxh50RK6WUoKc-ijTGQzgAAES4"]
[Sat Jul 18 23:34:31.448898 2026] [security2:error] [pid 898098:tid 898303] [client 190.245.146.99:52546] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxh50RK6WUoKc-ijTGQ0AAAAEc"]
[Sat Jul 18 23:34:31.449027 2026] [security2:error] [pid 898098:tid 898303] [client 190.245.146.99:52546] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxh50RK6WUoKc-ijTGQ0AAAAEc"]
[Sat Jul 18 23:34:31.486635 2026] [security2:error] [pid 898098:tid 898108] [remote 152.228.213.32:38048] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxh50RK6WUoKc-ijTGQ0gAABQY"]
[Sat Jul 18 23:34:31.524800 2026] [security2:error] [pid 898098:tid 898196] [remote 4.205.168.44:36944] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/wp-login.php"] [unique_id "alxh50RK6WUoKc-ijTGQ1AAAIF0"]
[Sat Jul 18 23:34:31.672891 2026] [security2:error] [pid 898098:tid 898155] [remote 152.228.213.32:38048] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxh50RK6WUoKc-ijTGQ3wAAJjU"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:34:31.782288 2026] [security2:error] [pid 898098:tid 898107] [remote 4.205.168.44:36944] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/wp-login.php"] [unique_id "alxh50RK6WUoKc-ijTGQ4QAAYQU"], referer: https://transparentservices.online/wp-login.php
[Sat Jul 18 23:34:32.227384 2026] [security2:error] [pid 897595:tid 897797] [client 173.239.196.165:25903] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "alxh6OZhsBlduL7gIyy52AAAAMw"]
[Sat Jul 18 23:34:32.364478 2026] [security2:error] [pid 898098:tid 898339] [client 78.142.18.40:55792] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 40.18.142.78.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "holistichealthmassagenz.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxh6ERK6WUoKc-ijTGQ8AAAAGs"]
[Sat Jul 18 23:34:32.777472 2026] [security2:error] [pid 898098:tid 898336] [client 78.142.18.40:53843] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 40.18.142.78.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "holistichealthmassagenz.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxh6ERK6WUoKc-ijTGRBwAAAGg"]
[Sat Jul 18 23:34:33.109367 2026] [security2:error] [pid 898098:tid 898291] [client 173.239.196.166:39907] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/images/admin.php"] [unique_id "alxh6URK6WUoKc-ijTGRDwAAADs"]
[Sat Jul 18 23:34:33.191503 2026] [security2:error] [pid 898098:tid 898258] [client 78.142.18.40:65429] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 40.18.142.78.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "holistichealthmassagenz.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxh6URK6WUoKc-ijTGRFQAAABo"]
[Sat Jul 18 23:34:33.612156 2026] [security2:error] [pid 897595:tid 897726] [client 78.142.18.40:54817] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 40.18.142.78.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "holistichealthmassagenz.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxh6eZhsBlduL7gIyy59wAAAIU"]
[Sat Jul 18 23:34:33.704851 2026] [security2:error] [pid 898098:tid 898244] [client 119.154.81.234:64566] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxh6URK6WUoKc-ijTGRJgAAAAw"]
[Sat Jul 18 23:34:33.704981 2026] [security2:error] [pid 898098:tid 898244] [client 119.154.81.234:64566] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxh6URK6WUoKc-ijTGRJgAAAAw"]
[Sat Jul 18 23:34:33.989142 2026] [security2:error] [pid 898098:tid 898316] [client 173.239.196.166:22089] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "alxh6URK6WUoKc-ijTGRMgAAAFQ"]
[Sat Jul 18 23:34:34.736800 2026] [security2:error] [pid 897595:tid 897664] [remote 124.156.212.23:59407] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 23.212.156.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "fluidtemple.org"] [uri "/wp-login.php"] [unique_id "alxh6uZhsBlduL7gIyy6CwAAmEM"]
[Sat Jul 18 23:34:34.868139 2026] [security2:error] [pid 898098:tid 898249] [client 173.239.196.164:52117] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/about/function.php"] [unique_id "alxh6kRK6WUoKc-ijTGRVgAAABE"]
[Sat Jul 18 23:34:35.122392 2026] [security2:error] [pid 898098:tid 898319] [client 223.228.182.224:60708] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxh60RK6WUoKc-ijTGRYwAAAFc"]
[Sat Jul 18 23:34:35.126312 2026] [security2:error] [pid 898098:tid 898319] [client 223.228.182.224:60708] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxh60RK6WUoKc-ijTGRYwAAAFc"]
[Sat Jul 18 23:34:35.364232 2026] [proxy:error] [pid 898098:tid 898256] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:34:35.364310 2026] [proxy_http:error] [pid 898098:tid 898256] [client 24.199.96.58:40758] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:34:35.364800 2026] [proxy:error] [pid 898098:tid 898256] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:34:35.364828 2026] [proxy_http:error] [pid 898098:tid 898256] [client 24.199.96.58:40758] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:34:35.403155 2026] [proxy:error] [pid 898098:tid 898309] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:34:35.403231 2026] [proxy_http:error] [pid 898098:tid 898309] [client 24.199.96.58:40762] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: http://cpcontacts.theessencecatering.com/
[Sat Jul 18 23:34:35.403732 2026] [proxy:error] [pid 898098:tid 898309] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:34:35.403770 2026] [proxy_http:error] [pid 898098:tid 898309] [client 24.199.96.58:40762] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: http://cpcontacts.theessencecatering.com/
[Sat Jul 18 23:34:35.509805 2026] [core:error] [pid 898098:tid 898359] [client 24.199.96.58:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:34:35.509827 2026] [core:error] [pid 898098:tid 898359] [client 24.199.96.58:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:34:35.752550 2026] [security2:error] [pid 898098:tid 898301] [client 173.239.196.164:31671] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/Requests/index.php"] [unique_id "alxh60RK6WUoKc-ijTGRjwAAAEU"]
[Sat Jul 18 23:34:36.181091 2026] [security2:error] [pid 898098:tid 898345] [client 106.222.249.209:28206] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxh7ERK6WUoKc-ijTGRogAAAHE"]
[Sat Jul 18 23:34:36.181286 2026] [security2:error] [pid 898098:tid 898345] [client 106.222.249.209:28206] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxh7ERK6WUoKc-ijTGRogAAAHE"]
[Sat Jul 18 23:34:36.638972 2026] [security2:error] [pid 898098:tid 898298] [client 173.239.196.162:41227] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "alxh7ERK6WUoKc-ijTGRtwAAAEI"]
[Sat Jul 18 23:34:36.724014 2026] [security2:error] [pid 898098:tid 898346] [client 138.252.89.100:50985] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxh7ERK6WUoKc-ijTGRuwAAAHI"]
[Sat Jul 18 23:34:36.724109 2026] [security2:error] [pid 898098:tid 898346] [client 138.252.89.100:50985] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxh7ERK6WUoKc-ijTGRuwAAAHI"]
[Sat Jul 18 23:34:36.792610 2026] [security2:error] [pid 897595:tid 897676] [remote 124.156.212.23:59407] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 23.212.156.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "fluidtemple.org"] [uri "/wp-login.php"] [unique_id "alxh7OZhsBlduL7gIyy6JgAAuE8"], referer: https://fluidtemple.org/wp-login.php
[Sat Jul 18 23:34:37.468228 2026] [security2:error] [pid 898098:tid 898134] [remote 113.160.142.119:57728] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "dasmarque.com"] [uri "/xmlrpc.php"] [unique_id "alxh7URK6WUoKc-ijTGR4wAABiA"]
[Sat Jul 18 23:34:37.468451 2026] [security2:error] [pid 898098:tid 898238] [client 113.160.142.119:57728] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "dasmarque.com"] [uri "/xmlrpc.php"] [unique_id "alxh7URK6WUoKc-ijTGR4wAABiA"]
[Sat Jul 18 23:34:37.492958 2026] [security2:error] [pid 897595:tid 897798] [client 173.239.196.167:41017] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/ID3/about.php"] [unique_id "alxh7eZhsBlduL7gIyy6MAAAAM0"]
[Sat Jul 18 23:34:37.562277 2026] [security2:error] [pid 898098:tid 898258] [client 34.91.100.7:49152] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "webmail.uql.jwc.mybluehost.me"] [uri "/"] [unique_id "alxh7URK6WUoKc-ijTGR6QAAABo"]
[Sat Jul 18 23:34:37.562352 2026] [security2:error] [pid 898098:tid 898258] [client 34.91.100.7:49152] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "webmail.uql.jwc.mybluehost.me"] [uri "/"] [unique_id "alxh7URK6WUoKc-ijTGR6QAAABo"]
[Sat Jul 18 23:34:37.647511 2026] [security2:error] [pid 898098:tid 898330] [client 34.90.191.83:49152] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "webdisk.syn.myr.mybluehost.me"] [uri "/"] [unique_id "alxh7URK6WUoKc-ijTGR7QAAAGI"]
[Sat Jul 18 23:34:37.647590 2026] [security2:error] [pid 898098:tid 898330] [client 34.90.191.83:49152] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "webdisk.syn.myr.mybluehost.me"] [uri "/"] [unique_id "alxh7URK6WUoKc-ijTGR7QAAAGI"]
[Sat Jul 18 23:34:38.343852 2026] [security2:error] [pid 898098:tid 898244] [client 173.239.196.164:64701] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/languages/404.php"] [unique_id "alxh7kRK6WUoKc-ijTGSCwAAAAw"]
[Sat Jul 18 23:34:38.535906 2026] [security2:error] [pid 898098:tid 898146] [remote 160.187.68.132:56738] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.68.187.160.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.upf.ztf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxh7kRK6WUoKc-ijTGSHAAAEyw"]
[Sat Jul 18 23:34:38.536147 2026] [security2:error] [pid 898098:tid 898251] [client 160.187.68.132:56738] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "mail.upf.ztf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxh7kRK6WUoKc-ijTGSHAAAEyw"]
[Sat Jul 18 23:34:39.238790 2026] [security2:error] [pid 898098:tid 898282] [client 173.239.196.161:22959] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/update/403.php"] [unique_id "alxh70RK6WUoKc-ijTGSOQAAADI"]
[Sat Jul 18 23:34:39.962621 2026] [security2:error] [pid 898098:tid 898314] [client 74.208.214.194:53132] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxh70RK6WUoKc-ijTGSXgAAAFI"]
[Sat Jul 18 23:34:40.045219 2026] [security2:error] [pid 898098:tid 898321] [client 34.90.254.162:16384] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "autodiscover.ybh.gzk.mybluehost.me"] [uri "/"] [unique_id "alxh8ERK6WUoKc-ijTGSZAAAAFk"]
[Sat Jul 18 23:34:40.045304 2026] [security2:error] [pid 898098:tid 898321] [client 34.90.254.162:16384] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "autodiscover.ybh.gzk.mybluehost.me"] [uri "/"] [unique_id "alxh8ERK6WUoKc-ijTGSZAAAAFk"]
[Sat Jul 18 23:34:40.152054 2026] [security2:error] [pid 898098:tid 898335] [client 173.239.196.165:49283] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/default.php"] [unique_id "alxh8ERK6WUoKc-ijTGSaAAAAGc"]
[Sat Jul 18 23:34:40.504360 2026] [security2:error] [pid 897595:tid 897703] [remote 97.74.93.24:41150] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "narv.co"] [uri "/wp-login.php"] [unique_id "alxh8OZhsBlduL7gIyy6aQAAqmo"]
[Sat Jul 18 23:34:40.919603 2026] [security2:error] [pid 897595:tid 897698] [remote 97.74.93.24:41150] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "narv.co"] [uri "/wp-login.php"] [unique_id "alxh8OZhsBlduL7gIyy6dAAA_WU"], referer: https://narv.co/wp-login.php
[Sat Jul 18 23:34:41.067001 2026] [security2:error] [pid 898098:tid 898304] [client 173.239.196.162:54791] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/assets/info.php"] [unique_id "alxh8URK6WUoKc-ijTGSkwAAAEg"]
[Sat Jul 18 23:34:41.383699 2026] [security2:error] [pid 897595:tid 897833] [client 163.61.1.17:50477] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxh8eZhsBlduL7gIyy6fgAAAPA"]
[Sat Jul 18 23:34:41.387121 2026] [security2:error] [pid 897595:tid 897833] [client 163.61.1.17:50477] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxh8eZhsBlduL7gIyy6fgAAAPA"]
[Sat Jul 18 23:34:41.543048 2026] [security2:error] [pid 898098:tid 898338] [client 104.28.228.198:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "metodoshanti.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "alxh8URK6WUoKc-ijTGSrgAAAGo"]
[Sat Jul 18 23:34:41.786312 2026] [security2:error] [pid 898098:tid 898318] [client 114.119.152.33:32685] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.aliveinspirit.com"] [uri "/robots.txt"] [unique_id "alxh8URK6WUoKc-ijTGSvQAAAFY"], referer: https://www.aliveinspirit.com/robots.txt
[Sat Jul 18 23:34:41.786743 2026] [security2:error] [pid 897595:tid 897750] [client 136.243.222.140:46448] ModSecurity: Warning. Matched phrase "DomainStatsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "www.ccsdifference.com"] [uri "/index.php"] [unique_id "alxh8eZhsBlduL7gIyy6fwAAAJ0"]
[Sat Jul 18 23:34:41.786775 2026] [security2:error] [pid 897595:tid 897750] [client 136.243.222.140:46448] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.ccsdifference.com"] [uri "/index.php"] [unique_id "alxh8eZhsBlduL7gIyy6fwAAAJ0"]
[Sat Jul 18 23:34:41.952286 2026] [security2:error] [pid 898098:tid 898359] [client 173.239.196.164:32575] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/class.api.php"] [unique_id "alxh8URK6WUoKc-ijTGSxAAAAH8"]
[Sat Jul 18 23:34:42.000775 2026] [security2:error] [pid 898098:tid 898358] [client 190.245.146.99:53066] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxh8kRK6WUoKc-ijTGSxQAAAH4"]
[Sat Jul 18 23:34:42.007098 2026] [security2:error] [pid 898098:tid 898358] [client 190.245.146.99:53066] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxh8kRK6WUoKc-ijTGSxQAAAH4"]
[Sat Jul 18 23:34:42.047060 2026] [security2:error] [pid 897595:tid 897706] [remote 31.42.184.154:52042] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxh8uZhsBlduL7gIyy6hAAA4G0"]
[Sat Jul 18 23:34:42.047208 2026] [security2:error] [pid 897595:tid 897817] [client 31.42.184.154:52042] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxh8uZhsBlduL7gIyy6hAAA4G0"]
[Sat Jul 18 23:34:42.797361 2026] [security2:error] [pid 898098:tid 898248] [client 173.239.196.165:25541] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/fonts/index.php"] [unique_id "alxh8kRK6WUoKc-ijTGS7gAAABA"]
[Sat Jul 18 23:34:42.915464 2026] [security2:error] [pid 898098:tid 898212] [remote 49.13.1.223:38418] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.1.13.49.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxh8kRK6WUoKc-ijTGS8gAAIG0"]
[Sat Jul 18 23:34:43.357475 2026] [security2:error] [pid 898098:tid 898143] [remote 49.13.1.223:38418] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.1.13.49.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxh80RK6WUoKc-ijTGTAgAAPCk"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:34:43.656065 2026] [security2:error] [pid 898098:tid 898337] [client 173.239.196.167:50931] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/chosen.php"] [unique_id "alxh80RK6WUoKc-ijTGTDAAAAGk"]
[Sat Jul 18 23:34:44.097647 2026] [security2:error] [pid 898098:tid 898289] [client 51.195.248.115:50340] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "autodiscover.olearyplumbingllc.com"] [uri "/.env"] [unique_id "alxh9ERK6WUoKc-ijTGTIgAAADk"]
[Sat Jul 18 23:34:44.395292 2026] [security2:error] [pid 897595:tid 897799] [client 119.154.81.234:65029] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxh9OZhsBlduL7gIyy6rQAAAM4"]
[Sat Jul 18 23:34:44.395403 2026] [security2:error] [pid 897595:tid 897799] [client 119.154.81.234:65029] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxh9OZhsBlduL7gIyy6rQAAAM4"]
[Sat Jul 18 23:34:44.542042 2026] [security2:error] [pid 898098:tid 898307] [client 173.239.196.165:63433] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/autoload_classmap/bypass.php"] [unique_id "alxh9ERK6WUoKc-ijTGTPAAAAEs"]
[Sat Jul 18 23:34:45.412136 2026] [security2:error] [pid 898098:tid 898245] [client 173.239.196.166:40393] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/dropdown.php"] [unique_id "alxh9URK6WUoKc-ijTGTZQAAAA0"]
[Sat Jul 18 23:34:46.289265 2026] [security2:error] [pid 898098:tid 898346] [client 173.239.196.161:42185] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/images/admin.php"] [unique_id "alxh9kRK6WUoKc-ijTGTjwAAAHI"]
[Sat Jul 18 23:34:46.922608 2026] [security2:error] [pid 898098:tid 898290] [client 106.222.249.209:28722] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxh9kRK6WUoKc-ijTGTsQAAADo"]
[Sat Jul 18 23:34:46.922974 2026] [security2:error] [pid 898098:tid 898290] [client 106.222.249.209:28722] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxh9kRK6WUoKc-ijTGTsQAAADo"]
[Sat Jul 18 23:34:47.173903 2026] [security2:error] [pid 897595:tid 897764] [client 173.239.196.162:27903] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/db.php"] [unique_id "alxh9-ZhsBlduL7gIyy61wAAAKs"]
[Sat Jul 18 23:34:47.807735 2026] [security2:error] [pid 898098:tid 898184] [remote 120.72.98.5:7596] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxh90RK6WUoKc-ijTGT0wAANFE"]
[Sat Jul 18 23:34:48.080846 2026] [security2:error] [pid 898098:tid 898273] [client 173.239.196.166:33639] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/pki-validation/mariju.php"] [unique_id "alxh-ERK6WUoKc-ijTGT3wAAACk"]
[Sat Jul 18 23:34:48.177818 2026] [security2:error] [pid 897595:tid 897850] [client 180.252.198.240:52107] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxh-OZhsBlduL7gIyy65gAAAQE"]
[Sat Jul 18 23:34:48.177975 2026] [security2:error] [pid 897595:tid 897850] [client 180.252.198.240:52107] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxh-OZhsBlduL7gIyy65gAAAQE"]
[Sat Jul 18 23:34:48.261193 2026] [security2:error] [pid 898098:tid 898252] [client 138.252.89.100:51467] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxh-ERK6WUoKc-ijTGT6QAAABQ"]
[Sat Jul 18 23:34:48.261283 2026] [security2:error] [pid 898098:tid 898252] [client 138.252.89.100:51467] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxh-ERK6WUoKc-ijTGT6QAAABQ"]
[Sat Jul 18 23:34:48.291649 2026] [security2:error] [pid 898098:tid 898190] [remote 120.72.98.5:7596] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxh-ERK6WUoKc-ijTGT6gAALVc"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:34:48.361510 2026] [proxy:error] [pid 898098:tid 898332] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:34:48.361583 2026] [proxy_http:error] [pid 898098:tid 898332] [client 64.225.28.186:50284] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:34:48.362108 2026] [proxy:error] [pid 898098:tid 898332] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:34:48.362136 2026] [proxy_http:error] [pid 898098:tid 898332] [client 64.225.28.186:50284] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:34:48.505606 2026] [proxy:error] [pid 898098:tid 898316] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:34:48.505687 2026] [proxy_http:error] [pid 898098:tid 898316] [client 64.225.28.186:50300] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: http://cpcontacts.northbrookcpa.ca/
[Sat Jul 18 23:34:48.506268 2026] [proxy:error] [pid 898098:tid 898316] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:34:48.506313 2026] [proxy_http:error] [pid 898098:tid 898316] [client 64.225.28.186:50300] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: http://cpcontacts.northbrookcpa.ca/
[Sat Jul 18 23:34:48.506832 2026] [security2:error] [pid 898098:tid 898312] [client 223.228.182.224:49193] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxh-ERK6WUoKc-ijTGT-wAAAFA"]
[Sat Jul 18 23:34:48.506956 2026] [security2:error] [pid 898098:tid 898312] [client 223.228.182.224:49193] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxh-ERK6WUoKc-ijTGT-wAAAFA"]
[Sat Jul 18 23:34:48.792773 2026] [core:error] [pid 897595:tid 897752] [client 64.225.28.186:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:34:48.792798 2026] [core:error] [pid 897595:tid 897752] [client 64.225.28.186:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:34:48.960296 2026] [security2:error] [pid 898098:tid 898273] [client 173.239.196.163:33021] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/mah/function.php"] [unique_id "alxh-ERK6WUoKc-ijTGUDwAAACk"]
[Sat Jul 18 23:34:49.821050 2026] [security2:error] [pid 898098:tid 898263] [client 173.239.196.165:37027] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/bypass.php"] [unique_id "alxh-URK6WUoKc-ijTGUIwAAAB8"]
[Sat Jul 18 23:34:50.442728 2026] [core:error] [pid 898098:tid 898251] [client 64.225.28.186:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace., referer: https://cpcontacts.northbrookcpa.ca/
[Sat Jul 18 23:34:50.442759 2026] [core:error] [pid 898098:tid 898251] [client 64.225.28.186:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace., referer: https://cpcontacts.northbrookcpa.ca/
[Sat Jul 18 23:34:50.689523 2026] [security2:error] [pid 898098:tid 898306] [client 173.239.196.165:31031] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/admin.php"] [unique_id "alxh-kRK6WUoKc-ijTGUQAAAAEo"]
[Sat Jul 18 23:34:51.594557 2026] [security2:error] [pid 898098:tid 898271] [client 173.239.196.164:62521] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/tflow/up.php"] [unique_id "alxh-0RK6WUoKc-ijTGUYgAAACc"]
[Sat Jul 18 23:34:51.974499 2026] [security2:error] [pid 897595:tid 897714] [remote 188.138.102.156:36246] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mollycahill.com"] [uri "/wp-login.php"] [unique_id "alxh--ZhsBlduL7gIyy7TgAAiXU"]
[Sat Jul 18 23:34:52.044803 2026] [security2:error] [pid 897595:tid 897852] [client 163.61.1.17:50956] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxh_OZhsBlduL7gIyy7UAAAAQM"]
[Sat Jul 18 23:34:52.046483 2026] [security2:error] [pid 897595:tid 897852] [client 163.61.1.17:50956] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxh_OZhsBlduL7gIyy7UAAAAQM"]
[Sat Jul 18 23:34:52.297682 2026] [security2:error] [pid 897595:tid 897630] [remote 188.138.102.156:36246] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mollycahill.com"] [uri "/wp-login.php"] [unique_id "alxh_OZhsBlduL7gIyy7XAAAryE"], referer: https://mollycahill.com/wp-login.php
[Sat Jul 18 23:34:52.420017 2026] [authz_core:error] [pid 897595:tid 897746] [client 87.78.201.8:57750] AH01630: client denied by server configuration: /home1/asliceo1/public_html/upsurgecommunications/php.ini
[Sat Jul 18 23:34:52.479292 2026] [security2:error] [pid 898098:tid 898284] [client 190.245.146.99:53589] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxh_ERK6WUoKc-ijTGUdQAAADQ"]
[Sat Jul 18 23:34:52.484167 2026] [security2:error] [pid 898098:tid 898292] [client 173.239.196.165:26505] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/function.php"] [unique_id "alxh_ERK6WUoKc-ijTGUdgAAADw"]
[Sat Jul 18 23:34:52.485547 2026] [security2:error] [pid 898098:tid 898284] [client 190.245.146.99:53589] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxh_ERK6WUoKc-ijTGUdQAAADQ"]
[Sat Jul 18 23:34:52.711786 2026] [security2:error] [pid 898098:tid 898218] [remote 120.72.98.5:48770] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "iagdevelopments.com"] [uri "/wp-login.php"] [unique_id "alxh_ERK6WUoKc-ijTGUfQAAc3M"]
[Sat Jul 18 23:34:53.064508 2026] [security2:error] [pid 897595:tid 897827] [client 52.221.236.148:49654] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 148.236.221.52.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxh_eZhsBlduL7gIyy7eQAAAOo"]
[Sat Jul 18 23:34:53.184642 2026] [security2:error] [pid 898098:tid 898216] [remote 120.72.98.5:48770] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "iagdevelopments.com"] [uri "/wp-login.php"] [unique_id "alxh_URK6WUoKc-ijTGUkwAAXXE"], referer: https://iagdevelopments.com/wp-login.php
[Sat Jul 18 23:34:53.310177 2026] [security2:error] [pid 897595:tid 897848] [client 173.239.196.163:60575] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/templates/beez3/index.php"] [unique_id "alxh_eZhsBlduL7gIyy7ggAAAP8"]
[Sat Jul 18 23:34:53.684408 2026] [security2:error] [pid 898098:tid 898312] [client 57.141.18.56:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "falconarrowshop.com"] [uri "/index.php"] [unique_id "alxh-0RK6WUoKc-ijTGUYAAAAFA"]
[Sat Jul 18 23:34:53.899194 2026] [security2:error] [pid 898098:tid 898271] [client 34.171.141.44:1496] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "dadanetnet.net"] [uri "/wp-json/batch/v1"] [unique_id "alxh_URK6WUoKc-ijTGUrAAAACc"]
[Sat Jul 18 23:34:54.076357 2026] [security2:error] [pid 898098:tid 898254] [client 13.250.107.25:26374] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.107.250.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxh_kRK6WUoKc-ijTGUuQAAABY"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:34:54.208892 2026] [security2:error] [pid 898098:tid 898203] [remote 57.141.18.101:25476] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 101.18.141.57.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/product/6279416"] [unique_id "alxh_kRK6WUoKc-ijTGUvAAAEGQ"]
[Sat Jul 18 23:34:54.219982 2026] [security2:error] [pid 898098:tid 898351] [client 173.239.196.165:22185] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/js/wp-login.php"] [unique_id "alxh_kRK6WUoKc-ijTGUuwAAAHc"]
[Sat Jul 18 23:34:54.231707 2026] [security2:error] [pid 898098:tid 898192] [remote 31.42.184.154:55634] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.cathybuffini.com"] [uri "/wp-login.php"] [unique_id "alxh_kRK6WUoKc-ijTGUvwAAAlk"]
[Sat Jul 18 23:34:54.308387 2026] [security2:error] [pid 898098:tid 898235] [client 34.171.169.105:27068] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "anastasiproperties.com"] [uri "/wp-json/batch/v1"] [unique_id "alxh_kRK6WUoKc-ijTGUxAAAAAM"]
[Sat Jul 18 23:34:54.565098 2026] [security2:error] [pid 898098:tid 898215] [remote 31.42.184.154:55634] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.cathybuffini.com"] [uri "/wp-login.php"] [unique_id "alxh_kRK6WUoKc-ijTGUygAAB3A"], referer: https://mail.cathybuffini.com/wp-login.php
[Sat Jul 18 23:34:54.612080 2026] [security2:error] [pid 898098:tid 898306] [client 34.171.141.44:1496] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "dadanetnet.net"] [uri "/"] [unique_id "alxh_kRK6WUoKc-ijTGUzwAAAEo"]
[Sat Jul 18 23:34:54.721071 2026] [security2:error] [pid 898098:tid 898287] [client 34.171.169.105:27068] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "anastasiproperties.com"] [uri "/"] [unique_id "alxh_kRK6WUoKc-ijTGU1wAAADc"]
[Sat Jul 18 23:34:54.732105 2026] [security2:error] [pid 898098:tid 898238] [client 113.160.97.242:60106] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxh_kRK6WUoKc-ijTGU2QAAAAY"]
[Sat Jul 18 23:34:55.109164 2026] [security2:error] [pid 898098:tid 898187] [remote 157.66.47.83:57486] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxh_0RK6WUoKc-ijTGU5QAAMlQ"]
[Sat Jul 18 23:34:55.115735 2026] [security2:error] [pid 898098:tid 898302] [client 173.239.196.161:64767] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/install.php"] [unique_id "alxh_0RK6WUoKc-ijTGU5wAAAEY"]
[Sat Jul 18 23:34:55.184816 2026] [security2:error] [pid 898098:tid 898295] [client 119.154.81.234:65493] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxh_0RK6WUoKc-ijTGU6AAAAD8"]
[Sat Jul 18 23:34:55.184898 2026] [security2:error] [pid 898098:tid 898295] [client 119.154.81.234:65493] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxh_0RK6WUoKc-ijTGU6AAAAD8"]
[Sat Jul 18 23:34:55.518487 2026] [security2:error] [pid 898098:tid 898299] [client 178.156.165.255:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.cheesewithjam.com"] [uri "/index.php"] [unique_id "alxh_0RK6WUoKc-ijTGU9wAAAEM"]
[Sat Jul 18 23:34:55.554505 2026] [security2:error] [pid 898098:tid 898172] [remote 157.66.47.83:57486] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxh_0RK6WUoKc-ijTGU-wAAGUY"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:34:56.022053 2026] [security2:error] [pid 898098:tid 898347] [client 173.239.196.162:46481] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/blue/rk2.php"] [unique_id "alxiAERK6WUoKc-ijTGVDgAAAHM"]
[Sat Jul 18 23:34:56.120603 2026] [security2:error] [pid 898098:tid 898110] [remote 182.77.62.24:35826] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.62.77.182.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "rcq.nst.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxiAERK6WUoKc-ijTGVDwAABwg"]
[Sat Jul 18 23:34:56.412461 2026] [security2:error] [pid 897595:tid 897675] [remote 91.142.222.105:36270] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxiAOZhsBlduL7gIyy70wAA304"]
[Sat Jul 18 23:34:56.627387 2026] [security2:error] [pid 897595:tid 897827] [client 84.37.238.36:5622] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.sesamegreenbeans.com"] [uri "/index.php"] [unique_id "alxiAOZhsBlduL7gIyy70gAA6kk"]
[Sat Jul 18 23:34:56.628378 2026] [security2:error] [pid 898098:tid 898310] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxiAERK6WUoKc-ijTGVJwAAAE4"]
[Sat Jul 18 23:34:56.645373 2026] [security2:error] [pid 898098:tid 898142] [remote 182.77.62.24:35826] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.62.77.182.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "rcq.nst.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxiAERK6WUoKc-ijTGVKgAAHig"], referer: https://rcq.nst.mybluehost.me/wp-login.php
[Sat Jul 18 23:34:56.746016 2026] [security2:error] [pid 897595:tid 897662] [remote 91.142.222.105:36270] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxiAOZhsBlduL7gIyy72QAA0UE"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:34:56.908928 2026] [security2:error] [pid 898098:tid 898353] [client 173.239.196.162:23433] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/images/class-config.php"] [unique_id "alxiAERK6WUoKc-ijTGVPgAAAHk"]
[Sat Jul 18 23:34:57.075599 2026] [security2:error] [pid 898098:tid 898303] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxiAERK6WUoKc-ijTGVPQAAAEc"]
[Sat Jul 18 23:34:57.091192 2026] [security2:error] [pid 898098:tid 898322] [client 3.108.60.216:55904] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxiAURK6WUoKc-ijTGVQwAAAFo"]
[Sat Jul 18 23:34:57.326590 2026] [security2:error] [pid 898098:tid 898325] [client 5.161.102.22:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "cheesewithjam.com"] [uri "/index.php"] [unique_id "alxiAURK6WUoKc-ijTGVRwAAAF0"]
[Sat Jul 18 23:34:57.432556 2026] [security2:error] [pid 898098:tid 898207] [remote 217.182.128.41:33720] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.128.182.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxiAURK6WUoKc-ijTGVUQAANWg"]
[Sat Jul 18 23:34:57.600132 2026] [security2:error] [pid 897595:tid 897788] [client 180.252.198.240:52681] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiAeZhsBlduL7gIyy7_gAAAMM"]
[Sat Jul 18 23:34:57.600282 2026] [security2:error] [pid 897595:tid 897788] [client 180.252.198.240:52681] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiAeZhsBlduL7gIyy7_gAAAMM"]
[Sat Jul 18 23:34:57.623987 2026] [security2:error] [pid 898098:tid 898179] [remote 217.182.128.41:33720] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.128.182.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxiAURK6WUoKc-ijTGVWAAAPUw"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:34:57.651637 2026] [security2:error] [pid 898098:tid 898339] [client 106.222.249.209:2486] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxiAURK6WUoKc-ijTGVWQAAAGs"]
[Sat Jul 18 23:34:57.651803 2026] [security2:error] [pid 898098:tid 898339] [client 106.222.249.209:2486] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxiAURK6WUoKc-ijTGVWQAAAGs"]
[Sat Jul 18 23:34:57.777947 2026] [security2:error] [pid 897595:tid 897799] [client 173.239.196.167:26299] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/components/com_jea/views/form/tmpl/size.php"] [unique_id "alxiAeZhsBlduL7gIyy8AwAAAM4"]
[Sat Jul 18 23:34:57.914735 2026] [security2:error] [pid 898098:tid 898258] [client 223.228.182.224:60730] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxiAURK6WUoKc-ijTGVXwAAABo"]
[Sat Jul 18 23:34:57.919733 2026] [security2:error] [pid 898098:tid 898258] [client 223.228.182.224:60730] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxiAURK6WUoKc-ijTGVXwAAABo"]
[Sat Jul 18 23:34:58.603167 2026] [security2:error] [pid 898098:tid 898335] [client 173.239.196.163:35361] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/templates/beez/index.php"] [unique_id "alxiAkRK6WUoKc-ijTGVfgAAAGc"]
[Sat Jul 18 23:34:58.730023 2026] [security2:error] [pid 898098:tid 898167] [remote 188.138.102.156:54000] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "phillipbloch.com"] [uri "/wp-login.php"] [unique_id "alxiAkRK6WUoKc-ijTGVgwAAf0E"]
[Sat Jul 18 23:34:58.804972 2026] [security2:error] [pid 898098:tid 898313] [client 171.251.238.128:6300] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "thierry-henry.fr"] [uri "/index.php"] [unique_id "alxiAkRK6WUoKc-ijTGVgAAAAFE"]
[Sat Jul 18 23:34:58.916530 2026] [security2:error] [pid 898098:tid 898273] [client 3.109.49.224:57950] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "155"] [id "900406"] [msg "wp-login POST logging"] [data "200"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxiAkRK6WUoKc-ijTGVYwAAACk"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:34:58.979238 2026] [security2:error] [pid 898098:tid 898292] [client 216.73.216.203:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mail.bridgeamazon.com"] [uri "/index.php"] [unique_id "alxiAkRK6WUoKc-ijTGVkAAAADw"]
[Sat Jul 18 23:34:59.044878 2026] [security2:error] [pid 898098:tid 898168] [remote 188.138.102.156:54000] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "phillipbloch.com"] [uri "/wp-login.php"] [unique_id "alxiA0RK6WUoKc-ijTGVlAAAfEI"], referer: https://phillipbloch.com/wp-login.php
[Sat Jul 18 23:34:59.313427 2026] [security2:error] [pid 897595:tid 897839] [client 15.237.217.26:53902] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "curlsnpearlsss.com"] [uri "/robots.txt"] [unique_id "alxiA-ZhsBlduL7gIyy8MQAAAPY"]
[Sat Jul 18 23:34:59.313531 2026] [security2:error] [pid 897595:tid 897839] [client 15.237.217.26:53902] ModSecurity: Warning. Matched phrase "Semrush" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "curlsnpearlsss.com"] [uri "/robots.txt"] [unique_id "alxiA-ZhsBlduL7gIyy8MQAAAPY"]
[Sat Jul 18 23:34:59.341478 2026] [security2:error] [pid 897595:tid 897810] [client 3.64.55.230:25846] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.55.64.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxiA-ZhsBlduL7gIyy8MwAAANk"]
[Sat Jul 18 23:34:59.341585 2026] [security2:error] [pid 897595:tid 897810] [client 3.64.55.230:25846] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxiA-ZhsBlduL7gIyy8MwAAANk"]
[Sat Jul 18 23:34:59.453509 2026] [security2:error] [pid 898098:tid 898344] [client 173.239.196.165:20381] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/bypass.php"] [unique_id "alxiA0RK6WUoKc-ijTGVpQAAAHA"]
[Sat Jul 18 23:34:59.921183 2026] [security2:error] [pid 898098:tid 898266] [client 138.252.89.100:51957] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxiA0RK6WUoKc-ijTGVtgAAACI"]
[Sat Jul 18 23:34:59.921315 2026] [security2:error] [pid 898098:tid 898266] [client 138.252.89.100:51957] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxiA0RK6WUoKc-ijTGVtgAAACI"]
[Sat Jul 18 23:35:00.314065 2026] [security2:error] [pid 898098:tid 898328] [client 173.239.196.166:28879] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/class.php"] [unique_id "alxiBERK6WUoKc-ijTGVxgAAAGA"]
[Sat Jul 18 23:35:00.796423 2026] [security2:error] [pid 898098:tid 898259] [client 15.237.217.173:63228] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "curlsnpearlsss.com"] [uri "/empanadillas-puerto-rican-empanadas/"] [unique_id "alxiBERK6WUoKc-ijTGV3AAAABs"]
[Sat Jul 18 23:35:00.796536 2026] [security2:error] [pid 898098:tid 898259] [client 15.237.217.173:63228] ModSecurity: Warning. Matched phrase "Semrush" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "curlsnpearlsss.com"] [uri "/empanadillas-puerto-rican-empanadas/"] [unique_id "alxiBERK6WUoKc-ijTGV3AAAABs"]
[Sat Jul 18 23:35:00.840215 2026] [security2:error] [pid 897595:tid 897755] [client 57.141.18.101:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxiBOZhsBlduL7gIyy8YAAAAKI"]
[Sat Jul 18 23:35:01.196766 2026] [security2:error] [pid 897595:tid 897803] [client 173.239.196.161:44219] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/light/profile.php"] [unique_id "alxiBeZhsBlduL7gIyy8bQAAANI"]
[Sat Jul 18 23:35:01.332296 2026] [security2:error] [pid 898098:tid 898256] [client 34.171.141.44:1496] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "dadanetnet.net"] [uri "/index.php"] [unique_id "alxiA0RK6WUoKc-ijTGVmQAAABg"], referer: http://dadanetnet.net/wp-json/batch/v1
[Sat Jul 18 23:35:02.079889 2026] [security2:error] [pid 898098:tid 898268] [client 173.239.196.167:60753] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/product.php"] [unique_id "alxiBkRK6WUoKc-ijTGWBAAAACQ"]
[Sat Jul 18 23:35:02.407721 2026] [security2:error] [pid 898098:tid 898352] [client 163.61.1.17:51431] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxiBkRK6WUoKc-ijTGWFQAAAHg"]
[Sat Jul 18 23:35:02.409329 2026] [security2:error] [pid 898098:tid 898352] [client 163.61.1.17:51431] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxiBkRK6WUoKc-ijTGWFQAAAHg"]
[Sat Jul 18 23:35:02.500072 2026] [security2:error] [pid 898098:tid 898182] [remote 212.80.9.235:50550] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.9.80.212.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nextlvlmarketingco.com"] [uri "/wp-login.php"] [unique_id "alxiBkRK6WUoKc-ijTGWFgAAMU8"]
[Sat Jul 18 23:35:02.959733 2026] [security2:error] [pid 897595:tid 897812] [client 190.245.146.99:54110] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxiBuZhsBlduL7gIyy8pwAAANs"]
[Sat Jul 18 23:35:02.959862 2026] [security2:error] [pid 897595:tid 897812] [client 190.245.146.99:54110] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxiBuZhsBlduL7gIyy8pwAAANs"]
[Sat Jul 18 23:35:03.820031 2026] [security2:error] [pid 898098:tid 898132] [remote 72.167.132.114:38642] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxiB0RK6WUoKc-ijTGWPwAAIR4"]
[Sat Jul 18 23:35:03.932027 2026] [security2:error] [pid 898098:tid 898306] [client 142.147.160.123:23344] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.sesamegreenbeans.com"] [uri "/index.php"] [unique_id "alxiB0RK6WUoKc-ijTGWPgAAShs"]
[Sat Jul 18 23:35:03.991073 2026] [security2:error] [pid 898098:tid 898352] [client 173.239.196.161:61653] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/uploads/autoload_classmap.php"] [unique_id "alxiB0RK6WUoKc-ijTGWQgAAAHg"]
[Sat Jul 18 23:35:04.151839 2026] [security2:error] [pid 898098:tid 898144] [remote 167.71.132.111:57224] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.132.71.167.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "studio.xp-design.co"] [uri "/wp-login.php"] [unique_id "alxiCERK6WUoKc-ijTGWSwAAXSo"]
[Sat Jul 18 23:35:04.451412 2026] [security2:error] [pid 898098:tid 898151] [remote 167.71.132.111:57224] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.132.71.167.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "studio.xp-design.co"] [uri "/wp-login.php"] [unique_id "alxiCERK6WUoKc-ijTGWUwAAEzE"], referer: https://studio.xp-design.co/wp-login.php
[Sat Jul 18 23:35:04.851249 2026] [security2:error] [pid 898098:tid 898292] [client 173.239.196.163:58321] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/ask.php"] [unique_id "alxiCERK6WUoKc-ijTGWXQAAADw"]
[Sat Jul 18 23:35:05.077925 2026] [security2:error] [pid 898098:tid 898261] [client 34.147.91.161:8192] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "webmail.twy.mtk.mybluehost.me"] [uri "/"] [unique_id "alxiCURK6WUoKc-ijTGWYwAAAB0"]
[Sat Jul 18 23:35:05.078036 2026] [security2:error] [pid 898098:tid 898261] [client 34.147.91.161:8192] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "webmail.twy.mtk.mybluehost.me"] [uri "/"] [unique_id "alxiCURK6WUoKc-ijTGWYwAAAB0"]
[Sat Jul 18 23:35:05.685533 2026] [security2:error] [pid 897595:tid 897825] [client 173.239.196.164:45895] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/rest-api/about.php"] [unique_id "alxiCeZhsBlduL7gIyy8_QAAAOg"]
[Sat Jul 18 23:35:05.856449 2026] [security2:error] [pid 898098:tid 898266] [client 119.154.81.234:49573] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiCURK6WUoKc-ijTGWeQAAACI"]
[Sat Jul 18 23:35:05.856549 2026] [security2:error] [pid 898098:tid 898266] [client 119.154.81.234:49573] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiCURK6WUoKc-ijTGWeQAAACI"]
[Sat Jul 18 23:35:06.222192 2026] [security2:error] [pid 898098:tid 898257] [client 136.243.222.140:50850] ModSecurity: Warning. Matched phrase "DomainStatsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "www.ccsdifference.com"] [uri "/index.php"] [unique_id "alxiCURK6WUoKc-ijTGWeAAAAFg"]
[Sat Jul 18 23:35:06.589472 2026] [security2:error] [pid 897595:tid 897759] [client 173.239.196.163:49149] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/css/css.php"] [unique_id "alxiCuZhsBlduL7gIyy9GgAAAKY"]
[Sat Jul 18 23:35:06.936642 2026] [security2:error] [pid 897595:tid 897755] [client 192.178.4.98:52755] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "gertoger.org"] [uri "/index.php"] [unique_id "alxiCeZhsBlduL7gIyy9AQAAAKI"]
[Sat Jul 18 23:35:07.083002 2026] [security2:error] [pid 898098:tid 898240] [client 47.130.156.109:15950] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 109.156.130.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxiC0RK6WUoKc-ijTGWnwAAAAg"]
[Sat Jul 18 23:35:07.083120 2026] [security2:error] [pid 898098:tid 898240] [client 47.130.156.109:15950] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxiC0RK6WUoKc-ijTGWnwAAAAg"]
[Sat Jul 18 23:35:07.499236 2026] [security2:error] [pid 898098:tid 898353] [client 173.239.196.164:41547] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/init.php"] [unique_id "alxiC0RK6WUoKc-ijTGWrgAAAHk"]
[Sat Jul 18 23:35:07.680461 2026] [security2:error] [pid 898098:tid 898338] [client 18.97.9.102:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxiC0RK6WUoKc-ijTGWnQAAAGo"]
[Sat Jul 18 23:35:08.078407 2026] [security2:error] [pid 898098:tid 898250] [client 180.252.198.240:53124] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiDERK6WUoKc-ijTGWyQAAABI"]
[Sat Jul 18 23:35:08.078525 2026] [security2:error] [pid 898098:tid 898250] [client 180.252.198.240:53124] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiDERK6WUoKc-ijTGWyQAAABI"]
[Sat Jul 18 23:35:08.409183 2026] [security2:error] [pid 898098:tid 898358] [client 106.222.249.209:27864] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxiDERK6WUoKc-ijTGW1wAAAH4"]
[Sat Jul 18 23:35:08.409272 2026] [security2:error] [pid 898098:tid 898358] [client 106.222.249.209:27864] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxiDERK6WUoKc-ijTGW1wAAAH4"]
[Sat Jul 18 23:35:08.439931 2026] [security2:error] [pid 897595:tid 897832] [client 173.239.196.163:47459] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/user/wp-login.php"] [unique_id "alxiDOZhsBlduL7gIyy9UwAAAO8"]
[Sat Jul 18 23:35:08.597368 2026] [security2:error] [pid 898098:tid 898202] [remote 97.74.93.24:41776] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxiDERK6WUoKc-ijTGW3gAALGM"]
[Sat Jul 18 23:35:08.597547 2026] [security2:error] [pid 898098:tid 898276] [client 97.74.93.24:41776] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxiDERK6WUoKc-ijTGW3gAALGM"]
[Sat Jul 18 23:35:09.067898 2026] [security2:error] [pid 897595:tid 897777] [client 50.116.65.227:28858] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxiDeZhsBlduL7gIyy9aQAAALg"]
[Sat Jul 18 23:35:09.082381 2026] [security2:error] [pid 897595:tid 897790] [client 50.116.65.227:59778] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxiDeZhsBlduL7gIyy9awAAAMU"]
[Sat Jul 18 23:35:09.316033 2026] [security2:error] [pid 897595:tid 897813] [client 173.239.196.166:53565] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/autoload_classmap/function.php"] [unique_id "alxiDeZhsBlduL7gIyy9cQAAANw"]
[Sat Jul 18 23:35:10.160512 2026] [security2:error] [pid 897595:tid 897812] [client 173.239.196.166:41727] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/item.php"] [unique_id "alxiDuZhsBlduL7gIyy9jAAAANs"]
[Sat Jul 18 23:35:10.347627 2026] [security2:error] [pid 898098:tid 898263] [client 177.249.60.253:56664] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mazzucelli.com"] [uri "/index.php"] [unique_id "alxiDURK6WUoKc-ijTGW6wAAAB8"]
[Sat Jul 18 23:35:10.657174 2026] [security2:error] [pid 897595:tid 897824] [client 4.194.24.143:19437] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/nine2code.php"] [unique_id "alxiDuZhsBlduL7gIyy9nAAAAOc"]
[Sat Jul 18 23:35:11.001139 2026] [security2:error] [pid 897595:tid 897843] [client 173.239.196.160:54827] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/assets/index.php"] [unique_id "alxiD-ZhsBlduL7gIyy9sAAAAPo"]
[Sat Jul 18 23:35:11.180364 2026] [security2:error] [pid 897595:tid 897770] [client 18.97.9.97:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.partnerselectricalllc.com"] [uri "/index.php"] [unique_id "alxiDuZhsBlduL7gIyy9oAAAALE"]
[Sat Jul 18 23:35:11.250662 2026] [security2:error] [pid 897595:tid 897829] [client 4.194.24.143:29325] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/num.php"] [unique_id "alxiD-ZhsBlduL7gIyy9tgAAAOw"]
[Sat Jul 18 23:35:11.469501 2026] [security2:error] [pid 898098:tid 898302] [client 138.252.89.100:52456] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxiD0RK6WUoKc-ijTGXJgAAAEY"]
[Sat Jul 18 23:35:11.469589 2026] [security2:error] [pid 898098:tid 898302] [client 138.252.89.100:52456] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxiD0RK6WUoKc-ijTGXJgAAAEY"]
[Sat Jul 18 23:35:11.709361 2026] [security2:error] [pid 898098:tid 898326] [client 34.91.213.89:49152] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "webdisk.heatherbowman.com"] [uri "/"] [unique_id "alxiD0RK6WUoKc-ijTGXKgAAAF4"]
[Sat Jul 18 23:35:11.709467 2026] [security2:error] [pid 898098:tid 898326] [client 34.91.213.89:49152] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "webdisk.heatherbowman.com"] [uri "/"] [unique_id "alxiD0RK6WUoKc-ijTGXKgAAAF4"]
[Sat Jul 18 23:35:11.795243 2026] [security2:error] [pid 897595:tid 897840] [client 4.194.24.143:47043] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/odf7udtspqtpxzyxmw2rccdefault.php"] [unique_id "alxiD-ZhsBlduL7gIyy9ygAAAPc"]
[Sat Jul 18 23:35:11.849030 2026] [security2:error] [pid 898098:tid 898272] [client 173.239.196.167:37241] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/pki-validation/index.php"] [unique_id "alxiD0RK6WUoKc-ijTGXLQAAACg"]
[Sat Jul 18 23:35:12.353330 2026] [ssl:error] [pid 898098:tid 898290] [client 18.235.110.182:9116] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname webdisk.upsurgecommunications.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:35:12.380407 2026] [security2:error] [pid 898098:tid 898305] [client 4.194.24.143:47073] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/option.php"] [unique_id "alxiEERK6WUoKc-ijTGXQgAAAEk"]
[Sat Jul 18 23:35:12.717059 2026] [security2:error] [pid 898098:tid 898350] [client 173.239.196.160:57637] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/uploads/admin.php"] [unique_id "alxiEERK6WUoKc-ijTGXTgAAAHY"]
[Sat Jul 18 23:35:12.746292 2026] [security2:error] [pid 897595:tid 897637] [remote 91.142.222.105:58210] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "idigress.group"] [uri "/wp-login.php"] [unique_id "alxiEOZhsBlduL7gIyy98gAAzSg"]
[Sat Jul 18 23:35:12.952445 2026] [security2:error] [pid 897595:tid 897757] [client 4.194.24.143:20309] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/p.php"] [unique_id "alxiEOZhsBlduL7gIyy99gAAAKQ"]
[Sat Jul 18 23:35:12.981010 2026] [security2:error] [pid 898098:tid 898351] [client 163.61.1.17:51910] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxiEERK6WUoKc-ijTGXUgAAAHc"]
[Sat Jul 18 23:35:12.981097 2026] [security2:error] [pid 898098:tid 898351] [client 163.61.1.17:51910] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxiEERK6WUoKc-ijTGXUgAAAHc"]
[Sat Jul 18 23:35:13.455946 2026] [security2:error] [pid 897595:tid 897785] [client 190.245.146.99:54629] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxiEeZhsBlduL7gIyy-EwAAAMA"]
[Sat Jul 18 23:35:13.461619 2026] [security2:error] [pid 897595:tid 897785] [client 190.245.146.99:54629] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxiEeZhsBlduL7gIyy-EwAAAMA"]
[Sat Jul 18 23:35:13.547761 2026] [security2:error] [pid 897595:tid 897844] [client 4.194.24.143:19408] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/past.php"] [unique_id "alxiEeZhsBlduL7gIyy-FwAAAPs"]
[Sat Jul 18 23:35:13.577626 2026] [security2:error] [pid 897595:tid 897763] [client 173.239.196.167:53407] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/css/admin.php"] [unique_id "alxiEeZhsBlduL7gIyy-GQAAAKo"]
[Sat Jul 18 23:35:13.871155 2026] [security2:error] [pid 897595:tid 897643] [remote 91.142.222.105:58210] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "idigress.group"] [uri "/wp-login.php"] [unique_id "alxiEeZhsBlduL7gIyy-LAAA8y4"], referer: https://idigress.group/wp-login.php
[Sat Jul 18 23:35:14.007026 2026] [security2:error] [pid 898098:tid 898240] [client 54.213.35.220:3444] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxiEURK6WUoKc-ijTGXXAAAAAg"]
[Sat Jul 18 23:35:14.091435 2026] [security2:error] [pid 897595:tid 897744] [client 4.194.24.143:47084] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/php.php"] [unique_id "alxiEuZhsBlduL7gIyy-NgAAAJc"]
[Sat Jul 18 23:35:14.482184 2026] [security2:error] [pid 897595:tid 897800] [client 173.239.196.161:52047] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/adminfuns.php"] [unique_id "alxiEuZhsBlduL7gIyy-SgAAAM8"]
[Sat Jul 18 23:35:14.674519 2026] [security2:error] [pid 898098:tid 898299] [client 4.194.24.143:20348] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/php8.php"] [unique_id "alxiEkRK6WUoKc-ijTGXbwAAAEM"]
[Sat Jul 18 23:35:14.803875 2026] [security2:error] [pid 897595:tid 897785] [client 142.147.187.245:15970] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.sesamegreenbeans.com"] [uri "/index.php"] [unique_id "alxiEuZhsBlduL7gIyy-UQAAwF0"]
[Sat Jul 18 23:35:15.042564 2026] [security2:error] [pid 898098:tid 898225] [remote 31.42.184.154:58344] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tee.qtw.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxiE0RK6WUoKc-ijTGXeAAAPXo"]
[Sat Jul 18 23:35:15.223393 2026] [security2:error] [pid 898098:tid 898324] [client 4.194.24.143:19419] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/phpinfo.php"] [unique_id "alxiE0RK6WUoKc-ijTGXhAAAAFw"]
[Sat Jul 18 23:35:15.334652 2026] [security2:error] [pid 898098:tid 898138] [remote 31.42.184.154:58344] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tee.qtw.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxiE0RK6WUoKc-ijTGXiAAAcyQ"], referer: https://tee.qtw.mybluehost.me/wp-login.php
[Sat Jul 18 23:35:15.388284 2026] [security2:error] [pid 897595:tid 897792] [client 173.239.196.161:42495] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/autoload_classmap.php"] [unique_id "alxiE-ZhsBlduL7gIyy-aAAAAMc"]
[Sat Jul 18 23:35:15.985341 2026] [security2:error] [pid 898098:tid 898313] [client 4.194.24.143:47085] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/post.php"] [unique_id "alxiE0RK6WUoKc-ijTGXlwAAAFE"]
[Sat Jul 18 23:35:16.282995 2026] [security2:error] [pid 898098:tid 898359] [client 173.239.196.162:64155] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp_wlx.php"] [unique_id "alxiFERK6WUoKc-ijTGXnwAAAH8"]
[Sat Jul 18 23:35:16.549681 2026] [security2:error] [pid 898098:tid 898321] [client 4.194.24.143:47053] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/public/assets/design_1/css/parts/course_cards/grid_card_1.min.php"] [unique_id "alxiFERK6WUoKc-ijTGXowAAAFk"]
[Sat Jul 18 23:35:16.646285 2026] [security2:error] [pid 897595:tid 897829] [client 119.154.81.234:50132] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiFOZhsBlduL7gIyy-ngAAAOw"]
[Sat Jul 18 23:35:16.646371 2026] [security2:error] [pid 897595:tid 897829] [client 119.154.81.234:50132] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiFOZhsBlduL7gIyy-ngAAAOw"]
[Sat Jul 18 23:35:16.947892 2026] [security2:error] [pid 897595:tid 897678] [remote 103.133.214.160:38250] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.214.133.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxiFOZhsBlduL7gIyy-qQAAtFE"]
[Sat Jul 18 23:35:17.096675 2026] [security2:error] [pid 898098:tid 898352] [client 4.194.24.143:47078] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/public/css.php"] [unique_id "alxiFURK6WUoKc-ijTGXuAAAAHg"]
[Sat Jul 18 23:35:17.165563 2026] [security2:error] [pid 898098:tid 898288] [client 173.239.196.160:42605] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "alxiFURK6WUoKc-ijTGXvAAAADg"]
[Sat Jul 18 23:35:17.428463 2026] [security2:error] [pid 897595:tid 897619] [remote 103.133.214.160:38250] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.214.133.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxiFeZhsBlduL7gIyy-twAAlxY"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:35:17.711109 2026] [security2:error] [pid 897595:tid 897833] [client 4.194.24.143:29366] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/r.php"] [unique_id "alxiFeZhsBlduL7gIyy-vQAAAPA"]
[Sat Jul 18 23:35:17.853544 2026] [security2:error] [pid 897595:tid 897631] [remote 31.42.184.154:40680] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxiFeZhsBlduL7gIyy-wAAAxSI"]
[Sat Jul 18 23:35:18.037808 2026] [security2:error] [pid 897595:tid 897797] [client 173.239.196.164:58211] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/assets/husky301.php"] [unique_id "alxiFuZhsBlduL7gIyy-xwAAAMw"]
[Sat Jul 18 23:35:18.070965 2026] [security2:error] [pid 897595:tid 897624] [remote 31.42.184.154:40680] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxiFuZhsBlduL7gIyy-yQAAsBs"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:35:18.163056 2026] [security2:error] [pid 898098:tid 898125] [remote 31.42.184.154:58368] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nextlevelpressurewashing.com"] [uri "/wp-login.php"] [unique_id "alxiFkRK6WUoKc-ijTGX5wAASxc"]
[Sat Jul 18 23:35:18.277270 2026] [security2:error] [pid 898098:tid 898301] [client 4.194.24.143:47066] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/radio.php"] [unique_id "alxiFkRK6WUoKc-ijTGX6gAAAEU"]
[Sat Jul 18 23:35:18.441897 2026] [security2:error] [pid 898098:tid 898160] [remote 31.42.184.154:58368] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nextlevelpressurewashing.com"] [uri "/wp-login.php"] [unique_id "alxiFkRK6WUoKc-ijTGX8QAAFjo"], referer: https://nextlevelpressurewashing.com/wp-login.php
[Sat Jul 18 23:35:18.517201 2026] [security2:error] [pid 897595:tid 897845] [client 180.252.198.240:53570] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiFuZhsBlduL7gIyy-1wAAAPw"]
[Sat Jul 18 23:35:18.517283 2026] [security2:error] [pid 897595:tid 897845] [client 180.252.198.240:53570] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiFuZhsBlduL7gIyy-1wAAAPw"]
[Sat Jul 18 23:35:18.577695 2026] [security2:error] [pid 898098:tid 898341] [client 74.7.241.135:33340] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "cofigua.com"] [uri "/robots.txt"] [unique_id "alxiFkRK6WUoKc-ijTGX-wAAAG0"]
[Sat Jul 18 23:35:18.748706 2026] [security2:error] [pid 898098:tid 898353] [client 74.7.241.135:0] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "404"] [hostname "cofigua.com"] [uri "/cgi-sys/404.html"] [unique_id "alxiFkRK6WUoKc-ijTGYAQAAAHk"], referer: http://cofigua.com/robots.txt
[Sat Jul 18 23:35:18.750246 2026] [security2:error] [pid 898098:tid 898336] [client 74.7.241.135:47024] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "404"] [hostname "cofigua.com"] [uri "/robots.txt"] [unique_id "alxiFkRK6WUoKc-ijTGX_wAAaE4"], referer: http://cofigua.com/robots.txt
[Sat Jul 18 23:35:18.829112 2026] [security2:error] [pid 897595:tid 897762] [client 4.194.24.143:47090] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/randkeyword.php7"] [unique_id "alxiFuZhsBlduL7gIyy-3AAAAKk"]
[Sat Jul 18 23:35:18.935679 2026] [security2:error] [pid 898098:tid 898350] [client 173.239.196.161:46115] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp.php"] [unique_id "alxiFkRK6WUoKc-ijTGYCwAAAHY"]
[Sat Jul 18 23:35:19.181687 2026] [security2:error] [pid 898098:tid 898246] [client 223.228.182.224:51374] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxiF0RK6WUoKc-ijTGYFwAAAA4"]
[Sat Jul 18 23:35:19.181817 2026] [security2:error] [pid 898098:tid 898246] [client 223.228.182.224:51374] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxiF0RK6WUoKc-ijTGYFwAAAA4"]
[Sat Jul 18 23:35:19.221523 2026] [security2:error] [pid 898098:tid 898357] [client 106.222.249.209:18884] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxiF0RK6WUoKc-ijTGYGQAAAH0"]
[Sat Jul 18 23:35:19.221607 2026] [security2:error] [pid 898098:tid 898357] [client 106.222.249.209:18884] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxiF0RK6WUoKc-ijTGYGQAAAH0"]
[Sat Jul 18 23:35:19.243392 2026] [security2:error] [pid 898098:tid 898314] [client 74.208.214.194:44694] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxiF0RK6WUoKc-ijTGYGgAAAFI"]
[Sat Jul 18 23:35:19.371056 2026] [security2:error] [pid 898098:tid 898259] [client 4.194.24.143:19415] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/readme.php"] [unique_id "alxiF0RK6WUoKc-ijTGYIwAAABs"]
[Sat Jul 18 23:35:19.828546 2026] [security2:error] [pid 898098:tid 898337] [client 173.239.196.167:54273] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/blue/wp-trackback.php"] [unique_id "alxiF0RK6WUoKc-ijTGYOgAAAGk"]
[Sat Jul 18 23:35:19.913927 2026] [security2:error] [pid 898098:tid 898329] [client 4.194.24.143:29333] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/reze.php"] [unique_id "alxiF0RK6WUoKc-ijTGYQgAAAGE"]
[Sat Jul 18 23:35:20.488067 2026] [security2:error] [pid 898098:tid 898278] [client 4.194.24.143:29356] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/rh.php"] [unique_id "alxiGERK6WUoKc-ijTGYVgAAAC4"]
[Sat Jul 18 23:35:20.525107 2026] [security2:error] [pid 898098:tid 898122] [remote 49.13.1.223:42440] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.1.13.49.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "fansarogroup.com"] [uri "/wp-login.php"] [unique_id "alxiGERK6WUoKc-ijTGYVwAAXhQ"]
[Sat Jul 18 23:35:20.658685 2026] [security2:error] [pid 897595:tid 897673] [remote 31.42.184.154:46502] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "skiboutiques.com"] [uri "/wp-login.php"] [unique_id "alxiGOZhsBlduL7gIyy_EwAAwkw"]
[Sat Jul 18 23:35:20.684017 2026] [security2:error] [pid 898098:tid 898234] [client 173.239.196.164:34581] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/chosen.php"] [unique_id "alxiGERK6WUoKc-ijTGYXgAAAAI"]
[Sat Jul 18 23:35:20.729650 2026] [security2:error] [pid 898098:tid 898123] [remote 49.13.1.223:42440] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.1.13.49.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "fansarogroup.com"] [uri "/wp-login.php"] [unique_id "alxiGERK6WUoKc-ijTGYYAAAaRU"], referer: https://fansarogroup.com/wp-login.php
[Sat Jul 18 23:35:20.902991 2026] [security2:error] [pid 897595:tid 897687] [remote 31.42.184.154:46502] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "skiboutiques.com"] [uri "/wp-login.php"] [unique_id "alxiGOZhsBlduL7gIyy_HQAA3Fo"], referer: https://skiboutiques.com/wp-login.php
[Sat Jul 18 23:35:20.958267 2026] [security2:error] [pid 897595:tid 897690] [remote 97.74.93.24:58452] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cloudspacesgroup.com"] [uri "/wp-login.php"] [unique_id "alxiGOZhsBlduL7gIyy_IAAA310"]
[Sat Jul 18 23:35:20.963696 2026] [security2:error] [pid 898098:tid 898191] [remote 182.93.80.120:33856] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 120.80.93.182.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxiGERK6WUoKc-ijTGYcQAAd1g"]
[Sat Jul 18 23:35:21.040492 2026] [security2:error] [pid 898098:tid 898332] [client 74.7.227.179:59410] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxiGERK6WUoKc-ijTGYcAAAZCs"], referer: https://tejasenvironmental.com/p=2149245
[Sat Jul 18 23:35:21.042931 2026] [security2:error] [pid 898098:tid 898270] [client 4.194.24.143:47060] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/rip.php"] [unique_id "alxiGURK6WUoKc-ijTGYdwAAACY"]
[Sat Jul 18 23:35:21.374590 2026] [security2:error] [pid 897595:tid 897671] [remote 97.74.93.24:58452] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cloudspacesgroup.com"] [uri "/wp-login.php"] [unique_id "alxiGeZhsBlduL7gIyy_NQAAnEo"], referer: https://cloudspacesgroup.com/wp-login.php
[Sat Jul 18 23:35:21.553451 2026] [security2:error] [pid 897595:tid 897841] [client 173.239.196.160:42767] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-header.php"] [unique_id "alxiGeZhsBlduL7gIyy_OwAAAPg"]
[Sat Jul 18 23:35:21.607058 2026] [security2:error] [pid 898098:tid 898334] [client 4.194.24.143:19420] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/root.php"] [unique_id "alxiGURK6WUoKc-ijTGYiwAAAGY"]
[Sat Jul 18 23:35:21.655564 2026] [security2:error] [pid 897595:tid 897679] [remote 209.133.204.250:49810] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 250.204.133.209.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "floorsourcestock.com"] [uri "/wp-login.php"] [unique_id "alxiGeZhsBlduL7gIyy_PwAAiFI"]
[Sat Jul 18 23:35:21.897680 2026] [security2:error] [pid 898098:tid 898224] [remote 97.74.93.24:58462] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxiGURK6WUoKc-ijTGYmwAANXk"]
[Sat Jul 18 23:35:21.927335 2026] [security2:error] [pid 898098:tid 898210] [remote 182.93.80.120:33856] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 120.80.93.182.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxiGURK6WUoKc-ijTGYnAAAV2s"], referer: https://sesamegreenbeans.com/wp-login.php
[Sat Jul 18 23:35:22.166270 2026] [security2:error] [pid 898098:tid 898293] [client 4.194.24.143:20324] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/s.php"] [unique_id "alxiGkRK6WUoKc-ijTGYowAAAD0"]
[Sat Jul 18 23:35:22.337681 2026] [security2:error] [pid 898098:tid 898205] [remote 97.74.93.24:58462] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxiGkRK6WUoKc-ijTGYpgAAImY"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:35:22.341074 2026] [security2:error] [pid 897595:tid 897707] [remote 209.133.204.250:49810] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 250.204.133.209.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "floorsourcestock.com"] [uri "/wp-login.php"] [unique_id "alxiGuZhsBlduL7gIyy_YgAA524"], referer: https://floorsourcestock.com/wp-login.php
[Sat Jul 18 23:35:22.431283 2026] [security2:error] [pid 898098:tid 898274] [client 173.239.196.164:28313] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/admin.php"] [unique_id "alxiGkRK6WUoKc-ijTGYsgAAACo"]
[Sat Jul 18 23:35:22.710294 2026] [security2:error] [pid 898098:tid 898295] [client 4.194.24.143:29360] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/sang.php"] [unique_id "alxiGkRK6WUoKc-ijTGYxQAAAD8"]
[Sat Jul 18 23:35:22.967365 2026] [security2:error] [pid 898098:tid 898352] [client 138.252.89.100:52947] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxiGkRK6WUoKc-ijTGYzQAAAHg"]
[Sat Jul 18 23:35:22.967490 2026] [security2:error] [pid 898098:tid 898352] [client 138.252.89.100:52947] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxiGkRK6WUoKc-ijTGYzQAAAHg"]
[Sat Jul 18 23:35:23.297155 2026] [security2:error] [pid 898098:tid 898251] [client 4.194.24.143:29357] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/scxy.php"] [unique_id "alxiG0RK6WUoKc-ijTGY0wAAABM"]
[Sat Jul 18 23:35:23.325812 2026] [security2:error] [pid 898098:tid 898293] [client 173.239.196.164:36589] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/Marvins.php"] [unique_id "alxiG0RK6WUoKc-ijTGY1gAAAD0"]
[Sat Jul 18 23:35:23.525689 2026] [security2:error] [pid 898098:tid 898298] [client 163.61.1.17:52391] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxiG0RK6WUoKc-ijTGY4gAAAEI"]
[Sat Jul 18 23:35:23.525812 2026] [security2:error] [pid 898098:tid 898298] [client 163.61.1.17:52391] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxiG0RK6WUoKc-ijTGY4gAAAEI"]
[Sat Jul 18 23:35:23.844072 2026] [security2:error] [pid 897595:tid 897800] [client 4.194.24.143:19400] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/sd.php"] [unique_id "alxiG-ZhsBlduL7gIyy_kQAAAM8"]
[Sat Jul 18 23:35:23.997979 2026] [security2:error] [pid 898098:tid 898242] [client 190.245.146.99:55154] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxiG0RK6WUoKc-ijTGY_AAAAAo"]
[Sat Jul 18 23:35:23.998072 2026] [security2:error] [pid 898098:tid 898242] [client 190.245.146.99:55154] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxiG0RK6WUoKc-ijTGY_AAAAAo"]
[Sat Jul 18 23:35:24.224491 2026] [security2:error] [pid 898098:tid 898333] [client 89.167.13.70:54935] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.13.167.89.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "amberhillstyle.com"] [uri "/contact.php"] [unique_id "alxiHERK6WUoKc-ijTGZAgAAAGU"], referer: https://www.google.com/
[Sat Jul 18 23:35:24.236280 2026] [security2:error] [pid 897595:tid 897772] [client 173.239.196.166:27365] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/about.php"] [unique_id "alxiHOZhsBlduL7gIyy_rAAAALM"]
[Sat Jul 18 23:35:24.384271 2026] [security2:error] [pid 897595:tid 897765] [client 4.194.24.143:40576] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/sf.php"] [unique_id "alxiHOZhsBlduL7gIyy_sgAAAKw"]
[Sat Jul 18 23:35:24.464532 2026] [security2:error] [pid 898098:tid 898344] [client 89.167.13.70:60478] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.13.167.89.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "amberhillstyle.com"] [uri "/contact-us.php"] [unique_id "alxiHERK6WUoKc-ijTGZBgAAAHA"], referer: https://www.google.com/
[Sat Jul 18 23:35:24.503326 2026] [security2:error] [pid 898098:tid 898314] [client 89.167.13.70:54933] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.13.167.89.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "amberhillstyle.com"] [uri "/shipping.php"] [unique_id "alxiHERK6WUoKc-ijTGZCgAAAFI"], referer: https://www.google.com/
[Sat Jul 18 23:35:24.983076 2026] [security2:error] [pid 898098:tid 898271] [client 4.194.24.143:19445] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/shell.php"] [unique_id "alxiHERK6WUoKc-ijTGZFQAAACc"]
[Sat Jul 18 23:35:25.099441 2026] [security2:error] [pid 898098:tid 898250] [client 89.167.13.70:62845] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.13.167.89.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "amberhillstyle.com"] [uri "/about-us.php"] [unique_id "alxiHURK6WUoKc-ijTGZGAAAABI"], referer: https://www.google.com/
[Sat Jul 18 23:35:25.153271 2026] [security2:error] [pid 898098:tid 898296] [client 173.239.196.167:38171] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-class.php"] [unique_id "alxiHURK6WUoKc-ijTGZGwAAAEA"]
[Sat Jul 18 23:35:25.585120 2026] [security2:error] [pid 897595:tid 897777] [client 89.167.13.70:64336] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.13.167.89.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "amberhillstyle.com"] [uri "/info.php"] [unique_id "alxiHeZhsBlduL7gIyy_2gAAALg"], referer: https://www.google.com/
[Sat Jul 18 23:35:25.751779 2026] [security2:error] [pid 898098:tid 898270] [client 4.194.24.143:19317] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/sid3.php"] [unique_id "alxiHURK6WUoKc-ijTGZOAAAACY"]
[Sat Jul 18 23:35:25.990293 2026] [security2:error] [pid 898098:tid 898259] [client 89.167.13.70:62446] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.13.167.89.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "amberhillstyle.com"] [uri "/delivery.php"] [unique_id "alxiHURK6WUoKc-ijTGZQgAAABs"], referer: https://www.google.com/
[Sat Jul 18 23:35:26.000941 2026] [security2:error] [pid 898098:tid 898343] [client 173.239.196.164:50683] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "alxiHkRK6WUoKc-ijTGZQwAAAG8"]
[Sat Jul 18 23:35:26.038915 2026] [security2:error] [pid 898098:tid 898297] [client 89.167.13.70:62594] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.13.167.89.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "amberhillstyle.com"] [uri "/about.php"] [unique_id "alxiHkRK6WUoKc-ijTGZRgAAAEE"], referer: https://www.google.com/
[Sat Jul 18 23:35:26.109829 2026] [security2:error] [pid 898098:tid 898216] [remote 66.33.212.6:54608] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 6.212.33.66.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxiHkRK6WUoKc-ijTGZSAAAf3E"]
[Sat Jul 18 23:35:26.296029 2026] [security2:error] [pid 898098:tid 898349] [client 4.194.24.143:47050] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/simple.php"] [unique_id "alxiHkRK6WUoKc-ijTGZTAAAAHU"]
[Sat Jul 18 23:35:26.812833 2026] [security2:error] [pid 898098:tid 898206] [remote 66.33.212.6:54608] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 6.212.33.66.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxiHkRK6WUoKc-ijTGZXwAAYWc"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:35:26.843832 2026] [security2:error] [pid 897595:tid 897727] [client 4.194.24.143:29353] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/sitemap.php"] [unique_id "alxiHuZhsBlduL7gIyy__gAAAIY"]
[Sat Jul 18 23:35:26.865521 2026] [security2:error] [pid 898098:tid 898352] [client 173.239.196.167:55657] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/xx.php"] [unique_id "alxiHkRK6WUoKc-ijTGZYgAAAHg"]
[Sat Jul 18 23:35:26.890244 2026] [security2:error] [pid 898098:tid 898341] [client 57.141.18.101:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxiHkRK6WUoKc-ijTGZWwAAAG0"]
[Sat Jul 18 23:35:27.304042 2026] [security2:error] [pid 898098:tid 898282] [client 119.154.81.234:50822] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiH0RK6WUoKc-ijTGZbQAAADI"]
[Sat Jul 18 23:35:27.304146 2026] [security2:error] [pid 898098:tid 898282] [client 119.154.81.234:50822] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiH0RK6WUoKc-ijTGZbQAAADI"]
[Sat Jul 18 23:35:27.403947 2026] [security2:error] [pid 898098:tid 898305] [client 4.194.24.143:19440] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/size.php"] [unique_id "alxiH0RK6WUoKc-ijTGZdAAAAEk"]
[Sat Jul 18 23:35:27.735973 2026] [security2:error] [pid 898098:tid 898247] [client 173.239.196.166:33521] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/autoload_classmap.php"] [unique_id "alxiH0RK6WUoKc-ijTGZiAAAAA8"]
[Sat Jul 18 23:35:27.948122 2026] [security2:error] [pid 898098:tid 898242] [client 4.194.24.143:29349] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/sm.php"] [unique_id "alxiH0RK6WUoKc-ijTGZkgAAAAo"]
[Sat Jul 18 23:35:28.526369 2026] [security2:error] [pid 898098:tid 898311] [client 4.194.24.143:47101] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/sql.php"] [unique_id "alxiIERK6WUoKc-ijTGZogAAAE8"]
[Sat Jul 18 23:35:28.596510 2026] [security2:error] [pid 897595:tid 897845] [client 173.239.196.160:52801] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/classwithtostring.php"] [unique_id "alxiIOZhsBlduL7gIyzAJwAAAPw"]
[Sat Jul 18 23:35:28.958549 2026] [security2:error] [pid 898098:tid 898357] [client 180.252.198.240:54031] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiIERK6WUoKc-ijTGZsQAAAH0"]
[Sat Jul 18 23:35:28.958670 2026] [security2:error] [pid 898098:tid 898357] [client 180.252.198.240:54031] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiIERK6WUoKc-ijTGZsQAAAH0"]
[Sat Jul 18 23:35:29.078716 2026] [security2:error] [pid 898098:tid 898334] [client 4.194.24.143:19439] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/ss.php"] [unique_id "alxiIURK6WUoKc-ijTGZtQAAAGY"]
[Sat Jul 18 23:35:29.461414 2026] [security2:error] [pid 898098:tid 898257] [client 173.239.196.165:49429] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/blue.php"] [unique_id "alxiIURK6WUoKc-ijTGZwgAAABk"]
[Sat Jul 18 23:35:29.625962 2026] [security2:error] [pid 898098:tid 898329] [client 4.194.24.143:29329] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/stats.php"] [unique_id "alxiIURK6WUoKc-ijTGZxQAAAGE"]
[Sat Jul 18 23:35:29.654654 2026] [security2:error] [pid 898098:tid 898247] [client 223.228.182.224:26041] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxiIURK6WUoKc-ijTGZxwAAAA8"]
[Sat Jul 18 23:35:29.654806 2026] [security2:error] [pid 898098:tid 898247] [client 223.228.182.224:26041] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxiIURK6WUoKc-ijTGZxwAAAA8"]
[Sat Jul 18 23:35:29.788196 2026] [security2:error] [pid 898098:tid 898318] [client 106.222.249.209:31634] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxiIURK6WUoKc-ijTGZygAAAFY"]
[Sat Jul 18 23:35:29.788281 2026] [security2:error] [pid 898098:tid 898318] [client 106.222.249.209:31634] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxiIURK6WUoKc-ijTGZygAAAFY"]
[Sat Jul 18 23:35:30.148112 2026] [security2:error] [pid 898098:tid 898305] [client 35.92.83.184:51790] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 184.83.92.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxiIkRK6WUoKc-ijTGZ1AAAAEk"]
[Sat Jul 18 23:35:30.181665 2026] [security2:error] [pid 898098:tid 898311] [client 4.194.24.143:19451] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/sump1.php"] [unique_id "alxiIkRK6WUoKc-ijTGZ1QAAAE8"]
[Sat Jul 18 23:35:30.367891 2026] [security2:error] [pid 898098:tid 898294] [client 173.239.196.166:45429] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/content.php"] [unique_id "alxiIkRK6WUoKc-ijTGZ3gAAAD4"]
[Sat Jul 18 23:35:30.725261 2026] [security2:error] [pid 898098:tid 898346] [client 4.194.24.143:29337] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/system.php"] [unique_id "alxiIkRK6WUoKc-ijTGZ5gAAAHI"]
[Sat Jul 18 23:35:30.784361 2026] [security2:error] [pid 898098:tid 898280] [client 74.208.214.194:56728] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxiIkRK6WUoKc-ijTGZ6QAAADA"]
[Sat Jul 18 23:35:31.258902 2026] [security2:error] [pid 898098:tid 898282] [client 173.239.196.162:49941] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/uploads/about.php"] [unique_id "alxiI0RK6WUoKc-ijTGaBwAAADI"]
[Sat Jul 18 23:35:31.313530 2026] [security2:error] [pid 898098:tid 898244] [client 4.194.24.143:19412] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/system/03n1hob7p03r2npdefault.php"] [unique_id "alxiI0RK6WUoKc-ijTGaCgAAAAw"]
[Sat Jul 18 23:35:31.398255 2026] [security2:error] [pid 897595:tid 897639] [remote 31.42.184.154:35980] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "guidehunting.com"] [uri "/wp-login.php"] [unique_id "alxiI-ZhsBlduL7gIyzAbwAAlyo"]
[Sat Jul 18 23:35:31.620057 2026] [security2:error] [pid 897595:tid 897661] [remote 31.42.184.154:35980] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "guidehunting.com"] [uri "/wp-login.php"] [unique_id "alxiI-ZhsBlduL7gIyzAdQAA_EA"], referer: https://guidehunting.com/wp-login.php
[Sat Jul 18 23:35:31.867004 2026] [security2:error] [pid 898098:tid 898166] [remote 31.42.184.154:35976] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxiI0RK6WUoKc-ijTGaHgAAf0A"]
[Sat Jul 18 23:35:31.937199 2026] [security2:error] [pid 898098:tid 898350] [client 4.194.24.143:19395] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/system/cj5ha2rah8lyiqqdefault.php"] [unique_id "alxiI0RK6WUoKc-ijTGaIgAAAHY"]
[Sat Jul 18 23:35:32.146161 2026] [security2:error] [pid 898098:tid 898168] [remote 31.42.184.154:35976] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxiJERK6WUoKc-ijTGaMwAAVkI"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:35:32.180860 2026] [security2:error] [pid 898098:tid 898327] [client 173.239.196.162:31433] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/wp-login.php"] [unique_id "alxiJERK6WUoKc-ijTGaNAAAAF8"]
[Sat Jul 18 23:35:32.353895 2026] [security2:error] [pid 897595:tid 897741] [client 170.23.3.130:50986] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.sesamegreenbeans.com"] [uri "/index.php"] [unique_id "alxiJOZhsBlduL7gIyzAhAAAlEM"]
[Sat Jul 18 23:35:32.491532 2026] [security2:error] [pid 897595:tid 897808] [client 4.194.24.143:47047] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/system_log.php"] [unique_id "alxiJOZhsBlduL7gIyzAkAAAANc"]
[Sat Jul 18 23:35:32.856075 2026] [security2:error] [pid 897595:tid 897767] [client 3.108.60.216:53848] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxiJOZhsBlduL7gIyzAnwAAAK4"]
[Sat Jul 18 23:35:32.856162 2026] [security2:error] [pid 897595:tid 897767] [client 3.108.60.216:53848] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxiJOZhsBlduL7gIyzAnwAAAK4"]
[Sat Jul 18 23:35:32.952015 2026] [security2:error] [pid 898098:tid 898139] [remote 97.74.93.24:34568] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "narv.co"] [uri "/wp-login.php"] [unique_id "alxiJERK6WUoKc-ijTGaUQAAfCU"]
[Sat Jul 18 23:35:33.035179 2026] [security2:error] [pid 898098:tid 898256] [client 4.194.24.143:20339] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/t.php"] [unique_id "alxiJURK6WUoKc-ijTGaUwAAABg"]
[Sat Jul 18 23:35:33.066092 2026] [security2:error] [pid 898098:tid 898266] [client 173.239.196.162:54499] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "alxiJURK6WUoKc-ijTGaVAAAACI"]
[Sat Jul 18 23:35:33.347379 2026] [security2:error] [pid 898098:tid 898344] [client 34.90.69.83:49152] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "cpcontacts.twy.mtk.mybluehost.me"] [uri "/"] [unique_id "alxiJURK6WUoKc-ijTGaXgAAAHA"]
[Sat Jul 18 23:35:33.347455 2026] [security2:error] [pid 898098:tid 898344] [client 34.90.69.83:49152] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "cpcontacts.twy.mtk.mybluehost.me"] [uri "/"] [unique_id "alxiJURK6WUoKc-ijTGaXgAAAHA"]
[Sat Jul 18 23:35:33.412737 2026] [security2:error] [pid 898098:tid 898122] [remote 97.74.93.24:34568] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "narv.co"] [uri "/wp-login.php"] [unique_id "alxiJURK6WUoKc-ijTGaZAAASBQ"], referer: https://narv.co/wp-login.php
[Sat Jul 18 23:35:33.657341 2026] [security2:error] [pid 898098:tid 898354] [client 4.194.24.143:29362] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/term.php"] [unique_id "alxiJURK6WUoKc-ijTGaagAAAHo"]
[Sat Jul 18 23:35:33.817675 2026] [proxy:error] [pid 898098:tid 898341] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:35:33.817741 2026] [proxy_http:error] [pid 898098:tid 898341] [client 193.47.62.168:48940] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:35:33.818204 2026] [proxy:error] [pid 898098:tid 898341] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:35:33.818239 2026] [proxy_http:error] [pid 898098:tid 898341] [client 193.47.62.168:48940] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:35:33.956995 2026] [security2:error] [pid 897595:tid 897798] [client 173.239.196.166:31351] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/languages/about.php"] [unique_id "alxiJeZhsBlduL7gIyzAwwAAAM0"]
[Sat Jul 18 23:35:33.959200 2026] [security2:error] [pid 898098:tid 898327] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxiJURK6WUoKc-ijTGabgAAAF8"]
[Sat Jul 18 23:35:34.154848 2026] [security2:error] [pid 898098:tid 898322] [client 163.61.1.17:52866] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxiJkRK6WUoKc-ijTGalgAAAFo"]
[Sat Jul 18 23:35:34.154984 2026] [security2:error] [pid 898098:tid 898322] [client 163.61.1.17:52866] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxiJkRK6WUoKc-ijTGalgAAAFo"]
[Sat Jul 18 23:35:34.201429 2026] [security2:error] [pid 897595:tid 897813] [client 4.194.24.143:18839] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/test.php"] [unique_id "alxiJuZhsBlduL7gIyzAywAAANw"]
[Sat Jul 18 23:35:34.414055 2026] [security2:error] [pid 898098:tid 898334] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxiJkRK6WUoKc-ijTGamAAAAGY"]
[Sat Jul 18 23:35:34.514535 2026] [security2:error] [pid 898098:tid 898317] [client 138.252.89.100:53437] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxiJkRK6WUoKc-ijTGatwAAAFU"]
[Sat Jul 18 23:35:34.514624 2026] [security2:error] [pid 898098:tid 898317] [client 138.252.89.100:53437] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxiJkRK6WUoKc-ijTGatwAAAFU"]
[Sat Jul 18 23:35:34.592628 2026] [security2:error] [pid 898098:tid 898263] [client 190.245.146.99:55676] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxiJkRK6WUoKc-ijTGauwAAAB8"]
[Sat Jul 18 23:35:34.592762 2026] [security2:error] [pid 898098:tid 898263] [client 190.245.146.99:55676] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxiJkRK6WUoKc-ijTGauwAAAB8"]
[Sat Jul 18 23:35:34.745212 2026] [security2:error] [pid 897595:tid 897757] [client 4.194.24.143:19413] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/test1.php"] [unique_id "alxiJuZhsBlduL7gIyzA2gAAAKQ"]
[Sat Jul 18 23:35:34.847993 2026] [security2:error] [pid 898098:tid 898353] [client 173.239.196.165:58809] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/wp-theme-editor/include.php"] [unique_id "alxiJkRK6WUoKc-ijTGawgAAAHk"]
[Sat Jul 18 23:35:35.145470 2026] [security2:error] [pid 898098:tid 898327] [client 69.5.169.98:9166] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "50.116.64.27"] [uri "/onvif/device_service"] [unique_id "alxiJ0RK6WUoKc-ijTGaywAAAF8"]
[Sat Jul 18 23:35:35.306108 2026] [security2:error] [pid 898098:tid 898284] [client 4.194.24.143:20332] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/tfm.php"] [unique_id "alxiJ0RK6WUoKc-ijTGa1wAAADQ"]
[Sat Jul 18 23:35:35.700802 2026] [security2:error] [pid 897595:tid 897841] [client 47.128.117.87:34258] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "drawingthedog.com"] [uri "/robots.txt"] [unique_id "alxiJ-ZhsBlduL7gIyzA-QAAAPg"]
[Sat Jul 18 23:35:35.739101 2026] [security2:error] [pid 898098:tid 898266] [client 173.239.196.165:22971] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/up/main.php"] [unique_id "alxiJ0RK6WUoKc-ijTGa5wAAACI"]
[Sat Jul 18 23:35:35.850106 2026] [security2:error] [pid 898098:tid 898307] [client 4.194.24.143:20344] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/thebe.php"] [unique_id "alxiJ0RK6WUoKc-ijTGa7QAAAEs"]
[Sat Jul 18 23:35:36.251858 2026] [security2:error] [pid 898098:tid 898223] [remote 209.42.18.223:51756] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.18.42.209.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxiKERK6WUoKc-ijTGa-AAATXg"]
[Sat Jul 18 23:35:36.407284 2026] [security2:error] [pid 897595:tid 897777] [client 4.194.24.143:20345] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/themes.php"] [unique_id "alxiKOZhsBlduL7gIyzBMwAAALg"]
[Sat Jul 18 23:35:36.629289 2026] [security2:error] [pid 897595:tid 897829] [client 173.239.196.167:24653] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/fonts/fontawesome-webfont.php"] [unique_id "alxiKOZhsBlduL7gIyzBWwAAAOw"]
[Sat Jul 18 23:35:36.974406 2026] [security2:error] [pid 898098:tid 898215] [remote 209.42.18.223:51756] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.18.42.209.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxiKERK6WUoKc-ijTGbAAAAI3A"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:35:36.979044 2026] [security2:error] [pid 897595:tid 897735] [client 4.194.24.143:19265] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/tiny.php"] [unique_id "alxiKOZhsBlduL7gIyzBbwAAAI4"]
[Sat Jul 18 23:35:36.991338 2026] [security2:error] [pid 897595:tid 897729] [client 57.141.18.64:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxiKOZhsBlduL7gIyzBYgAAAIg"]
[Sat Jul 18 23:35:37.120819 2026] [security2:error] [pid 898098:tid 898334] [client 34.90.69.83:49153] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "www.frontend.safe-systems.net"] [uri "/"] [unique_id "alxiKURK6WUoKc-ijTGbCgAAAGY"]
[Sat Jul 18 23:35:37.120884 2026] [security2:error] [pid 898098:tid 898334] [client 34.90.69.83:49153] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "www.frontend.safe-systems.net"] [uri "/"] [unique_id "alxiKURK6WUoKc-ijTGbCgAAAGY"]
[Sat Jul 18 23:35:37.524266 2026] [security2:error] [pid 898098:tid 898277] [client 4.194.24.143:29365] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ithurtsuntilyoudie.com"] [uri "/tmp/byp.php"] [unique_id "alxiKURK6WUoKc-ijTGbEgAAAC0"]
[Sat Jul 18 23:35:37.527852 2026] [security2:error] [pid 897595:tid 897810] [client 173.239.196.161:22479] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/wp-conflg.php"] [unique_id "alxiKeZhsBlduL7gIyzBgQAAANk"]
[Sat Jul 18 23:35:37.844602 2026] [security2:error] [pid 898098:tid 898317] [client 119.154.81.234:51399] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiKURK6WUoKc-ijTGbHwAAAFU"]
[Sat Jul 18 23:35:37.845073 2026] [security2:error] [pid 898098:tid 898317] [client 119.154.81.234:51399] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiKURK6WUoKc-ijTGbHwAAAFU"]
[Sat Jul 18 23:35:37.906535 2026] [security2:error] [pid 898098:tid 898296] [client 57.141.18.107:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxiKURK6WUoKc-ijTGbGQAAAEA"]
[Sat Jul 18 23:35:38.084589 2026] [security2:error] [pid 897595:tid 897678] [remote 31.42.184.154:36052] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxiKuZhsBlduL7gIyzBlwAAzFE"]
[Sat Jul 18 23:35:38.100146 2026] [security2:error] [pid 897595:tid 897617] [remote 31.42.184.154:36044] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "momheadquarters.com"] [uri "/wp-login.php"] [unique_id "alxiKuZhsBlduL7gIyzBmAAA4xQ"]
[Sat Jul 18 23:35:38.312417 2026] [security2:error] [pid 897595:tid 897720] [remote 31.42.184.154:36052] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxiKuZhsBlduL7gIyzBnQAAqXs"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:35:38.386176 2026] [security2:error] [pid 897595:tid 897783] [client 173.239.196.167:24953] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/includes/about.php"] [unique_id "alxiKuZhsBlduL7gIyzBogAAAL4"]
[Sat Jul 18 23:35:38.563203 2026] [security2:error] [pid 897595:tid 897616] [remote 31.42.184.154:36044] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "momheadquarters.com"] [uri "/wp-login.php"] [unique_id "alxiKuZhsBlduL7gIyzBpgAAvRM"], referer: https://momheadquarters.com/wp-login.php
[Sat Jul 18 23:35:38.732896 2026] [security2:error] [pid 897595:tid 897741] [client 136.243.222.140:57972] ModSecurity: Warning. Matched phrase "DomainStatsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "www.ccsdifference.com"] [uri "/index.php"] [unique_id "alxiKuZhsBlduL7gIyzBnwAAAOg"]
[Sat Jul 18 23:35:39.261258 2026] [security2:error] [pid 898098:tid 898307] [client 173.239.196.164:28215] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "alxiK0RK6WUoKc-ijTGbUQAAAEs"]
[Sat Jul 18 23:35:39.476615 2026] [security2:error] [pid 898098:tid 898257] [client 180.252.198.240:54469] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiK0RK6WUoKc-ijTGbVwAAABk"]
[Sat Jul 18 23:35:39.476711 2026] [security2:error] [pid 898098:tid 898257] [client 180.252.198.240:54469] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiK0RK6WUoKc-ijTGbVwAAABk"]
[Sat Jul 18 23:35:39.556561 2026] [security2:error] [pid 897595:tid 897785] [client 50.116.65.227:46566] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxiK-ZhsBlduL7gIyzBvwAAAMA"]
[Sat Jul 18 23:35:39.572435 2026] [security2:error] [pid 898098:tid 898254] [client 50.116.65.227:52304] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxiK0RK6WUoKc-ijTGbXAAAABY"]
[Sat Jul 18 23:35:39.946922 2026] [security2:error] [pid 898098:tid 898118] [remote 74.235.96.117:45776] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.235.74.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "savilerowtravel.com"] [uri "/wp-login.php"] [unique_id "alxiK0RK6WUoKc-ijTGbawAAHRA"]
[Sat Jul 18 23:35:40.127852 2026] [security2:error] [pid 898098:tid 898296] [client 173.239.196.165:42845] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/images/images/about.php"] [unique_id "alxiLERK6WUoKc-ijTGbdAAAAEA"]
[Sat Jul 18 23:35:40.420352 2026] [security2:error] [pid 898098:tid 898115] [remote 74.235.96.117:45776] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.235.74.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "savilerowtravel.com"] [uri "/wp-login.php"] [unique_id "alxiLERK6WUoKc-ijTGbfAAAKA0"], referer: https://savilerowtravel.com/wp-login.php
[Sat Jul 18 23:35:40.871333 2026] [security2:error] [pid 898098:tid 898299] [client 223.228.182.224:60735] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxiLERK6WUoKc-ijTGbjQAAAEM"]
[Sat Jul 18 23:35:40.871385 2026] [security2:error] [pid 898098:tid 898150] [remote 31.42.184.154:51556] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "petpawo.com"] [uri "/wp-login.php"] [unique_id "alxiLERK6WUoKc-ijTGbjgAAXjA"]
[Sat Jul 18 23:35:40.875460 2026] [security2:error] [pid 898098:tid 898299] [client 223.228.182.224:60735] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxiLERK6WUoKc-ijTGbjQAAAEM"]
[Sat Jul 18 23:35:40.971250 2026] [security2:error] [pid 898098:tid 898238] [client 173.239.196.162:41299] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/images/class.php"] [unique_id "alxiLERK6WUoKc-ijTGbkgAAAAY"]
[Sat Jul 18 23:35:41.213644 2026] [proxy:error] [pid 898098:tid 898297] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:35:41.213722 2026] [proxy_http:error] [pid 898098:tid 898297] [client 193.47.62.168:51082] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:35:41.214190 2026] [proxy:error] [pid 898098:tid 898297] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:35:41.214217 2026] [proxy_http:error] [pid 898098:tid 898297] [client 193.47.62.168:51082] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:35:41.295399 2026] [security2:error] [pid 898098:tid 898179] [remote 31.42.184.154:51556] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "petpawo.com"] [uri "/wp-login.php"] [unique_id "alxiLURK6WUoKc-ijTGblwAAGEw"], referer: https://petpawo.com/wp-login.php
[Sat Jul 18 23:35:41.410340 2026] [security2:error] [pid 898098:tid 898168] [remote 31.42.184.154:51570] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "naturalsolutionsurbanforestry.com"] [uri "/wp-login.php"] [unique_id "alxiLURK6WUoKc-ijTGbnQAALEI"]
[Sat Jul 18 23:35:41.419976 2026] [security2:error] [pid 897595:tid 897726] [client 106.222.249.209:12372] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxiLeZhsBlduL7gIyzB-wAAAIU"]
[Sat Jul 18 23:35:41.420080 2026] [security2:error] [pid 897595:tid 897726] [client 106.222.249.209:12372] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxiLeZhsBlduL7gIyzB-wAAAIU"]
[Sat Jul 18 23:35:41.686423 2026] [security2:error] [pid 898098:tid 898170] [remote 31.42.184.154:51570] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "naturalsolutionsurbanforestry.com"] [uri "/wp-login.php"] [unique_id "alxiLURK6WUoKc-ijTGbqwAAKUQ"], referer: https://naturalsolutionsurbanforestry.com/wp-login.php
[Sat Jul 18 23:35:41.702352 2026] [security2:error] [pid 898098:tid 898304] [client 152.232.150.169:21034] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.sesamegreenbeans.com"] [uri "/index.php"] [unique_id "alxiLURK6WUoKc-ijTGbowAASCw"]
[Sat Jul 18 23:35:41.810125 2026] [security2:error] [pid 898098:tid 898288] [client 173.239.196.161:27117] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/autoload_classmap.php"] [unique_id "alxiLURK6WUoKc-ijTGbsQAAADg"]
[Sat Jul 18 23:35:42.671558 2026] [security2:error] [pid 897595:tid 897810] [client 173.239.196.165:41007] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/web.php"] [unique_id "alxiLuZhsBlduL7gIyzCTwAAANk"]
[Sat Jul 18 23:35:43.472127 2026] [security2:error] [pid 897595:tid 897602] [remote 31.42.184.154:51584] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxiL-ZhsBlduL7gIyzCjAAA0gU"]
[Sat Jul 18 23:35:43.472299 2026] [security2:error] [pid 897595:tid 897803] [client 31.42.184.154:51584] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxiL-ZhsBlduL7gIyzCjAAA0gU"]
[Sat Jul 18 23:35:43.561312 2026] [security2:error] [pid 897595:tid 897843] [client 173.239.196.167:27891] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/ocean/about.php"] [unique_id "alxiL-ZhsBlduL7gIyzCkwAAAPo"]
[Sat Jul 18 23:35:44.397071 2026] [security2:error] [pid 897595:tid 897621] [remote 91.142.222.105:47608] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tejasenvironmental.com"] [uri "/wp-login.php"] [unique_id "alxiMOZhsBlduL7gIyzCyAAAkhg"]
[Sat Jul 18 23:35:44.403026 2026] [security2:error] [pid 897595:tid 897792] [client 173.239.196.167:25747] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/images/index.php"] [unique_id "alxiMOZhsBlduL7gIyzCygAAAMc"]
[Sat Jul 18 23:35:44.441606 2026] [security2:error] [pid 897595:tid 897803] [client 50.116.65.227:52354] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.fkconstructionfunding.com"] [uri "/index.php"] [unique_id "alxiMOZhsBlduL7gIyzCwAAAANI"]
[Sat Jul 18 23:35:44.557225 2026] [security2:error] [pid 897595:tid 897825] [client 163.61.1.17:53344] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxiMOZhsBlduL7gIyzC3AAAAOg"]
[Sat Jul 18 23:35:44.557327 2026] [security2:error] [pid 897595:tid 897825] [client 163.61.1.17:53344] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxiMOZhsBlduL7gIyzC3AAAAOg"]
[Sat Jul 18 23:35:44.614484 2026] [security2:error] [pid 897595:tid 897826] [client 50.116.65.227:52358] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.fkconstructionfunding.com"] [uri "/index.php"] [unique_id "alxiMOZhsBlduL7gIyzC0AAAAOk"]
[Sat Jul 18 23:35:44.863483 2026] [security2:error] [pid 897595:tid 897690] [remote 91.142.222.105:47608] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tejasenvironmental.com"] [uri "/wp-login.php"] [unique_id "alxiMOZhsBlduL7gIyzC6gAAwV0"], referer: https://tejasenvironmental.com/wp-login.php
[Sat Jul 18 23:35:45.153762 2026] [security2:error] [pid 897595:tid 897818] [client 190.245.146.99:56198] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxiMeZhsBlduL7gIyzDAgAAAOE"]
[Sat Jul 18 23:35:45.159650 2026] [security2:error] [pid 897595:tid 897818] [client 190.245.146.99:56198] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxiMeZhsBlduL7gIyzDAgAAAOE"]
[Sat Jul 18 23:35:45.254417 2026] [security2:error] [pid 897595:tid 897770] [client 173.239.196.166:34421] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/bypass.php"] [unique_id "alxiMeZhsBlduL7gIyzDBQAAALE"]
[Sat Jul 18 23:35:46.037562 2026] [security2:error] [pid 897595:tid 897747] [client 138.252.89.100:53932] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxiMuZhsBlduL7gIyzDPQAAAJo"]
[Sat Jul 18 23:35:46.037664 2026] [security2:error] [pid 897595:tid 897747] [client 138.252.89.100:53932] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxiMuZhsBlduL7gIyzDPQAAAJo"]
[Sat Jul 18 23:35:46.058815 2026] [security2:error] [pid 897595:tid 897780] [client 45.145.137.251:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "locketsandcharms.com"] [uri "/index.php"] [unique_id "alxiMOZhsBlduL7gIyzC4wAAALs"]
[Sat Jul 18 23:35:46.063112 2026] [security2:error] [pid 897595:tid 897752] [client 139.167.225.146:50510] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxiMuZhsBlduL7gIyzDPAAAAJ8"]
[Sat Jul 18 23:35:46.063226 2026] [security2:error] [pid 897595:tid 897752] [client 139.167.225.146:50510] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxiMuZhsBlduL7gIyzDPAAAAJ8"]
[Sat Jul 18 23:35:46.099286 2026] [security2:error] [pid 897595:tid 897728] [client 173.239.196.163:23929] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "alxiMuZhsBlduL7gIyzDQgAAAIc"]
[Sat Jul 18 23:35:46.149712 2026] [security2:error] [pid 897595:tid 897759] [client 34.91.213.89:49153] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "webdisk.thh.mtk.mybluehost.me"] [uri "/"] [unique_id "alxiMuZhsBlduL7gIyzDSQAAAKY"]
[Sat Jul 18 23:35:46.149816 2026] [security2:error] [pid 897595:tid 897759] [client 34.91.213.89:49153] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "webdisk.thh.mtk.mybluehost.me"] [uri "/"] [unique_id "alxiMuZhsBlduL7gIyzDSQAAAKY"]
[Sat Jul 18 23:35:46.960757 2026] [security2:error] [pid 897595:tid 897738] [client 173.239.196.165:24939] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/midnight/install.php"] [unique_id "alxiMuZhsBlduL7gIyzDdAAAAJE"]
[Sat Jul 18 23:35:47.356472 2026] [security2:error] [pid 897595:tid 897816] [client 51.68.236.92:22487] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.aosta.nz"] [uri "/robots.txt"] [unique_id "alxiM-ZhsBlduL7gIyzDkwAAAN8"]
[Sat Jul 18 23:35:47.356562 2026] [security2:error] [pid 897595:tid 897816] [client 51.68.236.92:22487] ModSecurity: Warning. Matched phrase "MJ12bot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "www.aosta.nz"] [uri "/robots.txt"] [unique_id "alxiM-ZhsBlduL7gIyzDkwAAAN8"]
[Sat Jul 18 23:35:47.397225 2026] [security2:error] [pid 897595:tid 897847] [client 52.221.236.148:51694] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 148.236.221.52.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxiM-ZhsBlduL7gIyzDlgAAAP4"]
[Sat Jul 18 23:35:47.464138 2026] [core:error] [pid 897595:tid 897785] [client 103.96.147.148:36882] AH10244: invalid URI path (/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh)
[Sat Jul 18 23:35:47.853568 2026] [security2:error] [pid 897595:tid 897829] [client 173.239.196.167:21227] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-trackback.php"] [unique_id "alxiM-ZhsBlduL7gIyzDugAAAOw"]
[Sat Jul 18 23:35:48.420727 2026] [security2:error] [pid 897595:tid 897793] [client 119.154.81.234:51861] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiNOZhsBlduL7gIyzD3QAAAMg"]
[Sat Jul 18 23:35:48.420830 2026] [security2:error] [pid 897595:tid 897738] [client 113.160.97.242:64359] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxiNOZhsBlduL7gIyzD3gAAAJE"]
[Sat Jul 18 23:35:48.420857 2026] [security2:error] [pid 897595:tid 897793] [client 119.154.81.234:51861] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiNOZhsBlduL7gIyzD3QAAAMg"]
[Sat Jul 18 23:35:48.436322 2026] [security2:error] [pid 897595:tid 897782] [client 52.221.236.148:51700] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 148.236.221.52.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxiNOZhsBlduL7gIyzD3wAAAL0"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:35:48.483584 2026] [security2:error] [pid 897595:tid 897611] [remote 152.228.213.32:45324] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxiNOZhsBlduL7gIyzD4wAA4Q4"]
[Sat Jul 18 23:35:48.694539 2026] [security2:error] [pid 897595:tid 897649] [remote 152.228.213.32:45324] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxiNOZhsBlduL7gIyzD-gAA3zQ"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:35:49.925698 2026] [security2:error] [pid 897595:tid 897788] [client 173.239.196.165:26461] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "alxiNeZhsBlduL7gIyzEWQAAAMM"]
[Sat Jul 18 23:35:49.945956 2026] [security2:error] [pid 897595:tid 897743] [client 180.252.198.240:54939] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiNeZhsBlduL7gIyzEWwAAAJY"]
[Sat Jul 18 23:35:49.946104 2026] [security2:error] [pid 897595:tid 897743] [client 180.252.198.240:54939] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiNeZhsBlduL7gIyzEWwAAAJY"]
[Sat Jul 18 23:35:50.813329 2026] [security2:error] [pid 897595:tid 897765] [client 173.239.196.163:30837] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/radio.php"] [unique_id "alxiNuZhsBlduL7gIyzEmAAAAKw"]
[Sat Jul 18 23:35:51.432698 2026] [security2:error] [pid 897595:tid 897794] [client 223.228.182.224:11248] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxiN-ZhsBlduL7gIyzEvwAAAMk"]
[Sat Jul 18 23:35:51.437330 2026] [security2:error] [pid 897595:tid 897794] [client 223.228.182.224:11248] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxiN-ZhsBlduL7gIyzEvwAAAMk"]
[Sat Jul 18 23:35:51.693658 2026] [security2:error] [pid 897595:tid 897819] [client 173.239.196.163:33003] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/mah.php"] [unique_id "alxiN-ZhsBlduL7gIyzE0AAAAOI"]
[Sat Jul 18 23:35:52.497706 2026] [security2:error] [pid 897595:tid 897814] [client 106.222.249.209:17270] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxiOOZhsBlduL7gIyzFCgAAAN0"]
[Sat Jul 18 23:35:52.497841 2026] [security2:error] [pid 897595:tid 897814] [client 106.222.249.209:17270] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxiOOZhsBlduL7gIyzFCgAAAN0"]
[Sat Jul 18 23:35:52.579625 2026] [security2:error] [pid 897595:tid 897754] [client 173.239.196.163:31331] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/dummyyummy/wp-signup.php"] [unique_id "alxiOOZhsBlduL7gIyzFDwAAAKE"]
[Sat Jul 18 23:35:53.528685 2026] [security2:error] [pid 897595:tid 897766] [client 173.239.196.166:55163] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "alxiOeZhsBlduL7gIyzFTQAAAK0"]
[Sat Jul 18 23:35:53.576786 2026] [security2:error] [pid 897595:tid 897710] [remote 72.167.132.114:50586] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nextlevelpressurewashing.com"] [uri "/wp-login.php"] [unique_id "alxiOeZhsBlduL7gIyzFVgAA5HE"]
[Sat Jul 18 23:35:53.901506 2026] [security2:error] [pid 897595:tid 897635] [remote 72.167.132.114:50586] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nextlevelpressurewashing.com"] [uri "/wp-login.php"] [unique_id "alxiOeZhsBlduL7gIyzFagAAzSY"], referer: https://nextlevelpressurewashing.com/wp-login.php
[Sat Jul 18 23:35:54.419075 2026] [security2:error] [pid 897595:tid 897844] [client 173.239.196.166:58115] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-conflg.php"] [unique_id "alxiOuZhsBlduL7gIyzFggAAAPs"]
[Sat Jul 18 23:35:55.149855 2026] [security2:error] [pid 897595:tid 897778] [client 163.61.1.17:53819] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxiO-ZhsBlduL7gIyzFuwAAALk"]
[Sat Jul 18 23:35:55.150065 2026] [security2:error] [pid 897595:tid 897778] [client 163.61.1.17:53819] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxiO-ZhsBlduL7gIyzFuwAAALk"]
[Sat Jul 18 23:35:55.317042 2026] [security2:error] [pid 897595:tid 897831] [client 173.239.196.165:46037] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-setup.php"] [unique_id "alxiO-ZhsBlduL7gIyzFwQAAAO4"]
[Sat Jul 18 23:35:55.702394 2026] [security2:error] [pid 897595:tid 897767] [client 190.245.146.99:56719] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxiO-ZhsBlduL7gIyzF2AAAAK4"]
[Sat Jul 18 23:35:55.708780 2026] [security2:error] [pid 897595:tid 897767] [client 190.245.146.99:56719] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxiO-ZhsBlduL7gIyzF2AAAAK4"]
[Sat Jul 18 23:35:56.085873 2026] [ssl:error] [pid 897595:tid 897817] [client 18.235.110.182:30710] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname mail.familiaconsciente.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:35:56.225108 2026] [security2:error] [pid 897595:tid 897825] [client 173.239.196.160:32623] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/ms-themes.php"] [unique_id "alxiPOZhsBlduL7gIyzF_AAAAOg"]
[Sat Jul 18 23:35:56.497544 2026] [security2:error] [pid 897595:tid 897822] [client 139.167.225.146:51228] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxiPOZhsBlduL7gIyzGEgAAAOU"]
[Sat Jul 18 23:35:56.497637 2026] [security2:error] [pid 897595:tid 897822] [client 139.167.225.146:51228] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxiPOZhsBlduL7gIyzGEgAAAOU"]
[Sat Jul 18 23:35:56.525060 2026] [security2:error] [pid 897595:tid 897738] [client 103.251.217.36:42891] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "toddnielsen.com"] [uri "/index.php"] [unique_id "alxiO-ZhsBlduL7gIyzF1wAAkRw"], referer: https://toddnielsen.com
[Sat Jul 18 23:35:56.860992 2026] [security2:error] [pid 897595:tid 897790] [client 18.193.106.195:46030] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 195.106.193.18.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxiPOZhsBlduL7gIyzGJwAAAMU"]
[Sat Jul 18 23:35:56.861195 2026] [security2:error] [pid 897595:tid 897790] [client 18.193.106.195:46030] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxiPOZhsBlduL7gIyzGJwAAAMU"]
[Sat Jul 18 23:35:57.126980 2026] [security2:error] [pid 897595:tid 897753] [client 173.239.196.161:51681] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/assets/about.php"] [unique_id "alxiPeZhsBlduL7gIyzGOQAAAKA"]
[Sat Jul 18 23:35:57.431399 2026] [security2:error] [pid 897595:tid 897797] [client 151.244.200.216:37803] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "gertoger.org"] [uri "/index.php"] [unique_id "alxiPeZhsBlduL7gIyzGTQAAzBY"]
[Sat Jul 18 23:35:57.603284 2026] [security2:error] [pid 897595:tid 897780] [client 57.141.18.54:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxiPeZhsBlduL7gIyzGUgAAALs"]
[Sat Jul 18 23:35:57.630548 2026] [security2:error] [pid 897595:tid 897738] [client 138.252.89.100:54436] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxiPeZhsBlduL7gIyzGagAAAJE"]
[Sat Jul 18 23:35:57.630641 2026] [security2:error] [pid 897595:tid 897738] [client 138.252.89.100:54436] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxiPeZhsBlduL7gIyzGagAAAJE"]
[Sat Jul 18 23:35:57.986555 2026] [security2:error] [pid 897595:tid 897793] [client 173.239.196.166:49183] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/style.php"] [unique_id "alxiPeZhsBlduL7gIyzGfwAAAMg"]
[Sat Jul 18 23:35:58.095167 2026] [security2:error] [pid 897595:tid 897716] [remote 31.42.184.154:43810] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxiPuZhsBlduL7gIyzGhAAA3Xc"]
[Sat Jul 18 23:35:58.186632 2026] [security2:error] [pid 897595:tid 897750] [client 15.237.217.26:33164] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 26.217.237.15.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxiPuZhsBlduL7gIyzGiQAAAJ0"]
[Sat Jul 18 23:35:58.455440 2026] [security2:error] [pid 897595:tid 897765] [client 50.116.65.227:51270] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxiPuZhsBlduL7gIyzGpwAAAKw"]
[Sat Jul 18 23:35:58.469728 2026] [security2:error] [pid 897595:tid 897770] [client 50.116.65.227:41892] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxiPuZhsBlduL7gIyzGqgAAALE"]
[Sat Jul 18 23:35:58.513240 2026] [security2:error] [pid 897595:tid 897608] [remote 31.42.184.154:43810] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxiPuZhsBlduL7gIyzGrQAA4gs"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:35:58.828608 2026] [security2:error] [pid 897595:tid 897821] [client 173.239.196.167:53929] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/infi.php"] [unique_id "alxiPuZhsBlduL7gIyzGywAAAOQ"]
[Sat Jul 18 23:35:58.880246 2026] [security2:error] [pid 897595:tid 897761] [client 119.154.81.234:52319] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.81.154.119.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiPuZhsBlduL7gIyzGzQAAAKg"]
[Sat Jul 18 23:35:58.880362 2026] [security2:error] [pid 897595:tid 897761] [client 119.154.81.234:52319] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiPuZhsBlduL7gIyzGzQAAAKg"]
[Sat Jul 18 23:35:59.590999 2026] [security2:error] [pid 897595:tid 897800] [client 34.147.91.161:8193] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "webdisk.amalia-capital.com"] [uri "/"] [unique_id "alxiP-ZhsBlduL7gIyzHAAAAAM8"]
[Sat Jul 18 23:35:59.591076 2026] [security2:error] [pid 897595:tid 897800] [client 34.147.91.161:8193] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "webdisk.amalia-capital.com"] [uri "/"] [unique_id "alxiP-ZhsBlduL7gIyzHAAAAAM8"]
[Sat Jul 18 23:35:59.593066 2026] [security2:error] [pid 897595:tid 897606] [remote 41.186.86.12:6520] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "momheadquarters.com"] [uri "/wp-login.php"] [unique_id "alxiP-ZhsBlduL7gIyzG_wAArgk"]
[Sat Jul 18 23:35:59.688882 2026] [security2:error] [pid 897595:tid 897824] [client 173.239.196.167:42547] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/maint/index.php"] [unique_id "alxiP-ZhsBlduL7gIyzHBwAAAOc"]
[Sat Jul 18 23:35:59.748854 2026] [security2:error] [pid 897595:tid 897611] [remote 103.74.123.7:38202] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 7.123.74.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "margaretspeckogawa.com"] [uri "/wp-login.php"] [unique_id "alxiP-ZhsBlduL7gIyzHCwAA4A4"]
[Sat Jul 18 23:36:00.243114 2026] [security2:error] [pid 897595:tid 897661] [remote 103.74.123.7:38202] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 7.123.74.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "margaretspeckogawa.com"] [uri "/wp-login.php"] [unique_id "alxiQOZhsBlduL7gIyzHLgAAp0A"], referer: https://margaretspeckogawa.com/wp-login.php
[Sat Jul 18 23:36:00.296264 2026] [security2:error] [pid 897595:tid 897677] [remote 220.181.108.156:24329] ModSecurity: Access denied with code 406 (phase 2). Match of "beginsWith %{request_headers.host}" against "TX:1" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "504"] [id "340162"] [rev "302"] [msg "Atomicorp.com WAF Rules: Remote File Injection Attack detected (Unauthorized URL detected as argument)"] [data ",TX:1"] [severity "CRITICAL"] [hostname "mollycahill.com"] [uri "/"] [unique_id "alxiQOZhsBlduL7gIyzHOwAAl1A"]
[Sat Jul 18 23:36:00.399349 2026] [security2:error] [pid 897595:tid 897832] [client 180.252.198.240:55387] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiQOZhsBlduL7gIyzHPgAAAO8"]
[Sat Jul 18 23:36:00.399491 2026] [security2:error] [pid 897595:tid 897832] [client 180.252.198.240:55387] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiQOZhsBlduL7gIyzHPgAAAO8"]
[Sat Jul 18 23:36:00.430127 2026] [security2:error] [pid 897595:tid 897670] [remote 41.186.86.12:6520] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "momheadquarters.com"] [uri "/wp-login.php"] [unique_id "alxiQOZhsBlduL7gIyzHPwAA50k"], referer: https://momheadquarters.com/wp-login.php
[Sat Jul 18 23:36:00.545694 2026] [security2:error] [pid 897595:tid 897730] [client 173.239.196.166:37253] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/x.php"] [unique_id "alxiQOZhsBlduL7gIyzHRAAAAIk"]
[Sat Jul 18 23:36:01.136580 2026] [security2:error] [pid 897595:tid 897800] [client 13.38.58.119:61880] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.58.38.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxiQeZhsBlduL7gIyzHbAAAAM8"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:36:01.425036 2026] [security2:error] [pid 897595:tid 897768] [client 173.239.196.167:30123] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/IXR/index.php"] [unique_id "alxiQeZhsBlduL7gIyzHigAAAK8"]
[Sat Jul 18 23:36:02.059298 2026] [security2:error] [pid 897595:tid 897629] [remote 119.249.100.50:36597] ModSecurity: Access denied with code 406 (phase 2). Match of "beginsWith %{request_headers.host}" against "TX:1" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "504"] [id "340162"] [rev "302"] [msg "Atomicorp.com WAF Rules: Remote File Injection Attack detected (Unauthorized URL detected as argument)"] [data ",TX:1"] [severity "CRITICAL"] [hostname "mollycahill.com"] [uri "/"] [unique_id "alxiQuZhsBlduL7gIyzHrQAA2yA"]
[Sat Jul 18 23:36:02.213881 2026] [security2:error] [pid 897595:tid 897781] [client 223.228.182.224:46106] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxiQuZhsBlduL7gIyzHswAAALw"]
[Sat Jul 18 23:36:02.213978 2026] [security2:error] [pid 897595:tid 897781] [client 223.228.182.224:46106] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxiQuZhsBlduL7gIyzHswAAALw"]
[Sat Jul 18 23:36:02.326931 2026] [security2:error] [pid 897595:tid 897776] [client 173.239.196.161:23157] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/css/index.php"] [unique_id "alxiQuZhsBlduL7gIyzHvwAAALc"]
[Sat Jul 18 23:36:03.166117 2026] [security2:error] [pid 897595:tid 897798] [client 173.239.196.166:60441] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/images/index22.php"] [unique_id "alxiQ-ZhsBlduL7gIyzH8AAAAM0"]
[Sat Jul 18 23:36:03.795849 2026] [security2:error] [pid 897595:tid 897741] [client 106.222.249.209:7981] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxiQ-ZhsBlduL7gIyzIDwAAAJQ"]
[Sat Jul 18 23:36:03.795957 2026] [security2:error] [pid 897595:tid 897741] [client 106.222.249.209:7981] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxiQ-ZhsBlduL7gIyzIDwAAAJQ"]
[Sat Jul 18 23:36:04.030658 2026] [security2:error] [pid 897595:tid 897817] [client 173.239.196.165:40321] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-user.php"] [unique_id "alxiROZhsBlduL7gIyzIGwAAAOA"]
[Sat Jul 18 23:36:04.914899 2026] [security2:error] [pid 897595:tid 897742] [client 173.239.196.163:55489] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/pomo/about.php"] [unique_id "alxiROZhsBlduL7gIyzIRQAAAJU"]
[Sat Jul 18 23:36:05.606286 2026] [security2:error] [pid 897595:tid 897846] [client 163.61.1.17:54307] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxiReZhsBlduL7gIyzIcgAAAP0"]
[Sat Jul 18 23:36:05.607901 2026] [security2:error] [pid 897595:tid 897846] [client 163.61.1.17:54307] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxiReZhsBlduL7gIyzIcgAAAP0"]
[Sat Jul 18 23:36:05.782628 2026] [security2:error] [pid 897595:tid 897831] [client 173.239.196.162:21079] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/pomo/index.php"] [unique_id "alxiReZhsBlduL7gIyzIfAAAAO4"]
[Sat Jul 18 23:36:05.949916 2026] [security2:error] [pid 897595:tid 897619] [remote 152.228.213.32:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "innovativecleaningsvs.com"] [uri "/wp-login.php"] [unique_id "alxiReZhsBlduL7gIyzIiQAAsBY"]
[Sat Jul 18 23:36:06.176259 2026] [security2:error] [pid 897595:tid 897840] [client 190.245.146.99:57247] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxiRuZhsBlduL7gIyzImQAAAPc"]
[Sat Jul 18 23:36:06.182051 2026] [security2:error] [pid 897595:tid 897840] [client 190.245.146.99:57247] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxiRuZhsBlduL7gIyzImQAAAPc"]
[Sat Jul 18 23:36:06.268155 2026] [security2:error] [pid 897595:tid 897836] [client 139.167.225.146:51876] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxiRuZhsBlduL7gIyzInwAAAPM"]
[Sat Jul 18 23:36:06.268241 2026] [security2:error] [pid 897595:tid 897836] [client 139.167.225.146:51876] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxiRuZhsBlduL7gIyzInwAAAPM"]
[Sat Jul 18 23:36:06.486956 2026] [security2:error] [pid 897595:tid 897712] [remote 152.228.213.32:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "innovativecleaningsvs.com"] [uri "/wp-login.php"] [unique_id "alxiRuZhsBlduL7gIyzIsQAArHM"], referer: https://innovativecleaningsvs.com/wp-login.php
[Sat Jul 18 23:36:06.651421 2026] [security2:error] [pid 897595:tid 897802] [client 173.239.196.161:40851] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/config.php"] [unique_id "alxiRuZhsBlduL7gIyzIvgAAANE"]
[Sat Jul 18 23:36:07.004161 2026] [security2:error] [pid 897595:tid 897815] [client 157.100.107.3:6212] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "thewelloiledlife.com"] [uri "/index.php"] [unique_id "alxiReZhsBlduL7gIyzIdQAAAN4"], referer: https://thewelloiledlife.com/
[Sat Jul 18 23:36:07.514493 2026] [security2:error] [pid 897595:tid 897801] [client 173.239.196.162:61591] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/special.php"] [unique_id "alxiR-ZhsBlduL7gIyzI9gAAANA"]
[Sat Jul 18 23:36:07.777819 2026] [proxy:error] [pid 897595:tid 897845] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:36:07.777875 2026] [proxy_http:error] [pid 897595:tid 897845] [client 193.47.62.168:34128] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:36:07.778290 2026] [proxy:error] [pid 897595:tid 897845] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:36:07.778314 2026] [proxy_http:error] [pid 897595:tid 897845] [client 193.47.62.168:34128] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:36:08.015330 2026] [security2:error] [pid 897595:tid 897819] [client 34.90.69.83:49154] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "tt-pruebas.safe-systems.net"] [uri "/"] [unique_id "alxiSOZhsBlduL7gIyzJEgAAAOI"]
[Sat Jul 18 23:36:08.015401 2026] [security2:error] [pid 897595:tid 897819] [client 34.90.69.83:49154] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "tt-pruebas.safe-systems.net"] [uri "/"] [unique_id "alxiSOZhsBlduL7gIyzJEgAAAOI"]
[Sat Jul 18 23:36:08.371601 2026] [security2:error] [pid 897595:tid 897733] [client 173.239.196.163:33015] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/assets/script.js.php"] [unique_id "alxiSOZhsBlduL7gIyzJKQAAAIw"]
[Sat Jul 18 23:36:08.400189 2026] [security2:error] [pid 897595:tid 897770] [client 54.184.226.94:0] ModSecurity: Warning. Matched phrase "Sucuri" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "youpositive.co"] [uri "/index.php"] [unique_id "alxiRuZhsBlduL7gIyzIzQAAALE"]
[Sat Jul 18 23:36:08.402726 2026] [security2:error] [pid 897595:tid 897769] [client 54.184.226.94:12629] ModSecurity: Warning. Matched phrase "Sucuri" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "youpositive.co"] [uri "/"] [unique_id "alxiRuZhsBlduL7gIyzIygAAALA"]
[Sat Jul 18 23:36:08.562281 2026] [security2:error] [pid 897595:tid 897779] [client 185.41.120.32:3518] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "whiteoutcb.com"] [uri "/wp-login.php"] [unique_id "alxiSOZhsBlduL7gIyzJPAAAALo"], referer: https://www.google.com
[Sat Jul 18 23:36:08.575238 2026] [security2:error] [pid 897595:tid 897797] [client 104.28.214.112:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "thebestreps.net"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "alxiSOZhsBlduL7gIyzJPwAAAMw"]
[Sat Jul 18 23:36:08.656900 2026] [security2:error] [pid 897595:tid 897734] [client 185.41.120.32:7758] ModSecurity: Warning. String match "408" at RESPONSE_STATUS. [file "/etc/httpd/modsecurity.d/03_asl_dos.conf"] [line "35"] [id "343434"] [rev "1"] [msg "Atomicorp.com WAF Rules: Client Connection dropped by Apache due to slow connection, possible Slowaris attack"] [severity "WARNING"] [hostname "whiteoutcb.com"] [uri "/xmlrpc.php"] [unique_id "alxiPuZhsBlduL7gIyzGswAAAI0"]
[Sat Jul 18 23:36:08.656963 2026] [security2:error] [pid 897595:tid 897734] [client 185.41.120.32:7758] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "408"] [hostname "whiteoutcb.com"] [uri "/xmlrpc.php"] [unique_id "alxiPuZhsBlduL7gIyzGswAAAI0"]
[Sat Jul 18 23:36:09.140911 2026] [security2:error] [pid 897595:tid 897800] [client 54.184.226.94:0] ModSecurity: Warning. Matched phrase "Sucuri" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "youpositive.co"] [uri "/index.php"] [unique_id "alxiSOZhsBlduL7gIyzJNgAAAM8"], referer: https://youpositive.co/?rnd=1784439366623
[Sat Jul 18 23:36:09.143589 2026] [security2:error] [pid 897595:tid 897801] [client 54.184.226.94:12629] ModSecurity: Warning. Matched phrase "Sucuri" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "youpositive.co"] [uri "/ar/"] [unique_id "alxiSOZhsBlduL7gIyzJLQAAANA"], referer: https://youpositive.co/?rnd=1784439366623
[Sat Jul 18 23:36:09.233672 2026] [security2:error] [pid 897595:tid 897839] [client 138.252.89.100:54939] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxiSeZhsBlduL7gIyzJWwAAAPY"]
[Sat Jul 18 23:36:09.233823 2026] [security2:error] [pid 897595:tid 897839] [client 138.252.89.100:54939] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxiSeZhsBlduL7gIyzJWwAAAPY"]
[Sat Jul 18 23:36:09.280494 2026] [security2:error] [pid 897595:tid 897743] [client 173.239.196.162:63273] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/twentytwentythree/patterns/index.php"] [unique_id "alxiSeZhsBlduL7gIyzJYAAAAJY"]
[Sat Jul 18 23:36:09.688223 2026] [security2:error] [pid 897595:tid 897676] [remote 114.119.142.156:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "innovativecleaningsvs.com"] [uri "/wp-content/uploads/2026/05/How-Debris-Buildup-Leads-to-Long-Term-Damage-blog-300x225.jpg"] [unique_id "alxiSeZhsBlduL7gIyzJfQABBE8"], referer: https://innovativecleaningsvs.com/category/gutter-cleaning/
[Sat Jul 18 23:36:09.842286 2026] [security2:error] [pid 897595:tid 897690] [remote 97.74.93.24:35868] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxiSeZhsBlduL7gIyzJgQAA6l0"]
[Sat Jul 18 23:36:09.842475 2026] [security2:error] [pid 897595:tid 897827] [client 97.74.93.24:35868] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxiSeZhsBlduL7gIyzJgQAA6l0"]
[Sat Jul 18 23:36:10.171587 2026] [security2:error] [pid 897595:tid 897818] [client 173.239.196.160:53099] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/sunrise/colors_95.php"] [unique_id "alxiSuZhsBlduL7gIyzJlgAAAOE"]
[Sat Jul 18 23:36:10.854033 2026] [security2:error] [pid 897595:tid 897755] [client 180.252.198.240:55853] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiSuZhsBlduL7gIyzJxAAAAKI"]
[Sat Jul 18 23:36:10.855085 2026] [security2:error] [pid 897595:tid 897755] [client 180.252.198.240:55853] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiSuZhsBlduL7gIyzJxAAAAKI"]
[Sat Jul 18 23:36:12.243626 2026] [security2:error] [pid 897595:tid 897764] [client 173.239.196.164:50957] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "alxiTOZhsBlduL7gIyzKOQAAAKs"]
[Sat Jul 18 23:36:12.572048 2026] [security2:error] [pid 897595:tid 897832] [client 116.179.33.16:12158] ModSecurity: Access denied with code 406 (phase 2). Match of "beginsWith %{request_headers.host}" against "TX:1" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "504"] [id "340162"] [rev "302"] [msg "Atomicorp.com WAF Rules: Remote File Injection Attack detected (Unauthorized URL detected as argument)"] [data ",TX:1"] [severity "CRITICAL"] [hostname "mollycahill.com"] [uri "/"] [unique_id "alxiTOZhsBlduL7gIyzKUAAAAO8"]
[Sat Jul 18 23:36:12.979345 2026] [security2:error] [pid 897595:tid 897751] [client 223.228.182.224:58524] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxiTOZhsBlduL7gIyzKegAAAJ4"]
[Sat Jul 18 23:36:12.979445 2026] [security2:error] [pid 897595:tid 897751] [client 223.228.182.224:58524] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxiTOZhsBlduL7gIyzKegAAAJ4"]
[Sat Jul 18 23:36:13.110933 2026] [security2:error] [pid 897595:tid 897757] [client 173.239.196.161:33579] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/uploads/wp.php"] [unique_id "alxiTeZhsBlduL7gIyzKhQAAAKQ"]
[Sat Jul 18 23:36:14.010336 2026] [security2:error] [pid 897595:tid 897809] [client 173.239.196.166:48951] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/certificates/about.php"] [unique_id "alxiTuZhsBlduL7gIyzKxAAAANg"]
[Sat Jul 18 23:36:14.633996 2026] [security2:error] [pid 897595:tid 897784] [client 188.25.101.49:42819] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "collectingrealestate.com"] [uri "/index.php"] [unique_id "alxiTuZhsBlduL7gIyzK4AAAAL8"]
[Sat Jul 18 23:36:14.808872 2026] [security2:error] [pid 897595:tid 897821] [client 106.222.249.209:28961] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxiTuZhsBlduL7gIyzK7wAAAOQ"]
[Sat Jul 18 23:36:14.809024 2026] [security2:error] [pid 897595:tid 897821] [client 106.222.249.209:28961] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxiTuZhsBlduL7gIyzK7wAAAOQ"]
[Sat Jul 18 23:36:14.900341 2026] [security2:error] [pid 897595:tid 897811] [client 173.239.196.160:64801] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/cgi-bin/class.api.php"] [unique_id "alxiTuZhsBlduL7gIyzK9gAAANo"]
[Sat Jul 18 23:36:15.786227 2026] [security2:error] [pid 897595:tid 897752] [client 173.239.196.160:28989] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/cache/index.php"] [unique_id "alxiT-ZhsBlduL7gIyzLKAAAAJ8"]
[Sat Jul 18 23:36:16.115292 2026] [security2:error] [pid 897595:tid 897838] [client 163.61.1.17:54794] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxiUOZhsBlduL7gIyzLOgAAAPU"]
[Sat Jul 18 23:36:16.115391 2026] [security2:error] [pid 897595:tid 897838] [client 163.61.1.17:54794] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxiUOZhsBlduL7gIyzLOgAAAPU"]
[Sat Jul 18 23:36:16.657683 2026] [security2:error] [pid 897595:tid 897747] [client 173.239.196.163:32953] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "alxiUOZhsBlduL7gIyzLYgAAAJo"]
[Sat Jul 18 23:36:16.688539 2026] [security2:error] [pid 897595:tid 897753] [client 190.245.146.99:57766] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxiUOZhsBlduL7gIyzLZQAAAKA"]
[Sat Jul 18 23:36:16.691267 2026] [security2:error] [pid 897595:tid 897753] [client 190.245.146.99:57766] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxiUOZhsBlduL7gIyzLZQAAAKA"]
[Sat Jul 18 23:36:17.072791 2026] [security2:error] [pid 897595:tid 897784] [client 154.27.104.38:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mtlegnews.gov"] [uri "/index.php"] [unique_id "alxiUOZhsBlduL7gIyzLbwAAAL8"]
[Sat Jul 18 23:36:17.156901 2026] [autoindex:error] [pid 897595:tid 897779] [client 45.63.4.69:0] AH01276: Cannot serve directory /home2/youposit/public_html/upositive/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:36:17.359992 2026] [security2:error] [pid 897595:tid 897754] [client 85.204.245.69:63214] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.sesamegreenbeans.com"] [uri "/index.php"] [unique_id "alxiUeZhsBlduL7gIyzLggAAoRs"]
[Sat Jul 18 23:36:17.552009 2026] [security2:error] [pid 897595:tid 897832] [client 173.239.196.161:27343] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/edit.php"] [unique_id "alxiUeZhsBlduL7gIyzLngAAAO8"]
[Sat Jul 18 23:36:18.332972 2026] [security2:error] [pid 897595:tid 897757] [client 50.116.65.227:20906] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxiUuZhsBlduL7gIyzL0QAAAKQ"]
[Sat Jul 18 23:36:18.344475 2026] [security2:error] [pid 897595:tid 897766] [client 50.116.65.227:26204] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxiUuZhsBlduL7gIyzL0gAAAK0"]
[Sat Jul 18 23:36:18.412339 2026] [security2:error] [pid 897595:tid 897740] [client 173.239.196.166:53331] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/webdb.php"] [unique_id "alxiUuZhsBlduL7gIyzL2QAAAJM"]
[Sat Jul 18 23:36:19.094553 2026] [security2:error] [pid 897595:tid 897757] [client 52.109.124.141:27392] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "msoid.quangminhltd.vn"] [uri "/index.cgi"] [unique_id "alxiU-ZhsBlduL7gIyzMCAAAAKQ"]
[Sat Jul 18 23:36:19.251577 2026] [security2:error] [pid 897595:tid 897731] [client 173.239.196.167:31399] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/assets/images/doc.php"] [unique_id "alxiU-ZhsBlduL7gIyzMDgAAAIo"]
[Sat Jul 18 23:36:19.277265 2026] [security2:error] [pid 897595:tid 897841] [client 52.109.124.141:27392] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "404"] [hostname "msoid.quangminhltd.vn"] [uri "/404.html"] [unique_id "alxiU-ZhsBlduL7gIyzMDwAAAPg"]
[Sat Jul 18 23:36:19.852300 2026] [security2:error] [pid 897595:tid 897706] [remote 91.142.222.105:39984] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "floorsourcestock.com"] [uri "/wp-login.php"] [unique_id "alxiU-ZhsBlduL7gIyzMPAAAwm0"]
[Sat Jul 18 23:36:19.986043 2026] [security2:error] [pid 897595:tid 897848] [client 34.147.22.160:49152] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "webmail.besttestedrecipes.com"] [uri "/"] [unique_id "alxiU-ZhsBlduL7gIyzMSwAAAP8"]
[Sat Jul 18 23:36:19.986117 2026] [security2:error] [pid 897595:tid 897848] [client 34.147.22.160:49152] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "webmail.besttestedrecipes.com"] [uri "/"] [unique_id "alxiU-ZhsBlduL7gIyzMSwAAAP8"]
[Sat Jul 18 23:36:20.124541 2026] [security2:error] [pid 897595:tid 897745] [client 173.239.196.166:62855] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/file2.php"] [unique_id "alxiVOZhsBlduL7gIyzMUwAAAJg"]
[Sat Jul 18 23:36:20.574516 2026] [security2:error] [pid 897595:tid 897769] [client 57.141.18.28:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxiVOZhsBlduL7gIyzMXwAAALA"]
[Sat Jul 18 23:36:20.647360 2026] [security2:error] [pid 897595:tid 897686] [remote 97.74.93.24:60602] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxiVOZhsBlduL7gIyzMcAAA2lk"]
[Sat Jul 18 23:36:20.691246 2026] [security2:error] [pid 897595:tid 897717] [remote 31.42.184.154:41448] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "taskidsvirginia.com"] [uri "/wp-login.php"] [unique_id "alxiVOZhsBlduL7gIyzMdQAAkng"]
[Sat Jul 18 23:36:20.852665 2026] [security2:error] [pid 897595:tid 897609] [remote 154.61.75.100:47980] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxiVOZhsBlduL7gIyzMggAA_gw"]
[Sat Jul 18 23:36:20.924621 2026] [security2:error] [pid 897595:tid 897836] [client 138.252.89.100:55445] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxiVOZhsBlduL7gIyzMhAAAAPM"]
[Sat Jul 18 23:36:20.924728 2026] [security2:error] [pid 897595:tid 897836] [client 138.252.89.100:55445] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxiVOZhsBlduL7gIyzMhAAAAPM"]
[Sat Jul 18 23:36:20.991668 2026] [security2:error] [pid 897595:tid 897778] [client 173.239.196.165:53431] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "alxiVOZhsBlduL7gIyzMiQAAALk"]
[Sat Jul 18 23:36:21.031517 2026] [security2:error] [pid 897595:tid 897645] [remote 31.42.184.154:41448] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "taskidsvirginia.com"] [uri "/wp-login.php"] [unique_id "alxiVeZhsBlduL7gIyzMigAA2DA"], referer: https://taskidsvirginia.com/wp-login.php
[Sat Jul 18 23:36:21.168451 2026] [security2:error] [pid 897595:tid 897675] [remote 97.74.93.24:60602] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxiVeZhsBlduL7gIyzMlAAA404"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:36:21.381960 2026] [security2:error] [pid 897595:tid 897735] [client 180.252.198.240:56322] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiVeZhsBlduL7gIyzMogAAAI4"]
[Sat Jul 18 23:36:21.382066 2026] [security2:error] [pid 897595:tid 897735] [client 180.252.198.240:56322] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiVeZhsBlduL7gIyzMogAAAI4"]
[Sat Jul 18 23:36:21.861474 2026] [security2:error] [pid 897595:tid 897734] [client 173.239.196.160:57903] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/alfa.php"] [unique_id "alxiVeZhsBlduL7gIyzMwAAAAI0"]
[Sat Jul 18 23:36:22.044143 2026] [security2:error] [pid 897595:tid 897733] [client 161.10.124.24:46124] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "whiteoutcb.com"] [uri "/wp-login.php"] [unique_id "alxiVeZhsBlduL7gIyzMxQAAAIw"], referer: https://www.google.com
[Sat Jul 18 23:36:22.739713 2026] [security2:error] [pid 897595:tid 897829] [client 173.239.196.165:28619] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/blue/admin.php"] [unique_id "alxiVuZhsBlduL7gIyzM9wAAAOw"]
[Sat Jul 18 23:36:23.563120 2026] [security2:error] [pid 897595:tid 897761] [client 173.239.196.165:32125] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/click.php"] [unique_id "alxiV-ZhsBlduL7gIyzNTwAAAKg"]
[Sat Jul 18 23:36:23.761280 2026] [security2:error] [pid 897595:tid 897801] [client 223.228.182.224:32273] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxiV-ZhsBlduL7gIyzNYAAAANA"]
[Sat Jul 18 23:36:23.770898 2026] [security2:error] [pid 897595:tid 897801] [client 223.228.182.224:32273] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxiV-ZhsBlduL7gIyzNYAAAANA"]
[Sat Jul 18 23:36:24.442085 2026] [security2:error] [pid 897595:tid 897820] [client 173.239.196.162:41473] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/wp-conflg.php"] [unique_id "alxiWOZhsBlduL7gIyzNigAAAOM"]
[Sat Jul 18 23:36:24.939663 2026] [security2:error] [pid 897595:tid 897832] [client 188.217.52.248:2837] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.52.217.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "whiteoutcb.com"] [uri "/wp-login.php"] [unique_id "alxiWOZhsBlduL7gIyzNqwAAAO8"], referer: http://whiteoutcb.com/wp-login.php
[Sat Jul 18 23:36:25.303885 2026] [security2:error] [pid 897595:tid 897599] [remote 134.209.147.209:35142] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.147.209.134.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "christiancountytrumpet.com"] [uri "/wp-login.php"] [unique_id "alxiWeZhsBlduL7gIyzNxgAAzwI"]
[Sat Jul 18 23:36:25.305718 2026] [security2:error] [pid 897595:tid 897768] [client 173.239.196.161:39669] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/blue/atomlib.php"] [unique_id "alxiWeZhsBlduL7gIyzNxwAAAK8"]
[Sat Jul 18 23:36:25.974274 2026] [security2:error] [pid 897595:tid 897615] [remote 134.209.147.209:35142] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.147.209.134.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "christiancountytrumpet.com"] [uri "/wp-login.php"] [unique_id "alxiWeZhsBlduL7gIyzN9AAA2hI"], referer: https://christiancountytrumpet.com/wp-login.php
[Sat Jul 18 23:36:26.185671 2026] [security2:error] [pid 897595:tid 897847] [client 106.222.249.209:3215] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxiWuZhsBlduL7gIyzODAAAAP4"]
[Sat Jul 18 23:36:26.185811 2026] [security2:error] [pid 897595:tid 897847] [client 106.222.249.209:3215] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxiWuZhsBlduL7gIyzODAAAAP4"]
[Sat Jul 18 23:36:26.197714 2026] [security2:error] [pid 897595:tid 897746] [client 173.239.196.167:37983] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/js/widgets/bypass.php"] [unique_id "alxiWuZhsBlduL7gIyzODQAAAJk"]
[Sat Jul 18 23:36:26.417006 2026] [security2:error] [pid 897595:tid 897828] [client 74.7.227.179:51994] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxiWuZhsBlduL7gIyzOHgAA608"], referer: https://tejasenvironmental.com/p=524512
[Sat Jul 18 23:36:26.852874 2026] [security2:error] [pid 897595:tid 897768] [client 163.61.1.17:55280] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxiWuZhsBlduL7gIyzOPwAAAK8"]
[Sat Jul 18 23:36:26.853031 2026] [security2:error] [pid 897595:tid 897768] [client 163.61.1.17:55280] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxiWuZhsBlduL7gIyzOPwAAAK8"]
[Sat Jul 18 23:36:27.047790 2026] [security2:error] [pid 897595:tid 897696] [remote 216.38.28.47:52756] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 47.28.38.216.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxiW-ZhsBlduL7gIyzORgAAh2M"]
[Sat Jul 18 23:36:27.083143 2026] [security2:error] [pid 897595:tid 897790] [client 173.239.196.162:28543] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "alxiW-ZhsBlduL7gIyzOSAAAAMU"]
[Sat Jul 18 23:36:27.187040 2026] [security2:error] [pid 897595:tid 897822] [client 190.245.146.99:58289] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxiW-ZhsBlduL7gIyzOUAAAAOU"]
[Sat Jul 18 23:36:27.187124 2026] [security2:error] [pid 897595:tid 897822] [client 190.245.146.99:58289] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxiW-ZhsBlduL7gIyzOUAAAAOU"]
[Sat Jul 18 23:36:27.594862 2026] [security2:error] [pid 897595:tid 897701] [remote 216.38.28.47:52756] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 47.28.38.216.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxiW-ZhsBlduL7gIyzOaAAAx2g"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:36:27.941037 2026] [security2:error] [pid 897595:tid 897784] [client 74.7.241.164:45112] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "www.hoomanr.com"] [uri "/index.php"] [unique_id "alxiW-ZhsBlduL7gIyzOggAAv2I"]
[Sat Jul 18 23:36:27.948184 2026] [security2:error] [pid 897595:tid 897778] [client 173.239.196.167:56729] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/index.php"] [unique_id "alxiW-ZhsBlduL7gIyzOhAAAALk"]
[Sat Jul 18 23:36:28.803777 2026] [security2:error] [pid 897595:tid 897669] [remote 31.42.184.154:41456] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxiXOZhsBlduL7gIyzOrAAA3kg"]
[Sat Jul 18 23:36:28.841529 2026] [security2:error] [pid 897595:tid 897763] [client 173.239.196.163:34975] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/edit.php"] [unique_id "alxiXOZhsBlduL7gIyzOrgAAAKo"]
[Sat Jul 18 23:36:28.909871 2026] [security2:error] [pid 897595:tid 897770] [client 139.167.225.146:53159] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxiXOZhsBlduL7gIyzOtAAAALE"]
[Sat Jul 18 23:36:28.909967 2026] [security2:error] [pid 897595:tid 897770] [client 139.167.225.146:53159] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxiXOZhsBlduL7gIyzOtAAAALE"]
[Sat Jul 18 23:36:29.235066 2026] [security2:error] [pid 897595:tid 897813] [client 187.78.174.197:31978] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 197.174.78.187.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "juniper3medical.com"] [uri "/xmlrpc.php"] [unique_id "alxiXeZhsBlduL7gIyzOvwAAANw"]
[Sat Jul 18 23:36:29.235173 2026] [security2:error] [pid 897595:tid 897813] [client 187.78.174.197:31978] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "juniper3medical.com"] [uri "/xmlrpc.php"] [unique_id "alxiXeZhsBlduL7gIyzOvwAAANw"]
[Sat Jul 18 23:36:29.239696 2026] [security2:error] [pid 897595:tid 897671] [remote 31.42.184.154:41456] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxiXeZhsBlduL7gIyzOxwAA20o"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:36:29.245446 2026] [security2:error] [pid 897595:tid 897603] [remote 185.115.217.185:36432] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.217.115.185.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxiXeZhsBlduL7gIyzOxgAAzAY"]
[Sat Jul 18 23:36:29.709975 2026] [security2:error] [pid 897595:tid 897817] [client 173.239.196.164:56563] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/WordPressCore/index.php"] [unique_id "alxiXeZhsBlduL7gIyzO4QAAAOA"]
[Sat Jul 18 23:36:29.851149 2026] [security2:error] [pid 897595:tid 897655] [remote 185.115.217.185:36432] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.217.115.185.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxiXeZhsBlduL7gIyzO5wAAqjo"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:36:30.369990 2026] [security2:error] [pid 897595:tid 897766] [client 50.116.65.227:54832] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxiXuZhsBlduL7gIyzPBAAAAK0"]
[Sat Jul 18 23:36:30.384367 2026] [security2:error] [pid 897595:tid 897830] [client 50.116.65.227:17208] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxiXuZhsBlduL7gIyzPBQAAAO0"]
[Sat Jul 18 23:36:30.579138 2026] [security2:error] [pid 897595:tid 897814] [client 173.239.196.167:42323] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/cgi-bin/autoload_classmap.php"] [unique_id "alxiXuZhsBlduL7gIyzPEwAAAN0"]
[Sat Jul 18 23:36:31.143373 2026] [security2:error] [pid 897595:tid 897667] [remote 216.73.216.174:26879] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.216.73.216.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/training-temp"] [unique_id "alxiX-ZhsBlduL7gIyzPOQAAzUY"]
[Sat Jul 18 23:36:31.392366 2026] [security2:error] [pid 897595:tid 897814] [client 74.208.214.194:36654] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxiX-ZhsBlduL7gIyzPQwAAAN0"]
[Sat Jul 18 23:36:31.445878 2026] [security2:error] [pid 897595:tid 897787] [client 173.239.196.166:53383] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-links-opml.php"] [unique_id "alxiX-ZhsBlduL7gIyzPSAAAAMI"]
[Sat Jul 18 23:36:31.858661 2026] [security2:error] [pid 897595:tid 897811] [client 180.252.198.240:56780] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiX-ZhsBlduL7gIyzPXwAAANo"]
[Sat Jul 18 23:36:31.858801 2026] [security2:error] [pid 897595:tid 897811] [client 180.252.198.240:56780] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiX-ZhsBlduL7gIyzPXwAAANo"]
[Sat Jul 18 23:36:31.890883 2026] [security2:error] [pid 897595:tid 897757] [client 34.90.69.83:49155] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "cpcalendars.walkingandtalking.net"] [uri "/"] [unique_id "alxiX-ZhsBlduL7gIyzPYgAAAKQ"]
[Sat Jul 18 23:36:31.890990 2026] [security2:error] [pid 897595:tid 897757] [client 34.90.69.83:49155] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "cpcalendars.walkingandtalking.net"] [uri "/"] [unique_id "alxiX-ZhsBlduL7gIyzPYgAAAKQ"]
[Sat Jul 18 23:36:32.321375 2026] [security2:error] [pid 897595:tid 897797] [client 173.239.196.164:25229] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/user/network.php"] [unique_id "alxiYOZhsBlduL7gIyzPdwAAAMw"]
[Sat Jul 18 23:36:32.506842 2026] [security2:error] [pid 897595:tid 897727] [client 138.252.89.100:55945] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxiYOZhsBlduL7gIyzPhQAAAIY"]
[Sat Jul 18 23:36:32.506910 2026] [security2:error] [pid 897595:tid 897727] [client 138.252.89.100:55945] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxiYOZhsBlduL7gIyzPhQAAAIY"]
[Sat Jul 18 23:36:32.509483 2026] [security2:error] [pid 897595:tid 897648] [remote 47.128.58.166:30478] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "gertoger.org"] [uri "/make-a-reservation/"] [unique_id "alxiYOZhsBlduL7gIyzPhgAA9zM"]
[Sat Jul 18 23:36:32.737517 2026] [security2:error] [pid 897595:tid 897845] [client 34.34.16.122:49152] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "mail.elitetax-mi.com"] [uri "/"] [unique_id "alxiYOZhsBlduL7gIyzPlwAAAPw"]
[Sat Jul 18 23:36:32.737637 2026] [security2:error] [pid 897595:tid 897845] [client 34.34.16.122:49152] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "mail.elitetax-mi.com"] [uri "/"] [unique_id "alxiYOZhsBlduL7gIyzPlwAAAPw"]
[Sat Jul 18 23:36:32.750892 2026] [security2:error] [pid 897595:tid 897695] [remote 31.42.184.154:56740] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "hilltopnurseryinc.com"] [uri "/wp-login.php"] [unique_id "alxiYOZhsBlduL7gIyzPmAAApWI"]
[Sat Jul 18 23:36:33.134657 2026] [security2:error] [pid 897595:tid 897709] [remote 31.42.184.154:56740] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "hilltopnurseryinc.com"] [uri "/wp-login.php"] [unique_id "alxiYeZhsBlduL7gIyzPuAAA63A"], referer: https://hilltopnurseryinc.com/wp-login.php
[Sat Jul 18 23:36:33.213350 2026] [security2:error] [pid 897595:tid 897728] [client 173.239.196.167:26279] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/atomlib.php"] [unique_id "alxiYeZhsBlduL7gIyzPvQAAAIc"]
[Sat Jul 18 23:36:33.423993 2026] [security2:error] [pid 897595:tid 897669] [remote 91.142.222.105:54264] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "floorsourcestock.com"] [uri "/wp-login.php"] [unique_id "alxiYeZhsBlduL7gIyzPzAAA80g"], referer: https://floorsourcestock.com/wp-login.php
[Sat Jul 18 23:36:33.869009 2026] [security2:error] [pid 897595:tid 897603] [remote 160.187.68.132:47324] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.68.187.160.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ravmike.com"] [uri "/wp-login.php"] [unique_id "alxiYeZhsBlduL7gIyzP5QAA9gY"]
[Sat Jul 18 23:36:34.013490 2026] [security2:error] [pid 897595:tid 897817] [client 4.194.24.143:2670] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/nine2code.php"] [unique_id "alxiYuZhsBlduL7gIyzP7wAAAOA"]
[Sat Jul 18 23:36:34.091379 2026] [security2:error] [pid 897595:tid 897833] [client 173.239.196.167:49731] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "alxiYuZhsBlduL7gIyzP8wAAAPA"]
[Sat Jul 18 23:36:34.212070 2026] [security2:error] [pid 897595:tid 897626] [remote 45.157.54.14:36567] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "staging.joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxiYuZhsBlduL7gIyzP-gAA_h0"]
[Sat Jul 18 23:36:34.212260 2026] [security2:error] [pid 897595:tid 897847] [client 45.157.54.14:36567] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "staging.joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxiYuZhsBlduL7gIyzP-gAA_h0"]
[Sat Jul 18 23:36:34.242822 2026] [security2:error] [pid 897595:tid 897754] [client 34.73.248.36:1158] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "locketsandcharms.com"] [uri "/"] [unique_id "alxiYuZhsBlduL7gIyzP_gAAAKE"]
[Sat Jul 18 23:36:34.353224 2026] [security2:error] [pid 897595:tid 897655] [remote 160.187.68.132:47324] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.68.187.160.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ravmike.com"] [uri "/wp-login.php"] [unique_id "alxiYuZhsBlduL7gIyzQBQAAszo"], referer: https://ravmike.com/wp-login.php
[Sat Jul 18 23:36:34.760642 2026] [security2:error] [pid 897595:tid 897830] [client 173.238.143.58:49040] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "whiteoutcb.com"] [uri "/wp-login.php"] [unique_id "alxiYuZhsBlduL7gIyzQFQAAAO0"], referer: https://www.google.com
[Sat Jul 18 23:36:34.985514 2026] [security2:error] [pid 897595:tid 897826] [client 4.194.24.143:2627] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/num.php"] [unique_id "alxiYuZhsBlduL7gIyzQKwAAAOk"]
[Sat Jul 18 23:36:34.992792 2026] [security2:error] [pid 897595:tid 897739] [client 173.239.196.163:36477] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/xl2023.php"] [unique_id "alxiYuZhsBlduL7gIyzQLAAAAJI"]
[Sat Jul 18 23:36:35.489362 2026] [security2:error] [pid 897595:tid 897802] [client 50.31.161.116:62286] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.sesamegreenbeans.com"] [uri "/index.php"] [unique_id "alxiY-ZhsBlduL7gIyzQPQAA0Tc"]
[Sat Jul 18 23:36:35.810294 2026] [security2:error] [pid 897595:tid 897660] [remote 117.0.21.154:60660] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mochawavepublishing.com"] [uri "/wp-login.php"] [unique_id "alxiY-ZhsBlduL7gIyzQXAAA3j8"]
[Sat Jul 18 23:36:35.872112 2026] [security2:error] [pid 897595:tid 897846] [client 173.239.196.167:53707] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/certificates/admin.php"] [unique_id "alxiY-ZhsBlduL7gIyzQYgAAAP0"]
[Sat Jul 18 23:36:35.909944 2026] [security2:error] [pid 897595:tid 897828] [client 4.194.24.143:2654] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/odf7udtspqtpxzyxmw2rccdefault.php"] [unique_id "alxiY-ZhsBlduL7gIyzQYwAAAOs"]
[Sat Jul 18 23:36:36.658550 2026] [ssl:error] [pid 897595:tid 897808] [client 3.233.59.216:38032] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname cpcontacts.headachescarpaltunnelfibromyalgia.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:36:36.719202 2026] [security2:error] [pid 897595:tid 897744] [client 173.239.196.163:58153] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/images/media/dog.php"] [unique_id "alxiZOZhsBlduL7gIyzQtQAAAJc"]
[Sat Jul 18 23:36:36.731168 2026] [security2:error] [pid 897595:tid 897730] [client 4.194.24.143:49992] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/option.php"] [unique_id "alxiZOZhsBlduL7gIyzQtgAAAIk"]
[Sat Jul 18 23:36:37.159509 2026] [security2:error] [pid 897595:tid 897810] [client 106.222.249.209:1752] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxiZeZhsBlduL7gIyzQ2AAAANk"]
[Sat Jul 18 23:36:37.159684 2026] [security2:error] [pid 897595:tid 897810] [client 106.222.249.209:1752] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxiZeZhsBlduL7gIyzQ2AAAANk"]
[Sat Jul 18 23:36:37.162173 2026] [security2:error] [pid 897595:tid 897847] [client 85.204.70.98:60596] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "cheesewithjam.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "alxiZeZhsBlduL7gIyzQ2QAAAP4"]
[Sat Jul 18 23:36:37.462271 2026] [security2:error] [pid 897595:tid 897824] [client 163.61.1.17:55764] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxiZeZhsBlduL7gIyzQ5AAAAOc"]
[Sat Jul 18 23:36:37.462377 2026] [security2:error] [pid 897595:tid 897824] [client 163.61.1.17:55764] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxiZeZhsBlduL7gIyzQ5AAAAOc"]
[Sat Jul 18 23:36:37.499438 2026] [security2:error] [pid 897595:tid 897734] [client 4.194.24.143:49986] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/p.php"] [unique_id "alxiZeZhsBlduL7gIyzQ5gAAAI0"]
[Sat Jul 18 23:36:37.579730 2026] [security2:error] [pid 897595:tid 897842] [client 173.239.196.162:33383] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/xp.php"] [unique_id "alxiZeZhsBlduL7gIyzQ6QAAAPk"]
[Sat Jul 18 23:36:37.724805 2026] [security2:error] [pid 897595:tid 897801] [client 190.245.146.99:58820] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxiZeZhsBlduL7gIyzQ8wAAANA"]
[Sat Jul 18 23:36:37.724905 2026] [security2:error] [pid 897595:tid 897801] [client 190.245.146.99:58820] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxiZeZhsBlduL7gIyzQ8wAAANA"]
[Sat Jul 18 23:36:37.778046 2026] [security2:error] [pid 897595:tid 897730] [client 85.204.70.98:60606] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 98.70.204.85.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cheesewithjam.com"] [uri "/xmlrpc.php"] [unique_id "alxiZeZhsBlduL7gIyzQ9AAAAIk"]
[Sat Jul 18 23:36:38.155389 2026] [security2:error] [pid 897595:tid 897599] [remote 31.42.184.154:56778] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "oqw.bur.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxiZuZhsBlduL7gIyzREgAAtQI"]
[Sat Jul 18 23:36:38.234244 2026] [security2:error] [pid 897595:tid 897605] [remote 103.75.185.95:36090] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "karimnawfal.com"] [uri "/wp-login.php"] [unique_id "alxiZuZhsBlduL7gIyzRFQAAsgg"]
[Sat Jul 18 23:36:38.297280 2026] [security2:error] [pid 897595:tid 897849] [client 139.167.225.146:53797] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxiZuZhsBlduL7gIyzRGAAAAQA"]
[Sat Jul 18 23:36:38.297360 2026] [security2:error] [pid 897595:tid 897849] [client 139.167.225.146:53797] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxiZuZhsBlduL7gIyzRGAAAAQA"]
[Sat Jul 18 23:36:38.310143 2026] [security2:error] [pid 897595:tid 897776] [client 4.194.24.143:2634] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/past.php"] [unique_id "alxiZuZhsBlduL7gIyzRGQAAALc"]
[Sat Jul 18 23:36:38.444346 2026] [security2:error] [pid 897595:tid 897842] [client 173.239.196.161:28371] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "alxiZuZhsBlduL7gIyzRJQAAAPk"]
[Sat Jul 18 23:36:38.732243 2026] [security2:error] [pid 897595:tid 897634] [remote 31.42.184.154:56778] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "oqw.bur.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxiZuZhsBlduL7gIyzRNQAAjyU"], referer: https://oqw.bur.mybluehost.me/wp-login.php
[Sat Jul 18 23:36:39.090778 2026] [security2:error] [pid 897595:tid 897597] [remote 103.75.185.95:36090] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "karimnawfal.com"] [uri "/wp-login.php"] [unique_id "alxiZ-ZhsBlduL7gIyzRSQAAuAA"], referer: https://karimnawfal.com/wp-login.php
[Sat Jul 18 23:36:39.135684 2026] [security2:error] [pid 897595:tid 897745] [client 4.194.24.143:56604] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/php.php"] [unique_id "alxiZ-ZhsBlduL7gIyzRUQAAAJg"]
[Sat Jul 18 23:36:39.209366 2026] [security2:error] [pid 897595:tid 897800] [client 35.227.39.208:59252] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "sanifidensolutions.com"] [uri "/wp-json/batch/v1"] [unique_id "alxiZ-ZhsBlduL7gIyzRVQAAAM8"]
[Sat Jul 18 23:36:39.228237 2026] [security2:error] [pid 897595:tid 897734] [client 34.73.248.36:60958] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "locketsandcharms.com"] [uri "/wp-json/batch/v1"] [unique_id "alxiZ-ZhsBlduL7gIyzRVwAAAI0"]
[Sat Jul 18 23:36:39.309909 2026] [security2:error] [pid 897595:tid 897778] [client 173.239.196.162:25009] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/assets/index.php"] [unique_id "alxiZ-ZhsBlduL7gIyzRXAAAALk"]
[Sat Jul 18 23:36:39.697352 2026] [security2:error] [pid 897595:tid 897839] [client 35.227.39.208:59252] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "sanifidensolutions.com"] [uri "/"] [unique_id "alxiZ-ZhsBlduL7gIyzReAAAAPY"]
[Sat Jul 18 23:36:39.929449 2026] [security2:error] [pid 897595:tid 897836] [client 4.194.24.143:50036] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/php8.php"] [unique_id "alxiZ-ZhsBlduL7gIyzRgwAAAPM"]
[Sat Jul 18 23:36:40.205229 2026] [security2:error] [pid 897595:tid 897753] [client 173.239.196.166:35103] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-links.php"] [unique_id "alxiaOZhsBlduL7gIyzRkwAAAKA"]
[Sat Jul 18 23:36:40.287201 2026] [security2:error] [pid 897595:tid 897667] [remote 117.0.21.154:60660] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mochawavepublishing.com"] [uri "/wp-login.php"] [unique_id "alxiaOZhsBlduL7gIyzRlwAAx0Y"], referer: https://mochawavepublishing.com/wp-login.php
[Sat Jul 18 23:36:40.560035 2026] [security2:error] [pid 897595:tid 897741] [client 85.204.70.98:60618] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 98.70.204.85.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cheesewithjam.com"] [uri "/xmlrpc.php"] [unique_id "alxiaOZhsBlduL7gIyzRpgAAAJQ"]
[Sat Jul 18 23:36:40.560123 2026] [security2:error] [pid 897595:tid 897741] [client 85.204.70.98:60618] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cheesewithjam.com"] [uri "/xmlrpc.php"] [unique_id "alxiaOZhsBlduL7gIyzRpgAAAJQ"]
[Sat Jul 18 23:36:40.563177 2026] [security2:error] [pid 897595:tid 897786] [client 4.194.24.143:56591] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/phpinfo.php"] [unique_id "alxiaOZhsBlduL7gIyzRpwAAAME"]
[Sat Jul 18 23:36:40.908296 2026] [security2:error] [pid 897595:tid 897758] [client 34.73.248.36:60958] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "locketsandcharms.com"] [uri "/"] [unique_id "alxiaOZhsBlduL7gIyzRtAAAAKU"]
[Sat Jul 18 23:36:41.098258 2026] [security2:error] [pid 897595:tid 897778] [client 173.239.196.165:22255] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/as.php"] [unique_id "alxiaeZhsBlduL7gIyzRxAAAALk"]
[Sat Jul 18 23:36:41.443341 2026] [security2:error] [pid 897595:tid 897834] [client 35.227.39.208:23236] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "sanifidensolutions.com"] [uri "/wp-json/batch/v1"] [unique_id "alxiaeZhsBlduL7gIyzR2AAAAPE"]
[Sat Jul 18 23:36:41.446413 2026] [security2:error] [pid 897595:tid 897763] [client 4.194.24.143:49984] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/post.php"] [unique_id "alxiaeZhsBlduL7gIyzR2QAAAKo"]
[Sat Jul 18 23:36:41.510136 2026] [security2:error] [pid 897595:tid 897688] [remote 57.141.18.100:35212] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.18.141.57.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/product/4636225"] [unique_id "alxiaeZhsBlduL7gIyzR4wAA01s"]
[Sat Jul 18 23:36:41.977776 2026] [security2:error] [pid 897595:tid 897849] [client 173.239.196.162:28885] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/css/index.php"] [unique_id "alxiaeZhsBlduL7gIyzSAwAAAQA"]
[Sat Jul 18 23:36:42.236033 2026] [security2:error] [pid 897595:tid 897682] [remote 45.157.54.14:44884] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "staging.joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxiauZhsBlduL7gIyzSEAAAvlU"]
[Sat Jul 18 23:36:42.236161 2026] [security2:error] [pid 897595:tid 897783] [client 45.157.54.14:44884] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "staging.joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxiauZhsBlduL7gIyzSEAAAvlU"]
[Sat Jul 18 23:36:42.269858 2026] [security2:error] [pid 897595:tid 897762] [client 180.252.198.240:57234] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiauZhsBlduL7gIyzSEQAAAKk"]
[Sat Jul 18 23:36:42.269973 2026] [security2:error] [pid 897595:tid 897762] [client 180.252.198.240:57234] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiauZhsBlduL7gIyzSEQAAAKk"]
[Sat Jul 18 23:36:42.677674 2026] [security2:error] [pid 897595:tid 897610] [remote 31.42.184.154:38332] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxiauZhsBlduL7gIyzSNgAArA0"]
[Sat Jul 18 23:36:42.823166 2026] [security2:error] [pid 897595:tid 897853] [client 173.239.196.160:51363] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/ID3/index.php"] [unique_id "alxiauZhsBlduL7gIyzSOAAAAQQ"]
[Sat Jul 18 23:36:42.966769 2026] [security2:error] [pid 897595:tid 897603] [remote 31.42.184.154:38338] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "seedsofchangefilm.onewingpictures.com"] [uri "/wp-login.php"] [unique_id "alxiauZhsBlduL7gIyzSQwAA4gY"]
[Sat Jul 18 23:36:43.203084 2026] [security2:error] [pid 897595:tid 897707] [remote 31.42.184.154:38338] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "seedsofchangefilm.onewingpictures.com"] [uri "/wp-login.php"] [unique_id "alxia-ZhsBlduL7gIyzSUAAAyW4"], referer: https://seedsofchangefilm.onewingpictures.com/wp-login.php
[Sat Jul 18 23:36:43.329537 2026] [security2:error] [pid 897595:tid 897836] [client 35.227.39.208:23236] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "sanifidensolutions.com"] [uri "/"] [unique_id "alxia-ZhsBlduL7gIyzSWwAAAPM"]
[Sat Jul 18 23:36:43.331092 2026] [security2:error] [pid 897595:tid 897777] [client 179.97.88.75:29806] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "whiteoutcb.com"] [uri "/wp-login.php"] [unique_id "alxia-ZhsBlduL7gIyzSUwAAALg"], referer: https://www.google.com
[Sat Jul 18 23:36:43.339825 2026] [security2:error] [pid 897595:tid 897644] [remote 31.42.184.154:38332] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxia-ZhsBlduL7gIyzSXAAAki8"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:36:43.502850 2026] [security2:error] [pid 897595:tid 897832] [client 188.217.52.248:2837] ModSecurity: Warning. String match "408" at RESPONSE_STATUS. [file "/etc/httpd/modsecurity.d/03_asl_dos.conf"] [line "35"] [id "343434"] [rev "1"] [msg "Atomicorp.com WAF Rules: Client Connection dropped by Apache due to slow connection, possible Slowaris attack"] [severity "WARNING"] [hostname "whiteoutcb.com"] [uri "/wp-login.php"] [unique_id "alxiWOZhsBlduL7gIyzNqwAAAO8"], referer: http://whiteoutcb.com/wp-login.php
[Sat Jul 18 23:36:43.669570 2026] [security2:error] [pid 897595:tid 897732] [client 173.239.196.164:32741] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/pomo/admin.php"] [unique_id "alxia-ZhsBlduL7gIyzScAAAAIs"]
[Sat Jul 18 23:36:43.691205 2026] [security2:error] [pid 897595:tid 897646] [remote 41.186.86.12:56623] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.narv.co"] [uri "/xmlrpc.php"] [unique_id "alxia-ZhsBlduL7gIyzScwAAszE"]
[Sat Jul 18 23:36:43.691326 2026] [security2:error] [pid 897595:tid 897772] [client 41.186.86.12:56623] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.narv.co"] [uri "/xmlrpc.php"] [unique_id "alxia-ZhsBlduL7gIyzScwAAszE"]
[Sat Jul 18 23:36:43.872895 2026] [security2:error] [pid 897595:tid 897790] [client 3.108.60.216:28602] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxia-ZhsBlduL7gIyzSfQAAAMU"]
[Sat Jul 18 23:36:43.872964 2026] [security2:error] [pid 897595:tid 897790] [client 3.108.60.216:28602] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxia-ZhsBlduL7gIyzSfQAAAMU"]
[Sat Jul 18 23:36:44.109807 2026] [security2:error] [pid 897595:tid 897771] [client 4.194.24.143:49988] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/public/assets/design_1/css/parts/course_cards/grid_card_1.min.php"] [unique_id "alxibOZhsBlduL7gIyzSjQAAALI"]
[Sat Jul 18 23:36:44.138645 2026] [security2:error] [pid 897595:tid 897726] [client 138.252.89.100:56454] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxibOZhsBlduL7gIyzSkgAAAIU"]
[Sat Jul 18 23:36:44.138729 2026] [security2:error] [pid 897595:tid 897726] [client 138.252.89.100:56454] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxibOZhsBlduL7gIyzSkgAAAIU"]
[Sat Jul 18 23:36:44.199110 2026] [security2:error] [pid 897595:tid 897656] [remote 31.42.184.154:38414] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxibOZhsBlduL7gIyzSlgAA0js"]
[Sat Jul 18 23:36:44.325951 2026] [security2:error] [pid 897595:tid 897677] [remote 47.128.115.117:24656] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.locketsandcharms.com"] [uri "/wp-content/uploads/2014/12/Metallic-Black-Wrap-Limited-Origami-Owl-Bracelet.jpg"] [unique_id "alxibOZhsBlduL7gIyzSnAAAu1A"], referer: https://kenosong.weebly.com/
[Sat Jul 18 23:36:44.499635 2026] [security2:error] [pid 897595:tid 897813] [client 173.239.196.161:45447] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/IXR/security.php"] [unique_id "alxibOZhsBlduL7gIyzSrAAAANw"]
[Sat Jul 18 23:36:44.505339 2026] [proxy:error] [pid 897595:tid 897849] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:36:44.505419 2026] [proxy_http:error] [pid 897595:tid 897849] [client 193.47.62.168:48794] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:36:44.505947 2026] [security2:error] [pid 897595:tid 897621] [remote 31.42.184.154:38414] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxibOZhsBlduL7gIyzSrgAAqhg"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:36:44.506101 2026] [proxy:error] [pid 897595:tid 897849] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:36:44.506143 2026] [proxy_http:error] [pid 897595:tid 897849] [client 193.47.62.168:48794] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:36:44.663324 2026] [security2:error] [pid 897595:tid 897812] [client 4.194.24.143:2658] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/public/css.php"] [unique_id "alxibOZhsBlduL7gIyzSvQAAANs"]
[Sat Jul 18 23:36:45.204739 2026] [security2:error] [pid 897595:tid 897764] [client 4.194.24.143:50014] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/r.php"] [unique_id "alxibeZhsBlduL7gIyzS2QAAAKs"]
[Sat Jul 18 23:36:45.413530 2026] [security2:error] [pid 897595:tid 897794] [client 173.239.196.160:50277] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/phpadmin/as.php"] [unique_id "alxibeZhsBlduL7gIyzS6wAAAMk"]
[Sat Jul 18 23:36:45.742963 2026] [security2:error] [pid 897595:tid 897851] [client 4.194.24.143:34715] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/radio.php"] [unique_id "alxibeZhsBlduL7gIyzS_AAAAQI"]
[Sat Jul 18 23:36:46.295478 2026] [security2:error] [pid 897595:tid 897764] [client 4.194.24.143:56615] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/randkeyword.php7"] [unique_id "alxibuZhsBlduL7gIyzTIgAAAKs"]
[Sat Jul 18 23:36:46.301334 2026] [security2:error] [pid 897595:tid 897829] [client 173.239.196.163:41785] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "alxibuZhsBlduL7gIyzTIwAAAOw"]
[Sat Jul 18 23:36:46.651683 2026] [security2:error] [pid 897595:tid 897816] [client 179.97.88.75:30036] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/opt/mod_security/hg_rules.conf"] [line "306"] [id "900285"] [msg "Wordpress Brute Attempts"] [hostname "whiteoutcb.com"] [uri "/wp-login.php"] [unique_id "alxibuZhsBlduL7gIyzTOgAAAN8"], referer: http://whiteoutcb.com/wp-login.php
[Sat Jul 18 23:36:46.837218 2026] [security2:error] [pid 897595:tid 897751] [client 4.194.24.143:56601] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/readme.php"] [unique_id "alxibuZhsBlduL7gIyzTRQAAAJ4"]
[Sat Jul 18 23:36:47.181870 2026] [security2:error] [pid 897595:tid 897806] [client 173.239.196.162:53485] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/hello.php"] [unique_id "alxib-ZhsBlduL7gIyzTYAAAANU"]
[Sat Jul 18 23:36:47.379936 2026] [security2:error] [pid 897595:tid 897744] [client 4.194.24.143:2657] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/reze.php"] [unique_id "alxib-ZhsBlduL7gIyzTbwAAAJc"]
[Sat Jul 18 23:36:47.583032 2026] [security2:error] [pid 897595:tid 897770] [client 223.228.182.224:28477] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxib-ZhsBlduL7gIyzTeQAAALE"]
[Sat Jul 18 23:36:47.587397 2026] [security2:error] [pid 897595:tid 897770] [client 223.228.182.224:28477] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxib-ZhsBlduL7gIyzTeQAAALE"]
[Sat Jul 18 23:36:47.779955 2026] [security2:error] [pid 897595:tid 897729] [client 163.61.1.17:56245] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxib-ZhsBlduL7gIyzTgQAAAIg"]
[Sat Jul 18 23:36:47.780098 2026] [security2:error] [pid 897595:tid 897729] [client 163.61.1.17:56245] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxib-ZhsBlduL7gIyzTgQAAAIg"]
[Sat Jul 18 23:36:47.901247 2026] [proxy:error] [pid 897595:tid 897806] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:36:47.901329 2026] [proxy_http:error] [pid 897595:tid 897806] [client 104.37.28.96:25356] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:36:47.901780 2026] [proxy:error] [pid 897595:tid 897806] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:36:47.901807 2026] [proxy_http:error] [pid 897595:tid 897806] [client 104.37.28.96:25356] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:36:47.925148 2026] [security2:error] [pid 897595:tid 897732] [client 4.194.24.143:56597] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/rh.php"] [unique_id "alxib-ZhsBlduL7gIyzTkAAAAIs"]
[Sat Jul 18 23:36:48.064684 2026] [security2:error] [pid 897595:tid 897754] [client 173.239.196.160:28071] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/seoo/about.php"] [unique_id "alxicOZhsBlduL7gIyzTmQAAAKE"]
[Sat Jul 18 23:36:48.104677 2026] [security2:error] [pid 897595:tid 897708] [remote 103.74.116.239:34124] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 239.116.74.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxicOZhsBlduL7gIyzTmwAAvG8"]
[Sat Jul 18 23:36:48.214833 2026] [security2:error] [pid 897595:tid 897728] [client 106.222.249.209:14723] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxicOZhsBlduL7gIyzTpAAAAIc"]
[Sat Jul 18 23:36:48.214920 2026] [security2:error] [pid 897595:tid 897728] [client 106.222.249.209:14723] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxicOZhsBlduL7gIyzTpAAAAIc"]
[Sat Jul 18 23:36:48.220547 2026] [security2:error] [pid 897595:tid 897833] [client 190.245.146.99:59342] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxicOZhsBlduL7gIyzTpQAAAPA"]
[Sat Jul 18 23:36:48.226488 2026] [security2:error] [pid 897595:tid 897833] [client 190.245.146.99:59342] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxicOZhsBlduL7gIyzTpQAAAPA"]
[Sat Jul 18 23:36:48.336031 2026] [security2:error] [pid 897595:tid 897817] [client 57.141.18.80:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxicOZhsBlduL7gIyzToAAAAOA"]
[Sat Jul 18 23:36:48.523433 2026] [security2:error] [pid 897595:tid 897836] [client 4.194.24.143:33685] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/rip.php"] [unique_id "alxicOZhsBlduL7gIyzTuQAAAPM"]
[Sat Jul 18 23:36:48.648478 2026] [security2:error] [pid 897595:tid 897615] [remote 103.74.116.239:34124] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 239.116.74.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxicOZhsBlduL7gIyzTxgAA5BI"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:36:48.925483 2026] [security2:error] [pid 897595:tid 897808] [client 173.239.196.167:20727] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/fonts/about.php"] [unique_id "alxicOZhsBlduL7gIyzT2AAAANc"]
[Sat Jul 18 23:36:49.071856 2026] [security2:error] [pid 897595:tid 897852] [client 4.194.24.143:34732] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/root.php"] [unique_id "alxiceZhsBlduL7gIyzT4wAAAQM"]
[Sat Jul 18 23:36:49.611223 2026] [security2:error] [pid 897595:tid 897795] [client 4.194.24.143:2645] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/s.php"] [unique_id "alxiceZhsBlduL7gIyzUCgAAAMo"]
[Sat Jul 18 23:36:49.765516 2026] [security2:error] [pid 897595:tid 897803] [client 173.239.196.165:50373] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/moon.php"] [unique_id "alxiceZhsBlduL7gIyzUFQAAANI"]
[Sat Jul 18 23:36:50.162834 2026] [security2:error] [pid 897595:tid 897742] [client 4.194.24.143:34702] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/sang.php"] [unique_id "alxicuZhsBlduL7gIyzULAAAAJU"]
[Sat Jul 18 23:36:50.565248 2026] [security2:error] [pid 897595:tid 897751] [client 139.167.225.146:54429] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxicuZhsBlduL7gIyzUQQAAAJ4"]
[Sat Jul 18 23:36:50.565330 2026] [security2:error] [pid 897595:tid 897751] [client 139.167.225.146:54429] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxicuZhsBlduL7gIyzUQQAAAJ4"]
[Sat Jul 18 23:36:50.642952 2026] [security2:error] [pid 897595:tid 897746] [client 173.239.196.161:50033] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/user/about.php"] [unique_id "alxicuZhsBlduL7gIyzUSAAAAJk"]
[Sat Jul 18 23:36:50.762292 2026] [security2:error] [pid 897595:tid 897837] [client 4.194.24.143:47943] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/scxy.php"] [unique_id "alxicuZhsBlduL7gIyzUVQAAAPQ"]
[Sat Jul 18 23:36:51.303741 2026] [security2:error] [pid 897595:tid 897767] [client 4.194.24.143:33715] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/sd.php"] [unique_id "alxic-ZhsBlduL7gIyzUfgAAAK4"]
[Sat Jul 18 23:36:51.520352 2026] [security2:error] [pid 897595:tid 897839] [client 173.239.196.163:20799] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/js/widgets/index.php"] [unique_id "alxic-ZhsBlduL7gIyzUgQAAAPY"]
[Sat Jul 18 23:36:51.865900 2026] [security2:error] [pid 897595:tid 897841] [client 4.194.24.143:50009] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/sf.php"] [unique_id "alxic-ZhsBlduL7gIyzUmwAAAPg"]
[Sat Jul 18 23:36:51.895289 2026] [security2:error] [pid 897595:tid 897825] [client 50.116.65.227:31140] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxic-ZhsBlduL7gIyzUnQAAAOg"]
[Sat Jul 18 23:36:51.910246 2026] [security2:error] [pid 897595:tid 897829] [client 50.116.65.227:42136] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxic-ZhsBlduL7gIyzUngAAAOw"]
[Sat Jul 18 23:36:52.386701 2026] [security2:error] [pid 897595:tid 897837] [client 173.239.196.164:50729] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/webadmin.php"] [unique_id "alxidOZhsBlduL7gIyzUvAAAAPQ"]
[Sat Jul 18 23:36:52.406010 2026] [security2:error] [pid 897595:tid 897769] [client 4.194.24.143:56622] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/shell.php"] [unique_id "alxidOZhsBlduL7gIyzUvgAAALA"]
[Sat Jul 18 23:36:52.809251 2026] [security2:error] [pid 897595:tid 897845] [client 180.252.198.240:57699] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxidOZhsBlduL7gIyzUzQAAAPw"]
[Sat Jul 18 23:36:52.809367 2026] [security2:error] [pid 897595:tid 897845] [client 180.252.198.240:57699] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxidOZhsBlduL7gIyzUzQAAAPw"]
[Sat Jul 18 23:36:53.079841 2026] [security2:error] [pid 897595:tid 897628] [remote 41.76.213.235:50064] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxideZhsBlduL7gIyzU3AAApB8"]
[Sat Jul 18 23:36:53.123340 2026] [security2:error] [pid 897595:tid 897661] [remote 41.186.86.12:53163] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxideZhsBlduL7gIyzU4QAAhkA"]
[Sat Jul 18 23:36:53.142969 2026] [security2:error] [pid 897595:tid 897759] [client 4.194.24.143:56592] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/sid3.php"] [unique_id "alxideZhsBlduL7gIyzU4gAAAKY"]
[Sat Jul 18 23:36:53.264345 2026] [security2:error] [pid 897595:tid 897777] [client 173.239.196.166:29125] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "alxideZhsBlduL7gIyzU7QAAALg"]
[Sat Jul 18 23:36:53.631716 2026] [security2:error] [pid 897595:tid 897651] [remote 41.76.213.235:50064] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxideZhsBlduL7gIyzU-wAA6DY"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:36:53.643403 2026] [security2:error] [pid 897595:tid 897606] [remote 41.186.86.12:53163] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxideZhsBlduL7gIyzU_QAA2Qk"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:36:54.117391 2026] [proxy:error] [pid 897595:tid 897689] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:36:54.117422 2026] [proxy_http:error] [pid 897595:tid 897689] [remote 138.0.242.114:5410] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:36:54.117840 2026] [proxy:error] [pid 897595:tid 897689] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:36:54.117861 2026] [proxy_http:error] [pid 897595:tid 897689] [remote 138.0.242.114:5410] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:36:54.150069 2026] [security2:error] [pid 897595:tid 897808] [client 173.239.196.163:44083] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "655"] [id "900155"] [msg "WP Brute UA block"] [hostname "sixpackminer.org"] [uri "/wp-admin/about.php"] [unique_id "alxiduZhsBlduL7gIyzVHwAAANc"]
[Sat Jul 18 23:36:54.576269 2026] [security2:error] [pid 897595:tid 897759] [client 4.194.24.143:34703] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/simple.php"] [unique_id "alxiduZhsBlduL7gIyzVNwAAAKY"]
[Sat Jul 18 23:36:55.012008 2026] [security2:error] [pid 897595:tid 897819] [client 173.239.196.161:55669] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/xl2023.php"] [unique_id "alxid-ZhsBlduL7gIyzVWAAAAOI"]
[Sat Jul 18 23:36:55.105734 2026] [security2:error] [pid 897595:tid 897787] [client 13.232.206.133:22250] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.206.232.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxid-ZhsBlduL7gIyzVWwAAAMI"]
[Sat Jul 18 23:36:55.847176 2026] [security2:error] [pid 897595:tid 897797] [client 4.194.24.143:56576] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/sitemap.php"] [unique_id "alxid-ZhsBlduL7gIyzVjAAAAMw"]
[Sat Jul 18 23:36:55.884587 2026] [security2:error] [pid 897595:tid 897853] [client 173.239.196.163:55321] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/go.php"] [unique_id "alxid-ZhsBlduL7gIyzVjwAAAQQ"]
[Sat Jul 18 23:36:56.001570 2026] [security2:error] [pid 897595:tid 897781] [client 138.252.89.100:56977] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxieOZhsBlduL7gIyzVmAAAALw"]
[Sat Jul 18 23:36:56.001676 2026] [security2:error] [pid 897595:tid 897781] [client 138.252.89.100:56977] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxieOZhsBlduL7gIyzVmAAAALw"]
[Sat Jul 18 23:36:56.164702 2026] [security2:error] [pid 897595:tid 897786] [client 3.108.60.216:61330] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxieOZhsBlduL7gIyzVoQAAAME"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:36:56.444302 2026] [security2:error] [pid 897595:tid 897819] [client 223.228.182.224:30684] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxieOZhsBlduL7gIyzVtwAAAOI"]
[Sat Jul 18 23:36:56.444433 2026] [security2:error] [pid 897595:tid 897819] [client 223.228.182.224:30684] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxieOZhsBlduL7gIyzVtwAAAOI"]
[Sat Jul 18 23:36:56.741910 2026] [security2:error] [pid 897595:tid 897763] [client 173.239.196.162:49071] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/xleet.php"] [unique_id "alxieOZhsBlduL7gIyzV1wAAAKo"]
[Sat Jul 18 23:36:56.878070 2026] [security2:error] [pid 897595:tid 897734] [client 4.194.24.143:33684] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/size.php"] [unique_id "alxieOZhsBlduL7gIyzV3wAAAI0"]
[Sat Jul 18 23:36:57.072072 2026] [security2:error] [pid 897595:tid 897612] [remote 117.0.21.154:40194] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "syo.khd.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxieeZhsBlduL7gIyzV9gAA2Q8"]
[Sat Jul 18 23:36:57.072227 2026] [security2:error] [pid 897595:tid 897810] [client 117.0.21.154:40194] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "syo.khd.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxieeZhsBlduL7gIyzV9gAA2Q8"]
[Sat Jul 18 23:36:57.364132 2026] [security2:error] [pid 897595:tid 897624] [remote 4.205.168.44:39848] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxieeZhsBlduL7gIyzWEAAA3Bs"]
[Sat Jul 18 23:36:57.396823 2026] [security2:error] [pid 897595:tid 897791] [client 84.54.78.78:10460] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "whiteoutcb.com"] [uri "/wp-login.php"] [unique_id "alxieeZhsBlduL7gIyzWCwAAAMY"], referer: https://www.google.com
[Sat Jul 18 23:36:57.519242 2026] [security2:error] [pid 897595:tid 897802] [client 74.7.241.135:0] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "404"] [hostname "cofigua.com"] [uri "/cgi-sys/404.html"] [unique_id "alxieeZhsBlduL7gIyzWJQAAANE"]
[Sat Jul 18 23:36:57.520770 2026] [security2:error] [pid 897595:tid 897800] [client 74.7.241.135:39852] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "404"] [hostname "cofigua.com"] [uri "/robots.txt"] [unique_id "alxieeZhsBlduL7gIyzWHwAAz0A"]
[Sat Jul 18 23:36:57.613612 2026] [security2:error] [pid 897595:tid 897826] [client 173.239.196.162:58319] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/templates/beez3/bypass.php"] [unique_id "alxieeZhsBlduL7gIyzWLgAAAOk"]
[Sat Jul 18 23:36:57.667131 2026] [security2:error] [pid 897595:tid 897632] [remote 4.205.168.44:39848] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxieeZhsBlduL7gIyzWMQAAxyM"], referer: https://sesamegreenbeans.com/wp-login.php
[Sat Jul 18 23:36:57.722331 2026] [security2:error] [pid 897595:tid 897754] [client 4.194.24.143:2478] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/sm.php"] [unique_id "alxieeZhsBlduL7gIyzWMgAAAKE"]
[Sat Jul 18 23:36:58.325287 2026] [security2:error] [pid 897595:tid 897757] [client 4.194.24.143:33667] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/sql.php"] [unique_id "alxieuZhsBlduL7gIyzWUgAAAKQ"]
[Sat Jul 18 23:36:58.399614 2026] [security2:error] [pid 897595:tid 897806] [client 163.61.1.17:56725] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxieuZhsBlduL7gIyzWVAAAANU"]
[Sat Jul 18 23:36:58.399816 2026] [security2:error] [pid 897595:tid 897806] [client 163.61.1.17:56725] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxieuZhsBlduL7gIyzWVAAAANU"]
[Sat Jul 18 23:36:58.455763 2026] [security2:error] [pid 897595:tid 897733] [client 173.239.196.160:56207] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/blue/ahax.php"] [unique_id "alxieuZhsBlduL7gIyzWcQAAAIw"]
[Sat Jul 18 23:36:58.730206 2026] [security2:error] [pid 897595:tid 897804] [client 190.245.146.99:59863] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxieuZhsBlduL7gIyzWkgAAANM"]
[Sat Jul 18 23:36:58.736251 2026] [security2:error] [pid 897595:tid 897804] [client 190.245.146.99:59863] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxieuZhsBlduL7gIyzWkgAAANM"]
[Sat Jul 18 23:36:58.919740 2026] [security2:error] [pid 897595:tid 897842] [client 4.194.24.143:47983] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/ss.php"] [unique_id "alxieuZhsBlduL7gIyzWmQAAAPk"]
[Sat Jul 18 23:36:59.319448 2026] [security2:error] [pid 897595:tid 897748] [client 173.239.196.164:28861] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/admin.php"] [unique_id "alxie-ZhsBlduL7gIyzWuQAAAJs"]
[Sat Jul 18 23:36:59.374724 2026] [security2:error] [pid 897595:tid 897805] [client 106.222.249.209:5760] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxie-ZhsBlduL7gIyzWwwAAANQ"]
[Sat Jul 18 23:36:59.374844 2026] [security2:error] [pid 897595:tid 897805] [client 106.222.249.209:5760] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxie-ZhsBlduL7gIyzWwwAAANQ"]
[Sat Jul 18 23:36:59.656915 2026] [security2:error] [pid 897595:tid 897828] [client 4.194.24.143:2649] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/stats.php"] [unique_id "alxie-ZhsBlduL7gIyzW3wAAAOs"]
[Sat Jul 18 23:36:59.882676 2026] [security2:error] [pid 897595:tid 897786] [client 52.221.236.148:58330] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 148.236.221.52.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxie-ZhsBlduL7gIyzW5gAAAME"]
[Sat Jul 18 23:36:59.882907 2026] [security2:error] [pid 897595:tid 897786] [client 52.221.236.148:58330] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxie-ZhsBlduL7gIyzW5gAAAME"]
[Sat Jul 18 23:37:00.069699 2026] [security2:error] [pid 897595:tid 897740] [client 84.54.78.78:12943] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/opt/mod_security/hg_rules.conf"] [line "306"] [id "900285"] [msg "Wordpress Brute Attempts"] [hostname "whiteoutcb.com"] [uri "/wp-login.php"] [unique_id "alxifOZhsBlduL7gIyzW7QAAAJM"], referer: http://whiteoutcb.com/wp-login.php
[Sat Jul 18 23:37:00.159360 2026] [security2:error] [pid 897595:tid 897598] [remote 165.232.173.236:35814] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 236.173.232.165.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory-com.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxifOZhsBlduL7gIyzW9AAA3gE"]
[Sat Jul 18 23:37:00.159622 2026] [security2:error] [pid 897595:tid 897815] [client 165.232.173.236:35814] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nzfoodstory-com.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxifOZhsBlduL7gIyzW9AAA3gE"]
[Sat Jul 18 23:37:00.191132 2026] [security2:error] [pid 897595:tid 897774] [client 173.239.196.163:50285] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/assets/file.php"] [unique_id "alxifOZhsBlduL7gIyzW9gAAALU"]
[Sat Jul 18 23:37:00.381648 2026] [security2:error] [pid 897595:tid 897737] [client 34.172.185.49:35106] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "709fx.com"] [uri "/"] [unique_id "alxifOZhsBlduL7gIyzXAgAAAJA"]
[Sat Jul 18 23:37:00.513544 2026] [security2:error] [pid 897595:tid 897772] [client 4.194.24.143:56606] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/sump1.php"] [unique_id "alxifOZhsBlduL7gIyzXBQAAALM"]
[Sat Jul 18 23:37:00.912712 2026] [security2:error] [pid 897595:tid 897656] [remote 31.42.184.154:60304] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "inspirespublishing.com"] [uri "/wp-login.php"] [unique_id "alxifOZhsBlduL7gIyzXIwAAwjs"]
[Sat Jul 18 23:37:01.033707 2026] [security2:error] [pid 897595:tid 897739] [client 47.128.16.88:11172] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.locketsandcharms.com"] [uri "/robots.txt"] [unique_id "alxifeZhsBlduL7gIyzXKwAAAJI"]
[Sat Jul 18 23:37:01.051361 2026] [security2:error] [pid 897595:tid 897837] [client 173.239.196.163:61833] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/cgi-bin/index.php"] [unique_id "alxifeZhsBlduL7gIyzXLAAAAPQ"]
[Sat Jul 18 23:37:01.138816 2026] [security2:error] [pid 897595:tid 897597] [remote 31.42.184.154:60304] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "inspirespublishing.com"] [uri "/wp-login.php"] [unique_id "alxifeZhsBlduL7gIyzXNAAApAA"], referer: https://inspirespublishing.com/wp-login.php
[Sat Jul 18 23:37:01.310451 2026] [security2:error] [pid 897595:tid 897763] [client 4.194.24.143:47961] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/system.php"] [unique_id "alxifeZhsBlduL7gIyzXRgAAAKo"]
[Sat Jul 18 23:37:01.916420 2026] [security2:error] [pid 897595:tid 897807] [client 173.239.196.161:60307] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/uploads/file.php"] [unique_id "alxifeZhsBlduL7gIyzXaAAAANY"]
[Sat Jul 18 23:37:02.078280 2026] [security2:error] [pid 897595:tid 897802] [client 4.194.24.143:56596] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/system/03n1hob7p03r2npdefault.php"] [unique_id "alxifuZhsBlduL7gIyzXbgAAANE"]
[Sat Jul 18 23:37:02.780786 2026] [security2:error] [pid 897595:tid 897791] [client 173.239.196.162:52865] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/view-more/ioxi.php"] [unique_id "alxifuZhsBlduL7gIyzXnQAAAMY"]
[Sat Jul 18 23:37:02.795191 2026] [security2:error] [pid 897595:tid 897848] [client 179.32.37.252:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "worbals.com"] [uri "/index.php"] [unique_id "alxifOZhsBlduL7gIyzXEQAAAP8"]
[Sat Jul 18 23:37:02.968473 2026] [security2:error] [pid 897595:tid 897738] [client 4.194.24.143:56608] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/system/cj5ha2rah8lyiqqdefault.php"] [unique_id "alxifuZhsBlduL7gIyzXrwAAAJE"]
[Sat Jul 18 23:37:02.995823 2026] [security2:error] [pid 897595:tid 897819] [client 176.101.174.186:32756] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.sesamegreenbeans.com"] [uri "/index.php"] [unique_id "alxifuZhsBlduL7gIyzXnwAA4ks"]
[Sat Jul 18 23:37:03.238833 2026] [security2:error] [pid 897595:tid 897774] [client 180.252.198.240:58153] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxif-ZhsBlduL7gIyzXvgAAALU"]
[Sat Jul 18 23:37:03.238943 2026] [security2:error] [pid 897595:tid 897774] [client 180.252.198.240:58153] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxif-ZhsBlduL7gIyzXvgAAALU"]
[Sat Jul 18 23:37:03.383491 2026] [security2:error] [pid 897595:tid 897730] [client 50.116.65.227:41116] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/11/Fu-Lin-Feature-Image.jpg"] [unique_id "alxif-ZhsBlduL7gIyzXxQAAAIk"]
[Sat Jul 18 23:37:03.394827 2026] [security2:error] [pid 897595:tid 897761] [client 50.116.65.227:59564] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/11/Fu-Lin-Feature-Image.jpg"] [unique_id "alxif-ZhsBlduL7gIyzXyQAAAKg"]
[Sat Jul 18 23:37:03.589326 2026] [security2:error] [pid 897595:tid 897760] [client 4.194.24.143:47982] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/system_log.php"] [unique_id "alxif-ZhsBlduL7gIyzX0wAAAKc"]
[Sat Jul 18 23:37:03.638499 2026] [security2:error] [pid 897595:tid 897810] [client 173.239.196.162:34871] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "alxif-ZhsBlduL7gIyzX1gAAANk"]
[Sat Jul 18 23:37:03.718560 2026] [security2:error] [pid 897595:tid 897704] [remote 31.42.184.154:60318] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.fvx.wyy.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxif-ZhsBlduL7gIyzX3AAA9Gs"]
[Sat Jul 18 23:37:03.718696 2026] [security2:error] [pid 897595:tid 897837] [client 31.42.184.154:60318] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "mail.fvx.wyy.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxif-ZhsBlduL7gIyzX3AAA9Gs"]
[Sat Jul 18 23:37:04.060235 2026] [security2:error] [pid 897595:tid 897744] [client 74.208.214.194:42856] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxigOZhsBlduL7gIyzX7wAAAJc"]
[Sat Jul 18 23:37:04.175769 2026] [security2:error] [pid 897595:tid 897781] [client 4.194.24.143:2098] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/t.php"] [unique_id "alxigOZhsBlduL7gIyzX8gAAALw"]
[Sat Jul 18 23:37:04.508261 2026] [security2:error] [pid 897595:tid 897810] [client 173.239.196.167:49727] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "alxigOZhsBlduL7gIyzYDQAAANk"]
[Sat Jul 18 23:37:04.677814 2026] [security2:error] [pid 897595:tid 897814] [client 50.116.65.227:41122] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxigOZhsBlduL7gIyzYDwAAAN0"]
[Sat Jul 18 23:37:04.692731 2026] [security2:error] [pid 897595:tid 897824] [client 50.116.65.227:59576] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxigOZhsBlduL7gIyzYEQAAAKI"]
[Sat Jul 18 23:37:05.137234 2026] [security2:error] [pid 897595:tid 897796] [client 4.194.24.143:2097] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/term.php"] [unique_id "alxigeZhsBlduL7gIyzYMwAAAMs"]
[Sat Jul 18 23:37:05.229857 2026] [security2:error] [pid 897595:tid 897816] [client 179.97.88.75:30036] ModSecurity: Warning. String match "408" at RESPONSE_STATUS. [file "/etc/httpd/modsecurity.d/03_asl_dos.conf"] [line "35"] [id "343434"] [rev "1"] [msg "Atomicorp.com WAF Rules: Client Connection dropped by Apache due to slow connection, possible Slowaris attack"] [severity "WARNING"] [hostname "whiteoutcb.com"] [uri "/wp-login.php"] [unique_id "alxibuZhsBlduL7gIyzTOgAAAN8"], referer: http://whiteoutcb.com/wp-login.php
[Sat Jul 18 23:37:05.407495 2026] [security2:error] [pid 897595:tid 897824] [client 173.239.196.163:31503] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/index.php"] [unique_id "alxigeZhsBlduL7gIyzYSgAAAOc"]
[Sat Jul 18 23:37:05.413154 2026] [security2:error] [pid 897595:tid 897705] [remote 74.235.96.117:45326] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.235.74.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "secretkeynumerology.com"] [uri "/wp-login.php"] [unique_id "alxigeZhsBlduL7gIyzYSAAA5Ww"]
[Sat Jul 18 23:37:05.552329 2026] [security2:error] [pid 897595:tid 897807] [client 159.138.123.12:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxigeZhsBlduL7gIyzYPgAA1ko"], referer: https://www.aleishapenny.ca/listing/page/263?paged=263&view=list
[Sat Jul 18 23:37:05.631593 2026] [security2:error] [pid 897595:tid 897774] [client 35.204.135.22:32768] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "cpcalendars.besttestedrecipes.com"] [uri "/"] [unique_id "alxigeZhsBlduL7gIyzYWgAAALU"]
[Sat Jul 18 23:37:05.631679 2026] [security2:error] [pid 897595:tid 897774] [client 35.204.135.22:32768] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "cpcalendars.besttestedrecipes.com"] [uri "/"] [unique_id "alxigeZhsBlduL7gIyzYWgAAALU"]
[Sat Jul 18 23:37:05.867697 2026] [security2:error] [pid 897595:tid 897641] [remote 74.235.96.117:45326] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.235.74.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "secretkeynumerology.com"] [uri "/wp-login.php"] [unique_id "alxigeZhsBlduL7gIyzYaQABASw"], referer: https://secretkeynumerology.com/wp-login.php
[Sat Jul 18 23:37:06.080861 2026] [security2:error] [pid 897595:tid 897822] [client 222.154.43.254:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "bluedoorbar.co.nz"] [uri "/index.php"] [unique_id "alxiguZhsBlduL7gIyzYdgAAAOU"], referer: https://bluedoorbar.co.nz/wp-content/uploads/2025/09/Blue-Door-Bites.pdf
[Sat Jul 18 23:37:06.180589 2026] [security2:error] [pid 897595:tid 897751] [client 4.194.24.143:33634] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/test.php"] [unique_id "alxiguZhsBlduL7gIyzYegAAAJ4"]
[Sat Jul 18 23:37:06.726531 2026] [security2:error] [pid 897595:tid 897776] [client 173.239.196.166:30519] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/admin.php"] [unique_id "alxiguZhsBlduL7gIyzYnAAAALc"]
[Sat Jul 18 23:37:07.262074 2026] [security2:error] [pid 897595:tid 897727] [client 223.228.182.224:28400] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxig-ZhsBlduL7gIyzYxQAAAIY"]
[Sat Jul 18 23:37:07.262166 2026] [security2:error] [pid 897595:tid 897727] [client 223.228.182.224:28400] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxig-ZhsBlduL7gIyzYxQAAAIY"]
[Sat Jul 18 23:37:07.269032 2026] [security2:error] [pid 897595:tid 897853] [client 4.194.24.143:2368] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/test1.php"] [unique_id "alxig-ZhsBlduL7gIyzYxgAAAQQ"]
[Sat Jul 18 23:37:07.618308 2026] [security2:error] [pid 897595:tid 897841] [client 173.239.196.163:25865] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "alxig-ZhsBlduL7gIyzY2gAAAPg"]
[Sat Jul 18 23:37:07.747289 2026] [security2:error] [pid 897595:tid 897678] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/nine2code.php"] [unique_id "alxig-ZhsBlduL7gIyzY3QAA6FE"]
[Sat Jul 18 23:37:07.942636 2026] [security2:error] [pid 897595:tid 897803] [client 138.252.89.100:57489] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxig-ZhsBlduL7gIyzY6gAAANI"]
[Sat Jul 18 23:37:07.942739 2026] [security2:error] [pid 897595:tid 897803] [client 138.252.89.100:57489] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxig-ZhsBlduL7gIyzY6gAAANI"]
[Sat Jul 18 23:37:07.943024 2026] [security2:error] [pid 897595:tid 897695] [remote 91.142.222.105:60072] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.pfl.ail.mybluehost.me"] [uri "/wp-includes/wp-login.php"] [unique_id "alxig-ZhsBlduL7gIyzY6AAA_WI"]
[Sat Jul 18 23:37:07.987042 2026] [security2:error] [pid 897595:tid 897684] [remote 113.160.142.119:46104] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mollycahill.com"] [uri "/wp-login.php"] [unique_id "alxig-ZhsBlduL7gIyzY7AAAxVc"]
[Sat Jul 18 23:37:08.135600 2026] [security2:error] [pid 897595:tid 897831] [client 4.194.24.143:2454] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/tfm.php"] [unique_id "alxihOZhsBlduL7gIyzY8gAAAO4"]
[Sat Jul 18 23:37:08.359203 2026] [security2:error] [pid 897595:tid 897709] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/num.php"] [unique_id "alxihOZhsBlduL7gIyzZAgAAtXA"]
[Sat Jul 18 23:37:08.497304 2026] [security2:error] [pid 897595:tid 897724] [remote 113.160.142.119:46104] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mollycahill.com"] [uri "/wp-login.php"] [unique_id "alxihOZhsBlduL7gIyzZEQAAtn8"], referer: https://mollycahill.com/wp-login.php
[Sat Jul 18 23:37:08.510692 2026] [security2:error] [pid 897595:tid 897797] [client 173.239.196.161:48079] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/images/wp-login.php"] [unique_id "alxihOZhsBlduL7gIyzZCgAAAMw"]
[Sat Jul 18 23:37:08.583104 2026] [security2:error] [pid 897595:tid 897711] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/odf7udtspqtpxzyxmw2rccdefault.php"] [unique_id "alxihOZhsBlduL7gIyzZGgAAsnI"]
[Sat Jul 18 23:37:08.757623 2026] [security2:error] [pid 897595:tid 897686] [remote 91.142.222.105:60072] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.pfl.ail.mybluehost.me"] [uri "/wp-includes/wp-login.php"] [unique_id "alxihOZhsBlduL7gIyzZJwAA5Fk"], referer: https://mail.pfl.ail.mybluehost.me/wp-includes/wp-login.php
[Sat Jul 18 23:37:08.802528 2026] [security2:error] [pid 897595:tid 897601] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/option.php"] [unique_id "alxihOZhsBlduL7gIyzZKQAApAQ"]
[Sat Jul 18 23:37:08.992774 2026] [security2:error] [pid 897595:tid 897647] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/p.php"] [unique_id "alxihOZhsBlduL7gIyzZMwAAkjI"]
[Sat Jul 18 23:37:09.063796 2026] [security2:error] [pid 897595:tid 897788] [client 4.194.24.143:2069] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/thebe.php"] [unique_id "alxiheZhsBlduL7gIyzZPgAAAMM"]
[Sat Jul 18 23:37:09.227597 2026] [security2:error] [pid 897595:tid 897831] [client 190.245.146.99:60385] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxiheZhsBlduL7gIyzZSAAAAO4"]
[Sat Jul 18 23:37:09.233477 2026] [security2:error] [pid 897595:tid 897831] [client 190.245.146.99:60385] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxiheZhsBlduL7gIyzZSAAAAO4"]
[Sat Jul 18 23:37:09.276924 2026] [security2:error] [pid 897595:tid 897655] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/past.php"] [unique_id "alxiheZhsBlduL7gIyzZSgAAuTo"]
[Sat Jul 18 23:37:09.359408 2026] [security2:error] [pid 897595:tid 897809] [client 173.239.196.166:53789] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/ioxi/ioxiworm.php"] [unique_id "alxiheZhsBlduL7gIyzZTAAAANg"]
[Sat Jul 18 23:37:09.363117 2026] [security2:error] [pid 897595:tid 897792] [client 18.232.92.172:13874] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 172.92.232.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxiheZhsBlduL7gIyzZTQAAAMc"], referer: https://curlsnpearlsss.com/es/category/food/dinners/page/2/
[Sat Jul 18 23:37:09.518218 2026] [security2:error] [pid 897595:tid 897661] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/php.php"] [unique_id "alxiheZhsBlduL7gIyzZXgAAsUA"]
[Sat Jul 18 23:37:09.575195 2026] [security2:error] [pid 897595:tid 897743] [client 163.61.1.17:57206] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxiheZhsBlduL7gIyzZYgAAAJY"]
[Sat Jul 18 23:37:09.575320 2026] [security2:error] [pid 897595:tid 897743] [client 163.61.1.17:57206] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxiheZhsBlduL7gIyzZYgAAAJY"]
[Sat Jul 18 23:37:09.743365 2026] [security2:error] [pid 897595:tid 897718] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/php8.php"] [unique_id "alxiheZhsBlduL7gIyzZaAAAw3k"]
[Sat Jul 18 23:37:09.991109 2026] [security2:error] [pid 897595:tid 897802] [client 4.194.24.143:2462] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/themes.php"] [unique_id "alxiheZhsBlduL7gIyzZfgAAANE"]
[Sat Jul 18 23:37:10.009473 2026] [security2:error] [pid 897595:tid 897646] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/phpinfo.php"] [unique_id "alxihuZhsBlduL7gIyzZfwAApTE"]
[Sat Jul 18 23:37:10.079974 2026] [security2:error] [pid 897595:tid 897786] [client 93.178.114.72:4995] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "whiteoutcb.com"] [uri "/wp-login.php"] [unique_id "alxiheZhsBlduL7gIyzZegAAAME"], referer: https://www.google.com
[Sat Jul 18 23:37:10.121424 2026] [security2:error] [pid 897595:tid 897741] [client 185.192.69.7:56563] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "drewsasburyparkbeachhouse.com"] [uri "/000.php"] [unique_id "alxihuZhsBlduL7gIyzZhgAAAJQ"]
[Sat Jul 18 23:37:10.124726 2026] [security2:error] [pid 897595:tid 897762] [client 106.222.249.209:8236] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxihuZhsBlduL7gIyzZiAAAAKk"]
[Sat Jul 18 23:37:10.124982 2026] [security2:error] [pid 897595:tid 897762] [client 106.222.249.209:8236] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxihuZhsBlduL7gIyzZiAAAAKk"]
[Sat Jul 18 23:37:10.238648 2026] [security2:error] [pid 897595:tid 897738] [client 173.239.196.161:49417] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/blog/wp-content/about.php"] [unique_id "alxihuZhsBlduL7gIyzZkAAAAJE"]
[Sat Jul 18 23:37:10.577148 2026] [security2:error] [pid 897595:tid 897783] [client 185.192.69.33:50139] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "drewsasburyparkbeachhouse.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxihuZhsBlduL7gIyzZngAAAL4"]
[Sat Jul 18 23:37:10.708197 2026] [security2:error] [pid 897595:tid 897677] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/post.php"] [unique_id "alxihuZhsBlduL7gIyzZpwAAuVA"]
[Sat Jul 18 23:37:10.939835 2026] [security2:error] [pid 897595:tid 897627] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/public/assets/design_1/css/parts/course_cards/grid_card_1.min.php"] [unique_id "alxihuZhsBlduL7gIyzZtAAArx4"]
[Sat Jul 18 23:37:11.033586 2026] [security2:error] [pid 897595:tid 897805] [client 185.192.69.6:31459] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "drewsasburyparkbeachhouse.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxih-ZhsBlduL7gIyzZuQAAANQ"]
[Sat Jul 18 23:37:11.042557 2026] [security2:error] [pid 897595:tid 897800] [client 18.232.93.255:46696] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 255.93.232.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxih-ZhsBlduL7gIyzZtwAAAM8"], referer: https://curlsnpearlsss.com/es/
[Sat Jul 18 23:37:11.121028 2026] [security2:error] [pid 897595:tid 897801] [client 173.239.196.160:20291] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/hehehehe.php"] [unique_id "alxih-ZhsBlduL7gIyzZvwAAANA"]
[Sat Jul 18 23:37:11.152198 2026] [security2:error] [pid 897595:tid 897681] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/public/css.php"] [unique_id "alxih-ZhsBlduL7gIyzZxgABAlQ"]
[Sat Jul 18 23:37:11.179484 2026] [security2:error] [pid 897595:tid 897802] [client 4.194.24.143:2053] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/tiny.php"] [unique_id "alxih-ZhsBlduL7gIyzZywAAANE"]
[Sat Jul 18 23:37:11.370944 2026] [security2:error] [pid 897595:tid 897657] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/r.php"] [unique_id "alxih-ZhsBlduL7gIyzZ2AAA3jw"]
[Sat Jul 18 23:37:11.471922 2026] [security2:error] [pid 897595:tid 897797] [client 74.208.214.194:60194] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxih-ZhsBlduL7gIyzZ3wAAAMw"]
[Sat Jul 18 23:37:11.478869 2026] [security2:error] [pid 897595:tid 897839] [client 185.192.69.30:37323] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "drewsasburyparkbeachhouse.com"] [uri "/wp-content/index.php"] [unique_id "alxih-ZhsBlduL7gIyzZ4AAAAPY"]
[Sat Jul 18 23:37:11.591341 2026] [security2:error] [pid 897595:tid 897688] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/radio.php"] [unique_id "alxih-ZhsBlduL7gIyzZ5AAA6Vs"]
[Sat Jul 18 23:37:11.812225 2026] [security2:error] [pid 897595:tid 897643] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/randkeyword.php7"] [unique_id "alxih-ZhsBlduL7gIyzZ8QAA3S4"]
[Sat Jul 18 23:37:11.923466 2026] [security2:error] [pid 897595:tid 897811] [client 185.192.69.3:55633] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "drewsasburyparkbeachhouse.com"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "alxih-ZhsBlduL7gIyzaAQAAANo"]
[Sat Jul 18 23:37:11.976875 2026] [security2:error] [pid 897595:tid 897795] [client 173.239.196.160:52683] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/acme-challenge/install.php"] [unique_id "alxih-ZhsBlduL7gIyzaEwAAAMo"]
[Sat Jul 18 23:37:12.004124 2026] [security2:error] [pid 897595:tid 897636] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/readme.php"] [unique_id "alxiiOZhsBlduL7gIyzaFAAA0Sc"]
[Sat Jul 18 23:37:12.221953 2026] [security2:error] [pid 897595:tid 897669] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/reze.php"] [unique_id "alxiiOZhsBlduL7gIyzaJQAArUg"]
[Sat Jul 18 23:37:12.285888 2026] [security2:error] [pid 897595:tid 897742] [client 188.217.52.248:3949] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.52.217.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "whiteoutcb.com"] [uri "/wp-login.php"] [unique_id "alxiiOZhsBlduL7gIyzaKgAAAJU"], referer: http://whiteoutcb.com/wp-login.php
[Sat Jul 18 23:37:12.440202 2026] [security2:error] [pid 897595:tid 897655] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/rh.php"] [unique_id "alxiiOZhsBlduL7gIyzaNwAA8Do"]
[Sat Jul 18 23:37:12.459613 2026] [security2:error] [pid 897595:tid 897645] [remote 205.196.217.58:32894] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.217.196.205.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "jenfarley.com"] [uri "/wp-login.php"] [unique_id "alxiiOZhsBlduL7gIyzaOQAAwTA"]
[Sat Jul 18 23:37:12.659927 2026] [security2:error] [pid 897595:tid 897718] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/rip.php"] [unique_id "alxiiOZhsBlduL7gIyzaUgAAiXk"]
[Sat Jul 18 23:37:12.664535 2026] [security2:error] [pid 897595:tid 897609] [remote 205.196.217.58:32894] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.217.196.205.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "jenfarley.com"] [uri "/wp-login.php"] [unique_id "alxiiOZhsBlduL7gIyzaTwAA_ww"], referer: https://jenfarley.com/wp-login.php
[Sat Jul 18 23:37:12.835423 2026] [security2:error] [pid 897595:tid 897810] [client 173.239.196.166:32081] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/acme-challenge/plugins.php"] [unique_id "alxiiOZhsBlduL7gIyzaZwAAANk"]
[Sat Jul 18 23:37:12.870081 2026] [security2:error] [pid 897595:tid 897640] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/root.php"] [unique_id "alxiiOZhsBlduL7gIyzabAAAiis"]
[Sat Jul 18 23:37:12.942654 2026] [security2:error] [pid 897595:tid 897826] [client 4.194.24.143:2576] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/tmp/byp.php"] [unique_id "alxiiOZhsBlduL7gIyzacAAAAOk"]
[Sat Jul 18 23:37:13.087968 2026] [security2:error] [pid 897595:tid 897597] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/s.php"] [unique_id "alxiieZhsBlduL7gIyzadAAA_QA"]
[Sat Jul 18 23:37:13.309805 2026] [security2:error] [pid 897595:tid 897687] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/sang.php"] [unique_id "alxiieZhsBlduL7gIyzaggAAx1o"]
[Sat Jul 18 23:37:13.616985 2026] [security2:error] [pid 897595:tid 897618] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/scxy.php"] [unique_id "alxiieZhsBlduL7gIyzalgAAzxU"]
[Sat Jul 18 23:37:13.701167 2026] [security2:error] [pid 897595:tid 897744] [client 180.252.198.240:58604] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiieZhsBlduL7gIyzamAAAAJc"]
[Sat Jul 18 23:37:13.701269 2026] [security2:error] [pid 897595:tid 897744] [client 180.252.198.240:58604] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiieZhsBlduL7gIyzamAAAAJc"]
[Sat Jul 18 23:37:13.704562 2026] [security2:error] [pid 897595:tid 897810] [client 173.239.196.163:52681] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/acme-challenge/license.php"] [unique_id "alxiieZhsBlduL7gIyzamgAAANk"]
[Sat Jul 18 23:37:13.932516 2026] [security2:error] [pid 897595:tid 897619] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/sd.php"] [unique_id "alxiieZhsBlduL7gIyzasQAAzRY"]
[Sat Jul 18 23:37:14.125725 2026] [security2:error] [pid 897595:tid 897688] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/sf.php"] [unique_id "alxiiuZhsBlduL7gIyzavQAAu1s"]
[Sat Jul 18 23:37:14.245854 2026] [security2:error] [pid 897595:tid 897649] [remote 49.13.1.223:36810] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.1.13.49.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "kpb.qlr.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxiiuZhsBlduL7gIyzaxgAA0TQ"]
[Sat Jul 18 23:37:14.245987 2026] [security2:error] [pid 897595:tid 897802] [client 49.13.1.223:36810] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "kpb.qlr.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxiiuZhsBlduL7gIyzaxgAA0TQ"]
[Sat Jul 18 23:37:14.345380 2026] [security2:error] [pid 897595:tid 897670] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/shell.php"] [unique_id "alxiiuZhsBlduL7gIyza0QAArkk"]
[Sat Jul 18 23:37:14.439892 2026] [security2:error] [pid 897595:tid 897803] [client 54.149.239.117:31128] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.239.149.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cryptomeaning.com"] [uri "/wp-cron.php"] [unique_id "alxiiuZhsBlduL7gIyza0wAAANI"]
[Sat Jul 18 23:37:14.468775 2026] [security2:error] [pid 897595:tid 897774] [client 18.232.92.172:13882] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 172.92.232.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxiiuZhsBlduL7gIyza1AAAALU"], referer: https://curlsnpearlsss.com/es/category/food/dinners/page/2/
[Sat Jul 18 23:37:14.484260 2026] [security2:error] [pid 897595:tid 897759] [client 18.212.127.231:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "cryptomeaning.com"] [uri "/index.php"] [unique_id "alxiiOZhsBlduL7gIyzaPgAAAKY"]
[Sat Jul 18 23:37:14.565994 2026] [security2:error] [pid 897595:tid 897824] [client 173.239.196.164:43201] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "alxiiuZhsBlduL7gIyza2wAAAOc"]
[Sat Jul 18 23:37:14.770283 2026] [security2:error] [pid 897595:tid 897630] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/sid3.php"] [unique_id "alxiiuZhsBlduL7gIyza4gAA6CE"]
[Sat Jul 18 23:37:14.964803 2026] [security2:error] [pid 897595:tid 897712] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/simple.php"] [unique_id "alxiiuZhsBlduL7gIyza9gAAu3M"]
[Sat Jul 18 23:37:15.167778 2026] [security2:error] [pid 897595:tid 897756] [client 54.81.157.232:19700] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 232.157.81.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxii-ZhsBlduL7gIyza_gAAAKM"], referer: https://curlsnpearlsss.com/es/
[Sat Jul 18 23:37:15.184616 2026] [security2:error] [pid 897595:tid 897663] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/sitemap.php"] [unique_id "alxii-ZhsBlduL7gIyza_wAA4UI"]
[Sat Jul 18 23:37:15.376829 2026] [security2:error] [pid 897595:tid 897629] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/size.php"] [unique_id "alxii-ZhsBlduL7gIyzbCgAAmSA"]
[Sat Jul 18 23:37:15.410147 2026] [security2:error] [pid 897595:tid 897822] [client 173.239.196.162:24473] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/astra/inc/fm.php"] [unique_id "alxii-ZhsBlduL7gIyzbDQAAAOU"]
[Sat Jul 18 23:37:15.605637 2026] [security2:error] [pid 897595:tid 897669] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/sm.php"] [unique_id "alxii-ZhsBlduL7gIyzbHgAAvEg"]
[Sat Jul 18 23:37:15.803770 2026] [security2:error] [pid 897595:tid 897716] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/sql.php"] [unique_id "alxii-ZhsBlduL7gIyzbLgAAu3c"]
[Sat Jul 18 23:37:16.023951 2026] [security2:error] [pid 897595:tid 897800] [client 54.158.23.200:60826] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 200.23.158.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxijOZhsBlduL7gIyzbPAAAAM8"], referer: https://curlsnpearlsss.com/es/
[Sat Jul 18 23:37:16.080218 2026] [security2:error] [pid 897595:tid 897599] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/ss.php"] [unique_id "alxijOZhsBlduL7gIyzbQAAAtwI"]
[Sat Jul 18 23:37:16.237083 2026] [security2:error] [pid 897595:tid 897797] [client 173.239.196.162:21679] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/ccx/index.php"] [unique_id "alxijOZhsBlduL7gIyzbUQAAAMw"]
[Sat Jul 18 23:37:16.263052 2026] [security2:error] [pid 897595:tid 897642] [remote 91.142.222.105:46476] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxijOZhsBlduL7gIyzbUgAA-C0"]
[Sat Jul 18 23:37:16.286280 2026] [security2:error] [pid 897595:tid 897819] [client 13.221.201.234:39034] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.201.221.13.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxijOZhsBlduL7gIyzbUwAAAOI"], referer: https://curlsnpearlsss.com/es/
[Sat Jul 18 23:37:16.296857 2026] [security2:error] [pid 897595:tid 897718] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/stats.php"] [unique_id "alxijOZhsBlduL7gIyzbVQAA6Hk"]
[Sat Jul 18 23:37:16.444030 2026] [security2:error] [pid 897595:tid 897671] [remote 31.42.184.154:36082] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxijOZhsBlduL7gIyzbYAAAkEo"]
[Sat Jul 18 23:37:16.576834 2026] [security2:error] [pid 897595:tid 897624] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/sump1.php"] [unique_id "alxijOZhsBlduL7gIyzbaQAAhRs"]
[Sat Jul 18 23:37:16.783782 2026] [security2:error] [pid 897595:tid 897621] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/system.php"] [unique_id "alxijOZhsBlduL7gIyzbcAAAwBg"]
[Sat Jul 18 23:37:16.901839 2026] [security2:error] [pid 897595:tid 897634] [remote 31.42.184.154:36082] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxijOZhsBlduL7gIyzbegAAtSU"], referer: https://sesamegreenbeans.com/wp-login.php
[Sat Jul 18 23:37:17.009381 2026] [security2:error] [pid 897595:tid 897720] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/system/03n1hob7p03r2npdefault.php"] [unique_id "alxijeZhsBlduL7gIyzbfwAAxXs"]
[Sat Jul 18 23:37:17.100193 2026] [security2:error] [pid 897595:tid 897786] [client 173.239.196.167:26567] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/index.php"] [unique_id "alxijeZhsBlduL7gIyzbgwAAAME"]
[Sat Jul 18 23:37:17.204212 2026] [security2:error] [pid 897595:tid 897611] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/system/cj5ha2rah8lyiqqdefault.php"] [unique_id "alxijeZhsBlduL7gIyzbiAAA6A4"]
[Sat Jul 18 23:37:17.426164 2026] [security2:error] [pid 897595:tid 897627] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/system_log.php"] [unique_id "alxijeZhsBlduL7gIyzbmgAAoh4"]
[Sat Jul 18 23:37:17.620896 2026] [security2:error] [pid 897595:tid 897667] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/t.php"] [unique_id "alxijeZhsBlduL7gIyzbogAA2UY"]
[Sat Jul 18 23:37:17.860184 2026] [security2:error] [pid 897595:tid 897719] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/term.php"] [unique_id "alxijeZhsBlduL7gIyzbrgAA5Xo"]
[Sat Jul 18 23:37:17.954325 2026] [security2:error] [pid 897595:tid 897763] [client 173.239.196.165:41641] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/Requests/about.php"] [unique_id "alxijeZhsBlduL7gIyzbuwAAAKo"]
[Sat Jul 18 23:37:18.062646 2026] [security2:error] [pid 897595:tid 897664] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/test.php"] [unique_id "alxijuZhsBlduL7gIyzbvgAAm0M"]
[Sat Jul 18 23:37:18.252034 2026] [security2:error] [pid 897595:tid 897821] [client 223.228.182.224:43224] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxijuZhsBlduL7gIyzbyAAAAOQ"]
[Sat Jul 18 23:37:18.252211 2026] [security2:error] [pid 897595:tid 897821] [client 223.228.182.224:43224] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxijuZhsBlduL7gIyzbyAAAAOQ"]
[Sat Jul 18 23:37:18.295205 2026] [security2:error] [pid 897595:tid 897668] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/test1.php"] [unique_id "alxijuZhsBlduL7gIyzbywAAykc"]
[Sat Jul 18 23:37:18.487778 2026] [security2:error] [pid 897595:tid 897666] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/tfm.php"] [unique_id "alxijuZhsBlduL7gIyzb2wAAv0U"]
[Sat Jul 18 23:37:18.628345 2026] [security2:error] [pid 897595:tid 897740] [client 84.54.78.78:12943] ModSecurity: Warning. String match "408" at RESPONSE_STATUS. [file "/etc/httpd/modsecurity.d/03_asl_dos.conf"] [line "35"] [id "343434"] [rev "1"] [msg "Atomicorp.com WAF Rules: Client Connection dropped by Apache due to slow connection, possible Slowaris attack"] [severity "WARNING"] [hostname "whiteoutcb.com"] [uri "/wp-login.php"] [unique_id "alxifOZhsBlduL7gIyzW7QAAAJM"], referer: http://whiteoutcb.com/wp-login.php
[Sat Jul 18 23:37:18.716909 2026] [security2:error] [pid 897595:tid 897693] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/thebe.php"] [unique_id "alxijuZhsBlduL7gIyzb-gAAqGA"]
[Sat Jul 18 23:37:18.851703 2026] [security2:error] [pid 897595:tid 897763] [client 173.239.196.161:27615] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "alxijuZhsBlduL7gIyzcLQAAAKo"]
[Sat Jul 18 23:37:18.912191 2026] [security2:error] [pid 897595:tid 897674] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/themes.php"] [unique_id "alxijuZhsBlduL7gIyzcMAAA1E0"]
[Sat Jul 18 23:37:19.107208 2026] [security2:error] [pid 897595:tid 897720] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/tiny.php"] [unique_id "alxij-ZhsBlduL7gIyzcQQAA-Hs"]
[Sat Jul 18 23:37:19.303078 2026] [security2:error] [pid 897595:tid 897627] [remote 4.194.24.143:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ashleystrain.com"] [uri "/tmp/byp.php"] [unique_id "alxij-ZhsBlduL7gIyzcUAAAlh4"]
[Sat Jul 18 23:37:19.483387 2026] [security2:error] [pid 897595:tid 897852] [client 163.61.1.17:57688] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxij-ZhsBlduL7gIyzcagAAAQM"]
[Sat Jul 18 23:37:19.483465 2026] [security2:error] [pid 897595:tid 897852] [client 163.61.1.17:57688] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxij-ZhsBlduL7gIyzcagAAAQM"]
[Sat Jul 18 23:37:19.705190 2026] [security2:error] [pid 897595:tid 897830] [client 190.245.146.99:60875] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.146.245.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxij-ZhsBlduL7gIyzchAAAAO0"]
[Sat Jul 18 23:37:19.711608 2026] [security2:error] [pid 897595:tid 897830] [client 190.245.146.99:60875] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "itdynamix.com"] [uri "/xmlrpc.php"] [unique_id "alxij-ZhsBlduL7gIyzchAAAAO0"]
[Sat Jul 18 23:37:19.749161 2026] [security2:error] [pid 897595:tid 897753] [client 173.239.196.160:48255] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "alxij-ZhsBlduL7gIyzciQAAAKA"]
[Sat Jul 18 23:37:19.764723 2026] [security2:error] [pid 897595:tid 897782] [client 138.252.89.100:58012] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxij-ZhsBlduL7gIyzcigAAAL0"]
[Sat Jul 18 23:37:19.764828 2026] [security2:error] [pid 897595:tid 897782] [client 138.252.89.100:58012] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxij-ZhsBlduL7gIyzcigAAAL0"]
[Sat Jul 18 23:37:19.779286 2026] [security2:error] [pid 897595:tid 897694] [remote 91.142.222.105:46476] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxij-ZhsBlduL7gIyzciwAAomE"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:37:20.400898 2026] [security2:error] [pid 897595:tid 897743] [client 223.123.8.20:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "healthylifegourmet.org"] [uri "/index.php"] [unique_id "alxikOZhsBlduL7gIyzcowAAAJY"]
[Sat Jul 18 23:37:20.643164 2026] [security2:error] [pid 897595:tid 897752] [client 173.239.196.165:33085] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "alxikOZhsBlduL7gIyzcwgAAAJ8"]
[Sat Jul 18 23:37:20.878893 2026] [security2:error] [pid 897595:tid 897753] [client 136.108.4.202:21122] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "icemarc.org"] [uri "/wp-json/batch/v1"] [unique_id "alxikOZhsBlduL7gIyzc1gAAAKA"]
[Sat Jul 18 23:37:20.921874 2026] [security2:error] [pid 897595:tid 897788] [client 106.222.249.209:10902] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxikOZhsBlduL7gIyzc2AAAAMM"]
[Sat Jul 18 23:37:20.921953 2026] [security2:error] [pid 897595:tid 897788] [client 106.222.249.209:10902] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxikOZhsBlduL7gIyzc2AAAAMM"]
[Sat Jul 18 23:37:21.371776 2026] [security2:error] [pid 897595:tid 897839] [client 136.108.4.202:21122] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "icemarc.org"] [uri "/"] [unique_id "alxikeZhsBlduL7gIyzc8AAAAPY"]
[Sat Jul 18 23:37:21.513727 2026] [security2:error] [pid 897595:tid 897737] [client 173.239.196.164:28433] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "alxikeZhsBlduL7gIyzc9QAAAJA"]
[Sat Jul 18 23:37:21.836519 2026] [security2:error] [pid 897595:tid 897637] [remote 97.74.93.24:33162] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxikeZhsBlduL7gIyzdEgAAmSg"]
[Sat Jul 18 23:37:22.245329 2026] [security2:error] [pid 897595:tid 897721] [remote 97.74.93.24:33162] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxikuZhsBlduL7gIyzdKAAAxHw"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:37:22.336064 2026] [security2:error] [pid 897595:tid 897727] [client 173.239.196.165:34275] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "alxikuZhsBlduL7gIyzdLQAAAIY"]
[Sat Jul 18 23:37:22.453841 2026] [security2:error] [pid 897595:tid 897776] [client 136.108.4.202:37120] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "icemarc.org"] [uri "/wp-json/batch/v1"] [unique_id "alxikuZhsBlduL7gIyzdOAAAALc"]
[Sat Jul 18 23:37:22.619284 2026] [security2:error] [pid 897595:tid 897777] [client 176.28.174.139:20510] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "whiteoutcb.com"] [uri "/wp-login.php"] [unique_id "alxikuZhsBlduL7gIyzdPgAAALg"], referer: https://www.google.com
[Sat Jul 18 23:37:22.878209 2026] [security2:error] [pid 897595:tid 897782] [client 189.217.202.223:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "worbals.com"] [uri "/index.php"] [unique_id "alxikuZhsBlduL7gIyzdRgAAAL0"]
[Sat Jul 18 23:37:22.880371 2026] [security2:error] [pid 897595:tid 897726] [client 136.108.4.202:37120] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "icemarc.org"] [uri "/"] [unique_id "alxikuZhsBlduL7gIyzdXAAAAIU"]
[Sat Jul 18 23:37:23.013190 2026] [security2:error] [pid 897595:tid 897767] [client 89.167.13.70:51391] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.13.167.89.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ambienthost.com"] [uri "/contact.php"] [unique_id "alxik-ZhsBlduL7gIyzdYwAAAK4"], referer: https://www.google.com/
[Sat Jul 18 23:37:23.178733 2026] [security2:error] [pid 897595:tid 897819] [client 173.239.196.163:36831] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/ocean/index.php"] [unique_id "alxik-ZhsBlduL7gIyzdbgAAAOI"]
[Sat Jul 18 23:37:23.489510 2026] [security2:error] [pid 897595:tid 897788] [client 89.167.13.70:55755] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.13.167.89.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ambienthost.com"] [uri "/contact-us.php"] [unique_id "alxik-ZhsBlduL7gIyzdhAAAAMM"], referer: https://www.google.com/
[Sat Jul 18 23:37:23.695454 2026] [security2:error] [pid 897595:tid 897799] [client 89.167.13.70:51389] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.13.167.89.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ambienthost.com"] [uri "/shipping.php"] [unique_id "alxik-ZhsBlduL7gIyzdmAAAAM4"], referer: https://www.google.com/
[Sat Jul 18 23:37:23.721220 2026] [security2:error] [pid 897595:tid 897853] [client 89.167.13.70:49306] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.13.167.89.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ambienthost.com"] [uri "/delivery.php"] [unique_id "alxik-ZhsBlduL7gIyzdmQAAAQQ"], referer: https://www.google.com/
[Sat Jul 18 23:37:23.724805 2026] [security2:error] [pid 897595:tid 897813] [client 89.167.13.70:51382] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.13.167.89.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ambienthost.com"] [uri "/about.php"] [unique_id "alxik-ZhsBlduL7gIyzdmgAAANw"], referer: https://www.google.com/
[Sat Jul 18 23:37:24.048240 2026] [security2:error] [pid 897595:tid 897760] [client 173.239.196.162:32173] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/images/media/index.php"] [unique_id "alxilOZhsBlduL7gIyzdqAAAAKc"]
[Sat Jul 18 23:37:24.215409 2026] [security2:error] [pid 897595:tid 897744] [client 89.167.13.70:58297] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.13.167.89.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ambienthost.com"] [uri "/about-us.php"] [unique_id "alxilOZhsBlduL7gIyzdtwAAAJc"], referer: https://www.google.com/
[Sat Jul 18 23:37:24.256321 2026] [security2:error] [pid 897595:tid 897767] [client 180.252.198.240:59058] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxilOZhsBlduL7gIyzdugAAAK4"]
[Sat Jul 18 23:37:24.256419 2026] [security2:error] [pid 897595:tid 897767] [client 180.252.198.240:59058] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxilOZhsBlduL7gIyzdugAAAK4"]
[Sat Jul 18 23:37:24.890900 2026] [security2:error] [pid 897595:tid 897753] [client 173.239.196.164:22797] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "alxilOZhsBlduL7gIyzd4AAAAKA"]
[Sat Jul 18 23:37:25.062894 2026] [security2:error] [pid 897595:tid 897842] [client 89.167.13.70:57518] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.13.167.89.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ambienthost.com"] [uri "/info.php"] [unique_id "alxileZhsBlduL7gIyzd7wAAAPk"], referer: https://www.google.com/
[Sat Jul 18 23:37:25.488533 2026] [security2:error] [pid 897595:tid 897853] [client 46.251.201.240:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxileZhsBlduL7gIyzd-wAAAQQ"]
[Sat Jul 18 23:37:25.778834 2026] [security2:error] [pid 897595:tid 897796] [client 173.239.196.166:32061] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "alxileZhsBlduL7gIyzeIwAAAMs"]
[Sat Jul 18 23:37:26.088257 2026] [security2:error] [pid 897595:tid 897738] [client 18.212.127.231:34580] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 231.127.212.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxiluZhsBlduL7gIyzeNAAAAJE"], referer: https://curlsnpearlsss.com/es/category/food/dinners/page/2/
[Sat Jul 18 23:37:26.161928 2026] [security2:error] [pid 897595:tid 897614] [remote 113.160.142.119:59140] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "according2plant.com"] [uri "/wp-login.php"] [unique_id "alxiluZhsBlduL7gIyzeNgAAqRE"]
[Sat Jul 18 23:37:26.301015 2026] [security2:error] [pid 897595:tid 897790] [client 54.85.69.47:56846] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 47.69.85.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxiluZhsBlduL7gIyzeRQAAAMU"], referer: https://curlsnpearlsss.com/es/category/food/dinners/page/2/
[Sat Jul 18 23:37:26.662271 2026] [security2:error] [pid 897595:tid 897812] [client 173.239.196.161:56301] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "alxiluZhsBlduL7gIyzeYgAAANs"]
[Sat Jul 18 23:37:26.697187 2026] [security2:error] [pid 897595:tid 897599] [remote 113.160.142.119:59140] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "according2plant.com"] [uri "/wp-login.php"] [unique_id "alxiluZhsBlduL7gIyzeZAAAkQI"], referer: https://according2plant.com/wp-login.php
[Sat Jul 18 23:37:27.286719 2026] [security2:error] [pid 897595:tid 897810] [client 3.85.217.58:45100] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.217.85.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxil-ZhsBlduL7gIyzeigAAANk"], referer: https://curlsnpearlsss.com/es/
[Sat Jul 18 23:37:27.410114 2026] [security2:error] [pid 897595:tid 897770] [client 18.136.194.202:13938] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 202.194.136.18.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxil-ZhsBlduL7gIyzekgAAALE"]
[Sat Jul 18 23:37:27.410209 2026] [security2:error] [pid 897595:tid 897770] [client 18.136.194.202:13938] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxil-ZhsBlduL7gIyzekgAAALE"]
[Sat Jul 18 23:37:27.420969 2026] [security2:error] [pid 897595:tid 897651] [remote 41.76.213.235:45530] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.sk-financial.com"] [uri "/wp-login.php"] [unique_id "alxil-ZhsBlduL7gIyzelgAApTY"]
[Sat Jul 18 23:37:27.488209 2026] [security2:error] [pid 897595:tid 897738] [client 98.82.181.200:11316] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 200.181.82.98.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxil-ZhsBlduL7gIyzemQAAAJE"], referer: https://curlsnpearlsss.com/es/
[Sat Jul 18 23:37:27.562406 2026] [security2:error] [pid 897595:tid 897833] [client 173.239.196.163:22893] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/maint/themes.php"] [unique_id "alxil-ZhsBlduL7gIyzemwAAAPA"]
[Sat Jul 18 23:37:27.939628 2026] [security2:error] [pid 897595:tid 897620] [remote 41.76.213.235:45530] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.sk-financial.com"] [uri "/wp-login.php"] [unique_id "alxil-ZhsBlduL7gIyzesQAArBc"], referer: https://mail.sk-financial.com/wp-login.php
[Sat Jul 18 23:37:28.027228 2026] [security2:error] [pid 897595:tid 897845] [client 74.7.227.179:34544] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxil-ZhsBlduL7gIyzerwAA_BI"], referer: https://tejasenvironmental.com/p=673109
[Sat Jul 18 23:37:28.424866 2026] [security2:error] [pid 897595:tid 897657] [remote 97.74.93.24:46466] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "rpv.ekr.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alximOZhsBlduL7gIyzeygAAmzw"]
[Sat Jul 18 23:37:28.425052 2026] [security2:error] [pid 897595:tid 897748] [client 97.74.93.24:46466] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "rpv.ekr.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alximOZhsBlduL7gIyzeygAAmzw"]
[Sat Jul 18 23:37:28.443459 2026] [security2:error] [pid 897595:tid 897726] [client 173.239.196.160:50569] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/seoplugins/index.php"] [unique_id "alximOZhsBlduL7gIyzezAAAAIU"]
[Sat Jul 18 23:37:28.954399 2026] [security2:error] [pid 897595:tid 897770] [client 223.228.182.224:15612] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alximOZhsBlduL7gIyze5QAAALE"]
[Sat Jul 18 23:37:28.954508 2026] [security2:error] [pid 897595:tid 897770] [client 223.228.182.224:15612] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alximOZhsBlduL7gIyze5QAAALE"]
[Sat Jul 18 23:37:29.274949 2026] [security2:error] [pid 897595:tid 897755] [client 47.128.117.237:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.savilerowtravel.com"] [uri "/index.php"] [unique_id "alxil-ZhsBlduL7gIyzefgAAAKI"]
[Sat Jul 18 23:37:29.287918 2026] [security2:error] [pid 897595:tid 897812] [client 173.239.196.160:60431] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/fonts/themes.php"] [unique_id "alximeZhsBlduL7gIyze-AAAANs"]
[Sat Jul 18 23:37:29.563922 2026] [security2:error] [pid 897595:tid 897746] [client 14.191.31.53:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.maxenengineering.com"] [uri "/maxenengineering/index.php"] [unique_id "alxil-ZhsBlduL7gIyzeqwAAAJk"]
[Sat Jul 18 23:37:29.905139 2026] [security2:error] [pid 897595:tid 897820] [client 163.61.1.17:58166] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alximeZhsBlduL7gIyzfJQAAAOM"]
[Sat Jul 18 23:37:29.910413 2026] [security2:error] [pid 897595:tid 897678] [remote 91.142.222.105:51864] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "myspineworld.com"] [uri "/wp-login.php"] [unique_id "alximeZhsBlduL7gIyzfIgAAtVE"]
[Sat Jul 18 23:37:29.910882 2026] [security2:error] [pid 897595:tid 897820] [client 163.61.1.17:58166] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alximeZhsBlduL7gIyzfJQAAAOM"]
[Sat Jul 18 23:37:30.163379 2026] [security2:error] [pid 897595:tid 897813] [client 173.239.196.164:32367] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/twentytwentytwo/assets/fonts/index.php"] [unique_id "alximuZhsBlduL7gIyzfNAAAANw"]
[Sat Jul 18 23:37:30.431197 2026] [security2:error] [pid 897595:tid 897728] [client 3.108.60.216:15714] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alximuZhsBlduL7gIyzfQwAAAIc"]
[Sat Jul 18 23:37:30.431286 2026] [security2:error] [pid 897595:tid 897728] [client 3.108.60.216:15714] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alximuZhsBlduL7gIyzfQwAAAIc"]
[Sat Jul 18 23:37:30.667635 2026] [proxy:error] [pid 897595:tid 897754] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:37:30.667710 2026] [proxy_http:error] [pid 897595:tid 897754] [client 193.47.62.168:53454] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:37:30.668211 2026] [proxy:error] [pid 897595:tid 897754] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:37:30.668239 2026] [proxy_http:error] [pid 897595:tid 897754] [client 193.47.62.168:53454] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:37:30.755422 2026] [security2:error] [pid 897595:tid 897622] [remote 91.142.222.105:51864] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "myspineworld.com"] [uri "/wp-login.php"] [unique_id "alximuZhsBlduL7gIyzfVAAA5xk"], referer: https://myspineworld.com/wp-login.php
[Sat Jul 18 23:37:30.844549 2026] [security2:error] [pid 897595:tid 897742] [client 188.217.52.248:3949] ModSecurity: Warning. String match "408" at RESPONSE_STATUS. [file "/etc/httpd/modsecurity.d/03_asl_dos.conf"] [line "35"] [id "343434"] [rev "1"] [msg "Atomicorp.com WAF Rules: Client Connection dropped by Apache due to slow connection, possible Slowaris attack"] [severity "WARNING"] [hostname "whiteoutcb.com"] [uri "/wp-login.php"] [unique_id "alxiiOZhsBlduL7gIyzaKgAAAJU"], referer: http://whiteoutcb.com/wp-login.php
[Sat Jul 18 23:37:31.011150 2026] [security2:error] [pid 897595:tid 897788] [client 173.239.196.166:31049] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/certificates/index.php"] [unique_id "alxim-ZhsBlduL7gIyzfZAAAAMM"]
[Sat Jul 18 23:37:31.352201 2026] [fcgid:warn] [pid 897595:tid 897770] (70014)End of file found: [client 104.28.228.198:14980] mod_fcgid: can't get data from http client
[Sat Jul 18 23:37:31.618079 2026] [security2:error] [pid 897595:tid 897781] [client 106.222.249.209:33184] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxim-ZhsBlduL7gIyzfiwAAALw"]
[Sat Jul 18 23:37:31.618175 2026] [security2:error] [pid 897595:tid 897781] [client 106.222.249.209:33184] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxim-ZhsBlduL7gIyzfiwAAALw"]
[Sat Jul 18 23:37:31.698655 2026] [security2:error] [pid 897595:tid 897736] [client 138.252.89.100:58537] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxim-ZhsBlduL7gIyzfjgAAAI8"]
[Sat Jul 18 23:37:31.698796 2026] [security2:error] [pid 897595:tid 897736] [client 138.252.89.100:58537] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxim-ZhsBlduL7gIyzfjgAAAI8"]
[Sat Jul 18 23:37:31.850100 2026] [security2:error] [pid 897595:tid 897758] [client 173.239.196.161:44717] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/byp.php"] [unique_id "alxim-ZhsBlduL7gIyzfmQAAAKU"]
[Sat Jul 18 23:37:32.021353 2026] [security2:error] [pid 897595:tid 897815] [client 185.41.120.32:19096] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "200"] [hostname "whiteoutcb.com"] [uri "/xmlrpc.php"] [unique_id "alxim-ZhsBlduL7gIyzfmAAAAN4"]
[Sat Jul 18 23:37:32.714466 2026] [security2:error] [pid 897595:tid 897729] [client 173.239.196.166:46979] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/blog/wp-includes/about.php"] [unique_id "alxinOZhsBlduL7gIyzf0AAAAIg"]
[Sat Jul 18 23:37:32.804265 2026] [security2:error] [pid 897595:tid 897719] [remote 157.66.26.183:55472] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 183.26.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "secretkeynumerology.com"] [uri "/wp-login.php"] [unique_id "alxinOZhsBlduL7gIyzf0QAA7no"]
[Sat Jul 18 23:37:32.857297 2026] [security2:error] [pid 897595:tid 897760] [client 74.208.214.194:44420] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxinOZhsBlduL7gIyzf1QAAAKc"]
[Sat Jul 18 23:37:33.266315 2026] [security2:error] [pid 897595:tid 897650] [remote 157.66.26.183:55472] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 183.26.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "secretkeynumerology.com"] [uri "/wp-login.php"] [unique_id "alxineZhsBlduL7gIyzf7gAA9DU"], referer: https://secretkeynumerology.com/wp-login.php
[Sat Jul 18 23:37:33.615429 2026] [security2:error] [pid 897595:tid 897731] [client 173.239.196.161:61849] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "alxineZhsBlduL7gIyzf_AAAAIo"]
[Sat Jul 18 23:37:33.906592 2026] [security2:error] [pid 897595:tid 897811] [client 185.41.120.32:5240] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "200"] [hostname "whiteoutcb.com"] [uri "/xmlrpc.php"] [unique_id "alxineZhsBlduL7gIyzgDAAAANo"]
[Sat Jul 18 23:37:34.440300 2026] [security2:error] [pid 897595:tid 897796] [client 63.179.105.113:20202] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.105.179.63.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxinuZhsBlduL7gIyzgOAAAAMs"]
[Sat Jul 18 23:37:34.440411 2026] [security2:error] [pid 897595:tid 897796] [client 63.179.105.113:20202] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxinuZhsBlduL7gIyzgOAAAAMs"]
[Sat Jul 18 23:37:34.489662 2026] [security2:error] [pid 897595:tid 897785] [client 173.239.196.167:24325] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/blog/wp-admin/about.php"] [unique_id "alxinuZhsBlduL7gIyzgPQAAAMA"]
[Sat Jul 18 23:37:34.619290 2026] [security2:error] [pid 897595:tid 897732] [client 180.252.198.240:59512] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxinuZhsBlduL7gIyzgQQAAAIs"]
[Sat Jul 18 23:37:34.619375 2026] [security2:error] [pid 897595:tid 897732] [client 180.252.198.240:59512] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxinuZhsBlduL7gIyzgQQAAAIs"]
[Sat Jul 18 23:37:35.019610 2026] [security2:error] [pid 897595:tid 897686] [remote 154.0.166.254:47502] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 254.166.0.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxin-ZhsBlduL7gIyzgVgAAm1k"]
[Sat Jul 18 23:37:35.829140 2026] [http2:info] [pid 930223:tid 930223] h2_workers: created with min=128 max=192 idle_ms=600000
[Sat Jul 18 23:37:35.857152 2026] [security2:error] [pid 930223:tid 930355] [client 173.239.196.166:28981] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/twentyfive/include.php"] [unique_id "alxin2pwVNghF8G0ENOctQAAAQo"]
[Sat Jul 18 23:37:35.858499 2026] [security2:error] [pid 930223:tid 930356] [client 113.160.97.242:63731] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxin2pwVNghF8G0ENOctAAAAQs"]
[Sat Jul 18 23:37:36.270319 2026] [security2:error] [pid 930223:tid 930460] [client 50.116.65.227:57290] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.fkconstructionfunding.com"] [uri "/wp-content/plugins/contact-form-7/includes/css/styles.css"] [unique_id "alxioGpwVNghF8G0ENOc_QAAAXM"]
[Sat Jul 18 23:37:36.280645 2026] [security2:error] [pid 930223:tid 930464] [client 50.116.65.227:57294] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.fkconstructionfunding.com"] [uri "/wp-content/plugins/contact-form-7/includes/css/styles-rtl.css"] [unique_id "alxioGpwVNghF8G0ENOc_gAAAXc"]
[Sat Jul 18 23:37:36.518140 2026] [security2:error] [pid 930223:tid 930261] [remote 154.0.166.254:47506] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 254.166.0.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxioGpwVNghF8G0ENOdCQABUSM"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:37:36.589955 2026] [security2:error] [pid 930223:tid 930265] [remote 103.169.160.74:36036] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.160.169.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "northbrookcpa.ca"] [uri "/wp-login.php"] [unique_id "alxioGpwVNghF8G0ENOdDwABVSc"]
[Sat Jul 18 23:37:36.690932 2026] [security2:error] [pid 930223:tid 930435] [client 173.239.196.164:50091] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/css/about.php"] [unique_id "alxioGpwVNghF8G0ENOdGwAAAVo"]
[Sat Jul 18 23:37:37.466498 2026] [security2:error] [pid 930223:tid 930285] [remote 103.169.160.74:36036] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.160.169.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "northbrookcpa.ca"] [uri "/wp-login.php"] [unique_id "alxioWpwVNghF8G0ENOdRwABUTs"], referer: https://northbrookcpa.ca/wp-login.php
[Sat Jul 18 23:37:37.541475 2026] [security2:error] [pid 930223:tid 930429] [client 173.239.196.162:35043] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/cgi-bin/install.php"] [unique_id "alxioWpwVNghF8G0ENOdSQAAAVQ"]
[Sat Jul 18 23:37:38.430450 2026] [security2:error] [pid 930223:tid 930380] [client 173.239.196.161:43395] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/wso.php"] [unique_id "alxiompwVNghF8G0ENOdiQAAASM"]
[Sat Jul 18 23:37:38.453849 2026] [security2:error] [pid 897595:tid 897790] [client 178.156.225.15:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "drewsasburyparkbeachhouse.com"] [uri "/index.php"] [unique_id "alxinuZhsBlduL7gIyzgQgAAAMU"]
[Sat Jul 18 23:37:38.478370 2026] [security2:error] [pid 930223:tid 930417] [client 5.161.69.23:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "drewsasburyparkbeachhouse.com"] [uri "/index.php"] [unique_id "alxin2pwVNghF8G0ENOc5QAAAUg"]
[Sat Jul 18 23:37:39.324697 2026] [security2:error] [pid 930223:tid 930385] [client 173.239.196.167:29465] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/class.api.php"] [unique_id "alxio2pwVNghF8G0ENOdxgAAASg"]
[Sat Jul 18 23:37:39.880365 2026] [security2:error] [pid 930223:tid 930416] [client 223.228.182.224:34394] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxio2pwVNghF8G0ENOd6gAAAUc"]
[Sat Jul 18 23:37:39.880477 2026] [security2:error] [pid 930223:tid 930416] [client 223.228.182.224:34394] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxio2pwVNghF8G0ENOd6gAAAUc"]
[Sat Jul 18 23:37:39.994458 2026] [security2:error] [pid 930223:tid 930243] [remote 97.74.93.24:59268] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "uritems.net"] [uri "/xmlrpc.php"] [unique_id "alxio2pwVNghF8G0ENOd9AABGBE"]
[Sat Jul 18 23:37:39.994629 2026] [security2:error] [pid 930223:tid 930369] [client 97.74.93.24:59268] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "uritems.net"] [uri "/xmlrpc.php"] [unique_id "alxio2pwVNghF8G0ENOd9AABGBE"]
[Sat Jul 18 23:37:40.105954 2026] [security2:error] [pid 930223:tid 930389] [client 104.210.56.226:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "mollycahill.com"] [uri "/index.php"] [unique_id "alxiompwVNghF8G0ENOdawAAASw"]
[Sat Jul 18 23:37:40.190582 2026] [security2:error] [pid 930223:tid 930419] [client 173.239.196.161:32629] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "alxipGpwVNghF8G0ENOeBgAAAUo"]
[Sat Jul 18 23:37:40.286633 2026] [security2:error] [pid 930223:tid 930437] [client 34.91.36.231:24576] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "www.bjw.jsf.mybluehost.me"] [uri "/"] [unique_id "alxipGpwVNghF8G0ENOeDwAAAVw"]
[Sat Jul 18 23:37:40.286737 2026] [security2:error] [pid 930223:tid 930437] [client 34.91.36.231:24576] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "www.bjw.jsf.mybluehost.me"] [uri "/"] [unique_id "alxipGpwVNghF8G0ENOeDwAAAVw"]
[Sat Jul 18 23:37:40.406199 2026] [security2:error] [pid 930223:tid 930373] [client 163.61.1.17:58644] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxipGpwVNghF8G0ENOeFQAAARw"]
[Sat Jul 18 23:37:40.406372 2026] [security2:error] [pid 930223:tid 930373] [client 163.61.1.17:58644] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxipGpwVNghF8G0ENOeFQAAARw"]
[Sat Jul 18 23:37:40.469789 2026] [security2:error] [pid 930223:tid 930367] [client 50.116.65.227:56474] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Jin-Wee-Feature-Image.jpg"] [unique_id "alxipGpwVNghF8G0ENOeGQAAARY"]
[Sat Jul 18 23:37:40.481140 2026] [security2:error] [pid 930223:tid 930388] [client 50.116.65.227:22858] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Jin-Wee-Feature-Image.jpg"] [unique_id "alxipGpwVNghF8G0ENOeGwAAAV8"]
[Sat Jul 18 23:37:40.886082 2026] [security2:error] [pid 930223:tid 930447] [client 34.90.69.83:49153] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "cpcalendars.amalia-capital.com"] [uri "/"] [unique_id "alxipGpwVNghF8G0ENOeKQAAAWY"]
[Sat Jul 18 23:37:40.886181 2026] [security2:error] [pid 930223:tid 930447] [client 34.90.69.83:49153] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "cpcalendars.amalia-capital.com"] [uri "/"] [unique_id "alxipGpwVNghF8G0ENOeKQAAAWY"]
[Sat Jul 18 23:37:41.081948 2026] [security2:error] [pid 930223:tid 930408] [client 173.239.196.163:32013] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/radio.php"] [unique_id "alxipWpwVNghF8G0ENOeOgAAAT8"]
[Sat Jul 18 23:37:41.176365 2026] [security2:error] [pid 930223:tid 930261] [remote 216.73.216.174:45417] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.216.73.216.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/contact-us/"] [unique_id "alxipWpwVNghF8G0ENOePQABWiM"]
[Sat Jul 18 23:37:41.396979 2026] [security2:error] [pid 930223:tid 930263] [remote 91.142.222.105:46034] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sarahsnyder.net"] [uri "/xmlrpc.php"] [unique_id "alxipWpwVNghF8G0ENOeQwABSiU"]
[Sat Jul 18 23:37:41.397189 2026] [security2:error] [pid 930223:tid 930419] [client 91.142.222.105:46034] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "sarahsnyder.net"] [uri "/xmlrpc.php"] [unique_id "alxipWpwVNghF8G0ENOeQwABSiU"]
[Sat Jul 18 23:37:41.652021 2026] [security2:error] [pid 930223:tid 930364] [client 110.249.201.139:51466] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "locketsandcharms.com"] [uri "/robots.txt"] [unique_id "alxipWpwVNghF8G0ENOeWQAAARM"]
[Sat Jul 18 23:37:41.941627 2026] [security2:error] [pid 930223:tid 930277] [remote 54.64.35.240:43720] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.35.64.54.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxipWpwVNghF8G0ENOeZAABhTM"]
[Sat Jul 18 23:37:41.962204 2026] [security2:error] [pid 930223:tid 930377] [client 173.239.196.163:46577] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/system_log.php"] [unique_id "alxipWpwVNghF8G0ENOeaAAAASA"]
[Sat Jul 18 23:37:42.460990 2026] [security2:error] [pid 930223:tid 930471] [client 106.222.249.209:15284] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxipmpwVNghF8G0ENOeggAAAX4"]
[Sat Jul 18 23:37:42.461897 2026] [security2:error] [pid 930223:tid 930471] [client 106.222.249.209:15284] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxipmpwVNghF8G0ENOeggAAAX4"]
[Sat Jul 18 23:37:42.569269 2026] [security2:error] [pid 930223:tid 930296] [remote 54.64.35.240:43720] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.35.64.54.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxipmpwVNghF8G0ENOeigABC0Y"], referer: https://sesamegreenbeans.com/wp-login.php
[Sat Jul 18 23:37:42.789670 2026] [security2:error] [pid 930223:tid 930431] [client 173.239.196.164:29935] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.alf.php"] [unique_id "alxipmpwVNghF8G0ENOenAAAAVY"]
[Sat Jul 18 23:37:42.846483 2026] [security2:error] [pid 930223:tid 930295] [remote 220.181.108.155:19125] ModSecurity: Access denied with code 406 (phase 2). Match of "beginsWith %{request_headers.host}" against "TX:1" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "504"] [id "340162"] [rev "302"] [msg "Atomicorp.com WAF Rules: Remote File Injection Attack detected (Unauthorized URL detected as argument)"] [data ",TX:1"] [severity "CRITICAL"] [hostname "www.mollycahill.com"] [uri "/"] [unique_id "alxipmpwVNghF8G0ENOeogABcEU"]
[Sat Jul 18 23:37:42.856354 2026] [security2:error] [pid 930223:tid 930302] [remote 41.186.86.12:9815] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxipmpwVNghF8G0ENOepAABYEw"]
[Sat Jul 18 23:37:43.349065 2026] [security2:error] [pid 930223:tid 930305] [remote 41.186.86.12:9815] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxip2pwVNghF8G0ENOevQABD08"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:37:43.374955 2026] [security2:error] [pid 930223:tid 930388] [client 138.252.89.100:59057] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxip2pwVNghF8G0ENOevgAAASs"]
[Sat Jul 18 23:37:43.375050 2026] [security2:error] [pid 930223:tid 930388] [client 138.252.89.100:59057] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxip2pwVNghF8G0ENOevgAAASs"]
[Sat Jul 18 23:37:43.657871 2026] [security2:error] [pid 930223:tid 930426] [client 173.239.196.163:27553] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wso.php"] [unique_id "alxip2pwVNghF8G0ENOezAAAAVE"]
[Sat Jul 18 23:37:44.022512 2026] [security2:error] [pid 930223:tid 930331] [remote 119.249.100.117:4858] ModSecurity: Access denied with code 406 (phase 2). Match of "beginsWith %{request_headers.host}" against "TX:1" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "504"] [id "340162"] [rev "302"] [msg "Atomicorp.com WAF Rules: Remote File Injection Attack detected (Unauthorized URL detected as argument)"] [data ",TX:1"] [severity "CRITICAL"] [hostname "www.mollycahill.com"] [uri "/"] [unique_id "alxiqGpwVNghF8G0ENOe4AABbmk"]
[Sat Jul 18 23:37:44.495591 2026] [security2:error] [pid 930223:tid 930369] [client 173.239.196.167:41883] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/blocks/about.php"] [unique_id "alxiqGpwVNghF8G0ENOe_gAAARg"]
[Sat Jul 18 23:37:44.564274 2026] [security2:error] [pid 930223:tid 930482] [client 216.244.66.228:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.commonsensesf.com"] [uri "/robots.txt"] [unique_id "alxiqGpwVNghF8G0ENOfAgAAAYk"]
[Sat Jul 18 23:37:44.564348 2026] [security2:error] [pid 930223:tid 930482] [client 216.244.66.228:0] ModSecurity: Warning. Matched phrase "Dotbot" at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "www.commonsensesf.com"] [uri "/robots.txt"] [unique_id "alxiqGpwVNghF8G0ENOfAgAAAYk"]
[Sat Jul 18 23:37:45.396913 2026] [security2:error] [pid 930223:tid 930379] [client 173.239.196.165:44457] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/flower.php"] [unique_id "alxiqWpwVNghF8G0ENOfOAAAASI"]
[Sat Jul 18 23:37:45.801259 2026] [security2:error] [pid 930223:tid 930364] [client 180.252.198.240:59967] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiqWpwVNghF8G0ENOfVgAAARM"]
[Sat Jul 18 23:37:45.802692 2026] [security2:error] [pid 930223:tid 930364] [client 180.252.198.240:59967] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiqWpwVNghF8G0ENOfVgAAARM"]
[Sat Jul 18 23:37:46.293433 2026] [security2:error] [pid 930223:tid 930426] [client 173.239.196.164:59893] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/wp-class.php"] [unique_id "alxiqmpwVNghF8G0ENOfcwAAAVE"]
[Sat Jul 18 23:37:47.171017 2026] [security2:error] [pid 930223:tid 930379] [client 173.239.196.160:44641] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/js/autoload_classmap.php"] [unique_id "alxiq2pwVNghF8G0ENOfpgAAASI"]
[Sat Jul 18 23:37:47.245090 2026] [security2:error] [pid 930223:tid 930387] [client 34.90.254.162:16384] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "cpanel.twy.mtk.mybluehost.me"] [uri "/"] [unique_id "alxiq2pwVNghF8G0ENOfqgAAASo"]
[Sat Jul 18 23:37:47.245178 2026] [security2:error] [pid 930223:tid 930387] [client 34.90.254.162:16384] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "cpanel.twy.mtk.mybluehost.me"] [uri "/"] [unique_id "alxiq2pwVNghF8G0ENOfqgAAASo"]
[Sat Jul 18 23:37:47.482926 2026] [security2:error] [pid 930223:tid 930298] [remote 31.42.184.154:36736] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxiq2pwVNghF8G0ENOftgABckg"]
[Sat Jul 18 23:37:47.553349 2026] [security2:error] [pid 930223:tid 930402] [client 187.19.131.167:61149] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "thewelloiledlife.com"] [uri "/index.php"] [unique_id "alxiq2pwVNghF8G0ENOftQAAATk"], referer: https://thewelloiledlife.com/
[Sat Jul 18 23:37:47.756409 2026] [security2:error] [pid 930223:tid 930306] [remote 31.42.184.154:36736] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxiq2pwVNghF8G0ENOfyQABfVA"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:37:47.808991 2026] [security2:error] [pid 930223:tid 930478] [client 34.91.129.93:24576] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "cpanel.thh.mtk.mybluehost.me"] [uri "/"] [unique_id "alxiq2pwVNghF8G0ENOfzwAAAYU"]
[Sat Jul 18 23:37:47.809096 2026] [security2:error] [pid 930223:tid 930478] [client 34.91.129.93:24576] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "cpanel.thh.mtk.mybluehost.me"] [uri "/"] [unique_id "alxiq2pwVNghF8G0ENOfzwAAAYU"]
[Sat Jul 18 23:37:47.834359 2026] [security2:error] [pid 930223:tid 930309] [remote 31.42.184.154:36738] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxiq2pwVNghF8G0ENOf0gABWFM"]
[Sat Jul 18 23:37:47.834486 2026] [security2:error] [pid 930223:tid 930433] [client 31.42.184.154:36738] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxiq2pwVNghF8G0ENOf0gABWFM"]
[Sat Jul 18 23:37:47.887469 2026] [security2:error] [pid 930223:tid 930393] [client 168.143.80.211:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxiq2pwVNghF8G0ENOfwAAAATA"]
[Sat Jul 18 23:37:47.999789 2026] [security2:error] [pid 930223:tid 930305] [remote 31.42.184.154:36756] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxiq2pwVNghF8G0ENOf5wABDk8"]
[Sat Jul 18 23:37:48.069606 2026] [security2:error] [pid 930223:tid 930454] [client 173.239.196.163:60089] ModSecurity: Warning. Pattern match "/1\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1543"] [id "900921"] [msg "temporary TUW-72162 logging rule"] [hostname "sixpackminer.org"] [uri "/wp-content/1.php"] [unique_id "alxirGpwVNghF8G0ENOf6QAAAW0"]
[Sat Jul 18 23:37:48.069713 2026] [security2:error] [pid 930223:tid 930454] [client 173.239.196.163:60089] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/1.php"] [unique_id "alxirGpwVNghF8G0ENOf6QAAAW0"]
[Sat Jul 18 23:37:48.226645 2026] [security2:error] [pid 930223:tid 930315] [remote 31.42.184.154:36756] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxirGpwVNghF8G0ENOf7gABGVk"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:37:48.789980 2026] [security2:error] [pid 930223:tid 930438] [client 57.141.18.4:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxirGpwVNghF8G0ENOgDAAAAV0"]
[Sat Jul 18 23:37:48.970908 2026] [security2:error] [pid 930223:tid 930355] [client 173.239.196.164:38795] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/ioxi-o.php"] [unique_id "alxirGpwVNghF8G0ENOgJQAAAQo"]
[Sat Jul 18 23:37:49.841136 2026] [security2:error] [pid 930223:tid 930468] [client 173.239.196.167:26659] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/info.php"] [unique_id "alxirWpwVNghF8G0ENOgVQAAAXs"]
[Sat Jul 18 23:37:49.876936 2026] [security2:error] [pid 930223:tid 930432] [client 57.141.18.54:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxirWpwVNghF8G0ENOgSAAAAVc"]
[Sat Jul 18 23:37:50.323554 2026] [security2:error] [pid 930223:tid 930408] [client 18.212.127.231:23260] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 231.127.212.18.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxirmpwVNghF8G0ENOgdgAAAT8"]
[Sat Jul 18 23:37:50.323719 2026] [security2:error] [pid 930223:tid 930408] [client 18.212.127.231:23260] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxirmpwVNghF8G0ENOgdgAAAT8"]
[Sat Jul 18 23:37:50.681101 2026] [security2:error] [pid 930223:tid 930359] [client 223.228.182.224:15605] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxirmpwVNghF8G0ENOgkgAAAQ4"]
[Sat Jul 18 23:37:50.681202 2026] [security2:error] [pid 930223:tid 930359] [client 223.228.182.224:15605] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxirmpwVNghF8G0ENOgkgAAAQ4"]
[Sat Jul 18 23:37:50.737887 2026] [security2:error] [pid 930223:tid 930475] [client 173.239.196.161:47769] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/setup.php"] [unique_id "alxirmpwVNghF8G0ENOglQAAAYI"]
[Sat Jul 18 23:37:50.854435 2026] [security2:error] [pid 930223:tid 930370] [client 57.141.18.28:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxirmpwVNghF8G0ENOgkQAAARk"]
[Sat Jul 18 23:37:50.907693 2026] [security2:error] [pid 930223:tid 930427] [client 163.61.1.17:59115] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxirmpwVNghF8G0ENOgpQAAAVI"]
[Sat Jul 18 23:37:50.908941 2026] [security2:error] [pid 930223:tid 930427] [client 163.61.1.17:59115] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxirmpwVNghF8G0ENOgpQAAAVI"]
[Sat Jul 18 23:37:51.056661 2026] [security2:error] [pid 930223:tid 930401] [client 116.179.33.146:3361] ModSecurity: Access denied with code 406 (phase 2). Match of "beginsWith %{request_headers.host}" against "TX:1" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "504"] [id "340162"] [rev "302"] [msg "Atomicorp.com WAF Rules: Remote File Injection Attack detected (Unauthorized URL detected as argument)"] [data ",TX:1"] [severity "CRITICAL"] [hostname "www.mollycahill.com"] [uri "/"] [unique_id "alxir2pwVNghF8G0ENOgsgAAATg"]
[Sat Jul 18 23:37:51.589583 2026] [security2:error] [pid 930223:tid 930382] [client 173.239.196.167:21437] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.bod/.ll/ss.php"] [unique_id "alxir2pwVNghF8G0ENOg2QAAASU"]
[Sat Jul 18 23:37:52.426681 2026] [security2:error] [pid 930223:tid 930371] [client 173.239.196.165:32297] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/radio.php"] [unique_id "alxisGpwVNghF8G0ENOhDgAAARo"]
[Sat Jul 18 23:37:52.476720 2026] [security2:error] [pid 930223:tid 930479] [client 34.90.191.83:32768] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "webdisk.uninursity.com"] [uri "/"] [unique_id "alxisGpwVNghF8G0ENOhFgAAAYY"]
[Sat Jul 18 23:37:52.476823 2026] [security2:error] [pid 930223:tid 930479] [client 34.90.191.83:32768] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "webdisk.uninursity.com"] [uri "/"] [unique_id "alxisGpwVNghF8G0ENOhFgAAAYY"]
[Sat Jul 18 23:37:52.508330 2026] [security2:error] [pid 930223:tid 930315] [remote 113.160.142.119:49526] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "musichaven.info"] [uri "/wp-login.php"] [unique_id "alxisGpwVNghF8G0ENOhGQABQlk"]
[Sat Jul 18 23:37:52.778832 2026] [security2:error] [pid 930223:tid 930327] [remote 124.156.212.23:29757] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 23.212.156.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxisGpwVNghF8G0ENOhKAABdWU"]
[Sat Jul 18 23:37:52.942895 2026] [security2:error] [pid 930223:tid 930417] [client 104.210.56.226:42214] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "ccsdifference.com"] [uri "/index.php"] [unique_id "alxir2pwVNghF8G0ENOgvQABSCw"]
[Sat Jul 18 23:37:53.002659 2026] [security2:error] [pid 930223:tid 930331] [remote 113.160.142.119:49526] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "musichaven.info"] [uri "/wp-login.php"] [unique_id "alxisWpwVNghF8G0ENOhMwABfWk"], referer: https://musichaven.info/wp-login.php
[Sat Jul 18 23:37:53.033784 2026] [security2:error] [pid 930223:tid 930401] [client 34.90.191.83:32769] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "autodiscover.cjh.tmu.mybluehost.me"] [uri "/"] [unique_id "alxisWpwVNghF8G0ENOhNQAAATg"]
[Sat Jul 18 23:37:53.033859 2026] [security2:error] [pid 930223:tid 930401] [client 34.90.191.83:32769] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "autodiscover.cjh.tmu.mybluehost.me"] [uri "/"] [unique_id "alxisWpwVNghF8G0ENOhNQAAATg"]
[Sat Jul 18 23:37:53.117611 2026] [security2:error] [pid 930223:tid 930447] [client 34.34.16.122:49153] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "mail.besttestedrecipes.com"] [uri "/"] [unique_id "alxisWpwVNghF8G0ENOhPAAAAWY"]
[Sat Jul 18 23:37:53.117724 2026] [security2:error] [pid 930223:tid 930447] [client 34.34.16.122:49153] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "mail.besttestedrecipes.com"] [uri "/"] [unique_id "alxisWpwVNghF8G0ENOhPAAAAWY"]
[Sat Jul 18 23:37:53.131040 2026] [security2:error] [pid 930223:tid 930406] [client 106.222.249.209:26899] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxisWpwVNghF8G0ENOhPQAAAT0"]
[Sat Jul 18 23:37:53.131131 2026] [security2:error] [pid 930223:tid 930406] [client 106.222.249.209:26899] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxisWpwVNghF8G0ENOhPQAAAT0"]
[Sat Jul 18 23:37:53.268153 2026] [security2:error] [pid 930223:tid 930448] [client 173.239.196.166:54989] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugin.php"] [unique_id "alxisWpwVNghF8G0ENOhRgAAAWc"]
[Sat Jul 18 23:37:53.990520 2026] [security2:error] [pid 930223:tid 930420] [client 216.73.217.113:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "weifangsmefarm.com"] [uri "/index.php"] [unique_id "alxisGpwVNghF8G0ENOhFwAAAUs"]
[Sat Jul 18 23:37:54.119624 2026] [security2:error] [pid 930223:tid 930368] [client 173.239.196.160:63779] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/ectoplasm/about.php"] [unique_id "alxismpwVNghF8G0ENOhgAAAARc"]
[Sat Jul 18 23:37:54.429278 2026] [security2:error] [pid 930223:tid 930413] [client 20.151.10.161:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.10.151.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "dotx.com"] [uri "/.well-known/about.php"] [unique_id "alxismpwVNghF8G0ENOhkQAAAUQ"]
[Sat Jul 18 23:37:54.429420 2026] [security2:error] [pid 930223:tid 930413] [client 20.151.10.161:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "dotx.com"] [uri "/.well-known/about.php"] [unique_id "alxismpwVNghF8G0ENOhkQAAAUQ"]
[Sat Jul 18 23:37:54.703882 2026] [security2:error] [pid 930223:tid 930464] [client 5.161.215.244:57778] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "windowtx.com"] [uri "/index.php"] [unique_id "alxismpwVNghF8G0ENOhhAAAAXc"], referer: https://windowtx.com
[Sat Jul 18 23:37:54.996842 2026] [security2:error] [pid 930223:tid 930460] [client 173.239.196.166:28157] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/as.php"] [unique_id "alxismpwVNghF8G0ENOhtgAAAXM"]
[Sat Jul 18 23:37:55.145998 2026] [security2:error] [pid 930223:tid 930364] [client 138.252.89.100:59579] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxis2pwVNghF8G0ENOhwwAAARM"]
[Sat Jul 18 23:37:55.146096 2026] [security2:error] [pid 930223:tid 930364] [client 138.252.89.100:59579] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxis2pwVNghF8G0ENOhwwAAARM"]
[Sat Jul 18 23:37:55.900736 2026] [security2:error] [pid 930223:tid 930364] [client 173.239.196.166:41925] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/cc.php"] [unique_id "alxis2pwVNghF8G0ENOh7wAAARM"]
[Sat Jul 18 23:37:56.050940 2026] [security2:error] [pid 930223:tid 930477] [client 180.252.198.240:60411] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxitGpwVNghF8G0ENOh9AAAAYQ"]
[Sat Jul 18 23:37:56.051088 2026] [security2:error] [pid 930223:tid 930477] [client 180.252.198.240:60411] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxitGpwVNghF8G0ENOh9AAAAYQ"]
[Sat Jul 18 23:37:56.096506 2026] [security2:error] [pid 930223:tid 930399] [client 34.210.88.185:45744] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.88.210.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxitGpwVNghF8G0ENOh9wAAATY"]
[Sat Jul 18 23:37:56.766004 2026] [security2:error] [pid 930223:tid 930442] [client 173.239.196.166:54241] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/index.php"] [unique_id "alxitGpwVNghF8G0ENOiKgAAAWE"]
[Sat Jul 18 23:37:57.122123 2026] [security2:error] [pid 930223:tid 930316] [remote 124.156.212.23:29757] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 23.212.156.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxitWpwVNghF8G0ENOiOQABRlo"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:37:57.638384 2026] [security2:error] [pid 930223:tid 930373] [client 173.239.196.164:56879] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/ab.php"] [unique_id "alxitWpwVNghF8G0ENOiXQAAARw"]
[Sat Jul 18 23:37:58.545912 2026] [security2:error] [pid 930223:tid 930370] [client 173.239.196.162:47291] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/about.php"] [unique_id "alxitmpwVNghF8G0ENOiiAAAARk"]
[Sat Jul 18 23:37:59.057130 2026] [security2:error] [pid 930223:tid 930244] [remote 31.42.184.154:38632] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxit2pwVNghF8G0ENOiqQABVhI"]
[Sat Jul 18 23:37:59.289790 2026] [security2:error] [pid 930223:tid 930233] [remote 31.42.184.154:38632] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxit2pwVNghF8G0ENOitgABgAc"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:37:59.427722 2026] [security2:error] [pid 930223:tid 930448] [client 173.239.196.164:29839] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "alxit2pwVNghF8G0ENOivwAAAWc"]
[Sat Jul 18 23:37:59.636046 2026] [security2:error] [pid 930223:tid 930234] [remote 188.138.102.156:45702] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxit2pwVNghF8G0ENOiyQABRAg"]
[Sat Jul 18 23:37:59.923027 2026] [security2:error] [pid 930223:tid 930245] [remote 188.138.102.156:45702] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxit2pwVNghF8G0ENOi3wABahM"], referer: https://sesamegreenbeans.com/wp-login.php
[Sat Jul 18 23:38:00.350053 2026] [security2:error] [pid 930223:tid 930356] [client 173.239.196.167:52721] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/doc.php"] [unique_id "alxiuGpwVNghF8G0ENOi_gAAAQs"]
[Sat Jul 18 23:38:01.215844 2026] [security2:error] [pid 930223:tid 930460] [client 173.239.196.167:62885] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "alxiuWpwVNghF8G0ENOjSQAAAXM"]
[Sat Jul 18 23:38:01.383430 2026] [security2:error] [pid 930223:tid 930432] [client 66.249.70.3:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxiuWpwVNghF8G0ENOjSAABV1c"]
[Sat Jul 18 23:38:01.433436 2026] [security2:error] [pid 930223:tid 930464] [client 163.61.1.17:59872] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxiuWpwVNghF8G0ENOjWAAAAXc"]
[Sat Jul 18 23:38:01.433531 2026] [security2:error] [pid 930223:tid 930464] [client 163.61.1.17:59872] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxiuWpwVNghF8G0ENOjWAAAAXc"]
[Sat Jul 18 23:38:01.447800 2026] [security2:error] [pid 930223:tid 930368] [client 34.23.246.146:29732] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "myhealthspot.org"] [uri "/"] [unique_id "alxiuWpwVNghF8G0ENOjWgAAARc"]
[Sat Jul 18 23:38:01.467812 2026] [security2:error] [pid 930223:tid 930422] [client 223.228.182.224:11237] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxiuWpwVNghF8G0ENOjXgAAAU0"]
[Sat Jul 18 23:38:01.467916 2026] [security2:error] [pid 930223:tid 930422] [client 223.228.182.224:11237] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxiuWpwVNghF8G0ENOjXgAAAU0"]
[Sat Jul 18 23:38:02.071841 2026] [security2:error] [pid 930223:tid 930382] [client 173.239.196.163:29345] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "alxiumpwVNghF8G0ENOjigAAASU"]
[Sat Jul 18 23:38:02.955014 2026] [security2:error] [pid 930223:tid 930473] [client 173.239.196.163:29665] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/mar.php"] [unique_id "alxiumpwVNghF8G0ENOjwAAAAYA"]
[Sat Jul 18 23:38:03.795838 2026] [security2:error] [pid 930223:tid 930392] [client 173.239.196.164:20651] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "alxiu2pwVNghF8G0ENOj9gAAAS8"]
[Sat Jul 18 23:38:03.855332 2026] [security2:error] [pid 930223:tid 930380] [client 106.222.249.209:17440] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxiu2pwVNghF8G0ENOj9wAAASM"]
[Sat Jul 18 23:38:03.855477 2026] [security2:error] [pid 930223:tid 930380] [client 106.222.249.209:17440] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxiu2pwVNghF8G0ENOj9wAAASM"]
[Sat Jul 18 23:38:03.982277 2026] [security2:error] [pid 930223:tid 930370] [client 52.207.32.99:32774] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.32.207.52.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxiu2pwVNghF8G0ENOj_AAAARk"]
[Sat Jul 18 23:38:03.982389 2026] [security2:error] [pid 930223:tid 930370] [client 52.207.32.99:32774] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxiu2pwVNghF8G0ENOj_AAAARk"]
[Sat Jul 18 23:38:04.444645 2026] [security2:error] [pid 930223:tid 930438] [client 216.244.66.228:42126] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.fansarogroup.com"] [uri "/robots.txt"] [unique_id "alxivGpwVNghF8G0ENOkJAAAAV0"]
[Sat Jul 18 23:38:04.444736 2026] [security2:error] [pid 930223:tid 930438] [client 216.244.66.228:42126] ModSecurity: Warning. Matched phrase "Dotbot" at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "www.fansarogroup.com"] [uri "/robots.txt"] [unique_id "alxivGpwVNghF8G0ENOkJAAAAV0"]
[Sat Jul 18 23:38:04.665100 2026] [security2:error] [pid 930223:tid 930459] [client 173.239.196.162:63965] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "alxivGpwVNghF8G0ENOkNgAAAXI"]
[Sat Jul 18 23:38:04.831838 2026] [security2:error] [pid 930223:tid 930417] [client 78.46.190.63:1486] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "mtlegnews.gov"] [uri "/index.php"] [unique_id "alxivGpwVNghF8G0ENOkLQAAAUg"], referer: https://mtlegnews.gov/
[Sat Jul 18 23:38:05.560109 2026] [security2:error] [pid 930223:tid 930395] [client 173.239.196.167:46857] ModSecurity: Warning. Pattern match "/1\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1543"] [id "900921"] [msg "temporary TUW-72162 logging rule"] [hostname "sixpackminer.org"] [uri "/1.php"] [unique_id "alxivWpwVNghF8G0ENOkagAAATI"]
[Sat Jul 18 23:38:05.560226 2026] [security2:error] [pid 930223:tid 930395] [client 173.239.196.167:46857] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/1.php"] [unique_id "alxivWpwVNghF8G0ENOkagAAATI"]
[Sat Jul 18 23:38:06.341622 2026] [security2:error] [pid 930223:tid 930368] [client 180.252.198.240:60873] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxivmpwVNghF8G0ENOknwAAARc"]
[Sat Jul 18 23:38:06.341704 2026] [security2:error] [pid 930223:tid 930368] [client 180.252.198.240:60873] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxivmpwVNghF8G0ENOknwAAARc"]
[Sat Jul 18 23:38:06.385808 2026] [security2:error] [pid 930223:tid 930325] [remote 31.42.184.154:50506] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "timespans.org"] [uri "/wp-login.php"] [unique_id "alxivmpwVNghF8G0ENOkqAABgGM"]
[Sat Jul 18 23:38:06.437641 2026] [security2:error] [pid 930223:tid 930474] [client 173.239.196.164:63201] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "alxivmpwVNghF8G0ENOkqwAAAYE"]
[Sat Jul 18 23:38:06.603045 2026] [security2:error] [pid 930223:tid 930331] [remote 31.42.184.154:50506] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "timespans.org"] [uri "/wp-login.php"] [unique_id "alxivmpwVNghF8G0ENOktQABS2k"], referer: https://timespans.org/wp-login.php
[Sat Jul 18 23:38:06.821249 2026] [security2:error] [pid 930223:tid 930481] [client 138.252.89.100:60152] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxivmpwVNghF8G0ENOkwwAAAYg"]
[Sat Jul 18 23:38:06.821332 2026] [security2:error] [pid 930223:tid 930481] [client 138.252.89.100:60152] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxivmpwVNghF8G0ENOkwwAAAYg"]
[Sat Jul 18 23:38:07.353622 2026] [security2:error] [pid 930223:tid 930475] [client 173.239.196.167:48397] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/style-engine/index.php"] [unique_id "alxiv2pwVNghF8G0ENOk3wAAAYI"]
[Sat Jul 18 23:38:08.240195 2026] [security2:error] [pid 930223:tid 930464] [client 173.239.196.162:38541] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/js/fm.php"] [unique_id "alxiwGpwVNghF8G0ENOlFAAAAXc"]
[Sat Jul 18 23:38:09.120819 2026] [security2:error] [pid 930223:tid 930392] [client 173.239.196.163:32949] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/images/index.php"] [unique_id "alxiwWpwVNghF8G0ENOlTAAAAS8"]
[Sat Jul 18 23:38:09.332177 2026] [security2:error] [pid 930223:tid 930271] [remote 91.142.222.105:48438] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "floorsourcestock.com"] [uri "/wp-login.php"] [unique_id "alxiwWpwVNghF8G0ENOlYgABfC0"]
[Sat Jul 18 23:38:09.529599 2026] [proxy:error] [pid 930223:tid 930409] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:38:09.529640 2026] [proxy_http:error] [pid 930223:tid 930409] [client 193.47.62.168:57166] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:38:09.530139 2026] [proxy:error] [pid 930223:tid 930409] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:38:09.530168 2026] [proxy_http:error] [pid 930223:tid 930409] [client 193.47.62.168:57166] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:38:10.011138 2026] [security2:error] [pid 930223:tid 930465] [client 173.239.196.160:32679] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "alxiwmpwVNghF8G0ENOlhQAAAXg"]
[Sat Jul 18 23:38:10.042343 2026] [security2:error] [pid 930223:tid 930276] [remote 91.142.222.105:48438] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "floorsourcestock.com"] [uri "/wp-login.php"] [unique_id "alxiwmpwVNghF8G0ENOliAABITI"], referer: https://floorsourcestock.com/wp-login.php
[Sat Jul 18 23:38:10.094904 2026] [security2:error] [pid 930223:tid 930308] [remote 31.42.184.154:57250] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxiwmpwVNghF8G0ENOliwABIlI"]
[Sat Jul 18 23:38:10.364204 2026] [security2:error] [pid 930223:tid 930298] [remote 31.42.184.154:57250] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxiwmpwVNghF8G0ENOlmwABQEg"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:38:10.819034 2026] [security2:error] [pid 930223:tid 930447] [client 50.116.65.227:26422] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "obc.enu.mybluehost.me"] [uri "/website_d9d7fe47/wp-cron.php"] [unique_id "alxiwmpwVNghF8G0ENOlswAAAWY"]
[Sat Jul 18 23:38:10.884544 2026] [security2:error] [pid 930223:tid 930450] [client 173.239.196.165:49107] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/file.php"] [unique_id "alxiwmpwVNghF8G0ENOluwAAAWk"]
[Sat Jul 18 23:38:10.949726 2026] [security2:error] [pid 930223:tid 930304] [remote 152.228.213.32:44298] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxiwmpwVNghF8G0ENOlwgABbU4"]
[Sat Jul 18 23:38:11.146313 2026] [security2:error] [pid 930223:tid 930325] [remote 152.228.213.32:44298] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxiw2pwVNghF8G0ENOlzQABGGM"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:38:11.755526 2026] [security2:error] [pid 930223:tid 930454] [client 173.239.196.167:35943] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "alxiw2pwVNghF8G0ENOl8AAAAW0"]
[Sat Jul 18 23:38:12.092375 2026] [security2:error] [pid 930223:tid 930445] [client 57.141.18.46:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxiw2pwVNghF8G0ENOl_gAAAWQ"]
[Sat Jul 18 23:38:12.283556 2026] [security2:error] [pid 930223:tid 930432] [client 223.228.182.224:32283] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxixGpwVNghF8G0ENOmGQAAAVc"]
[Sat Jul 18 23:38:12.283657 2026] [security2:error] [pid 930223:tid 930432] [client 223.228.182.224:32283] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxixGpwVNghF8G0ENOmGQAAAVc"]
[Sat Jul 18 23:38:12.560203 2026] [security2:error] [pid 930223:tid 930361] [client 163.61.1.17:60498] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxixGpwVNghF8G0ENOmKQAAARA"]
[Sat Jul 18 23:38:12.560305 2026] [security2:error] [pid 930223:tid 930361] [client 163.61.1.17:60498] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxixGpwVNghF8G0ENOmKQAAARA"]
[Sat Jul 18 23:38:12.591985 2026] [security2:error] [pid 930223:tid 930343] [remote 31.42.184.154:57260] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cheesewithjam.com"] [uri "/wp-login.php"] [unique_id "alxixGpwVNghF8G0ENOmLAABXHU"]
[Sat Jul 18 23:38:12.603694 2026] [security2:error] [pid 930223:tid 930235] [remote 152.228.213.32:44304] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "keywayconstructionclt.com"] [uri "/wp-login.php"] [unique_id "alxixGpwVNghF8G0ENOmKwABMgk"]
[Sat Jul 18 23:38:12.646390 2026] [security2:error] [pid 930223:tid 930426] [client 173.239.196.166:42125] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/fm.php"] [unique_id "alxixGpwVNghF8G0ENOmLgAAAVE"]
[Sat Jul 18 23:38:12.749300 2026] [security2:error] [pid 930223:tid 930408] [client 13.232.206.133:29378] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.206.232.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxixGpwVNghF8G0ENOmMAAAAT8"]
[Sat Jul 18 23:38:12.749383 2026] [security2:error] [pid 930223:tid 930408] [client 13.232.206.133:29378] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxixGpwVNghF8G0ENOmMAAAAT8"]
[Sat Jul 18 23:38:12.827712 2026] [security2:error] [pid 930223:tid 930249] [remote 152.228.213.32:44304] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "keywayconstructionclt.com"] [uri "/wp-login.php"] [unique_id "alxixGpwVNghF8G0ENOmOwABDhc"], referer: https://keywayconstructionclt.com/wp-login.php
[Sat Jul 18 23:38:12.874290 2026] [security2:error] [pid 930223:tid 930226] [remote 31.42.184.154:57260] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cheesewithjam.com"] [uri "/wp-login.php"] [unique_id "alxixGpwVNghF8G0ENOmPwABZwA"], referer: https://cheesewithjam.com/wp-login.php
[Sat Jul 18 23:38:13.184779 2026] [security2:error] [pid 930223:tid 930364] [client 139.167.225.146:60114] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxixWpwVNghF8G0ENOmWAAAARM"]
[Sat Jul 18 23:38:13.184935 2026] [security2:error] [pid 930223:tid 930364] [client 139.167.225.146:60114] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxixWpwVNghF8G0ENOmWAAAARM"]
[Sat Jul 18 23:38:13.515090 2026] [security2:error] [pid 930223:tid 930434] [client 173.239.196.160:41155] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/js/widgets/cloud.php"] [unique_id "alxixWpwVNghF8G0ENOmaAAAAVk"]
[Sat Jul 18 23:38:14.198859 2026] [security2:error] [pid 930223:tid 930282] [remote 41.76.213.235:48172] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxixmpwVNghF8G0ENOmlgABgTg"]
[Sat Jul 18 23:38:14.393443 2026] [security2:error] [pid 930223:tid 930386] [client 173.239.196.165:29273] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/adminfuns.php7"] [unique_id "alxixmpwVNghF8G0ENOmmwAAASk"]
[Sat Jul 18 23:38:14.569234 2026] [security2:error] [pid 930223:tid 930419] [client 106.222.249.209:17492] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxixmpwVNghF8G0ENOmpwAAAUo"]
[Sat Jul 18 23:38:14.569322 2026] [security2:error] [pid 930223:tid 930419] [client 106.222.249.209:17492] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxixmpwVNghF8G0ENOmpwAAAUo"]
[Sat Jul 18 23:38:14.691229 2026] [security2:error] [pid 930223:tid 930309] [remote 41.76.213.235:48172] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxixmpwVNghF8G0ENOmuAABV1M"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:38:15.049274 2026] [security2:error] [pid 930223:tid 930429] [client 64.119.64.184:43667] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "gertoger.org"] [uri "/index.php"] [unique_id "alxixmpwVNghF8G0ENOmvwABVD4"]
[Sat Jul 18 23:38:15.246948 2026] [security2:error] [pid 930223:tid 930466] [client 173.239.196.164:45443] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/images/about.php"] [unique_id "alxix2pwVNghF8G0ENOm1gAAAXk"]
[Sat Jul 18 23:38:16.112065 2026] [security2:error] [pid 930223:tid 930389] [client 173.239.196.160:42721] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/ini.php"] [unique_id "alxiyGpwVNghF8G0ENOnBwAAASw"]
[Sat Jul 18 23:38:16.713954 2026] [security2:error] [pid 930223:tid 930378] [client 180.252.198.240:61337] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiyGpwVNghF8G0ENOnMQAAASE"]
[Sat Jul 18 23:38:16.714055 2026] [security2:error] [pid 930223:tid 930378] [client 180.252.198.240:61337] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxiyGpwVNghF8G0ENOnMQAAASE"]
[Sat Jul 18 23:38:16.961859 2026] [security2:error] [pid 930223:tid 930366] [client 173.239.196.162:37775] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/coffee/cloud.php"] [unique_id "alxiyGpwVNghF8G0ENOnOwAAARU"]
[Sat Jul 18 23:38:17.854873 2026] [security2:error] [pid 930223:tid 930466] [client 173.239.196.166:42091] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "alxiyWpwVNghF8G0ENOneAAAAXk"]
[Sat Jul 18 23:38:18.577640 2026] [security2:error] [pid 930223:tid 930410] [client 138.252.89.100:60799] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxiympwVNghF8G0ENOnpQAAAUE"]
[Sat Jul 18 23:38:18.577721 2026] [security2:error] [pid 930223:tid 930410] [client 138.252.89.100:60799] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxiympwVNghF8G0ENOnpQAAAUE"]
[Sat Jul 18 23:38:18.746076 2026] [security2:error] [pid 930223:tid 930366] [client 173.239.196.161:54225] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "alxiympwVNghF8G0ENOnrAAAARU"]
[Sat Jul 18 23:38:19.600708 2026] [security2:error] [pid 930223:tid 930456] [client 173.239.196.167:35573] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/acme-challenge/atomlib.php"] [unique_id "alxiy2pwVNghF8G0ENOn4QAAAW8"]
[Sat Jul 18 23:38:19.679020 2026] [security2:error] [pid 930223:tid 930390] [client 57.141.18.0:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxiy2pwVNghF8G0ENOn2wAAAS0"]
[Sat Jul 18 23:38:20.461690 2026] [security2:error] [pid 930223:tid 930373] [client 173.239.196.163:34427] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/js/instaall.php"] [unique_id "alxizGpwVNghF8G0ENOoKgAAARw"]
[Sat Jul 18 23:38:21.347224 2026] [security2:error] [pid 930223:tid 930474] [client 173.239.196.162:40577] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/function.php"] [unique_id "alxizWpwVNghF8G0ENOobAAAAYE"]
[Sat Jul 18 23:38:21.459824 2026] [security2:error] [pid 930223:tid 930440] [client 114.119.137.237:57509] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.thecreole.com"] [uri "/"] [unique_id "alxizWpwVNghF8G0ENOoeQAAAV8"], referer: https://newstral.com/en/article/en/990815631/ascension-parish-naacp-awards-scholarships-2015-
[Sat Jul 18 23:38:21.506077 2026] [security2:error] [pid 930223:tid 930334] [remote 120.72.98.5:42502] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxizWpwVNghF8G0ENOoegABW2w"]
[Sat Jul 18 23:38:21.550146 2026] [security2:error] [pid 930223:tid 930358] [client 184.72.71.30:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "ghivs.com"] [uri "/index.php"] [unique_id "alxizWpwVNghF8G0ENOodwAAAQ0"]
[Sat Jul 18 23:38:21.885225 2026] [security2:error] [pid 930223:tid 930377] [client 57.141.18.112:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "liquidationteam.com"] [uri "/index.php"] [unique_id "alxizWpwVNghF8G0ENOobgAAASA"]
[Sat Jul 18 23:38:21.988803 2026] [security2:error] [pid 930223:tid 930341] [remote 120.72.98.5:42502] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxizWpwVNghF8G0ENOongABWnM"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:38:22.172295 2026] [security2:error] [pid 930223:tid 930383] [client 173.239.196.162:53799] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/plugins.php"] [unique_id "alxizmpwVNghF8G0ENOopwAAASY"]
[Sat Jul 18 23:38:22.445625 2026] [security2:error] [pid 930223:tid 930230] [remote 31.42.184.154:41662] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxizmpwVNghF8G0ENOovgABKAQ"]
[Sat Jul 18 23:38:22.539096 2026] [security2:error] [pid 930223:tid 930369] [client 163.61.1.17:60980] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxizmpwVNghF8G0ENOoxgAAARg"]
[Sat Jul 18 23:38:22.539183 2026] [security2:error] [pid 930223:tid 930369] [client 163.61.1.17:60980] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxizmpwVNghF8G0ENOoxgAAARg"]
[Sat Jul 18 23:38:22.674431 2026] [security2:error] [pid 930223:tid 930351] [remote 31.42.184.154:41662] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxizmpwVNghF8G0ENOo0QABan0"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:38:22.829144 2026] [security2:error] [pid 930223:tid 930367] [client 74.208.214.194:42748] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxizmpwVNghF8G0ENOo2AAAARY"]
[Sat Jul 18 23:38:23.025719 2026] [security2:error] [pid 930223:tid 930433] [client 173.239.196.163:64683] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/atomlib.php"] [unique_id "alxiz2pwVNghF8G0ENOo5gAAAVg"]
[Sat Jul 18 23:38:23.135354 2026] [security2:error] [pid 930223:tid 930365] [client 196.251.121.187:60610] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\w ?(?:user|and)(\\\\w+)char ?\\\\([0-9]| \\\\b(?:execute|convert) ?\\\\(|; ?\\\\bdelete\\\\b.{1,100}?; ?(?:insert|declare @|varchar) ?|\\\\bdrop\\\\b .{1,100} table |(?:declare|convert) .{1,100} varchar\\\\(|null ?, ?null ?, ?(?:accesslevel|user_?name) ?,|\\\\bconcat ..." at ARGS:requests.requests.body.requests.requests.path. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "395"] [id "340157"] [rev "38"] [msg "Atomicorp.com WAF Rules: Generic SQL inline command protection"] [data "union select ,ARGS:requests.requests.body.requests.requests.path"] [severity "CRITICAL"] [tag "SQLi"] [hostname "liquidationteam.com"] [uri "/"] [unique_id "alxizmpwVNghF8G0ENOo0wAAARQ"]
[Sat Jul 18 23:38:23.159213 2026] [security2:error] [pid 930223:tid 930464] [client 223.228.182.224:53132] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxiz2pwVNghF8G0ENOo7gAAAXc"]
[Sat Jul 18 23:38:23.168606 2026] [security2:error] [pid 930223:tid 930464] [client 223.228.182.224:53132] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxiz2pwVNghF8G0ENOo7gAAAXc"]
[Sat Jul 18 23:38:23.384628 2026] [security2:error] [pid 930223:tid 930386] [client 139.167.225.146:60793] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxiz2pwVNghF8G0ENOo-AAAASk"]
[Sat Jul 18 23:38:23.384734 2026] [security2:error] [pid 930223:tid 930386] [client 139.167.225.146:60793] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxiz2pwVNghF8G0ENOo-AAAASk"]
[Sat Jul 18 23:38:23.898620 2026] [security2:error] [pid 930223:tid 930390] [client 173.239.196.166:26407] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content.php"] [unique_id "alxiz2pwVNghF8G0ENOpGAAAAS0"]
[Sat Jul 18 23:38:24.065197 2026] [security2:error] [pid 930223:tid 930281] [remote 154.61.75.100:51094] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "jndsupport.com"] [uri "/wp-login.php"] [unique_id "alxi0GpwVNghF8G0ENOpJgABUTc"]
[Sat Jul 18 23:38:24.798826 2026] [security2:error] [pid 930223:tid 930448] [client 173.239.196.163:30051] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/css/chosen.php"] [unique_id "alxi0GpwVNghF8G0ENOpTwAAAWc"]
[Sat Jul 18 23:38:25.088202 2026] [security2:error] [pid 930223:tid 930401] [client 106.222.249.209:29319] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxi0WpwVNghF8G0ENOpYwAAATg"]
[Sat Jul 18 23:38:25.088579 2026] [security2:error] [pid 930223:tid 930401] [client 106.222.249.209:29319] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxi0WpwVNghF8G0ENOpYwAAATg"]
[Sat Jul 18 23:38:25.251062 2026] [security2:error] [pid 930223:tid 930389] [client 157.15.187.201:60026] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "155"] [id "900406"] [msg "wp-login POST logging"] [data "200"] [hostname "whiteoutcb.com"] [uri "/wp-login.php"] [unique_id "alxi0WpwVNghF8G0ENOpYAAAASw"], referer: https://whiteoutcb.com/wp-login.php
[Sat Jul 18 23:38:25.671908 2026] [security2:error] [pid 930223:tid 930429] [client 173.239.196.161:26327] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "alxi0WpwVNghF8G0ENOpiwAAAVQ"]
[Sat Jul 18 23:38:25.912828 2026] [security2:error] [pid 930223:tid 930448] [client 154.27.104.38:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mtlegnews.gov"] [uri "/index.php"] [unique_id "alxi0WpwVNghF8G0ENOpjAAAAWc"]
[Sat Jul 18 23:38:26.010847 2026] [ssl:error] [pid 930223:tid 930370] [client 104.48.69.105:50250] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname blog.danwolfe.us provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:38:26.530707 2026] [security2:error] [pid 930223:tid 930388] [client 173.239.196.160:48789] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/network/index.php"] [unique_id "alxi0mpwVNghF8G0ENOpuwAAASs"]
[Sat Jul 18 23:38:26.646586 2026] [security2:error] [pid 930223:tid 930384] [client 183.7.16.50:15609] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "lifeisbetterlakeside.com"] [uri "/index.php"] [unique_id "alxi0WpwVNghF8G0ENOpXwAAASc"]
[Sat Jul 18 23:38:27.407168 2026] [security2:error] [pid 930223:tid 930453] [client 173.239.196.163:47025] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/light/about.php"] [unique_id "alxi02pwVNghF8G0ENOp8AAAAWw"]
[Sat Jul 18 23:38:27.555268 2026] [security2:error] [pid 930223:tid 930358] [client 180.252.198.240:61845] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxi02pwVNghF8G0ENOp_QAAAQ0"]
[Sat Jul 18 23:38:27.555954 2026] [security2:error] [pid 930223:tid 930358] [client 180.252.198.240:61845] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxi02pwVNghF8G0ENOp_QAAAQ0"]
[Sat Jul 18 23:38:28.001832 2026] [security2:error] [pid 930223:tid 930254] [remote 143.110.183.208:40072] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 208.183.110.143.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "weifangsmefarm.com"] [uri "/wp-login.php"] [unique_id "alxi02pwVNghF8G0ENOqEgABeBw"]
[Sat Jul 18 23:38:28.279900 2026] [security2:error] [pid 930223:tid 930412] [client 173.239.196.162:59311] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/customize.php"] [unique_id "alxi1GpwVNghF8G0ENOqKAAAAUM"]
[Sat Jul 18 23:38:28.376024 2026] [security2:error] [pid 930223:tid 930353] [remote 143.110.183.208:40072] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 208.183.110.143.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "weifangsmefarm.com"] [uri "/wp-login.php"] [unique_id "alxi1GpwVNghF8G0ENOqLQABP38"], referer: https://weifangsmefarm.com/wp-login.php
[Sat Jul 18 23:38:29.165706 2026] [security2:error] [pid 930223:tid 930365] [client 173.239.196.164:53393] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/license.php"] [unique_id "alxi1WpwVNghF8G0ENOqXQAAARQ"]
[Sat Jul 18 23:38:29.940578 2026] [ssl:error] [pid 930223:tid 930464] [client 104.48.69.105:40252] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname www.bandsir.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:38:30.064582 2026] [security2:error] [pid 930223:tid 930428] [client 173.239.196.164:57513] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/languages/autoload_classmap.php"] [unique_id "alxi1mpwVNghF8G0ENOqmwAAAVM"]
[Sat Jul 18 23:38:30.410544 2026] [security2:error] [pid 930223:tid 930380] [client 138.252.89.100:61322] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxi1mpwVNghF8G0ENOqtQAAASM"]
[Sat Jul 18 23:38:30.411296 2026] [security2:error] [pid 930223:tid 930380] [client 138.252.89.100:61322] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxi1mpwVNghF8G0ENOqtQAAASM"]
[Sat Jul 18 23:38:30.947591 2026] [security2:error] [pid 930223:tid 930433] [client 173.239.196.163:42263] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/lock.php"] [unique_id "alxi1mpwVNghF8G0ENOq0wAAAVg"]
[Sat Jul 18 23:38:31.173090 2026] [security2:error] [pid 930223:tid 930438] [client 74.208.214.194:34624] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxi12pwVNghF8G0ENOq3wAAAV0"]
[Sat Jul 18 23:38:31.832229 2026] [security2:error] [pid 930223:tid 930348] [remote 31.42.184.154:53822] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/wp-login.php"] [unique_id "alxi12pwVNghF8G0ENOrDQABbXo"]
[Sat Jul 18 23:38:31.834294 2026] [security2:error] [pid 930223:tid 930401] [client 173.239.196.164:23835] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/blue/gold.php"] [unique_id "alxi12pwVNghF8G0ENOrDgAAATg"]
[Sat Jul 18 23:38:32.101385 2026] [security2:error] [pid 930223:tid 930244] [remote 31.42.184.154:53822] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/wp-login.php"] [unique_id "alxi2GpwVNghF8G0ENOrIQABPRI"], referer: https://transparentservices.online/wp-login.php
[Sat Jul 18 23:38:32.271558 2026] [proxy:error] [pid 930223:tid 930405] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:38:32.271638 2026] [proxy_http:error] [pid 930223:tid 930405] [client 193.47.62.168:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:38:32.272246 2026] [proxy:error] [pid 930223:tid 930405] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:38:32.272287 2026] [proxy_http:error] [pid 930223:tid 930405] [client 193.47.62.168:0] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:38:32.749572 2026] [security2:error] [pid 930223:tid 930433] [client 173.239.196.161:43499] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/atomlib.php"] [unique_id "alxi2GpwVNghF8G0ENOrSQAAAVg"]
[Sat Jul 18 23:38:33.079598 2026] [security2:error] [pid 930223:tid 930450] [client 163.61.1.17:61455] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxi2WpwVNghF8G0ENOrWgAAAWk"]
[Sat Jul 18 23:38:33.079689 2026] [security2:error] [pid 930223:tid 930450] [client 163.61.1.17:61455] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxi2WpwVNghF8G0ENOrWgAAAWk"]
[Sat Jul 18 23:38:33.273979 2026] [security2:error] [pid 930223:tid 930441] [client 74.7.227.179:48288] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxi2WpwVNghF8G0ENOrXQABYH4"], referer: https://tejasenvironmental.com/p=824981
[Sat Jul 18 23:38:33.500890 2026] [security2:error] [pid 930223:tid 930258] [remote 154.61.75.100:43640] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "jndsupport.com"] [uri "/wp-login.php"] [unique_id "alxi2WpwVNghF8G0ENOrdAABKyA"], referer: https://jndsupport.com/wp-login.php
[Sat Jul 18 23:38:33.650020 2026] [security2:error] [pid 930223:tid 930384] [client 173.239.196.167:45661] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/rest-api/index.php"] [unique_id "alxi2WpwVNghF8G0ENOregAAASc"]
[Sat Jul 18 23:38:33.874718 2026] [security2:error] [pid 930223:tid 930482] [client 50.116.65.227:59752] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Jin-Wee-Feature-Image.jpg"] [unique_id "alxi2WpwVNghF8G0ENOrqgAAAYk"]
[Sat Jul 18 23:38:33.885102 2026] [security2:error] [pid 930223:tid 930465] [client 50.116.65.227:14344] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Jin-Wee-Feature-Image.jpg"] [unique_id "alxi2WpwVNghF8G0ENOrqwAAAUk"]
[Sat Jul 18 23:38:33.895046 2026] [security2:error] [pid 930223:tid 930311] [remote 149.88.64.125:55138] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 125.64.88.149.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.verdunestate.com"] [uri "/wp-login.php"] [unique_id "alxi2WpwVNghF8G0ENOrqAABiFU"]
[Sat Jul 18 23:38:34.032172 2026] [security2:error] [pid 930223:tid 930312] [remote 47.86.33.52:13070] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "secoaches.co"] [uri "/wp-login.php"] [unique_id "alxi2mpwVNghF8G0ENOrwgABPlY"]
[Sat Jul 18 23:38:34.105201 2026] [security2:error] [pid 930223:tid 930469] [client 223.228.182.224:32283] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxi2mpwVNghF8G0ENOrzQAAAXw"]
[Sat Jul 18 23:38:34.105315 2026] [security2:error] [pid 930223:tid 930469] [client 223.228.182.224:32283] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxi2mpwVNghF8G0ENOrzQAAAXw"]
[Sat Jul 18 23:38:34.280132 2026] [security2:error] [pid 930223:tid 930326] [remote 149.88.64.125:55138] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 125.64.88.149.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.verdunestate.com"] [uri "/wp-login.php"] [unique_id "alxi2mpwVNghF8G0ENOr0gABJ2Q"], referer: https://mail.verdunestate.com/wp-login.php
[Sat Jul 18 23:38:34.405944 2026] [security2:error] [pid 930223:tid 930377] [client 34.10.140.162:8438] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "greenbee-emea.com"] [uri "/wp-json/batch/v1"] [unique_id "alxi2mpwVNghF8G0ENOr2wAAASA"]
[Sat Jul 18 23:38:34.431908 2026] [security2:error] [pid 930223:tid 930288] [remote 47.86.33.52:13070] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "secoaches.co"] [uri "/wp-login.php"] [unique_id "alxi2mpwVNghF8G0ENOr3wABXT4"], referer: https://secoaches.co/wp-login.php
[Sat Jul 18 23:38:34.560837 2026] [security2:error] [pid 930223:tid 930482] [client 173.239.196.162:51479] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/about.php"] [unique_id "alxi2mpwVNghF8G0ENOr-wAAAYk"]
[Sat Jul 18 23:38:34.584622 2026] [security2:error] [pid 930223:tid 930401] [client 139.167.225.146:61420] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxi2mpwVNghF8G0ENOsAwAAATg"]
[Sat Jul 18 23:38:34.584717 2026] [security2:error] [pid 930223:tid 930401] [client 139.167.225.146:61420] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxi2mpwVNghF8G0ENOsAwAAATg"]
[Sat Jul 18 23:38:34.608249 2026] [ssl:error] [pid 930223:tid 930452] [client 104.48.69.105:40260] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname www.icemarc.org provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:38:34.649856 2026] [security2:error] [pid 930223:tid 930392] [client 34.10.140.162:8438] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "greenbee-emea.com"] [uri "/"] [unique_id "alxi2mpwVNghF8G0ENOsDgAAAS8"]
[Sat Jul 18 23:38:35.153944 2026] [security2:error] [pid 930223:tid 930369] [client 34.10.140.162:59486] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "greenbee-emea.com"] [uri "/wp-json/batch/v1"] [unique_id "alxi22pwVNghF8G0ENOsMwAAARg"]
[Sat Jul 18 23:38:35.405704 2026] [security2:error] [pid 930223:tid 930417] [client 34.10.140.162:59486] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "greenbee-emea.com"] [uri "/"] [unique_id "alxi22pwVNghF8G0ENOsPwAAAUg"]
[Sat Jul 18 23:38:35.443114 2026] [security2:error] [pid 930223:tid 930442] [client 173.239.196.162:55669] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/wincust.php"] [unique_id "alxi22pwVNghF8G0ENOsQQAAAWE"]
[Sat Jul 18 23:38:35.754654 2026] [security2:error] [pid 930223:tid 930458] [client 106.222.249.209:17590] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxi22pwVNghF8G0ENOsWAAAAXE"]
[Sat Jul 18 23:38:35.754862 2026] [security2:error] [pid 930223:tid 930458] [client 106.222.249.209:17590] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxi22pwVNghF8G0ENOsWAAAAXE"]
[Sat Jul 18 23:38:36.089488 2026] [security2:error] [pid 930223:tid 930387] [client 57.141.18.73:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxi22pwVNghF8G0ENOsXQAAASo"]
[Sat Jul 18 23:38:36.305853 2026] [security2:error] [pid 930223:tid 930398] [client 173.239.196.162:63569] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/light/alfa-rex.php"] [unique_id "alxi3GpwVNghF8G0ENOshwAAATU"]
[Sat Jul 18 23:38:37.144821 2026] [security2:error] [pid 930223:tid 930370] [client 173.239.196.160:43707] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-good.php"] [unique_id "alxi3WpwVNghF8G0ENOsvwAAARk"]
[Sat Jul 18 23:38:37.459336 2026] [security2:error] [pid 930223:tid 930328] [remote 152.228.213.32:47742] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxi3WpwVNghF8G0ENOs0AABWmY"]
[Sat Jul 18 23:38:37.656506 2026] [security2:error] [pid 930223:tid 930334] [remote 152.228.213.32:47742] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxi3WpwVNghF8G0ENOs4gABL2w"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:38:37.813613 2026] [security2:error] [pid 930223:tid 930420] [client 185.92.25.135:28887] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/ms-themes.php"] [unique_id "alxi3WpwVNghF8G0ENOs6QAAAUs"]
[Sat Jul 18 23:38:37.888917 2026] [security2:error] [pid 930223:tid 930370] [client 91.230.225.154:64693] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/ms-themes.php"] [unique_id "alxi3WpwVNghF8G0ENOs7wAAARk"]
[Sat Jul 18 23:38:37.905046 2026] [security2:error] [pid 930223:tid 930364] [client 185.192.71.219:63825] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/ms-themes.php"] [unique_id "alxi3WpwVNghF8G0ENOs8AAAARM"]
[Sat Jul 18 23:38:37.915289 2026] [security2:error] [pid 930223:tid 930425] [client 91.230.225.150:22691] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/ms-themes.php"] [unique_id "alxi3WpwVNghF8G0ENOs8wAAAVA"]
[Sat Jul 18 23:38:37.928482 2026] [security2:error] [pid 930223:tid 930474] [client 91.230.225.157:23409] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/ms-themes.php"] [unique_id "alxi3WpwVNghF8G0ENOs9AAAAYE"]
[Sat Jul 18 23:38:37.948036 2026] [security2:error] [pid 930223:tid 930388] [client 216.73.216.95:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.cira.org"] [uri "/index.php"] [unique_id "alxi3GpwVNghF8G0ENOshgAAASs"]
[Sat Jul 18 23:38:38.000096 2026] [security2:error] [pid 930223:tid 930478] [client 180.252.198.240:62323] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxi3WpwVNghF8G0ENOs-QAAAYU"]
[Sat Jul 18 23:38:38.000184 2026] [security2:error] [pid 930223:tid 930478] [client 180.252.198.240:62323] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxi3WpwVNghF8G0ENOs-QAAAYU"]
[Sat Jul 18 23:38:38.003328 2026] [security2:error] [pid 930223:tid 930445] [client 173.239.196.161:46041] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/index.php"] [unique_id "alxi3mpwVNghF8G0ENOs-gAAAWQ"]
[Sat Jul 18 23:38:38.039930 2026] [security2:error] [pid 930223:tid 930431] [client 103.100.176.212:43339] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "mtlegnews.gov"] [uri "/"] [unique_id "alxi3mpwVNghF8G0ENOs_QAAAVY"]
[Sat Jul 18 23:38:38.065717 2026] [security2:error] [pid 930223:tid 930466] [client 185.192.71.221:49675] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/ms-themes.php"] [unique_id "alxi3mpwVNghF8G0ENOtAAAAAXk"]
[Sat Jul 18 23:38:38.086831 2026] [security2:error] [pid 930223:tid 930415] [client 185.192.71.215:45789] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/ms-themes.php"] [unique_id "alxi3mpwVNghF8G0ENOtAgAAAUY"]
[Sat Jul 18 23:38:38.139911 2026] [security2:error] [pid 930223:tid 930359] [client 34.147.91.161:8192] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "mail.sitelca.com.co"] [uri "/"] [unique_id "alxi3mpwVNghF8G0ENOtBQAAAQ4"]
[Sat Jul 18 23:38:38.139999 2026] [security2:error] [pid 930223:tid 930359] [client 34.147.91.161:8192] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "mail.sitelca.com.co"] [uri "/"] [unique_id "alxi3mpwVNghF8G0ENOtBQAAAQ4"]
[Sat Jul 18 23:38:38.228354 2026] [security2:error] [pid 930223:tid 930376] [client 91.230.225.150:58667] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/chosen.php"] [unique_id "alxi3mpwVNghF8G0ENOtEAAAAR8"]
[Sat Jul 18 23:38:38.474429 2026] [security2:error] [pid 930223:tid 930426] [client 185.192.71.215:20391] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.eja.xsa.mybluehost.me"] [uri "/ms-themes.php"] [unique_id "alxi3mpwVNghF8G0ENOtHwAAAVE"]
[Sat Jul 18 23:38:38.847825 2026] [security2:error] [pid 930223:tid 930402] [client 173.239.196.163:61057] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "alxi3mpwVNghF8G0ENOtOwAAATk"]
[Sat Jul 18 23:38:39.190662 2026] [security2:error] [pid 930223:tid 930417] [client 52.167.144.211:54551] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.vfcthomasville.org"] [uri "/index.php"] [unique_id "alxi3mpwVNghF8G0ENOtEQABSHg"]
[Sat Jul 18 23:38:39.604875 2026] [security2:error] [pid 930223:tid 930465] [client 185.92.25.93:43369] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/chosen.php"] [unique_id "alxi32pwVNghF8G0ENOtagAAAXg"]
[Sat Jul 18 23:38:39.708081 2026] [security2:error] [pid 930223:tid 930435] [client 173.239.196.161:29903] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "alxi32pwVNghF8G0ENOtcQAAAVo"]
[Sat Jul 18 23:38:39.797912 2026] [proxy:error] [pid 930223:tid 930390] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:38:39.797989 2026] [proxy_http:error] [pid 930223:tid 930390] [client 195.96.139.94:37261] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:38:39.798454 2026] [proxy:error] [pid 930223:tid 930390] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:38:39.798482 2026] [proxy_http:error] [pid 930223:tid 930390] [client 195.96.139.94:37261] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:38:39.963416 2026] [security2:error] [pid 930223:tid 930366] [client 18.141.144.104:46372] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.144.141.18.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxi32pwVNghF8G0ENOtiAAAARU"]
[Sat Jul 18 23:38:40.523994 2026] [security2:error] [pid 930223:tid 930438] [client 185.92.25.81:39867] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/chosen.php"] [unique_id "alxi4GpwVNghF8G0ENOtrgAAAV0"]
[Sat Jul 18 23:38:40.533734 2026] [security2:error] [pid 930223:tid 930456] [client 185.92.25.93:21623] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/chosen.php"] [unique_id "alxi4GpwVNghF8G0ENOtrwAAAW8"]
[Sat Jul 18 23:38:40.534510 2026] [security2:error] [pid 930223:tid 930381] [client 185.92.25.134:52153] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/chosen.php"] [unique_id "alxi4GpwVNghF8G0ENOtsAAAASQ"]
[Sat Jul 18 23:38:40.548240 2026] [security2:error] [pid 930223:tid 930436] [client 185.192.71.217:30801] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/chosen.php"] [unique_id "alxi4GpwVNghF8G0ENOtsQAAAVs"]
[Sat Jul 18 23:38:40.562331 2026] [security2:error] [pid 930223:tid 930393] [client 185.192.71.210:24331] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/chosen.php"] [unique_id "alxi4GpwVNghF8G0ENOtsgAAATA"]
[Sat Jul 18 23:38:40.563287 2026] [security2:error] [pid 930223:tid 930453] [client 185.192.71.223:60913] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/file.php"] [unique_id "alxi4GpwVNghF8G0ENOtswAAAWw"]
[Sat Jul 18 23:38:40.579008 2026] [security2:error] [pid 930223:tid 930411] [client 173.239.196.162:48649] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/twentytwentyfour/about.php"] [unique_id "alxi4GpwVNghF8G0ENOttAAAAUI"]
[Sat Jul 18 23:38:40.638474 2026] [security2:error] [pid 930223:tid 930404] [client 185.192.71.213:40691] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.eja.xsa.mybluehost.me"] [uri "/chosen.php"] [unique_id "alxi4GpwVNghF8G0ENOtuAAAATs"]
[Sat Jul 18 23:38:40.769336 2026] [security2:error] [pid 930223:tid 930399] [client 47.130.151.169:52596] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 169.151.130.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxi4GpwVNghF8G0ENOtxAAAATY"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:38:41.204842 2026] [security2:error] [pid 930223:tid 930425] [client 174.140.80.84:51785] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 84.80.140.174.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "walkingandtalking.net"] [uri "/xmlrpc.php"] [unique_id "alxi4WpwVNghF8G0ENOt2wAAAVA"]
[Sat Jul 18 23:38:41.204967 2026] [security2:error] [pid 930223:tid 930425] [client 174.140.80.84:51785] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "walkingandtalking.net"] [uri "/xmlrpc.php"] [unique_id "alxi4WpwVNghF8G0ENOt2wAAAVA"]
[Sat Jul 18 23:38:41.438777 2026] [security2:error] [pid 930223:tid 930312] [remote 4.205.168.44:57684] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "keywayconstructionclt.com"] [uri "/wp-login.php"] [unique_id "alxi4WpwVNghF8G0ENOt6wABdlY"]
[Sat Jul 18 23:38:41.616693 2026] [security2:error] [pid 930223:tid 930313] [remote 4.205.168.44:57684] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "keywayconstructionclt.com"] [uri "/wp-login.php"] [unique_id "alxi4WpwVNghF8G0ENOt-QABhlc"], referer: https://keywayconstructionclt.com/wp-login.php
[Sat Jul 18 23:38:41.828936 2026] [security2:error] [pid 930223:tid 930409] [client 185.192.71.220:46577] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/file.php"] [unique_id "alxi4WpwVNghF8G0ENOuDAAAAUA"]
[Sat Jul 18 23:38:41.955602 2026] [security2:error] [pid 930223:tid 930393] [client 173.239.196.162:37413] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/js/widgets/about.php"] [unique_id "alxi4WpwVNghF8G0ENOuFQAAATA"]
[Sat Jul 18 23:38:42.032693 2026] [security2:error] [pid 930223:tid 930395] [client 136.243.59.237:47006] ModSecurity: Warning. Matched phrase "DomainStatsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "www.ccsdifference.com"] [uri "/index.php"] [unique_id "alxi4WpwVNghF8G0ENOt_QAAAWs"]
[Sat Jul 18 23:38:42.054390 2026] [security2:error] [pid 930223:tid 930325] [remote 154.0.166.254:53774] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 254.166.0.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "uninursity.com"] [uri "/wp-login.php"] [unique_id "alxi4mpwVNghF8G0ENOuGQABSmM"]
[Sat Jul 18 23:38:42.251647 2026] [security2:error] [pid 930223:tid 930436] [client 138.252.89.100:61839] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxi4mpwVNghF8G0ENOuIwAAAVs"]
[Sat Jul 18 23:38:42.251785 2026] [security2:error] [pid 930223:tid 930436] [client 138.252.89.100:61839] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxi4mpwVNghF8G0ENOuIwAAAVs"]
[Sat Jul 18 23:38:42.666158 2026] [security2:error] [pid 930223:tid 930381] [client 91.230.225.152:57213] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/file.php"] [unique_id "alxi4mpwVNghF8G0ENOuRgAAASQ"]
[Sat Jul 18 23:38:42.692908 2026] [security2:error] [pid 930223:tid 930378] [client 91.230.225.159:33121] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/file.php"] [unique_id "alxi4mpwVNghF8G0ENOuSAAAASE"]
[Sat Jul 18 23:38:42.708845 2026] [security2:error] [pid 930223:tid 930390] [client 185.92.25.90:29707] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/file.php"] [unique_id "alxi4mpwVNghF8G0ENOuSQAAAS0"]
[Sat Jul 18 23:38:42.711124 2026] [security2:error] [pid 930223:tid 930387] [client 185.92.25.81:57003] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/file.php"] [unique_id "alxi4mpwVNghF8G0ENOuSgAAASo"]
[Sat Jul 18 23:38:42.717259 2026] [security2:error] [pid 930223:tid 930426] [client 185.192.71.213:21749] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/file.php"] [unique_id "alxi4mpwVNghF8G0ENOuSwAAAVE"]
[Sat Jul 18 23:38:42.718367 2026] [security2:error] [pid 930223:tid 930478] [client 185.92.25.82:36505] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/flower.php"] [unique_id "alxi4mpwVNghF8G0ENOuTQAAAYU"]
[Sat Jul 18 23:38:42.772215 2026] [security2:error] [pid 930223:tid 930428] [client 4.194.24.143:13994] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/nine2code.php"] [unique_id "alxi4mpwVNghF8G0ENOuUgAAAVM"]
[Sat Jul 18 23:38:42.780294 2026] [security2:error] [pid 930223:tid 930472] [client 185.92.25.81:42853] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.eja.xsa.mybluehost.me"] [uri "/file.php"] [unique_id "alxi4mpwVNghF8G0ENOuUwAAAX8"]
[Sat Jul 18 23:38:42.832369 2026] [security2:error] [pid 930223:tid 930230] [remote 154.0.166.254:53774] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 254.166.0.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "uninursity.com"] [uri "/wp-login.php"] [unique_id "alxi4mpwVNghF8G0ENOuWAABhwQ"], referer: https://uninursity.com/wp-login.php
[Sat Jul 18 23:38:42.840477 2026] [security2:error] [pid 930223:tid 930418] [client 173.239.196.166:28399] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/fonts/database.php"] [unique_id "alxi4mpwVNghF8G0ENOuWwAAAUk"]
[Sat Jul 18 23:38:43.552646 2026] [security2:error] [pid 930223:tid 930406] [client 163.61.1.17:61938] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxi42pwVNghF8G0ENOulwAAAT0"]
[Sat Jul 18 23:38:43.556193 2026] [security2:error] [pid 930223:tid 930406] [client 163.61.1.17:61938] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxi42pwVNghF8G0ENOulwAAAT0"]
[Sat Jul 18 23:38:43.620183 2026] [security2:error] [pid 930223:tid 930372] [client 91.230.225.150:59501] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/flower.php"] [unique_id "alxi42pwVNghF8G0ENOumwAAARs"]
[Sat Jul 18 23:38:43.691958 2026] [security2:error] [pid 930223:tid 930452] [client 173.239.196.164:33421] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/ff2.php"] [unique_id "alxi42pwVNghF8G0ENOuqQAAAWs"]
[Sat Jul 18 23:38:43.902702 2026] [security2:error] [pid 930223:tid 930297] [remote 97.74.93.24:57200] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.talknutritionwithlesley.com"] [uri "/wp-login.php"] [unique_id "alxi42pwVNghF8G0ENOuuQABcUc"]
[Sat Jul 18 23:38:43.951133 2026] [security2:error] [pid 930223:tid 930474] [client 185.192.71.216:34527] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/flower.php"] [unique_id "alxi42pwVNghF8G0ENOuvgAAAYE"]
[Sat Jul 18 23:38:43.951577 2026] [security2:error] [pid 930223:tid 930395] [client 185.192.71.216:22011] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.eja.xsa.mybluehost.me"] [uri "/flower.php"] [unique_id "alxi42pwVNghF8G0ENOuvwAAATI"]
[Sat Jul 18 23:38:43.965786 2026] [security2:error] [pid 930223:tid 930465] [client 185.92.25.92:56279] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/flower.php"] [unique_id "alxi42pwVNghF8G0ENOuwgAAAXg"]
[Sat Jul 18 23:38:43.967914 2026] [security2:error] [pid 930223:tid 930427] [client 185.192.71.219:20623] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/flower.php"] [unique_id "alxi42pwVNghF8G0ENOuwwAAAVI"]
[Sat Jul 18 23:38:43.970003 2026] [security2:error] [pid 930223:tid 930400] [client 185.192.71.208:37513] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/flower.php"] [unique_id "alxi42pwVNghF8G0ENOuxAAAATc"]
[Sat Jul 18 23:38:43.972555 2026] [security2:error] [pid 930223:tid 930480] [client 185.192.71.222:57005] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/flower.php"] [unique_id "alxi42pwVNghF8G0ENOuxgAAAYc"]
[Sat Jul 18 23:38:43.973059 2026] [security2:error] [pid 930223:tid 930467] [client 185.192.71.215:24193] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/gifclass.php"] [unique_id "alxi42pwVNghF8G0ENOuxwAAAXo"]
[Sat Jul 18 23:38:44.148308 2026] [security2:error] [pid 930223:tid 930370] [client 4.194.24.143:14293] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/num.php"] [unique_id "alxi5GpwVNghF8G0ENOu1gAAARk"]
[Sat Jul 18 23:38:44.315135 2026] [security2:error] [pid 930223:tid 930246] [remote 97.74.93.24:57200] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.talknutritionwithlesley.com"] [uri "/wp-login.php"] [unique_id "alxi5GpwVNghF8G0ENOu3AABLxQ"], referer: https://mail.talknutritionwithlesley.com/wp-login.php
[Sat Jul 18 23:38:44.541233 2026] [security2:error] [pid 930223:tid 930441] [client 173.239.196.167:65357] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "alxi5GpwVNghF8G0ENOu8gAAAWA"]
[Sat Jul 18 23:38:44.574307 2026] [security2:error] [pid 930223:tid 930480] [client 54.211.205.212:41886] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 212.205.211.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxi5GpwVNghF8G0ENOu9AAAAYc"], referer: https://curlsnpearlsss.com/es/category/food/dinners/
[Sat Jul 18 23:38:44.748542 2026] [security2:error] [pid 930223:tid 930407] [client 185.192.71.208:22881] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/gifclass.php"] [unique_id "alxi5GpwVNghF8G0ENOu_QAAAT4"]
[Sat Jul 18 23:38:44.942343 2026] [security2:error] [pid 930223:tid 930355] [client 185.92.25.135:33185] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/bless.php"] [unique_id "alxi5GpwVNghF8G0ENOvCQAAAQo"]
[Sat Jul 18 23:38:44.942437 2026] [security2:error] [pid 930223:tid 930365] [client 185.192.71.218:53157] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/gifclass.php"] [unique_id "alxi5GpwVNghF8G0ENOvCAAAARQ"]
[Sat Jul 18 23:38:44.942657 2026] [security2:error] [pid 930223:tid 930421] [client 223.228.182.224:34397] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxi5GpwVNghF8G0ENOvCgAAAUw"]
[Sat Jul 18 23:38:44.947361 2026] [security2:error] [pid 930223:tid 930421] [client 223.228.182.224:34397] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxi5GpwVNghF8G0ENOvCgAAAUw"]
[Sat Jul 18 23:38:44.958319 2026] [security2:error] [pid 930223:tid 930374] [client 185.192.71.208:23035] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/gifclass.php"] [unique_id "alxi5GpwVNghF8G0ENOvCwAAAR0"]
[Sat Jul 18 23:38:44.964870 2026] [security2:error] [pid 930223:tid 930473] [client 91.230.225.152:60975] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/gifclass.php"] [unique_id "alxi5GpwVNghF8G0ENOvDQAAAYA"]
[Sat Jul 18 23:38:44.973384 2026] [security2:error] [pid 930223:tid 930405] [client 185.192.71.216:47887] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.eja.xsa.mybluehost.me"] [uri "/gifclass.php"] [unique_id "alxi5GpwVNghF8G0ENOvDgAAATw"]
[Sat Jul 18 23:38:44.976943 2026] [security2:error] [pid 930223:tid 930430] [client 185.92.25.92:45595] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/gifclass.php"] [unique_id "alxi5GpwVNghF8G0ENOvDwAAAVU"]
[Sat Jul 18 23:38:44.983239 2026] [security2:error] [pid 930223:tid 930443] [client 91.230.225.153:57461] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/gifclass.php"] [unique_id "alxi5GpwVNghF8G0ENOvEgAAAWI"]
[Sat Jul 18 23:38:45.213936 2026] [security2:error] [pid 930223:tid 930431] [client 4.194.24.143:14280] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/odf7udtspqtpxzyxmw2rccdefault.php"] [unique_id "alxi5WpwVNghF8G0ENOvJgAAAVY"]
[Sat Jul 18 23:38:45.416379 2026] [security2:error] [pid 930223:tid 930361] [client 173.239.196.167:27659] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/plugin.php"] [unique_id "alxi5WpwVNghF8G0ENOvMwAAARA"]
[Sat Jul 18 23:38:45.740427 2026] [security2:error] [pid 930223:tid 930459] [client 139.167.225.146:62032] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxi5WpwVNghF8G0ENOvSgAAAXI"]
[Sat Jul 18 23:38:45.740525 2026] [security2:error] [pid 930223:tid 930459] [client 139.167.225.146:62032] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxi5WpwVNghF8G0ENOvSgAAAXI"]
[Sat Jul 18 23:38:45.788082 2026] [security2:error] [pid 930223:tid 930422] [client 185.192.71.218:32675] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/bless.php"] [unique_id "alxi5WpwVNghF8G0ENOvUAAAAU0"]
[Sat Jul 18 23:38:45.788371 2026] [security2:error] [pid 930223:tid 930397] [client 185.92.25.93:65491] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/bless.php"] [unique_id "alxi5WpwVNghF8G0ENOvUQAAATQ"]
[Sat Jul 18 23:38:45.789206 2026] [security2:error] [pid 930223:tid 930428] [client 185.92.25.88:36681] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/bless.php"] [unique_id "alxi5WpwVNghF8G0ENOvUgAAAVM"]
[Sat Jul 18 23:38:45.790497 2026] [security2:error] [pid 930223:tid 930380] [client 91.230.225.159:63043] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/class-t.api.php"] [unique_id "alxi5WpwVNghF8G0ENOvUwAAASM"]
[Sat Jul 18 23:38:45.793024 2026] [security2:error] [pid 930223:tid 930477] [client 185.92.25.93:53187] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/bless.php"] [unique_id "alxi5WpwVNghF8G0ENOvVAAAAYQ"]
[Sat Jul 18 23:38:45.972531 2026] [security2:error] [pid 930223:tid 930398] [client 185.92.25.81:46027] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/bless.php"] [unique_id "alxi5WpwVNghF8G0ENOvZwAAATU"]
[Sat Jul 18 23:38:46.241477 2026] [security2:error] [pid 930223:tid 930466] [client 4.194.24.143:24461] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/option.php"] [unique_id "alxi5mpwVNghF8G0ENOvfQAAAXk"]
[Sat Jul 18 23:38:46.299077 2026] [security2:error] [pid 930223:tid 930374] [client 173.239.196.162:64587] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "alxi5mpwVNghF8G0ENOvfgAAAR0"]
[Sat Jul 18 23:38:46.354416 2026] [security2:error] [pid 930223:tid 930418] [client 106.222.249.209:9116] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxi5mpwVNghF8G0ENOvgAAAAUk"]
[Sat Jul 18 23:38:46.354605 2026] [security2:error] [pid 930223:tid 930418] [client 106.222.249.209:9116] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxi5mpwVNghF8G0ENOvgAAAAUk"]
[Sat Jul 18 23:38:46.743863 2026] [security2:error] [pid 930223:tid 930474] [client 185.192.71.208:51351] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/class-t.api.php"] [unique_id "alxi5mpwVNghF8G0ENOvmwAAAYE"]
[Sat Jul 18 23:38:46.750557 2026] [security2:error] [pid 930223:tid 930416] [client 185.92.25.84:42841] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/class-t.api.php"] [unique_id "alxi5mpwVNghF8G0ENOvnAAAAUc"]
[Sat Jul 18 23:38:46.752654 2026] [security2:error] [pid 930223:tid 930472] [client 91.230.225.153:56637] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/class-t.api.php"] [unique_id "alxi5mpwVNghF8G0ENOvnQAAAX8"]
[Sat Jul 18 23:38:46.835335 2026] [security2:error] [pid 930223:tid 930379] [client 185.92.25.85:62167] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/class-t.api.php"] [unique_id "alxi5mpwVNghF8G0ENOvpwAAASI"]
[Sat Jul 18 23:38:46.886645 2026] [security2:error] [pid 930223:tid 930407] [client 185.192.71.212:37847] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/bless.php"] [unique_id "alxi5mpwVNghF8G0ENOvqgAAAT4"]
[Sat Jul 18 23:38:46.894212 2026] [security2:error] [pid 930223:tid 930382] [client 91.230.225.152:63413] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.eja.xsa.mybluehost.me"] [uri "/bless.php"] [unique_id "alxi5mpwVNghF8G0ENOvqwAAASU"]
[Sat Jul 18 23:38:47.111606 2026] [security2:error] [pid 930223:tid 930362] [client 185.92.25.135:48921] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/blurbs.php"] [unique_id "alxi52pwVNghF8G0ENOvvQAAARE"]
[Sat Jul 18 23:38:47.115030 2026] [security2:error] [pid 930223:tid 930387] [client 185.92.25.93:62945] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/blurbs.php"] [unique_id "alxi52pwVNghF8G0ENOvvgAAASo"]
[Sat Jul 18 23:38:47.199188 2026] [security2:error] [pid 930223:tid 930422] [client 173.239.196.167:60439] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/jp.php"] [unique_id "alxi52pwVNghF8G0ENOvxQAAAU0"]
[Sat Jul 18 23:38:47.232004 2026] [security2:error] [pid 930223:tid 930441] [client 185.192.71.212:24155] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/blurbs.php"] [unique_id "alxi52pwVNghF8G0ENOvyAAAAWA"]
[Sat Jul 18 23:38:47.322171 2026] [security2:error] [pid 930223:tid 930402] [client 4.194.24.143:40789] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/p.php"] [unique_id "alxi52pwVNghF8G0ENOv0AAAATk"]
[Sat Jul 18 23:38:47.547678 2026] [security2:error] [pid 930223:tid 930467] [client 185.92.25.83:64007] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/akcc.php"] [unique_id "alxi52pwVNghF8G0ENOv3gAAAXo"]
[Sat Jul 18 23:38:47.629835 2026] [security2:error] [pid 930223:tid 930407] [client 185.192.71.211:25509] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/blurbs.php"] [unique_id "alxi52pwVNghF8G0ENOv5wAAAT4"]
[Sat Jul 18 23:38:47.652035 2026] [security2:error] [pid 930223:tid 930434] [client 185.192.71.207:28595] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/blurbs.php"] [unique_id "alxi52pwVNghF8G0ENOv6QAAAVk"]
[Sat Jul 18 23:38:47.752994 2026] [security2:error] [pid 930223:tid 930440] [client 185.92.25.87:24193] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/akcc.php"] [unique_id "alxi52pwVNghF8G0ENOv7wAAAV8"]
[Sat Jul 18 23:38:47.769537 2026] [security2:error] [pid 930223:tid 930401] [client 185.92.25.91:56503] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/akcc.php"] [unique_id "alxi52pwVNghF8G0ENOv8QAAATg"]
[Sat Jul 18 23:38:47.774527 2026] [security2:error] [pid 930223:tid 930418] [client 185.92.25.86:24383] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/class-t.api.php"] [unique_id "alxi52pwVNghF8G0ENOv8gAAAUk"]
[Sat Jul 18 23:38:47.813886 2026] [security2:error] [pid 930223:tid 930479] [client 185.92.25.86:52891] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/class-t.api.php"] [unique_id "alxi52pwVNghF8G0ENOv8wAAAYY"]
[Sat Jul 18 23:38:47.842711 2026] [security2:error] [pid 930223:tid 930432] [client 91.230.225.157:61875] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.eja.xsa.mybluehost.me"] [uri "/class-t.api.php"] [unique_id "alxi52pwVNghF8G0ENOv9wAAAVc"]
[Sat Jul 18 23:38:48.066469 2026] [security2:error] [pid 930223:tid 930360] [client 173.239.196.163:44327] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-atom.php"] [unique_id "alxi6GpwVNghF8G0ENOwAgAAAQ8"]
[Sat Jul 18 23:38:48.073274 2026] [security2:error] [pid 930223:tid 930357] [client 4.194.24.143:55693] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/past.php"] [unique_id "alxi6GpwVNghF8G0ENOwAwAAAQw"]
[Sat Jul 18 23:38:48.162164 2026] [security2:error] [pid 930223:tid 930411] [client 180.252.198.240:62790] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxi6GpwVNghF8G0ENOwBQAAAUI"]
[Sat Jul 18 23:38:48.162263 2026] [security2:error] [pid 930223:tid 930411] [client 180.252.198.240:62790] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxi6GpwVNghF8G0ENOwBQAAAUI"]
[Sat Jul 18 23:38:48.171036 2026] [security2:error] [pid 930223:tid 930464] [client 185.192.71.217:31643] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/akcc.php"] [unique_id "alxi6GpwVNghF8G0ENOwBwAAAXc"]
[Sat Jul 18 23:38:48.321010 2026] [security2:error] [pid 930223:tid 930378] [client 185.192.71.209:34891] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/abcd.php"] [unique_id "alxi6GpwVNghF8G0ENOwEAAAASE"]
[Sat Jul 18 23:38:48.500516 2026] [security2:error] [pid 930223:tid 930382] [client 91.230.225.156:53143] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/akcc.php"] [unique_id "alxi6GpwVNghF8G0ENOwFwAAASU"]
[Sat Jul 18 23:38:48.634538 2026] [security2:error] [pid 930223:tid 930406] [client 98.82.181.200:37512] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 200.181.82.98.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxi6GpwVNghF8G0ENOwIwAAAT0"], referer: https://curlsnpearlsss.com/es/category/food/dinners/page/2/
[Sat Jul 18 23:38:48.655019 2026] [security2:error] [pid 930223:tid 930456] [client 185.192.71.218:38817] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/abcd.php"] [unique_id "alxi6GpwVNghF8G0ENOwJQAAAW8"]
[Sat Jul 18 23:38:48.655542 2026] [security2:error] [pid 930223:tid 930430] [client 185.92.25.85:58247] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/abcd.php"] [unique_id "alxi6GpwVNghF8G0ENOwJgAAAVU"]
[Sat Jul 18 23:38:48.677357 2026] [security2:error] [pid 930223:tid 930432] [client 91.230.225.156:46703] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/blurbs.php"] [unique_id "alxi6GpwVNghF8G0ENOwKgAAAVc"]
[Sat Jul 18 23:38:48.713380 2026] [security2:error] [pid 930223:tid 930369] [client 185.192.71.225:43463] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.eja.xsa.mybluehost.me"] [uri "/blurbs.php"] [unique_id "alxi6GpwVNghF8G0ENOwLgAAARg"]
[Sat Jul 18 23:38:48.770224 2026] [security2:error] [pid 930223:tid 930445] [client 4.194.24.143:50305] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/php.php"] [unique_id "alxi6GpwVNghF8G0ENOwNQAAAWQ"]
[Sat Jul 18 23:38:48.930972 2026] [security2:error] [pid 930223:tid 930442] [client 173.239.196.166:57983] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/index.php"] [unique_id "alxi6GpwVNghF8G0ENOwPwAAAWE"]
[Sat Jul 18 23:38:49.008189 2026] [security2:error] [pid 930223:tid 930462] [client 91.230.225.155:30027] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/abcd.php"] [unique_id "alxi6WpwVNghF8G0ENOwQQAAAXU"]
[Sat Jul 18 23:38:49.134938 2026] [security2:error] [pid 930223:tid 930463] [client 185.192.71.215:54557] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/shelp.php"] [unique_id "alxi6WpwVNghF8G0ENOwSwAAAXY"]
[Sat Jul 18 23:38:49.276044 2026] [security2:error] [pid 930223:tid 930397] [client 185.92.25.89:34641] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/abcd.php"] [unique_id "alxi6WpwVNghF8G0ENOwVgAAATQ"]
[Sat Jul 18 23:38:49.488013 2026] [security2:error] [pid 930223:tid 930430] [client 185.192.71.216:49623] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/shelp.php"] [unique_id "alxi6WpwVNghF8G0ENOwYgAAAVU"]
[Sat Jul 18 23:38:49.508492 2026] [security2:error] [pid 930223:tid 930478] [client 91.230.225.155:39533] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/shelp.php"] [unique_id "alxi6WpwVNghF8G0ENOwZAAAAYU"]
[Sat Jul 18 23:38:49.572486 2026] [security2:error] [pid 930223:tid 930364] [client 4.194.24.143:50339] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/php8.php"] [unique_id "alxi6WpwVNghF8G0ENOwcAAAARM"]
[Sat Jul 18 23:38:49.577412 2026] [security2:error] [pid 930223:tid 930358] [client 185.92.25.135:27813] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/shelp.php"] [unique_id "alxi6WpwVNghF8G0ENOwcwAAAQ0"]
[Sat Jul 18 23:38:49.675339 2026] [security2:error] [pid 930223:tid 930442] [client 185.92.25.83:32273] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/akcc.php"] [unique_id "alxi6WpwVNghF8G0ENOwdgAAAWE"]
[Sat Jul 18 23:38:49.747213 2026] [security2:error] [pid 930223:tid 930439] [client 91.230.225.157:53033] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/blurbs.php"] [unique_id "alxi6WpwVNghF8G0ENOweAAAAV4"]
[Sat Jul 18 23:38:49.767600 2026] [security2:error] [pid 930223:tid 930392] [client 185.192.71.207:64513] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/cord.php"] [unique_id "alxi6WpwVNghF8G0ENOwewAAAS8"]
[Sat Jul 18 23:38:49.810335 2026] [security2:error] [pid 930223:tid 930428] [client 173.239.196.164:33545] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/up.php"] [unique_id "alxi6WpwVNghF8G0ENOwggAAAVM"]
[Sat Jul 18 23:38:49.905321 2026] [security2:error] [pid 930223:tid 930375] [client 185.192.71.217:64395] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/shelp.php"] [unique_id "alxi6WpwVNghF8G0ENOwjAAAAR4"]
[Sat Jul 18 23:38:50.026773 2026] [security2:error] [pid 930223:tid 930420] [client 185.192.71.222:46485] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/cord.php"] [unique_id "alxi6mpwVNghF8G0ENOwkwAAAUs"]
[Sat Jul 18 23:38:50.061185 2026] [security2:error] [pid 930223:tid 930448] [client 91.230.225.153:37711] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/akcc.php"] [unique_id "alxi6mpwVNghF8G0ENOwlwAAAWc"]
[Sat Jul 18 23:38:50.162264 2026] [proxy:error] [pid 930223:tid 930430] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:38:50.162328 2026] [proxy_http:error] [pid 930223:tid 930430] [client 193.47.62.168:43716] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:38:50.162732 2026] [proxy:error] [pid 930223:tid 930430] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:38:50.162772 2026] [proxy_http:error] [pid 930223:tid 930430] [client 193.47.62.168:43716] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:38:50.171226 2026] [security2:error] [pid 930223:tid 930478] [client 185.92.25.92:27225] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/abcd.php"] [unique_id "alxi6mpwVNghF8G0ENOwnQAAAYU"]
[Sat Jul 18 23:38:50.171570 2026] [security2:error] [pid 930223:tid 930422] [client 185.192.71.223:49361] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/cord.php"] [unique_id "alxi6mpwVNghF8G0ENOwngAAAU0"]
[Sat Jul 18 23:38:50.225641 2026] [security2:error] [pid 930223:tid 930372] [client 185.192.71.214:41515] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/cord.php"] [unique_id "alxi6mpwVNghF8G0ENOwpAAAARs"]
[Sat Jul 18 23:38:50.314524 2026] [security2:error] [pid 930223:tid 930472] [client 4.194.24.143:46718] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/phpinfo.php"] [unique_id "alxi6mpwVNghF8G0ENOwqAAAAX8"]
[Sat Jul 18 23:38:50.464943 2026] [security2:error] [pid 930223:tid 930463] [client 185.92.25.135:32619] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/dex.php"] [unique_id "alxi6mpwVNghF8G0ENOwtQAAAXY"]
[Sat Jul 18 23:38:50.684445 2026] [security2:error] [pid 930223:tid 930438] [client 173.239.196.166:55761] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/uploads/bypass.php"] [unique_id "alxi6mpwVNghF8G0ENOwwgAAAV0"]
[Sat Jul 18 23:38:50.688800 2026] [security2:error] [pid 930223:tid 930465] [client 185.192.71.221:22483] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/dex.php"] [unique_id "alxi6mpwVNghF8G0ENOwwwAAAXg"]
[Sat Jul 18 23:38:50.753634 2026] [security2:error] [pid 930223:tid 930435] [client 185.92.25.89:56793] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/dex.php"] [unique_id "alxi6mpwVNghF8G0ENOwxwAAAVo"]
[Sat Jul 18 23:38:50.813782 2026] [security2:error] [pid 930223:tid 930471] [client 185.92.25.86:35017] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/shelp.php"] [unique_id "alxi6mpwVNghF8G0ENOwzQAAAX4"]
[Sat Jul 18 23:38:50.813917 2026] [security2:error] [pid 930223:tid 930453] [client 91.230.225.163:28369] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/dex.php"] [unique_id "alxi6mpwVNghF8G0ENOwzgAAAWw"]
[Sat Jul 18 23:38:50.979066 2026] [security2:error] [pid 930223:tid 930472] [client 91.230.225.164:36143] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/abcd.php"] [unique_id "alxi6mpwVNghF8G0ENOw4AAAAX8"]
[Sat Jul 18 23:38:51.137798 2026] [security2:error] [pid 930223:tid 930400] [client 185.192.71.215:29597] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxi62pwVNghF8G0ENOw7AAAATc"]
[Sat Jul 18 23:38:51.278204 2026] [security2:error] [pid 930223:tid 930382] [client 91.230.225.164:47889] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/cord.php"] [unique_id "alxi62pwVNghF8G0ENOw9AAAASU"]
[Sat Jul 18 23:38:51.374624 2026] [security2:error] [pid 930223:tid 930250] [remote 20.153.140.50:49776] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ouw.egd.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxi62pwVNghF8G0ENOxAQABTBg"]
[Sat Jul 18 23:38:51.374839 2026] [security2:error] [pid 930223:tid 930421] [client 20.153.140.50:49776] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ouw.egd.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxi62pwVNghF8G0ENOxAQABTBg"]
[Sat Jul 18 23:38:51.478478 2026] [security2:error] [pid 930223:tid 930306] [remote 41.76.213.235:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "innovativecleaningsvs.com"] [uri "/xmlrpc.php"] [unique_id "alxi62pwVNghF8G0ENOxCwABKlA"]
[Sat Jul 18 23:38:51.478678 2026] [security2:error] [pid 930223:tid 930387] [client 41.76.213.235:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "innovativecleaningsvs.com"] [uri "/xmlrpc.php"] [unique_id "alxi62pwVNghF8G0ENOxCwABKlA"]
[Sat Jul 18 23:38:51.492270 2026] [security2:error] [pid 930223:tid 930447] [client 185.192.71.209:63515] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxi62pwVNghF8G0ENOxDQAAAWY"]
[Sat Jul 18 23:38:51.544953 2026] [security2:error] [pid 930223:tid 930385] [client 173.239.196.164:64381] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/assets/images/admin.php"] [unique_id "alxi62pwVNghF8G0ENOxDwAAASg"]
[Sat Jul 18 23:38:51.571811 2026] [security2:error] [pid 930223:tid 930309] [remote 31.42.184.154:34430] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "gregoryanicholas.com"] [uri "/wp-login.php"] [unique_id "alxi62pwVNghF8G0ENOxEQABDlM"]
[Sat Jul 18 23:38:51.579590 2026] [security2:error] [pid 930223:tid 930446] [client 185.192.71.209:37789] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/shelp.php"] [unique_id "alxi62pwVNghF8G0ENOxFQAAAWU"]
[Sat Jul 18 23:38:51.611231 2026] [security2:error] [pid 930223:tid 930448] [client 4.194.24.143:55706] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "royalart-lb.com"] [uri "/index.php"] [unique_id "alxi6mpwVNghF8G0ENOw3wAAAWc"]
[Sat Jul 18 23:38:51.617000 2026] [security2:error] [pid 930223:tid 930389] [client 185.192.71.207:28789] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxi62pwVNghF8G0ENOxHAAAASw"]
[Sat Jul 18 23:38:51.643441 2026] [security2:error] [pid 930223:tid 930365] [client 91.230.225.155:22607] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/cord.php"] [unique_id "alxi62pwVNghF8G0ENOxHQAAARQ"]
[Sat Jul 18 23:38:51.664115 2026] [security2:error] [pid 930223:tid 930400] [client 185.92.25.87:25873] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxi62pwVNghF8G0ENOxHgAAATc"]
[Sat Jul 18 23:38:51.743119 2026] [security2:error] [pid 930223:tid 930475] [client 91.230.225.159:47985] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/zwso.php"] [unique_id "alxi62pwVNghF8G0ENOxJQAAAYI"]
[Sat Jul 18 23:38:51.783320 2026] [security2:error] [pid 930223:tid 930361] [client 91.230.225.158:40795] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/zwso.php"] [unique_id "alxi62pwVNghF8G0ENOxKQAAARA"]
[Sat Jul 18 23:38:51.799900 2026] [security2:error] [pid 930223:tid 930267] [remote 31.42.184.154:34430] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "gregoryanicholas.com"] [uri "/wp-login.php"] [unique_id "alxi62pwVNghF8G0ENOxKgABCik"], referer: https://gregoryanicholas.com/wp-login.php
[Sat Jul 18 23:38:51.814103 2026] [security2:error] [pid 930223:tid 930462] [client 91.230.225.163:30963] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/dex.php"] [unique_id "alxi62pwVNghF8G0ENOxLgAAAXU"]
[Sat Jul 18 23:38:51.995259 2026] [security2:error] [pid 930223:tid 930456] [client 113.160.97.242:62623] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "wpad"] [uri "/wpad.dat"] [unique_id "alxi62pwVNghF8G0ENOxPQAAAW8"]
[Sat Jul 18 23:38:51.996054 2026] [security2:error] [pid 930223:tid 930432] [client 113.160.97.242:62621] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "wpad"] [uri "/wpad.dat"] [unique_id "alxi62pwVNghF8G0ENOxPgAAAVc"]
[Sat Jul 18 23:38:52.005522 2026] [security2:error] [pid 930223:tid 930440] [client 113.160.97.242:62622] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "wpad"] [uri "/wpad.dat"] [unique_id "alxi7GpwVNghF8G0ENOxPwAAAV8"]
[Sat Jul 18 23:38:52.129247 2026] [security2:error] [pid 930223:tid 930416] [client 185.192.71.208:38471] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/cord.php"] [unique_id "alxi7GpwVNghF8G0ENOxRQAAAUc"]
[Sat Jul 18 23:38:52.142018 2026] [security2:error] [pid 930223:tid 930420] [client 4.194.24.143:55706] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/post.php"] [unique_id "alxi7GpwVNghF8G0ENOxRwAAAUs"]
[Sat Jul 18 23:38:52.178837 2026] [security2:error] [pid 930223:tid 930363] [client 185.192.71.224:58943] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/zwso.php"] [unique_id "alxi7GpwVNghF8G0ENOxSQAAARI"]
[Sat Jul 18 23:38:52.249633 2026] [security2:error] [pid 930223:tid 930455] [client 91.230.225.161:34453] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxi7GpwVNghF8G0ENOxUQAAAW4"]
[Sat Jul 18 23:38:52.263543 2026] [security2:error] [pid 930223:tid 930478] [client 185.92.25.89:64657] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/dex.php"] [unique_id "alxi7GpwVNghF8G0ENOxUgAAAYU"]
[Sat Jul 18 23:38:52.286136 2026] [security2:error] [pid 930223:tid 930429] [client 91.230.225.163:22025] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/zwso.php"] [unique_id "alxi7GpwVNghF8G0ENOxUwAAAVQ"]
[Sat Jul 18 23:38:52.304360 2026] [security2:error] [pid 930223:tid 930458] [client 91.230.225.157:63453] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxi7GpwVNghF8G0ENOxVAAAAXE"]
[Sat Jul 18 23:38:52.392340 2026] [security2:error] [pid 930223:tid 930375] [client 173.239.196.162:39743] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/index.php"] [unique_id "alxi7GpwVNghF8G0ENOxWQAAAR4"]
[Sat Jul 18 23:38:52.466306 2026] [security2:error] [pid 930223:tid 930255] [remote 45.148.121.173:54922] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 173.121.148.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thegoulashconcept.org"] [uri "/wp-login.php"] [unique_id "alxi7GpwVNghF8G0ENOxXwABEx0"]
[Sat Jul 18 23:38:52.522249 2026] [security2:error] [pid 930223:tid 930469] [client 185.192.71.209:29781] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxi7GpwVNghF8G0ENOxYgAAAXw"]
[Sat Jul 18 23:38:52.592040 2026] [security2:error] [pid 930223:tid 930376] [client 185.92.25.88:61549] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/dex.php"] [unique_id "alxi7GpwVNghF8G0ENOxagAAAR8"]
[Sat Jul 18 23:38:52.640151 2026] [security2:error] [pid 930223:tid 930310] [remote 45.148.121.173:54922] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 173.121.148.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thegoulashconcept.org"] [uri "/wp-login.php"] [unique_id "alxi7GpwVNghF8G0ENOxbgABIlQ"], referer: https://thegoulashconcept.org/wp-login.php
[Sat Jul 18 23:38:52.651260 2026] [security2:error] [pid 930223:tid 930378] [client 91.230.225.157:21661] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxi7GpwVNghF8G0ENOxbwAAASE"]
[Sat Jul 18 23:38:52.668368 2026] [security2:error] [pid 930223:tid 930456] [client 185.192.71.211:28915] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxi7GpwVNghF8G0ENOxcQAAAW8"]
[Sat Jul 18 23:38:52.723242 2026] [security2:error] [pid 930223:tid 930381] [client 185.92.25.88:58079] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/bolt.php"] [unique_id "alxi7GpwVNghF8G0ENOxeQAAASQ"]
[Sat Jul 18 23:38:52.744615 2026] [security2:error] [pid 930223:tid 930371] [client 185.92.25.89:26103] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/bolt.php"] [unique_id "alxi7GpwVNghF8G0ENOxewAAARo"]
[Sat Jul 18 23:38:52.767565 2026] [security2:error] [pid 930223:tid 930420] [client 52.187.75.220:1154] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "msoid.quangminhltd.vn"] [uri "/index.cgi"] [unique_id "alxi7GpwVNghF8G0ENOxfAAAAUs"]
[Sat Jul 18 23:38:52.940178 2026] [security2:error] [pid 930223:tid 930463] [client 185.192.71.214:53325] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/zwso.php"] [unique_id "alxi7GpwVNghF8G0ENOxhQAAAXY"]
[Sat Jul 18 23:38:52.949183 2026] [security2:error] [pid 930223:tid 930373] [client 52.187.75.220:1154] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "404"] [hostname "msoid.quangminhltd.vn"] [uri "/404.html"] [unique_id "alxi7GpwVNghF8G0ENOxhwAAARw"]
[Sat Jul 18 23:38:52.997064 2026] [security2:error] [pid 930223:tid 930482] [client 185.92.25.135:57713] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxi7GpwVNghF8G0ENOxjgAAAYk"]
[Sat Jul 18 23:38:53.012001 2026] [security2:error] [pid 930223:tid 930416] [client 4.194.24.143:46669] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/public/assets/design_1/css/parts/course_cards/grid_card_1.min.php"] [unique_id "alxi7WpwVNghF8G0ENOxjwAAAUc"]
[Sat Jul 18 23:38:53.097263 2026] [security2:error] [pid 930223:tid 930451] [client 185.192.71.221:54435] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxi7WpwVNghF8G0ENOxkQAAAWo"]
[Sat Jul 18 23:38:53.229066 2026] [security2:error] [pid 930223:tid 930401] [client 185.92.25.134:53809] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/cjfuns.php"] [unique_id "alxi7WpwVNghF8G0ENOxoQAAATg"]
[Sat Jul 18 23:38:53.251341 2026] [security2:error] [pid 930223:tid 930379] [client 185.192.71.218:47605] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/zwso.php"] [unique_id "alxi7WpwVNghF8G0ENOxpAAAASI"]
[Sat Jul 18 23:38:53.268244 2026] [security2:error] [pid 930223:tid 930438] [client 185.92.25.81:39791] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/bolt.php"] [unique_id "alxi7WpwVNghF8G0ENOxpgAAAV0"]
[Sat Jul 18 23:38:53.282288 2026] [security2:error] [pid 930223:tid 930469] [client 173.239.196.162:50689] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/js/wp-login.php"] [unique_id "alxi7WpwVNghF8G0ENOxnwAAAXw"]
[Sat Jul 18 23:38:53.450250 2026] [security2:error] [pid 930223:tid 930392] [client 91.230.225.157:39103] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/cjfuns.php"] [unique_id "alxi7WpwVNghF8G0ENOxsQAAAS8"]
[Sat Jul 18 23:38:53.510543 2026] [security2:error] [pid 930223:tid 930421] [client 185.92.25.80:42181] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxi7WpwVNghF8G0ENOxuwAAAUw"]
[Sat Jul 18 23:38:53.530253 2026] [security2:error] [pid 930223:tid 930400] [client 91.230.225.163:44647] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/zwso.php"] [unique_id "alxi7WpwVNghF8G0ENOxvgAAATc"]
[Sat Jul 18 23:38:53.767683 2026] [security2:error] [pid 930223:tid 930390] [client 185.192.71.214:46215] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxi7WpwVNghF8G0ENOxxgAAAS0"]
[Sat Jul 18 23:38:53.815947 2026] [security2:error] [pid 930223:tid 930444] [client 185.92.25.81:28521] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/cjfuns.php"] [unique_id "alxi7WpwVNghF8G0ENOxywAAAWM"]
[Sat Jul 18 23:38:53.862130 2026] [security2:error] [pid 930223:tid 930393] [client 185.92.25.84:46667] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/bolt.php"] [unique_id "alxi7WpwVNghF8G0ENOx0gAAATA"]
[Sat Jul 18 23:38:53.899211 2026] [security2:error] [pid 930223:tid 930439] [client 91.230.225.157:45769] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/wp-admin/css/index.php"] [unique_id "alxi7WpwVNghF8G0ENOx1AAAAV4"]
[Sat Jul 18 23:38:53.954381 2026] [security2:error] [pid 930223:tid 930383] [client 4.194.24.143:49418] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/public/css.php"] [unique_id "alxi7WpwVNghF8G0ENOx2AAAASY"]
[Sat Jul 18 23:38:53.990184 2026] [security2:error] [pid 930223:tid 930464] [client 185.192.71.207:64871] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/wp-admin/css/index.php"] [unique_id "alxi7WpwVNghF8G0ENOx3QAAAXc"]
[Sat Jul 18 23:38:54.075484 2026] [security2:error] [pid 930223:tid 930455] [client 163.61.1.17:62425] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxi7mpwVNghF8G0ENOx6AAAAW4"]
[Sat Jul 18 23:38:54.075587 2026] [security2:error] [pid 930223:tid 930455] [client 163.61.1.17:62425] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxi7mpwVNghF8G0ENOx6AAAAW4"]
[Sat Jul 18 23:38:54.149779 2026] [security2:error] [pid 930223:tid 930388] [client 138.252.89.100:62365] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxi7mpwVNghF8G0ENOx6QAAASs"]
[Sat Jul 18 23:38:54.149874 2026] [security2:error] [pid 930223:tid 930388] [client 138.252.89.100:62365] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxi7mpwVNghF8G0ENOx6QAAASs"]
[Sat Jul 18 23:38:54.159461 2026] [security2:error] [pid 930223:tid 930381] [client 173.239.196.165:26735] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/simple/function.php"] [unique_id "alxi7mpwVNghF8G0ENOx7QAAASQ"]
[Sat Jul 18 23:38:54.323206 2026] [security2:error] [pid 930223:tid 930403] [client 185.92.25.134:33805] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/wp-content/plugins/index.php"] [unique_id "alxi7mpwVNghF8G0ENOx8wAAATo"]
[Sat Jul 18 23:38:54.401299 2026] [security2:error] [pid 930223:tid 930470] [client 185.92.25.81:51019] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/bolt.php"] [unique_id "alxi7mpwVNghF8G0ENOx9wAAAX0"]
[Sat Jul 18 23:38:54.416035 2026] [security2:error] [pid 930223:tid 930377] [client 185.92.25.83:51097] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxi7mpwVNghF8G0ENOx-QAAASA"]
[Sat Jul 18 23:38:54.425638 2026] [security2:error] [pid 930223:tid 930363] [client 52.201.135.180:52770] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 180.135.201.52.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxi7mpwVNghF8G0ENOx-wAAARI"], referer: https://curlsnpearlsss.com/es/category/food/dinners/page/3/
[Sat Jul 18 23:38:54.459690 2026] [security2:error] [pid 930223:tid 930413] [client 18.232.92.172:18364] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 172.92.232.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxi7mpwVNghF8G0ENOyAAAAAUQ"], referer: https://curlsnpearlsss.com/es/category/food/dinners/page/3/
[Sat Jul 18 23:38:54.541308 2026] [security2:error] [pid 930223:tid 930375] [client 4.194.24.143:50830] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/r.php"] [unique_id "alxi7mpwVNghF8G0ENOyBAAAAR4"]
[Sat Jul 18 23:38:54.616887 2026] [security2:error] [pid 930223:tid 930249] [remote 31.42.184.154:34440] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxi7mpwVNghF8G0ENOyDAABNhc"]
[Sat Jul 18 23:38:54.617000 2026] [security2:error] [pid 930223:tid 930399] [client 31.42.184.154:34440] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxi7mpwVNghF8G0ENOyDAABNhc"]
[Sat Jul 18 23:38:54.642530 2026] [security2:error] [pid 930223:tid 930454] [client 185.192.71.208:34301] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/bolt.php"] [unique_id "alxi7mpwVNghF8G0ENOyDwAAAW0"]
[Sat Jul 18 23:38:54.655465 2026] [security2:error] [pid 930223:tid 930459] [client 185.192.71.206:30487] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/wp-admin/css/index.php"] [unique_id "alxi7mpwVNghF8G0ENOyEQAAAXI"]
[Sat Jul 18 23:38:54.692510 2026] [security2:error] [pid 930223:tid 930450] [client 91.230.225.152:53673] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/cjfuns.php"] [unique_id "alxi7mpwVNghF8G0ENOyEgAAAWk"]
[Sat Jul 18 23:38:54.709611 2026] [security2:error] [pid 930223:tid 930428] [client 185.192.71.217:44961] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/wp-content/plugins/index.php"] [unique_id "alxi7mpwVNghF8G0ENOyEwAAAVM"]
[Sat Jul 18 23:38:54.782053 2026] [security2:error] [pid 930223:tid 930409] [client 185.192.71.216:20197] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/wp-content/index.php"] [unique_id "alxi7mpwVNghF8G0ENOyFAAAAUA"]
[Sat Jul 18 23:38:54.999622 2026] [security2:error] [pid 930223:tid 930408] [client 185.192.71.213:38491] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/bolt.php"] [unique_id "alxi7mpwVNghF8G0ENOyKgAAAT8"]
[Sat Jul 18 23:38:54.999707 2026] [security2:error] [pid 930223:tid 930373] [client 185.92.25.83:45833] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/cjfuns.php"] [unique_id "alxi7mpwVNghF8G0ENOyKQAAARw"]
[Sat Jul 18 23:38:55.000605 2026] [security2:error] [pid 930223:tid 930470] [client 185.92.25.91:56149] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/wp-admin/css/index.php"] [unique_id "alxi72pwVNghF8G0ENOyKwAAAX0"]
[Sat Jul 18 23:38:55.014686 2026] [security2:error] [pid 930223:tid 930384] [client 31.56.58.122:46122] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.website-9883e81f.vgf.duj.mybluehost.me"] [uri "/.env"] [unique_id "alxi72pwVNghF8G0ENOyLwAAASc"]
[Sat Jul 18 23:38:55.105106 2026] [security2:error] [pid 930223:tid 930424] [client 4.194.24.143:46697] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/radio.php"] [unique_id "alxi72pwVNghF8G0ENOyNQAAAU8"]
[Sat Jul 18 23:38:55.215504 2026] [security2:error] [pid 930223:tid 930430] [client 54.211.205.212:20294] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 212.205.211.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxi72pwVNghF8G0ENOyNgAAAVU"], referer: https://curlsnpearlsss.com/es/category/food/dinners/
[Sat Jul 18 23:38:55.238199 2026] [security2:error] [pid 930223:tid 930422] [client 185.192.71.225:64527] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/cjfuns.php"] [unique_id "alxi72pwVNghF8G0ENOyNwAAAU0"]
[Sat Jul 18 23:38:55.247077 2026] [security2:error] [pid 930223:tid 930375] [client 185.192.71.207:36075] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/wp-content/plugins/index.php"] [unique_id "alxi72pwVNghF8G0ENOyOgAAAR4"]
[Sat Jul 18 23:38:55.286265 2026] [security2:error] [pid 930223:tid 930464] [client 185.92.25.84:30063] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/wp-content/plugins/index.php"] [unique_id "alxi72pwVNghF8G0ENOyPQAAAXc"]
[Sat Jul 18 23:38:55.451013 2026] [security2:error] [pid 930223:tid 930379] [client 173.239.196.163:32909] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/ext.php"] [unique_id "alxi72pwVNghF8G0ENOySAAAASI"]
[Sat Jul 18 23:38:55.484214 2026] [security2:error] [pid 930223:tid 930478] [client 185.192.71.212:46955] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/ioxi-o.php"] [unique_id "alxi72pwVNghF8G0ENOySQAAAYU"]
[Sat Jul 18 23:38:55.607429 2026] [security2:error] [pid 930223:tid 930363] [client 185.92.25.81:28039] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/wp-content/index.php"] [unique_id "alxi72pwVNghF8G0ENOyWwAAARI"]
[Sat Jul 18 23:38:55.612158 2026] [security2:error] [pid 930223:tid 930386] [client 223.228.182.224:52518] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxi72pwVNghF8G0ENOyXwAAASk"]
[Sat Jul 18 23:38:55.612282 2026] [security2:error] [pid 930223:tid 930386] [client 223.228.182.224:52518] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxi72pwVNghF8G0ENOyXwAAASk"]
[Sat Jul 18 23:38:55.630392 2026] [security2:error] [pid 930223:tid 930426] [client 31.56.58.122:46142] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webdisk.msandreaadams.net"] [uri "/___proxy_subdomain_webdisk/.env"] [unique_id "alxi72pwVNghF8G0ENOyYgAAAVE"]
[Sat Jul 18 23:38:55.649161 2026] [security2:error] [pid 930223:tid 930436] [client 4.194.24.143:14025] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/randkeyword.php7"] [unique_id "alxi72pwVNghF8G0ENOyYwAAAVs"]
[Sat Jul 18 23:38:55.674458 2026] [security2:error] [pid 930223:tid 930466] [client 31.56.58.122:46152] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "cpcontacts.msandreaadams.net"] [uri "/___proxy_subdomain_cpcontacts/.env"] [unique_id "alxi72pwVNghF8G0ENOyZQAAAXk"]
[Sat Jul 18 23:38:55.681639 2026] [security2:error] [pid 930223:tid 930479] [client 31.56.58.122:46164] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.msandreaadams.net"] [uri "/___proxy_subdomain_webmail/.env"] [unique_id "alxi72pwVNghF8G0ENOyZwAAAYY"]
[Sat Jul 18 23:38:55.683303 2026] [security2:error] [pid 930223:tid 930403] [client 31.56.58.122:46188] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "cpcalendars.msandreaadams.net"] [uri "/___proxy_subdomain_cpcalendars/.env"] [unique_id "alxi72pwVNghF8G0ENOyaQAAATo"]
[Sat Jul 18 23:38:55.683303 2026] [security2:error] [pid 930223:tid 930383] [client 31.56.58.122:46204] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "blog.danwolfe.us"] [uri "/.env"] [unique_id "alxi72pwVNghF8G0ENOyaAAAASY"]
[Sat Jul 18 23:38:55.689834 2026] [security2:error] [pid 930223:tid 930432] [client 31.56.58.122:46228] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "mail.msandreaadams.net"] [uri "/.env"] [unique_id "alxi72pwVNghF8G0ENOyagAAAVc"]
[Sat Jul 18 23:38:55.690219 2026] [security2:error] [pid 930223:tid 930481] [client 31.56.58.122:46224] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "website-5d571088.vgf.duj.mybluehost.me"] [uri "/.env"] [unique_id "alxi72pwVNghF8G0ENOyawAAAYg"]
[Sat Jul 18 23:38:55.708972 2026] [security2:error] [pid 930223:tid 930250] [remote 98.156.100.191:56784] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 191.100.156.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxi72pwVNghF8G0ENOybQABDhg"]
[Sat Jul 18 23:38:55.730568 2026] [security2:error] [pid 930223:tid 930388] [client 31.56.58.122:46136] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "autodiscover.msandreaadams.net"] [uri "/.env"] [unique_id "alxi72pwVNghF8G0ENOycwAAASs"]
[Sat Jul 18 23:38:55.760081 2026] [security2:error] [pid 930223:tid 930444] [client 31.56.58.122:46180] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "cpanel.msandreaadams.net"] [uri "/___proxy_subdomain_cpanel/.env"] [unique_id "alxi72pwVNghF8G0ENOydwAAAWM"]
[Sat Jul 18 23:38:55.761357 2026] [core:error] [pid 930223:tid 930437] [client 31.56.58.122:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:38:55.761374 2026] [core:error] [pid 930223:tid 930437] [client 31.56.58.122:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:38:55.763462 2026] [core:error] [pid 930223:tid 930451] [client 31.56.58.122:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:38:55.763486 2026] [core:error] [pid 930223:tid 930451] [client 31.56.58.122:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:38:55.769081 2026] [core:error] [pid 930223:tid 930455] [client 31.56.58.122:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:38:55.769097 2026] [core:error] [pid 930223:tid 930455] [client 31.56.58.122:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:38:55.805307 2026] [core:error] [pid 930223:tid 930478] [client 31.56.58.122:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:38:55.805326 2026] [core:error] [pid 930223:tid 930478] [client 31.56.58.122:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:38:55.840692 2026] [core:error] [pid 930223:tid 930427] [client 31.56.58.122:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:38:55.840717 2026] [core:error] [pid 930223:tid 930427] [client 31.56.58.122:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:38:55.845011 2026] [security2:error] [pid 930223:tid 930355] [client 185.92.25.90:53435] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/cjfuns.php"] [unique_id "alxi72pwVNghF8G0ENOykAAAAQo"]
[Sat Jul 18 23:38:55.978332 2026] [security2:error] [pid 930223:tid 930452] [client 31.56.58.122:46274] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.website-5d571088.vgf.duj.mybluehost.me"] [uri "/.env"] [unique_id "alxi72pwVNghF8G0ENOymQAAAWs"]
[Sat Jul 18 23:38:55.986168 2026] [security2:error] [pid 930223:tid 930387] [client 31.56.58.122:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.website-9883e81f.vgf.duj.mybluehost.me"] [uri "/index.php"] [unique_id "alxi72pwVNghF8G0ENOyOwAAASo"]
[Sat Jul 18 23:38:55.986235 2026] [security2:error] [pid 930223:tid 930420] [client 31.56.58.122:46208] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "website-9883e81f.vgf.duj.mybluehost.me"] [uri "/.env"] [unique_id "alxi72pwVNghF8G0ENOymwAAAUs"]
[Sat Jul 18 23:38:56.075110 2026] [security2:error] [pid 930223:tid 930393] [client 185.92.25.81:37625] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/wp-admin/css/index.php"] [unique_id "alxi8GpwVNghF8G0ENOyqgAAATA"]
[Sat Jul 18 23:38:56.086668 2026] [security2:error] [pid 930223:tid 930474] [client 185.92.25.82:46027] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/wp-content/index.php"] [unique_id "alxi8GpwVNghF8G0ENOyrwAAAYE"]
[Sat Jul 18 23:38:56.105597 2026] [security2:error] [pid 930223:tid 930355] [client 185.192.71.206:28755] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/wp-content/index.php"] [unique_id "alxi8GpwVNghF8G0ENOysQAAAQo"]
[Sat Jul 18 23:38:56.132818 2026] [security2:error] [pid 930223:tid 930446] [client 31.56.58.122:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "mail.msandreaadams.net"] [uri "/index.php"] [unique_id "alxi72pwVNghF8G0ENOygQAAAWU"]
[Sat Jul 18 23:38:56.224490 2026] [security2:error] [pid 930223:tid 930436] [client 185.92.25.134:47741] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/wp-admin/css/index.php"] [unique_id "alxi8GpwVNghF8G0ENOyuQAAAVs"]
[Sat Jul 18 23:38:56.224640 2026] [security2:error] [pid 930223:tid 930479] [client 185.92.25.135:33111] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/ioxi-o.php"] [unique_id "alxi8GpwVNghF8G0ENOyuAAAAYY"]
[Sat Jul 18 23:38:56.262329 2026] [security2:error] [pid 930223:tid 930369] [client 31.56.58.122:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "website-5d571088.vgf.duj.mybluehost.me"] [uri "/index.php"] [unique_id "alxi72pwVNghF8G0ENOyjwAAARg"]
[Sat Jul 18 23:38:56.268396 2026] [security2:error] [pid 930223:tid 930272] [remote 98.156.100.191:56784] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 191.100.156.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxi8GpwVNghF8G0ENOyuwABPS4"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:38:56.295650 2026] [security2:error] [pid 930223:tid 930418] [client 4.194.24.143:14075] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/readme.php"] [unique_id "alxi8GpwVNghF8G0ENOywAAAAUk"]
[Sat Jul 18 23:38:56.297892 2026] [security2:error] [pid 930223:tid 930372] [client 31.56.58.122:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "website-9883e81f.vgf.duj.mybluehost.me"] [uri "/index.php"] [unique_id "alxi8GpwVNghF8G0ENOypAAAARs"]
[Sat Jul 18 23:38:56.347114 2026] [security2:error] [pid 930223:tid 930439] [client 173.239.196.162:21427] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/delpaths.php"] [unique_id "alxi8GpwVNghF8G0ENOyxAAAAV4"]
[Sat Jul 18 23:38:56.403325 2026] [security2:error] [pid 930223:tid 930433] [client 31.56.58.122:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "blog.danwolfe.us"] [uri "/index.php"] [unique_id "alxi8GpwVNghF8G0ENOyogAAAVg"]
[Sat Jul 18 23:38:56.427347 2026] [security2:error] [pid 930223:tid 930419] [client 91.230.225.164:39699] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/insc.php"] [unique_id "alxi8GpwVNghF8G0ENOyywAAAUo"]
[Sat Jul 18 23:38:56.427996 2026] [security2:error] [pid 930223:tid 930474] [client 91.230.225.150:49553] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/wp-content/plugins/index.php"] [unique_id "alxi8GpwVNghF8G0ENOyzAAAAYE"]
[Sat Jul 18 23:38:56.463760 2026] [security2:error] [pid 930223:tid 930472] [client 31.56.58.122:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.website-5d571088.vgf.duj.mybluehost.me"] [uri "/index.php"] [unique_id "alxi8GpwVNghF8G0ENOyowAAAX8"]
[Sat Jul 18 23:38:56.564441 2026] [security2:error] [pid 930223:tid 930428] [client 34.73.248.36:36960] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "longevityperformanceclinic.com"] [uri "/"] [unique_id "alxi8GpwVNghF8G0ENOy2AAAAVM"]
[Sat Jul 18 23:38:56.845874 2026] [security2:error] [pid 930223:tid 930420] [client 91.230.225.152:53799] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/wp-admin/css/index.php"] [unique_id "alxi8GpwVNghF8G0ENOy6AAAAUs"]
[Sat Jul 18 23:38:56.988230 2026] [security2:error] [pid 930223:tid 930460] [client 4.194.24.143:49464] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/reze.php"] [unique_id "alxi8GpwVNghF8G0ENOy9AAAAXM"]
[Sat Jul 18 23:38:57.000955 2026] [security2:error] [pid 930223:tid 930426] [client 185.192.71.217:54627] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/ioxi-o.php"] [unique_id "alxi8WpwVNghF8G0ENOy9gAAAVE"]
[Sat Jul 18 23:38:57.040374 2026] [security2:error] [pid 930223:tid 930408] [client 185.92.25.135:20539] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/ioxi-o.php"] [unique_id "alxi8WpwVNghF8G0ENOy-QAAAT8"]
[Sat Jul 18 23:38:57.101034 2026] [security2:error] [pid 930223:tid 930425] [client 103.100.176.212:45539] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "mtredistricting.gov"] [uri "/"] [unique_id "alxi8WpwVNghF8G0ENOy-wAAAVA"]
[Sat Jul 18 23:38:57.104993 2026] [security2:error] [pid 930223:tid 930368] [client 106.222.249.209:9198] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxi8WpwVNghF8G0ENOy_QAAARc"]
[Sat Jul 18 23:38:57.105297 2026] [security2:error] [pid 930223:tid 930368] [client 106.222.249.209:9198] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxi8WpwVNghF8G0ENOy_QAAARc"]
[Sat Jul 18 23:38:57.128148 2026] [security2:error] [pid 930223:tid 930365] [client 185.192.71.221:30251] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/wp-content/plugins/index.php"] [unique_id "alxi8WpwVNghF8G0ENOy_wAAARQ"]
[Sat Jul 18 23:38:57.134083 2026] [security2:error] [pid 930223:tid 930360] [client 91.230.225.157:26709] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/insc.php"] [unique_id "alxi8WpwVNghF8G0ENOzAQAAAQ8"]
[Sat Jul 18 23:38:57.216876 2026] [security2:error] [pid 930223:tid 930442] [client 173.239.196.164:21411] ModSecurity: Warning. Pattern match "/1\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1543"] [id "900921"] [msg "temporary TUW-72162 logging rule"] [hostname "sixpackminer.org"] [uri "/.well-known/pki-validation/1.php"] [unique_id "alxi8WpwVNghF8G0ENOzCAAAAWE"]
[Sat Jul 18 23:38:57.216995 2026] [security2:error] [pid 930223:tid 930442] [client 173.239.196.164:21411] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/pki-validation/1.php"] [unique_id "alxi8WpwVNghF8G0ENOzCAAAAWE"]
[Sat Jul 18 23:38:57.351640 2026] [security2:error] [pid 930223:tid 930444] [client 185.192.71.225:30553] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/classwithtostring.php"] [unique_id "alxi8WpwVNghF8G0ENOzDwAAAWM"]
[Sat Jul 18 23:38:57.356126 2026] [security2:error] [pid 930223:tid 930437] [client 185.92.25.134:29209] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/wp-content/index.php"] [unique_id "alxi8WpwVNghF8G0ENOzEAAAAVw"]
[Sat Jul 18 23:38:57.451925 2026] [security2:error] [pid 930223:tid 930480] [client 18.232.92.172:37846] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 172.92.232.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxi8WpwVNghF8G0ENOzGQAAAYc"], referer: https://curlsnpearlsss.com/es/category/food/dinners/page/3/
[Sat Jul 18 23:38:57.453818 2026] [security2:error] [pid 930223:tid 930468] [client 139.167.225.146:62657] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxi8WpwVNghF8G0ENOzGgAAAXs"]
[Sat Jul 18 23:38:57.454005 2026] [security2:error] [pid 930223:tid 930468] [client 139.167.225.146:62657] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxi8WpwVNghF8G0ENOzGgAAAXs"]
[Sat Jul 18 23:38:57.667026 2026] [security2:error] [pid 930223:tid 930376] [client 4.194.24.143:14077] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/rh.php"] [unique_id "alxi8WpwVNghF8G0ENOzKgAAAR8"]
[Sat Jul 18 23:38:57.705337 2026] [security2:error] [pid 930223:tid 930368] [client 185.192.71.219:64125] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/wp-content/plugins/index.php"] [unique_id "alxi8WpwVNghF8G0ENOzLQAAARc"]
[Sat Jul 18 23:38:57.819261 2026] [security2:error] [pid 930223:tid 930362] [client 91.230.225.150:34819] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/insc.php"] [unique_id "alxi8WpwVNghF8G0ENOzMgAAARE"]
[Sat Jul 18 23:38:57.850669 2026] [security2:error] [pid 930223:tid 930434] [client 185.192.71.222:37607] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/insc.php"] [unique_id "alxi8WpwVNghF8G0ENOzOQAAAVk"]
[Sat Jul 18 23:38:57.989343 2026] [security2:error] [pid 930223:tid 930374] [client 91.230.225.150:39383] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/wp-content/index.php"] [unique_id "alxi8WpwVNghF8G0ENOzQAAAAR0"]
[Sat Jul 18 23:38:57.994463 2026] [security2:error] [pid 930223:tid 930444] [client 185.192.71.225:24335] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/classwithtostring.php"] [unique_id "alxi8WpwVNghF8G0ENOzQQAAAWM"]
[Sat Jul 18 23:38:58.139630 2026] [security2:error] [pid 930223:tid 930418] [client 173.239.196.165:23365] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "alxi8mpwVNghF8G0ENOzSgAAAUk"]
[Sat Jul 18 23:38:58.314344 2026] [security2:error] [pid 930223:tid 930458] [client 185.192.71.210:33901] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/txets.php"] [unique_id "alxi8mpwVNghF8G0ENOzXAAAAXE"]
[Sat Jul 18 23:38:58.314414 2026] [security2:error] [pid 930223:tid 930408] [client 185.192.71.213:47033] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/ioxi-o.php"] [unique_id "alxi8mpwVNghF8G0ENOzWwAAAT8"]
[Sat Jul 18 23:38:58.339511 2026] [security2:error] [pid 930223:tid 930376] [client 91.230.225.161:44619] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/ioxi-o.php"] [unique_id "alxi8mpwVNghF8G0ENOzXgAAAR8"]
[Sat Jul 18 23:38:58.572306 2026] [security2:error] [pid 930223:tid 930420] [client 185.8.106.147:33796] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "cira.org"] [uri "/index.php"] [unique_id "alxi8mpwVNghF8G0ENOzVgABS2U"]
[Sat Jul 18 23:38:58.575145 2026] [security2:error] [pid 930223:tid 930441] [client 185.92.25.84:61445] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/classwithtostring.php"] [unique_id "alxi8mpwVNghF8G0ENOzjQAAAWA"]
[Sat Jul 18 23:38:58.661993 2026] [security2:error] [pid 930223:tid 930438] [client 185.92.25.80:23011] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/txets.php"] [unique_id "alxi8mpwVNghF8G0ENOzlQAAAV0"]
[Sat Jul 18 23:38:58.685413 2026] [security2:error] [pid 930223:tid 930431] [client 185.92.25.93:31807] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/wp-content/index.php"] [unique_id "alxi8mpwVNghF8G0ENOzlwAAAVY"]
[Sat Jul 18 23:38:58.859113 2026] [security2:error] [pid 930223:tid 930404] [client 180.252.198.240:63252] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxi8mpwVNghF8G0ENOzogAAATs"]
[Sat Jul 18 23:38:58.859193 2026] [security2:error] [pid 930223:tid 930404] [client 180.252.198.240:63252] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxi8mpwVNghF8G0ENOzogAAATs"]
[Sat Jul 18 23:38:59.028946 2026] [security2:error] [pid 930223:tid 930407] [client 173.239.196.167:56725] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/pki-validation/install.php"] [unique_id "alxi82pwVNghF8G0ENOzsQAAAT4"]
[Sat Jul 18 23:38:59.149669 2026] [security2:error] [pid 930223:tid 930456] [client 185.192.71.220:21973] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/classwithtostring.php"] [unique_id "alxi82pwVNghF8G0ENOzvQAAAW8"]
[Sat Jul 18 23:38:59.484950 2026] [security2:error] [pid 930223:tid 930377] [client 54.211.205.212:50690] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 212.205.211.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxi82pwVNghF8G0ENOz1gAAASA"], referer: https://curlsnpearlsss.com/es/category/food/dinners/page/2/
[Sat Jul 18 23:38:59.684369 2026] [security2:error] [pid 930223:tid 930374] [client 185.92.25.93:32257] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/wp-content/themes/txets.php"] [unique_id "alxi82pwVNghF8G0ENOz4QAAAR0"]
[Sat Jul 18 23:38:59.690328 2026] [security2:error] [pid 930223:tid 930358] [client 91.230.225.162:26417] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/insc.php"] [unique_id "alxi82pwVNghF8G0ENOz4gAAAQ0"]
[Sat Jul 18 23:38:59.698735 2026] [security2:error] [pid 930223:tid 930415] [client 185.192.71.211:54781] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/insc.php"] [unique_id "alxi82pwVNghF8G0ENOz5AAAAUY"]
[Sat Jul 18 23:39:00.018919 2026] [security2:error] [pid 930223:tid 930455] [client 185.192.71.213:51181] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/txets.php"] [unique_id "alxi9GpwVNghF8G0ENOz_wAAAW4"]
[Sat Jul 18 23:39:00.034387 2026] [security2:error] [pid 930223:tid 930416] [client 185.92.25.134:39289] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/wp-content/themes/txets.php"] [unique_id "alxi9GpwVNghF8G0ENO0AAAAAUc"]
[Sat Jul 18 23:39:00.035569 2026] [security2:error] [pid 930223:tid 930440] [client 185.92.25.81:49711] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/classwithtostring.php"] [unique_id "alxi9GpwVNghF8G0ENO0AQAAAV8"]
[Sat Jul 18 23:39:00.075042 2026] [security2:error] [pid 930223:tid 930408] [client 185.192.71.223:58673] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/ioxi-o.php"] [unique_id "alxi9GpwVNghF8G0ENO0AgAAAT8"]
[Sat Jul 18 23:39:00.427281 2026] [security2:error] [pid 930223:tid 930438] [client 104.210.56.226:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "aleishapenny.ca"] [uri "/index.php"] [unique_id "alxi9GpwVNghF8G0ENO0EQABXVc"]
[Sat Jul 18 23:39:00.579730 2026] [security2:error] [pid 930223:tid 930447] [client 91.230.225.160:43143] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/txets.php"] [unique_id "alxi9GpwVNghF8G0ENO0LgAAAWY"]
[Sat Jul 18 23:39:00.725494 2026] [security2:error] [pid 930223:tid 930360] [client 113.160.97.242:62631] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "wpad"] [uri "/wpad.dat"] [unique_id "alxi9GpwVNghF8G0ENO0NgAAAQ8"]
[Sat Jul 18 23:39:00.804163 2026] [security2:error] [pid 930223:tid 930442] [client 216.73.217.22:4883] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "www.hoomanr.com"] [uri "/index.php"] [unique_id "alxi9GpwVNghF8G0ENO0OgAAAWE"]
[Sat Jul 18 23:39:01.120717 2026] [security2:error] [pid 930223:tid 930438] [client 173.239.196.163:42901] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/sunrise/admin.php"] [unique_id "alxi9WpwVNghF8G0ENO0XQAAAV0"]
[Sat Jul 18 23:39:01.194914 2026] [security2:error] [pid 930223:tid 930373] [client 113.160.97.242:62633] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "wpad"] [uri "/wpad.dat"] [unique_id "alxi9WpwVNghF8G0ENO0YgAAARw"]
[Sat Jul 18 23:39:01.417822 2026] [security2:error] [pid 930223:tid 930427] [client 185.192.71.211:46999] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/classwithtostring.php"] [unique_id "alxi9WpwVNghF8G0ENO0awAAAVI"]
[Sat Jul 18 23:39:01.590121 2026] [security2:error] [pid 930223:tid 930362] [client 113.160.97.242:62634] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "wpad"] [uri "/wpad.dat"] [unique_id "alxi9WpwVNghF8G0ENO0dQAAARE"]
[Sat Jul 18 23:39:01.711261 2026] [security2:error] [pid 930223:tid 930392] [client 185.192.71.215:41863] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/wp-admin/txets.php"] [unique_id "alxi9WpwVNghF8G0ENO0fQAAAS8"]
[Sat Jul 18 23:39:01.878466 2026] [security2:error] [pid 930223:tid 930482] [client 185.92.25.90:29299] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/wp-content/themes/txets.php"] [unique_id "alxi9WpwVNghF8G0ENO0iwAAAYk"]
[Sat Jul 18 23:39:01.937192 2026] [security2:error] [pid 930223:tid 930438] [client 185.192.71.206:30937] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/txets.php"] [unique_id "alxi9WpwVNghF8G0ENO0kwAAAV0"]
[Sat Jul 18 23:39:01.944304 2026] [security2:error] [pid 930223:tid 930450] [client 91.230.225.164:40957] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/wp-admin/txets.php"] [unique_id "alxi9WpwVNghF8G0ENO0lAAAAWk"]
[Sat Jul 18 23:39:01.964959 2026] [security2:error] [pid 930223:tid 930357] [client 173.239.196.165:53145] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/gifclass.php"] [unique_id "alxi9WpwVNghF8G0ENO0lQAAAQw"]
[Sat Jul 18 23:39:02.182184 2026] [security2:error] [pid 930223:tid 930465] [client 4.194.24.143:14031] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/rip.php"] [unique_id "alxi9mpwVNghF8G0ENO0pAAAAXg"]
[Sat Jul 18 23:39:02.591103 2026] [security2:error] [pid 930223:tid 930415] [client 91.230.225.156:64079] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/insc.php"] [unique_id "alxi9mpwVNghF8G0ENO0xwAAAUY"]
[Sat Jul 18 23:39:02.672059 2026] [security2:error] [pid 930223:tid 930465] [client 185.92.25.92:21297] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/wp-content/themes/txets.php"] [unique_id "alxi9mpwVNghF8G0ENO00AAAAXg"]
[Sat Jul 18 23:39:02.834241 2026] [security2:error] [pid 930223:tid 930424] [client 173.239.196.162:42419] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/plugin.php"] [unique_id "alxi9mpwVNghF8G0ENO02QAAAU8"]
[Sat Jul 18 23:39:03.047160 2026] [security2:error] [pid 930223:tid 930275] [remote 31.42.184.154:39590] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.savilerowtravel.com"] [uri "/wp-login.php"] [unique_id "alxi92pwVNghF8G0ENO06QABQjE"], referer: https://savilerowtravel.co.uk/wp-login.php
[Sat Jul 18 23:39:03.078088 2026] [security2:error] [pid 930223:tid 930296] [remote 31.42.184.154:33822] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxi92pwVNghF8G0ENO07gABSkY"]
[Sat Jul 18 23:39:03.305693 2026] [security2:error] [pid 930223:tid 930284] [remote 31.42.184.154:33822] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxi92pwVNghF8G0ENO1AgABFjo"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:39:03.563400 2026] [security2:error] [pid 930223:tid 930463] [client 45.31.64.192:56812] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 192.64.31.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "wathenbartlett.co.uk"] [uri "/xmlrpc.php"] [unique_id "alxi92pwVNghF8G0ENO1FAAAAXY"]
[Sat Jul 18 23:39:03.563526 2026] [security2:error] [pid 930223:tid 930463] [client 45.31.64.192:56812] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "wathenbartlett.co.uk"] [uri "/xmlrpc.php"] [unique_id "alxi92pwVNghF8G0ENO1FAAAAXY"]
[Sat Jul 18 23:39:03.584581 2026] [security2:error] [pid 930223:tid 930363] [client 185.92.25.85:25147] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/txets.php"] [unique_id "alxi92pwVNghF8G0ENO1GgAAARI"]
[Sat Jul 18 23:39:03.661321 2026] [lsapi:warn] [pid 930223:tid 930253] [remote 68.220.215.172:0] [host ali-alghanim.com] Backend log: PHP Warning:  getimagesize(https://aasgroup.online/wp-content/uploads/2021/09/1291810.jpg): Failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden\r\n in /home2/aasgroup/public_html/alialghanim/wp-content/plugins/litespeed-cache/src/media.cls.php on line 860\n
[Sat Jul 18 23:39:03.671951 2026] [security2:error] [pid 930223:tid 930279] [remote 188.138.102.156:49822] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/wp-login.php"] [unique_id "alxi92pwVNghF8G0ENO1JAABOjU"]
[Sat Jul 18 23:39:03.721163 2026] [security2:error] [pid 930223:tid 930472] [client 173.239.196.166:55343] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/twentytwentyfour/bypass.php"] [unique_id "alxi92pwVNghF8G0ENO1JwAAAX8"]
[Sat Jul 18 23:39:03.887929 2026] [security2:error] [pid 930223:tid 930305] [remote 188.138.102.156:49822] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/wp-login.php"] [unique_id "alxi92pwVNghF8G0ENO1LwABL08"], referer: https://youpositive.co/wp-login.php
[Sat Jul 18 23:39:04.077294 2026] [security2:error] [pid 930223:tid 930310] [remote 31.42.184.154:39590] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.savilerowtravel.com"] [uri "/wp-login.php"] [unique_id "alxi-GpwVNghF8G0ENO1PAABZlQ"], referer: https://savilerowtravel.co.uk/wp-login.php
[Sat Jul 18 23:39:04.378250 2026] [security2:error] [pid 930223:tid 930411] [client 91.230.225.157:41277] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/wp-includes/txets.php"] [unique_id "alxi-GpwVNghF8G0ENO1UAAAAUI"]
[Sat Jul 18 23:39:04.537084 2026] [security2:error] [pid 930223:tid 930406] [client 185.192.71.208:54857] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/wp-includes/txets.php"] [unique_id "alxi-GpwVNghF8G0ENO1WQAAAT0"]
[Sat Jul 18 23:39:04.554114 2026] [security2:error] [pid 930223:tid 930466] [client 91.230.225.160:63633] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/wp-content/themes/txets.php"] [unique_id "alxi-GpwVNghF8G0ENO1WgAAAXk"]
[Sat Jul 18 23:39:04.554338 2026] [security2:error] [pid 930223:tid 930399] [client 91.230.225.153:41241] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/wp-admin/txets.php"] [unique_id "alxi-GpwVNghF8G0ENO1WwAAATY"]
[Sat Jul 18 23:39:04.584907 2026] [security2:error] [pid 930223:tid 930390] [client 173.239.196.160:41731] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/update-core.php"] [unique_id "alxi-GpwVNghF8G0ENO1XgAAAS0"]
[Sat Jul 18 23:39:05.192663 2026] [security2:error] [pid 930223:tid 930429] [client 163.61.1.17:62912] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxi-WpwVNghF8G0ENO1iAAAAVQ"]
[Sat Jul 18 23:39:05.194400 2026] [security2:error] [pid 930223:tid 930429] [client 163.61.1.17:62912] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxi-WpwVNghF8G0ENO1iAAAAVQ"]
[Sat Jul 18 23:39:05.300532 2026] [security2:error] [pid 930223:tid 930411] [client 91.230.225.156:64049] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/classwithtostring.php"] [unique_id "alxi-WpwVNghF8G0ENO1igAAAUI"]
[Sat Jul 18 23:39:05.412448 2026] [security2:error] [pid 930223:tid 930373] [client 91.230.225.151:34535] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/wp-admin/txets.php"] [unique_id "alxi-WpwVNghF8G0ENO1jwAAARw"]
[Sat Jul 18 23:39:05.438416 2026] [security2:error] [pid 930223:tid 930384] [client 173.239.196.160:46971] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/blue/about.php"] [unique_id "alxi-WpwVNghF8G0ENO1kwAAASc"]
[Sat Jul 18 23:39:05.548648 2026] [security2:error] [pid 930223:tid 930414] [client 43.135.107.25:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxi-WpwVNghF8G0ENO1jgAAAUU"]
[Sat Jul 18 23:39:05.558656 2026] [security2:error] [pid 930223:tid 930449] [client 14.224.227.113:54782] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxi-WpwVNghF8G0ENO1pwAAAWg"]
[Sat Jul 18 23:39:05.585291 2026] [security2:error] [pid 930223:tid 930242] [remote 157.66.47.83:57600] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "website-19aec4aa.spencersadventures.com"] [uri "/wp-login.php"] [unique_id "alxi-WpwVNghF8G0ENO1qgABRhA"]
[Sat Jul 18 23:39:05.684261 2026] [security2:error] [pid 930223:tid 930350] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "soundmeditationmiami.com"] [uri "/.git/config"] [unique_id "alxi-WpwVNghF8G0ENO1twABfXw"]
[Sat Jul 18 23:39:05.699927 2026] [security2:error] [pid 930223:tid 930315] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "soundmeditationmiami.com"] [uri "/wp-json"] [unique_id "alxi-WpwVNghF8G0ENO1vAABSVk"]
[Sat Jul 18 23:39:05.808480 2026] [security2:error] [pid 930223:tid 930468] [client 138.252.89.100:62884] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxi-WpwVNghF8G0ENO1xQAAAXs"]
[Sat Jul 18 23:39:05.808561 2026] [security2:error] [pid 930223:tid 930468] [client 138.252.89.100:62884] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxi-WpwVNghF8G0ENO1xQAAAXs"]
[Sat Jul 18 23:39:05.885915 2026] [security2:error] [pid 930223:tid 930247] [remote 113.160.142.119:57092] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/wp-login.php"] [unique_id "alxi-WpwVNghF8G0ENO1xwABGhU"]
[Sat Jul 18 23:39:05.992032 2026] [security2:error] [pid 930223:tid 930347] [remote 157.66.47.83:57600] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "website-19aec4aa.spencersadventures.com"] [uri "/wp-login.php"] [unique_id "alxi-WpwVNghF8G0ENO1zQABOnk"], referer: https://website-19aec4aa.spencersadventures.com/wp-login.php
[Sat Jul 18 23:39:05.992210 2026] [security2:error] [pid 930223:tid 930234] [remote 97.74.93.24:59390] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxi-WpwVNghF8G0ENO1zgABSAg"]
[Sat Jul 18 23:39:06.178042 2026] [security2:error] [pid 930223:tid 930274] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "soundmeditationmiami.com"] [uri "/graphql"] [unique_id "alxi-mpwVNghF8G0ENO14gABWjA"]
[Sat Jul 18 23:39:06.190240 2026] [security2:error] [pid 930223:tid 930266] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "soundmeditationmiami.com"] [uri "/.gitconfig"] [unique_id "alxi-mpwVNghF8G0ENO15gABRig"]
[Sat Jul 18 23:39:06.190880 2026] [security2:error] [pid 930223:tid 930280] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "soundmeditationmiami.com"] [uri "/.env"] [unique_id "alxi-mpwVNghF8G0ENO15wABejY"]
[Sat Jul 18 23:39:06.191898 2026] [security2:error] [pid 930223:tid 930309] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\.bak|\\\\.bak\\\\.php)$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1260"] [id "390582"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that nclude .bak)"] [severity "CRITICAL"] [hostname "soundmeditationmiami.com"] [uri "/.env.bak"] [unique_id "alxi-mpwVNghF8G0ENO16AABelM"]
[Sat Jul 18 23:39:06.316899 2026] [security2:error] [pid 930223:tid 930439] [client 173.239.196.163:52227] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-mail.php"] [unique_id "alxi-mpwVNghF8G0ENO18gAAAV4"]
[Sat Jul 18 23:39:06.378596 2026] [security2:error] [pid 930223:tid 930275] [remote 97.74.93.24:59390] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxi-mpwVNghF8G0ENO19AABHjE"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:39:06.393515 2026] [security2:error] [pid 930223:tid 930296] [remote 113.160.142.119:57092] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/wp-login.php"] [unique_id "alxi-mpwVNghF8G0ENO19QABFEY"], referer: https://youpositive.co/wp-login.php
[Sat Jul 18 23:39:06.432151 2026] [security2:error] [pid 930223:tid 930263] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "soundmeditationmiami.com"] [uri "/api/.env"] [unique_id "alxi-mpwVNghF8G0ENO1-QABcSU"]
[Sat Jul 18 23:39:06.435874 2026] [security2:error] [pid 930223:tid 930342] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "soundmeditationmiami.com"] [uri "/.env.local"] [unique_id "alxi-mpwVNghF8G0ENO1-wABX3Q"]
[Sat Jul 18 23:39:06.437679 2026] [security2:error] [pid 930223:tid 930285] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.backup$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1279"] [id "390588"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .backup)"] [severity "CRITICAL"] [hostname "soundmeditationmiami.com"] [uri "/.env.backup"] [unique_id "alxi-mpwVNghF8G0ENO1-gABXzs"]
[Sat Jul 18 23:39:06.439782 2026] [security2:error] [pid 930223:tid 930284] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.old$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1263"] [id "390583"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .old)"] [severity "CRITICAL"] [hostname "soundmeditationmiami.com"] [uri "/.env.old"] [unique_id "alxi-mpwVNghF8G0ENO1_gABXzo"]
[Sat Jul 18 23:39:06.444879 2026] [security2:error] [pid 930223:tid 930366] [client 223.228.182.224:43206] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxi-mpwVNghF8G0ENO2AAAAARU"]
[Sat Jul 18 23:39:06.444959 2026] [security2:error] [pid 930223:tid 930366] [client 223.228.182.224:43206] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxi-mpwVNghF8G0ENO2AAAAARU"]
[Sat Jul 18 23:39:06.530349 2026] [security2:error] [pid 930223:tid 930460] [client 139.167.225.146:63273] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxi-mpwVNghF8G0ENO2BgAAAXM"]
[Sat Jul 18 23:39:06.530443 2026] [security2:error] [pid 930223:tid 930460] [client 139.167.225.146:63273] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxi-mpwVNghF8G0ENO2BgAAAXM"]
[Sat Jul 18 23:39:06.647100 2026] [security2:error] [pid 930223:tid 930421] [client 54.198.0.135:57326] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.0.198.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxi-mpwVNghF8G0ENO2DgAAAUw"], referer: https://curlsnpearlsss.com/es/category/food/dinners/page/3/
[Sat Jul 18 23:39:06.776676 2026] [security2:error] [pid 930223:tid 930297] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "soundmeditationmiami.com"] [uri "/api/graphql"] [unique_id "alxi-mpwVNghF8G0ENO2GwABbEc"]
[Sat Jul 18 23:39:06.781313 2026] [security2:error] [pid 930223:tid 930287] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "soundmeditationmiami.com"] [uri "/backend/.env"] [unique_id "alxi-mpwVNghF8G0ENO2HwABRj0"]
[Sat Jul 18 23:39:06.795642 2026] [security2:error] [pid 930223:tid 930307] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "soundmeditationmiami.com"] [uri "/config/.env"] [unique_id "alxi-mpwVNghF8G0ENO2JAABRFE"]
[Sat Jul 18 23:39:06.846845 2026] [security2:error] [pid 930223:tid 930469] [client 91.230.225.154:57473] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/wp-content/themes/txets.php"] [unique_id "alxi-mpwVNghF8G0ENO2JwAAAXw"]
[Sat Jul 18 23:39:06.982691 2026] [security2:error] [pid 930223:tid 930361] [client 185.92.25.81:47517] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/goods.php"] [unique_id "alxi-mpwVNghF8G0ENO2KgAAARA"]
[Sat Jul 18 23:39:07.167619 2026] [security2:error] [pid 930223:tid 930443] [client 173.239.196.165:47027] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/admin.php"] [unique_id "alxi-2pwVNghF8G0ENO2PwAAAWI"]
[Sat Jul 18 23:39:07.193044 2026] [security2:error] [pid 930223:tid 930430] [client 4.194.24.143:57618] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/root.php"] [unique_id "alxi-2pwVNghF8G0ENO2QQAAAVU"]
[Sat Jul 18 23:39:07.289489 2026] [security2:error] [pid 930223:tid 930466] [client 185.92.25.79:34089] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/goods.php"] [unique_id "alxi-2pwVNghF8G0ENO2SwAAAXk"]
[Sat Jul 18 23:39:07.303719 2026] [security2:error] [pid 930223:tid 930412] [client 91.230.225.151:36941] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/wp-includes/txets.php"] [unique_id "alxi-2pwVNghF8G0ENO2TgAAAUM"]
[Sat Jul 18 23:39:07.312846 2026] [security2:error] [pid 930223:tid 930390] [client 91.230.225.153:37255] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/wp-admin/txets.php"] [unique_id "alxi-2pwVNghF8G0ENO2TwAAAS0"]
[Sat Jul 18 23:39:07.697095 2026] [security2:error] [pid 930223:tid 930348] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "soundmeditationmiami.com"] [uri "/v1/graphql"] [unique_id "alxi-2pwVNghF8G0ENO2cAABLno"]
[Sat Jul 18 23:39:07.697154 2026] [authz_core:error] [pid 930223:tid 930336] [remote 34.131.101.221:41280] AH01630: client denied by server configuration: /home2/sarahmd3/public_html/soundmeditationmiami/.htpasswd
[Sat Jul 18 23:39:07.714015 2026] [security2:error] [pid 930223:tid 930320] [remote 165.232.173.236:60882] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 236.173.232.165.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxi-2pwVNghF8G0ENO2cwABSF4"]
[Sat Jul 18 23:39:07.763477 2026] [security2:error] [pid 930223:tid 930376] [client 185.92.25.86:65517] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/wp-editor.php"] [unique_id "alxi-2pwVNghF8G0ENO2dwAAAR8"]
[Sat Jul 18 23:39:07.794096 2026] [security2:error] [pid 930223:tid 930441] [client 91.230.225.150:51909] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/txets.php"] [unique_id "alxi-2pwVNghF8G0ENO2egAAAWA"]
[Sat Jul 18 23:39:07.804569 2026] [security2:error] [pid 930223:tid 930343] [remote 217.113.60.80:56874] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.60.113.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/wp-login.php"] [unique_id "alxi-2pwVNghF8G0ENO2eQABD3U"]
[Sat Jul 18 23:39:07.876392 2026] [security2:error] [pid 930223:tid 930379] [client 106.222.249.209:9209] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxi-2pwVNghF8G0ENO2ggAAASI"]
[Sat Jul 18 23:39:07.876484 2026] [security2:error] [pid 930223:tid 930379] [client 106.222.249.209:9209] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxi-2pwVNghF8G0ENO2ggAAASI"]
[Sat Jul 18 23:39:07.984276 2026] [security2:error] [pid 930223:tid 930239] [remote 116.179.32.41:19362] ModSecurity: Access denied with code 406 (phase 2). Match of "beginsWith %{request_headers.host}" against "TX:1" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "504"] [id "340162"] [rev "302"] [msg "Atomicorp.com WAF Rules: Remote File Injection Attack detected (Unauthorized URL detected as argument)"] [data ",TX:1"] [severity "CRITICAL"] [hostname "mollycahill.com"] [uri "/"] [unique_id "alxi-2pwVNghF8G0ENO2iwABNA0"]
[Sat Jul 18 23:39:08.015334 2026] [security2:error] [pid 930223:tid 930333] [remote 217.113.60.80:56874] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.60.113.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/wp-login.php"] [unique_id "alxi_GpwVNghF8G0ENO2jQABRGs"], referer: https://nevelow.com/wp-login.php
[Sat Jul 18 23:39:08.041931 2026] [security2:error] [pid 930223:tid 930369] [client 173.239.196.164:54093] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/defaults.php"] [unique_id "alxi_GpwVNghF8G0ENO2jgAAARg"]
[Sat Jul 18 23:39:08.082389 2026] [security2:error] [pid 930223:tid 930312] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "soundmeditationmiami.com"] [uri "/.ssh/id_dsa"] [unique_id "alxi_GpwVNghF8G0ENO2kQABJFY"]
[Sat Jul 18 23:39:08.119028 2026] [security2:error] [pid 930223:tid 930351] [remote 165.232.173.236:60882] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 236.173.232.165.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxi_GpwVNghF8G0ENO2mAABFH0"], referer: https://mezzacraft.com/wp-login.php
[Sat Jul 18 23:39:08.281785 2026] [security2:error] [pid 930223:tid 930238] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "soundmeditationmiami.com"] [uri "/id_rsa"] [unique_id "alxi_GpwVNghF8G0ENO2qwABgQw"]
[Sat Jul 18 23:39:08.282258 2026] [security2:error] [pid 930223:tid 930282] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "soundmeditationmiami.com"] [uri "/.ssh/id_rsa"] [unique_id "alxi_GpwVNghF8G0ENO2qQABgTg"]
[Sat Jul 18 23:39:08.282623 2026] [security2:error] [pid 930223:tid 930303] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "soundmeditationmiami.com"] [uri "/id_dsa"] [unique_id "alxi_GpwVNghF8G0ENO2qgABgU0"]
403 (Forbidden): 403 Forbidden
Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157.
[Sat Jul 18 23:39:08.370439 2026] [security2:error] [pid 930223:tid 930416] [client 91.230.225.152:23001] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/wp-includes/txets.php"] [unique_id "alxi_GpwVNghF8G0ENO2ugAAAUc"]
[Sat Jul 18 23:39:08.549303 2026] [security2:error] [pid 930223:tid 930366] [client 185.92.25.93:27431] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/wp-admin/txets.php"] [unique_id "alxi_GpwVNghF8G0ENO2ygAAARU"]
[Sat Jul 18 23:39:08.597786 2026] [security2:error] [pid 930223:tid 930440] [client 4.194.24.143:45656] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/s.php"] [unique_id "alxi_GpwVNghF8G0ENO2zAAAAV8"]
[Sat Jul 18 23:39:08.669719 2026] [security2:error] [pid 930223:tid 930413] [client 185.192.71.218:28525] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/wp-editor.php"] [unique_id "alxi_GpwVNghF8G0ENO20gAAAUQ"]
[Sat Jul 18 23:39:08.801850 2026] [security2:error] [pid 930223:tid 930418] [client 185.92.25.90:65219] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/wp-includes/txets.php"] [unique_id "alxi_GpwVNghF8G0ENO23AAAAUk"]
[Sat Jul 18 23:39:08.801929 2026] [security2:error] [pid 930223:tid 930453] [client 185.192.71.206:59755] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/goods.php"] [unique_id "alxi_GpwVNghF8G0ENO23QAAAWw"]
[Sat Jul 18 23:39:08.910450 2026] [security2:error] [pid 930223:tid 930309] [remote 154.0.166.254:47806] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 254.166.0.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxi_GpwVNghF8G0ENO25AABTVM"]
[Sat Jul 18 23:39:08.942703 2026] [security2:error] [pid 930223:tid 930337] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "soundmeditationmiami.com"] [uri "/.openclaw/.env"] [unique_id "alxi_GpwVNghF8G0ENO26QABgG8"]
[Sat Jul 18 23:39:08.943845 2026] [security2:error] [pid 930223:tid 930262] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "soundmeditationmiami.com"] [uri "/key.pem"] [unique_id "alxi_GpwVNghF8G0ENO26gABgCQ"]
[Sat Jul 18 23:39:08.952119 2026] [security2:error] [pid 930223:tid 930477] [client 173.239.196.160:60091] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/acme-challenge/content.php"] [unique_id "alxi_GpwVNghF8G0ENO27wAAAYQ"]
[Sat Jul 18 23:39:09.032326 2026] [security2:error] [pid 930223:tid 930428] [client 180.252.198.240:63727] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxi_WpwVNghF8G0ENO28wAAAVM"]
[Sat Jul 18 23:39:09.032429 2026] [security2:error] [pid 930223:tid 930428] [client 180.252.198.240:63727] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxi_WpwVNghF8G0ENO28wAAAVM"]
[Sat Jul 18 23:39:09.136566 2026] [security2:error] [pid 930223:tid 930342] [remote 119.249.100.175:32227] ModSecurity: Access denied with code 406 (phase 2). Match of "beginsWith %{request_headers.host}" against "TX:1" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "504"] [id "340162"] [rev "302"] [msg "Atomicorp.com WAF Rules: Remote File Injection Attack detected (Unauthorized URL detected as argument)"] [data ",TX:1"] [severity "CRITICAL"] [hostname "mollycahill.com"] [uri "/"] [unique_id "alxi_WpwVNghF8G0ENO29QABQHQ"]
[Sat Jul 18 23:39:09.143814 2026] [security2:error] [pid 930223:tid 930284] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "soundmeditationmiami.com"] [uri "/privatekey.key"] [unique_id "alxi_WpwVNghF8G0ENO2-AABdDo"]
[Sat Jul 18 23:39:09.164228 2026] [security2:error] [pid 930223:tid 930406] [client 4.194.24.143:57624] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/sang.php"] [unique_id "alxi_WpwVNghF8G0ENO2_gAAAT0"]
[Sat Jul 18 23:39:09.219463 2026] [security2:error] [pid 930223:tid 930271] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "soundmeditationmiami.com"] [uri "/.hermes/.env"] [unique_id "alxi_WpwVNghF8G0ENO3AwABZy0"]
[Sat Jul 18 23:39:09.219620 2026] [security2:error] [pid 930223:tid 930448] [client 34.131.101.221:41280] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "soundmeditationmiami.com"] [uri "/.hermes/.env"] [unique_id "alxi_WpwVNghF8G0ENO3AwABZy0"]
[Sat Jul 18 23:39:09.326539 2026] [security2:error] [pid 930223:tid 930363] [client 74.7.241.189:34548] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "hoomanr.com"] [uri "/index.php"] [unique_id "alxi_WpwVNghF8G0ENO3CgABEmo"]
[Sat Jul 18 23:39:09.328554 2026] [security2:error] [pid 930223:tid 930346] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "soundmeditationmiami.com"] [uri "/.codex/config.toml"] [unique_id "alxi_WpwVNghF8G0ENO3DgABK3g"]
[Sat Jul 18 23:39:09.328670 2026] [security2:error] [pid 930223:tid 930388] [client 34.131.101.221:41280] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "soundmeditationmiami.com"] [uri "/.codex/config.toml"] [unique_id "alxi_WpwVNghF8G0ENO3DgABK3g"]
[Sat Jul 18 23:39:09.441312 2026] [security2:error] [pid 930223:tid 930307] [remote 154.0.166.254:47806] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 254.166.0.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxi_WpwVNghF8G0ENO3GAABLFE"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:39:09.619467 2026] [security2:error] [pid 930223:tid 930431] [client 3.85.217.58:44596] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.217.85.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxi_WpwVNghF8G0ENO3JgAAAVY"], referer: https://curlsnpearlsss.com/es/category/food/dinners/page/3/
[Sat Jul 18 23:39:09.649250 2026] [security2:error] [pid 930223:tid 930253] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "soundmeditationmiami.com"] [uri "/.profile"] [unique_id "alxi_WpwVNghF8G0ENO3LAABNhs"]
[Sat Jul 18 23:39:09.649376 2026] [security2:error] [pid 930223:tid 930399] [client 34.131.101.221:41280] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "soundmeditationmiami.com"] [uri "/.profile"] [unique_id "alxi_WpwVNghF8G0ENO3LAABNhs"]
[Sat Jul 18 23:39:09.650370 2026] [security2:error] [pid 930223:tid 930264] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-config\\\\.php(?:\\\\W[a-z]*|bak)" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "300"] [id "900256"] [msg "Wp-Config Backup/edit file request"] [hostname "soundmeditationmiami.com"] [uri "/wp-config.php.old"] [unique_id "alxi_WpwVNghF8G0ENO3LwABCiY"]
[Sat Jul 18 23:39:09.650429 2026] [security2:error] [pid 930223:tid 930478] [client 91.230.225.164:38471] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/lufix.php"] [unique_id "alxi_WpwVNghF8G0ENO3LgAAAYU"]
[Sat Jul 18 23:39:09.651458 2026] [security2:error] [pid 930223:tid 930331] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-config\\\\.php(?:\\\\W[a-z]*|bak)" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "300"] [id "900256"] [msg "Wp-Config Backup/edit file request"] [hostname "soundmeditationmiami.com"] [uri "/wp-config.php.bak"] [unique_id "alxi_WpwVNghF8G0ENO3MAABCmk"]
[Sat Jul 18 23:39:09.653577 2026] [security2:error] [pid 930223:tid 930305] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "soundmeditationmiami.com"] [uri "/.bash_profile"] [unique_id "alxi_WpwVNghF8G0ENO3MgABdU8"]
[Sat Jul 18 23:39:09.653701 2026] [security2:error] [pid 930223:tid 930462] [client 34.131.101.221:41280] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "soundmeditationmiami.com"] [uri "/.bash_profile"] [unique_id "alxi_WpwVNghF8G0ENO3MgABdU8"]
[Sat Jul 18 23:39:09.772068 2026] [security2:error] [pid 930223:tid 930463] [client 4.194.24.143:45707] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/scxy.php"] [unique_id "alxi_WpwVNghF8G0ENO3PgAAAXY"]
[Sat Jul 18 23:39:09.856836 2026] [security2:error] [pid 930223:tid 930432] [client 173.239.196.161:65209] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/ALFA_DATA/alfacgiapi/bypass.php"] [unique_id "alxi_WpwVNghF8G0ENO3QQAAAVc"]
[Sat Jul 18 23:39:09.957822 2026] [security2:error] [pid 930223:tid 930256] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.sw[a-z]$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1275"] [id "390587"] [rev "5"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .sw)"] [severity "CRITICAL"] [hostname "soundmeditationmiami.com"] [uri "/.env.swp"] [unique_id "alxi_WpwVNghF8G0ENO3RgABEh4"]
[Sat Jul 18 23:39:09.959626 2026] [security2:error] [pid 930223:tid 930314] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "soundmeditationmiami.com"] [uri "/public/.env"] [unique_id "alxi_WpwVNghF8G0ENO3SQABElg"]
[Sat Jul 18 23:39:09.968236 2026] [security2:error] [pid 930223:tid 930292] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 221.101.131.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "soundmeditationmiami.com"] [uri "/config/.env.php"] [unique_id "alxi_WpwVNghF8G0ENO3RwABEkI"]
[Sat Jul 18 23:39:09.968376 2026] [security2:error] [pid 930223:tid 930295] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 221.101.131.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "soundmeditationmiami.com"] [uri "/config.php.bak"] [unique_id "alxi_WpwVNghF8G0ENO3SAABEkU"]
[Sat Jul 18 23:39:09.985952 2026] [security2:error] [pid 930223:tid 930345] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "soundmeditationmiami.com"] [uri "/laravel/.env"] [unique_id "alxi_WpwVNghF8G0ENO3TQABSnc"]
[Sat Jul 18 23:39:09.986037 2026] [security2:error] [pid 930223:tid 930419] [client 34.131.101.221:41280] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "soundmeditationmiami.com"] [uri "/laravel/.env"] [unique_id "alxi_WpwVNghF8G0ENO3TQABSnc"]
[Sat Jul 18 23:39:09.986900 2026] [security2:error] [pid 930223:tid 930317] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "soundmeditationmiami.com"] [uri "/.env.php.bak"] [unique_id "alxi_WpwVNghF8G0ENO3TwABSls"]
[Sat Jul 18 23:39:09.986979 2026] [security2:error] [pid 930223:tid 930419] [client 34.131.101.221:41280] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "soundmeditationmiami.com"] [uri "/.env.php.bak"] [unique_id "alxi_WpwVNghF8G0ENO3TwABSls"]
[Sat Jul 18 23:39:09.987638 2026] [security2:error] [pid 930223:tid 930304] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "soundmeditationmiami.com"] [uri "/core/.env"] [unique_id "alxi_WpwVNghF8G0ENO3UAABSk4"]
[Sat Jul 18 23:39:09.988705 2026] [security2:error] [pid 930223:tid 930339] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "soundmeditationmiami.com"] [uri "/web/.env"] [unique_id "alxi_WpwVNghF8G0ENO3UQABSnE"]
[Sat Jul 18 23:39:09.988769 2026] [security2:error] [pid 930223:tid 930335] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 221.101.131.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "soundmeditationmiami.com"] [uri "/configuration.php.bak"] [unique_id "alxi_WpwVNghF8G0ENO3UgABSm0"]
[Sat Jul 18 23:39:10.152463 2026] [security2:error] [pid 930223:tid 930338] [remote 111.225.214.184:2125] ModSecurity: Access denied with code 406 (phase 2). Match of "beginsWith %{request_headers.host}" against "TX:1" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "504"] [id "340162"] [rev "302"] [msg "Atomicorp.com WAF Rules: Remote File Injection Attack detected (Unauthorized URL detected as argument)"] [data ",TX:1"] [severity "CRITICAL"] [hostname "mollycahill.com"] [uri "/"] [unique_id "alxi_mpwVNghF8G0ENO3VAABf3A"]
[Sat Jul 18 23:39:10.244982 2026] [security2:error] [pid 930223:tid 930401] [client 185.192.71.214:64821] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/wp-content/themes/txets.php"] [unique_id "alxi_mpwVNghF8G0ENO3YAAAATg"]
[Sat Jul 18 23:39:10.289600 2026] [security2:error] [pid 930223:tid 930458] [client 185.92.25.79:32613] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/goods.php"] [unique_id "alxi_mpwVNghF8G0ENO3ZwAAAXE"]
[Sat Jul 18 23:39:10.381372 2026] [security2:error] [pid 930223:tid 930454] [client 4.194.24.143:45712] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/sd.php"] [unique_id "alxi_mpwVNghF8G0ENO3bAAAAW0"]
[Sat Jul 18 23:39:10.401583 2026] [security2:error] [pid 930223:tid 930462] [client 91.230.225.155:39013] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/wp-includes/txets.php"] [unique_id "alxi_mpwVNghF8G0ENO3bQAAAXU"]
[Sat Jul 18 23:39:10.412515 2026] [security2:error] [pid 930223:tid 930447] [client 185.192.71.214:44993] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/lufix.php"] [unique_id "alxi_mpwVNghF8G0ENO3bgAAAWY"]
[Sat Jul 18 23:39:10.530704 2026] [security2:error] [pid 930223:tid 930404] [client 185.92.25.83:23891] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/goods.php"] [unique_id "alxi_mpwVNghF8G0ENO3eAAAATs"]
[Sat Jul 18 23:39:10.723866 2026] [security2:error] [pid 930223:tid 930381] [client 173.239.196.163:26657] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/maint/about.php"] [unique_id "alxi_mpwVNghF8G0ENO3gAAAASQ"]
[Sat Jul 18 23:39:10.834551 2026] [security2:error] [pid 930223:tid 930351] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "soundmeditationmiami.com"] [uri "/gradle.properties"] [unique_id "alxi_mpwVNghF8G0ENO3iwABiH0"]
[Sat Jul 18 23:39:10.834739 2026] [security2:error] [pid 930223:tid 930481] [client 34.131.101.221:41280] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "soundmeditationmiami.com"] [uri "/gradle.properties"] [unique_id "alxi_mpwVNghF8G0ENO3iwABiH0"]
[Sat Jul 18 23:39:10.836732 2026] [security2:error] [pid 930223:tid 930242] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "soundmeditationmiami.com"] [uri "/actuator/env"] [unique_id "alxi_mpwVNghF8G0ENO3jwABiBA"]
[Sat Jul 18 23:39:10.836876 2026] [security2:error] [pid 930223:tid 930481] [client 34.131.101.221:41280] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "soundmeditationmiami.com"] [uri "/actuator/env"] [unique_id "alxi_mpwVNghF8G0ENO3jwABiBA"]
[Sat Jul 18 23:39:10.854443 2026] [security2:error] [pid 930223:tid 930238] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "soundmeditationmiami.com"] [uri "/appsettings.Development.json"] [unique_id "alxi_mpwVNghF8G0ENO3kwABfww"]
[Sat Jul 18 23:39:10.929997 2026] [security2:error] [pid 930223:tid 930413] [client 4.194.24.143:57645] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/sf.php"] [unique_id "alxi_mpwVNghF8G0ENO3nQAAAUQ"]
[Sat Jul 18 23:39:11.411499 2026] [security2:error] [pid 930223:tid 930347] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "soundmeditationmiami.com"] [uri "/settings.py"] [unique_id "alxi_2pwVNghF8G0ENO3vAABiXk"]
[Sat Jul 18 23:39:11.411631 2026] [security2:error] [pid 930223:tid 930482] [client 34.131.101.221:41280] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "soundmeditationmiami.com"] [uri "/settings.py"] [unique_id "alxi_2pwVNghF8G0ENO3vAABiXk"]
[Sat Jul 18 23:39:11.419896 2026] [security2:error] [pid 930223:tid 930252] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "web.config"] [severity "CRITICAL"] [hostname "soundmeditationmiami.com"] [uri "/web.config"] [unique_id "alxi_2pwVNghF8G0ENO3wQABaRo"]
[Sat Jul 18 23:39:11.515438 2026] [security2:error] [pid 930223:tid 930373] [client 185.192.71.215:48243] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.eja.xsa.mybluehost.me"] [uri "/style.php"] [unique_id "alxi_2pwVNghF8G0ENO3yQAAARw"]
[Sat Jul 18 23:39:11.531327 2026] [security2:error] [pid 930223:tid 930442] [client 4.194.24.143:53770] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/shell.php"] [unique_id "alxi_2pwVNghF8G0ENO3zQAAAWE"]
[Sat Jul 18 23:39:11.547204 2026] [security2:error] [pid 930223:tid 930231] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "soundmeditationmiami.com"] [uri "/config/database.yml"] [unique_id "alxi_2pwVNghF8G0ENO3zwABKQU"]
[Sat Jul 18 23:39:11.547430 2026] [security2:error] [pid 930223:tid 930386] [client 34.131.101.221:41280] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "soundmeditationmiami.com"] [uri "/config/database.yml"] [unique_id "alxi_2pwVNghF8G0ENO3zwABKQU"]
[Sat Jul 18 23:39:11.549841 2026] [security2:error] [pid 930223:tid 930261] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "soundmeditationmiami.com"] [uri "/local.settings.json"] [unique_id "alxi_2pwVNghF8G0ENO30wABECM"]
[Sat Jul 18 23:39:11.573106 2026] [security2:error] [pid 930223:tid 930426] [client 185.192.71.215:49253] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/wp-editor.php"] [unique_id "alxi_2pwVNghF8G0ENO31AAAAVE"]
[Sat Jul 18 23:39:11.581073 2026] [security2:error] [pid 930223:tid 930479] [client 173.239.196.164:29419] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/js/about.php"] [unique_id "alxi_2pwVNghF8G0ENO31QAAAYY"]
[Sat Jul 18 23:39:11.863977 2026] [security2:error] [pid 930223:tid 930422] [client 91.230.225.157:32107] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/wp-admin/txets.php"] [unique_id "alxi_2pwVNghF8G0ENO37AAAAU0"]
[Sat Jul 18 23:39:11.931000 2026] [security2:error] [pid 930223:tid 930451] [client 185.192.71.218:51243] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/wp-editor.php"] [unique_id "alxi_2pwVNghF8G0ENO37wAAAWo"]
[Sat Jul 18 23:39:11.981695 2026] [security2:error] [pid 930223:tid 930285] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "soundmeditationmiami.com"] [uri "/src/.env"] [unique_id "alxi_2pwVNghF8G0ENO3-AABNTs"]
[Sat Jul 18 23:39:11.982603 2026] [security2:error] [pid 930223:tid 930268] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "soundmeditationmiami.com"] [uri "/dev/.env"] [unique_id "alxi_2pwVNghF8G0ENO3_gABNSo"]
[Sat Jul 18 23:39:11.982903 2026] [security2:error] [pid 930223:tid 930306] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "soundmeditationmiami.com"] [uri "/staging/.env"] [unique_id "alxi_2pwVNghF8G0ENO3_AABNVA"]
[Sat Jul 18 23:39:11.982956 2026] [security2:error] [pid 930223:tid 930289] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "soundmeditationmiami.com"] [uri "/app/.env"] [unique_id "alxi_2pwVNghF8G0ENO3-QABNT8"]
[Sat Jul 18 23:39:11.983227 2026] [security2:error] [pid 930223:tid 930265] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "soundmeditationmiami.com"] [uri "/frontend/.env"] [unique_id "alxi_2pwVNghF8G0ENO3_wABNSc"]
[Sat Jul 18 23:39:11.983307 2026] [security2:error] [pid 930223:tid 930272] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\.bak|\\\\.bak\\\\.php)$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1260"] [id "390582"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that nclude .bak)"] [severity "CRITICAL"] [hostname "soundmeditationmiami.com"] [uri "/.env.prod.bak"] [unique_id "alxi_2pwVNghF8G0ENO3-wABNS4"]
[Sat Jul 18 23:39:11.983630 2026] [security2:error] [pid 930223:tid 930306] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "soundmeditationmiami.com"] [uri "/docker/.env"] [unique_id "alxi_2pwVNghF8G0ENO4AAABNVA"]
[Sat Jul 18 23:39:11.983836 2026] [security2:error] [pid 930223:tid 930332] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "soundmeditationmiami.com"] [uri "/server/.env"] [unique_id "alxi_2pwVNghF8G0ENO4AgABNWo"]
[Sat Jul 18 23:39:11.983984 2026] [security2:error] [pid 930223:tid 930257] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\.bak|\\\\.bak\\\\.php)$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1260"] [id "390582"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that nclude .bak)"] [severity "CRITICAL"] [hostname "soundmeditationmiami.com"] [uri "/.env.production.bak"] [unique_id "alxi_2pwVNghF8G0ENO4AQABNR8"]
[Sat Jul 18 23:39:12.172507 2026] [security2:error] [pid 930223:tid 930397] [client 91.230.225.154:64817] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "eja.xsa.mybluehost.me"] [uri "/style.php"] [unique_id "alxjAGpwVNghF8G0ENO4DAAAATQ"]
[Sat Jul 18 23:39:12.191216 2026] [security2:error] [pid 930223:tid 930478] [client 185.192.71.219:33385] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/goods.php"] [unique_id "alxjAGpwVNghF8G0ENO4DwAAAYU"]
[Sat Jul 18 23:39:12.212030 2026] [security2:error] [pid 930223:tid 930366] [client 185.192.71.225:44989] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/wp-editor.php"] [unique_id "alxjAGpwVNghF8G0ENO4EQAAARU"]
[Sat Jul 18 23:39:12.214105 2026] [security2:error] [pid 930223:tid 930277] [remote 34.131.101.221:41280] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "soundmeditationmiami.com"] [uri "/production/.env"] [unique_id "alxjAGpwVNghF8G0ENO4EgABYTM"]
[Sat Jul 18 23:39:12.384329 2026] [security2:error] [pid 930223:tid 930283] [remote 34.131.101.221:41280] ModSecurity: Access denied with connection close (phase 1). Pattern match "proc/self/environ" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1161"] [id "999997"] [msg "proc environ"] [hostname "soundmeditationmiami.com"] [uri "/@fs/proc/self/environ"] [unique_id "alxjAGpwVNghF8G0ENO4JgABEzk"]
[Sat Jul 18 23:39:12.435350 2026] [security2:error] [pid 930223:tid 930475] [client 173.239.196.165:61799] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/uploads/2023/05/404.php"] [unique_id "alxjAGpwVNghF8G0ENO4KQAAAYI"]
[Sat Jul 18 23:39:12.788651 2026] [security2:error] [pid 930223:tid 930437] [client 34.73.232.127:6542] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "joulecommunications.com"] [uri "/wp-json/batch/v1"] [unique_id "alxjAGpwVNghF8G0ENO4NwAAAVw"]
[Sat Jul 18 23:39:12.906787 2026] [security2:error] [pid 930223:tid 930402] [client 185.92.25.135:44281] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/wp-includes/txets.php"] [unique_id "alxjAGpwVNghF8G0ENO4QQAAATk"]
[Sat Jul 18 23:39:13.292183 2026] [security2:error] [pid 930223:tid 930387] [client 173.239.196.166:22479] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/maint/maint.php"] [unique_id "alxjAWpwVNghF8G0ENO4XwAAASo"]
[Sat Jul 18 23:39:13.307814 2026] [security2:error] [pid 930223:tid 930404] [client 4.194.24.143:57607] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/sid3.php"] [unique_id "alxjAWpwVNghF8G0ENO4YQAAATs"]
[Sat Jul 18 23:39:13.357486 2026] [security2:error] [pid 930223:tid 930446] [client 32.198.12.77:22426] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 77.12.198.32.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxjAWpwVNghF8G0ENO4ZQAAAWU"], referer: https://curlsnpearlsss.com/es/category/food/dinners/
[Sat Jul 18 23:39:13.381558 2026] [security2:error] [pid 930223:tid 930448] [client 91.230.225.152:28395] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/lufix.php"] [unique_id "alxjAWpwVNghF8G0ENO4ZwAAAWc"]
[Sat Jul 18 23:39:13.848898 2026] [security2:error] [pid 930223:tid 930471] [client 4.194.24.143:50606] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/simple.php"] [unique_id "alxjAWpwVNghF8G0ENO4igAAAX4"]
[Sat Jul 18 23:39:14.023175 2026] [security2:error] [pid 930223:tid 930406] [client 185.192.71.219:23147] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/lufix.php"] [unique_id "alxjAmpwVNghF8G0ENO4nQAAAT0"]
[Sat Jul 18 23:39:14.163102 2026] [security2:error] [pid 930223:tid 930430] [client 173.239.196.166:43699] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/assets/bypass.php"] [unique_id "alxjAmpwVNghF8G0ENO4ogAAAVU"]
[Sat Jul 18 23:39:14.308694 2026] [security2:error] [pid 930223:tid 930467] [client 34.73.232.127:6542] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "joulecommunications.com"] [uri "/"] [unique_id "alxjAmpwVNghF8G0ENO4qgAAAXo"]
[Sat Jul 18 23:39:14.391038 2026] [security2:error] [pid 930223:tid 930368] [client 4.194.24.143:53771] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/sitemap.php"] [unique_id "alxjAmpwVNghF8G0ENO4tAAAARc"]
[Sat Jul 18 23:39:14.594055 2026] [security2:error] [pid 930223:tid 930380] [client 185.92.25.134:47341] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/wp-editor.php"] [unique_id "alxjAmpwVNghF8G0ENO4xgAAASM"]
[Sat Jul 18 23:39:14.658926 2026] [security2:error] [pid 930223:tid 930341] [remote 34.131.101.221:40478] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "soundmeditationmiami.com"] [uri "/api/config"] [unique_id "alxjAmpwVNghF8G0ENO4ygABWXM"]
[Sat Jul 18 23:39:14.659273 2026] [security2:error] [pid 930223:tid 930245] [remote 34.131.101.221:40478] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "soundmeditationmiami.com"] [uri "/api/settings"] [unique_id "alxjAmpwVNghF8G0ENO4zAABWRM"]
[Sat Jul 18 23:39:14.659554 2026] [security2:error] [pid 930223:tid 930434] [client 34.131.101.221:40478] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "soundmeditationmiami.com"] [uri "/api/settings"] [unique_id "alxjAmpwVNghF8G0ENO4zAABWRM"]
[Sat Jul 18 23:39:14.660728 2026] [security2:error] [pid 930223:tid 930444] [client 185.92.25.91:36567] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/lufix.php"] [unique_id "alxjAmpwVNghF8G0ENO40wAAAWM"]
[Sat Jul 18 23:39:14.939380 2026] [security2:error] [pid 930223:tid 930427] [client 4.194.24.143:13369] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/size.php"] [unique_id "alxjAmpwVNghF8G0ENO45QAAAVI"]
[Sat Jul 18 23:39:15.022254 2026] [security2:error] [pid 930223:tid 930405] [client 173.239.196.161:58053] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/aa.php"] [unique_id "alxjA2pwVNghF8G0ENO46gAAATw"]
[Sat Jul 18 23:39:15.037292 2026] [security2:error] [pid 930223:tid 930450] [client 185.92.25.82:51689] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/goods.php"] [unique_id "alxjA2pwVNghF8G0ENO47AAAAWk"]
[Sat Jul 18 23:39:15.196866 2026] [security2:error] [pid 930223:tid 930396] [client 185.92.25.87:42647] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.eja.xsa.mybluehost.me"] [uri "/style.php"] [unique_id "alxjA2pwVNghF8G0ENO49gAAATM"]
[Sat Jul 18 23:39:15.283676 2026] [security2:error] [pid 930223:tid 930363] [client 91.230.225.151:38939] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.eja.xsa.mybluehost.me"] [uri "/style.php"] [unique_id "alxjA2pwVNghF8G0ENO4_gAAARI"]
[Sat Jul 18 23:39:15.374825 2026] [security2:error] [pid 930223:tid 930456] [client 163.61.1.17:63396] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjA2pwVNghF8G0ENO5BgAAAW8"]
[Sat Jul 18 23:39:15.374917 2026] [security2:error] [pid 930223:tid 930456] [client 163.61.1.17:63396] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjA2pwVNghF8G0ENO5BgAAAW8"]
[Sat Jul 18 23:39:15.482131 2026] [security2:error] [pid 930223:tid 930387] [client 4.194.24.143:45750] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/sm.php"] [unique_id "alxjA2pwVNghF8G0ENO5CgAAASo"]
[Sat Jul 18 23:39:15.489835 2026] [security2:error] [pid 930223:tid 930375] [client 185.192.71.209:26585] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/lufix.php"] [unique_id "alxjA2pwVNghF8G0ENO5CwAAAR4"]
[Sat Jul 18 23:39:15.567537 2026] [security2:error] [pid 930223:tid 930473] [client 185.92.25.81:22643] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.eja.xsa.mybluehost.me"] [uri "/style.php"] [unique_id "alxjA2pwVNghF8G0ENO5FAAAAYA"]
[Sat Jul 18 23:39:15.847743 2026] [security2:error] [pid 930223:tid 930467] [client 173.239.196.167:32255] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/index2.php"] [unique_id "alxjA2pwVNghF8G0ENO5JQAAAXo"]
[Sat Jul 18 23:39:15.926881 2026] [security2:error] [pid 930223:tid 930296] [remote 34.131.101.221:40478] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "soundmeditationmiami.com"] [uri "/env.js"] [unique_id "alxjA2pwVNghF8G0ENO5JwABR0Y"]
[Sat Jul 18 23:39:16.109600 2026] [security2:error] [pid 930223:tid 930442] [client 4.194.24.143:57606] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/sql.php"] [unique_id "alxjBGpwVNghF8G0ENO5PwAAAWE"]
[Sat Jul 18 23:39:16.176013 2026] [security2:error] [pid 930223:tid 930257] [remote 20.151.225.23:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 23.225.151.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "leapexinc.com"] [uri "/.well-known/admin.php"] [unique_id "alxjBGpwVNghF8G0ENO5QwABgx8"]
[Sat Jul 18 23:39:16.620709 2026] [security2:error] [pid 930223:tid 930362] [client 185.192.71.212:44735] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.eja.xsa.mybluehost.me"] [uri "/style.php"] [unique_id "alxjBGpwVNghF8G0ENO5agAAARE"]
[Sat Jul 18 23:39:16.664331 2026] [security2:error] [pid 930223:tid 930381] [client 4.194.24.143:45719] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/ss.php"] [unique_id "alxjBGpwVNghF8G0ENO5bAAAASQ"]
[Sat Jul 18 23:39:16.672618 2026] [security2:error] [pid 930223:tid 930470] [client 173.239.196.166:26165] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/hello-element/footer.php"] [unique_id "alxjBGpwVNghF8G0ENO5bQAAAX0"]
[Sat Jul 18 23:39:16.986953 2026] [security2:error] [pid 930223:tid 930454] [client 91.230.225.161:58955] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/wp-editor.php"] [unique_id "alxjBGpwVNghF8G0ENO5kQAAAW0"]
[Sat Jul 18 23:39:17.223446 2026] [security2:error] [pid 930223:tid 930360] [client 4.194.24.143:13352] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/stats.php"] [unique_id "alxjBWpwVNghF8G0ENO5ngAAAQ8"]
[Sat Jul 18 23:39:17.287808 2026] [security2:error] [pid 930223:tid 930472] [client 185.192.71.223:47023] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/lufix.php"] [unique_id "alxjBWpwVNghF8G0ENO5pgAAAX8"]
[Sat Jul 18 23:39:17.406078 2026] [security2:error] [pid 930223:tid 930476] [client 223.228.182.224:34389] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjBWpwVNghF8G0ENO5qgAAAYM"]
[Sat Jul 18 23:39:17.406197 2026] [security2:error] [pid 930223:tid 930476] [client 223.228.182.224:34389] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjBWpwVNghF8G0ENO5qgAAAYM"]
[Sat Jul 18 23:39:17.408223 2026] [security2:error] [pid 930223:tid 930445] [client 138.252.89.100:63397] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjBWpwVNghF8G0ENO5qwAAAWQ"]
[Sat Jul 18 23:39:17.408299 2026] [security2:error] [pid 930223:tid 930445] [client 138.252.89.100:63397] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjBWpwVNghF8G0ENO5qwAAAWQ"]
[Sat Jul 18 23:39:17.440918 2026] [security2:error] [pid 930223:tid 930328] [remote 34.131.101.221:40478] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "soundmeditationmiami.com"] [uri "/health"] [unique_id "alxjBWpwVNghF8G0ENO5sAABFWY"]
[Sat Jul 18 23:39:17.441106 2026] [security2:error] [pid 930223:tid 930366] [client 34.131.101.221:40478] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "soundmeditationmiami.com"] [uri "/health"] [unique_id "alxjBWpwVNghF8G0ENO5sAABFWY"]
[Sat Jul 18 23:39:17.527012 2026] [security2:error] [pid 930223:tid 930378] [client 173.239.196.161:51143] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/network/admin.php"] [unique_id "alxjBWpwVNghF8G0ENO5uwAAASE"]
[Sat Jul 18 23:39:17.554948 2026] [security2:error] [pid 930223:tid 930402] [client 139.167.225.146:63898] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjBWpwVNghF8G0ENO5vQAAATk"]
[Sat Jul 18 23:39:17.555046 2026] [security2:error] [pid 930223:tid 930402] [client 139.167.225.146:63898] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjBWpwVNghF8G0ENO5vQAAATk"]
[Sat Jul 18 23:39:17.595465 2026] [security2:error] [pid 930223:tid 930326] [remote 157.66.47.83:38052] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxjBWpwVNghF8G0ENO5wwABO2Q"]
[Sat Jul 18 23:39:17.827273 2026] [security2:error] [pid 930223:tid 930447] [client 4.194.24.143:45737] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/sump1.php"] [unique_id "alxjBWpwVNghF8G0ENO50gAAAWY"]
[Sat Jul 18 23:39:17.929653 2026] [security2:error] [pid 930223:tid 930458] [client 57.141.18.77:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxjBWpwVNghF8G0ENO50AAAAXE"]
[Sat Jul 18 23:39:18.022913 2026] [security2:error] [pid 930223:tid 930330] [remote 157.66.47.83:38052] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxjBmpwVNghF8G0ENO55AABRGg"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:39:18.319728 2026] [security2:error] [pid 930223:tid 930478] [client 57.141.18.28:31526] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "swafforddetailing.com"] [uri "/index.php"] [unique_id "alxjBGpwVNghF8G0ENO5awABhU8"]
[Sat Jul 18 23:39:18.398367 2026] [security2:error] [pid 930223:tid 930377] [client 173.239.196.164:55233] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/pki-validation/2index.php"] [unique_id "alxjBmpwVNghF8G0ENO5_QAAASA"]
[Sat Jul 18 23:39:18.434766 2026] [security2:error] [pid 930223:tid 930397] [client 106.222.249.209:32877] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjBmpwVNghF8G0ENO6AQAAATQ"]
[Sat Jul 18 23:39:18.434866 2026] [security2:error] [pid 930223:tid 930397] [client 106.222.249.209:32877] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjBmpwVNghF8G0ENO6AQAAATQ"]
[Sat Jul 18 23:39:18.489314 2026] [security2:error] [pid 930223:tid 930390] [client 185.92.25.82:46113] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.eja.xsa.mybluehost.me"] [uri "/style.php"] [unique_id "alxjBmpwVNghF8G0ENO6AwAAAS0"]
[Sat Jul 18 23:39:18.570610 2026] [security2:error] [pid 930223:tid 930367] [client 176.41.172.201:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "youpositive.co"] [uri "/index.php"] [unique_id "alxjA2pwVNghF8G0ENO5GgAAARY"]
[Sat Jul 18 23:39:18.586197 2026] [security2:error] [pid 930223:tid 930456] [client 4.194.24.143:50573] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/system.php"] [unique_id "alxjBmpwVNghF8G0ENO6CAAAAW8"]
[Sat Jul 18 23:39:19.175149 2026] [security2:error] [pid 930223:tid 930460] [client 4.194.24.143:13351] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/system/03n1hob7p03r2npdefault.php"] [unique_id "alxjB2pwVNghF8G0ENO6MQAAAXM"]
[Sat Jul 18 23:39:19.264734 2026] [security2:error] [pid 930223:tid 930357] [client 173.239.196.163:32655] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/languages/plugins.php"] [unique_id "alxjB2pwVNghF8G0ENO6NgAAAQw"]
[Sat Jul 18 23:39:19.578438 2026] [security2:error] [pid 930223:tid 930418] [client 180.252.198.240:64193] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjB2pwVNghF8G0ENO6QwAAAUk"]
[Sat Jul 18 23:39:19.578608 2026] [security2:error] [pid 930223:tid 930418] [client 180.252.198.240:64193] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjB2pwVNghF8G0ENO6QwAAAUk"]
[Sat Jul 18 23:39:19.902896 2026] [security2:error] [pid 930223:tid 930391] [client 4.194.24.143:13348] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/system/cj5ha2rah8lyiqqdefault.php"] [unique_id "alxjB2pwVNghF8G0ENO6VwAAAS4"]
[Sat Jul 18 23:39:20.134866 2026] [security2:error] [pid 930223:tid 930466] [client 173.239.196.160:35433] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/shell.php"] [unique_id "alxjCGpwVNghF8G0ENO6ZgAAAXk"]
[Sat Jul 18 23:39:20.447880 2026] [security2:error] [pid 930223:tid 930404] [client 4.194.24.143:57868] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/system_log.php"] [unique_id "alxjCGpwVNghF8G0ENO6fgAAATs"]
[Sat Jul 18 23:39:20.552596 2026] [security2:error] [pid 930223:tid 930387] [client 88.99.83.199:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxjCGpwVNghF8G0ENO6fAAAASo"]
[Sat Jul 18 23:39:20.696780 2026] [security2:error] [pid 930223:tid 930454] [client 116.179.33.83:58496] ModSecurity: Access denied with code 406 (phase 2). Match of "beginsWith %{request_headers.host}" against "TX:1" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "504"] [id "340162"] [rev "302"] [msg "Atomicorp.com WAF Rules: Remote File Injection Attack detected (Unauthorized URL detected as argument)"] [data ",TX:1"] [severity "CRITICAL"] [hostname "mollycahill.com"] [uri "/"] [unique_id "alxjCGpwVNghF8G0ENO6jgAAAW0"]
[Sat Jul 18 23:39:20.748248 2026] [security2:error] [pid 930223:tid 930476] [client 34.73.232.127:35478] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "joulecommunications.com"] [uri "/wp-json/batch/v1"] [unique_id "alxjCGpwVNghF8G0ENO6mQAAAYM"]
[Sat Jul 18 23:39:20.991382 2026] [security2:error] [pid 930223:tid 930477] [client 4.194.24.143:13355] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/t.php"] [unique_id "alxjCGpwVNghF8G0ENO6rAAAAYQ"]
[Sat Jul 18 23:39:21.025949 2026] [security2:error] [pid 930223:tid 930360] [client 173.239.196.162:56847] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/content.php"] [unique_id "alxjCWpwVNghF8G0ENO6sQAAAQ8"]
[Sat Jul 18 23:39:21.060179 2026] [security2:error] [pid 930223:tid 930467] [client 39.63.164.108:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxjCGpwVNghF8G0ENO6oQABejw"]
[Sat Jul 18 23:39:21.517842 2026] [security2:error] [pid 930223:tid 930438] [client 34.73.232.127:35478] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "joulecommunications.com"] [uri "/"] [unique_id "alxjCWpwVNghF8G0ENO60AAAAV0"]
[Sat Jul 18 23:39:21.571564 2026] [security2:error] [pid 930223:tid 930408] [client 4.194.24.143:57890] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/term.php"] [unique_id "alxjCWpwVNghF8G0ENO61AAAAT8"]
[Sat Jul 18 23:39:21.925730 2026] [security2:error] [pid 930223:tid 930421] [client 173.239.196.167:39411] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/Text/about.php"] [unique_id "alxjCWpwVNghF8G0ENO69AAAAUw"]
[Sat Jul 18 23:39:22.143923 2026] [security2:error] [pid 930223:tid 930373] [client 50.116.65.227:13782] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "recruitinginsight.us"] [uri "/wp-cron.php"] [unique_id "alxjCmpwVNghF8G0ENO7AgAAARw"]
[Sat Jul 18 23:39:22.565906 2026] [security2:error] [pid 930223:tid 930439] [client 4.194.24.143:45661] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/test.php"] [unique_id "alxjCmpwVNghF8G0ENO7GgAAAV4"]
[Sat Jul 18 23:39:22.841261 2026] [security2:error] [pid 930223:tid 930383] [client 173.239.196.165:30305] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/network/atomlib.php"] [unique_id "alxjCmpwVNghF8G0ENO7LAAAASY"]
[Sat Jul 18 23:39:23.367159 2026] [security2:error] [pid 930223:tid 930448] [client 4.194.24.143:14263] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/test1.php"] [unique_id "alxjC2pwVNghF8G0ENO7TwAAAWc"]
[Sat Jul 18 23:39:23.521563 2026] [security2:error] [pid 930223:tid 930409] [client 74.208.214.194:47978] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxjC2pwVNghF8G0ENO7VgAAAUA"]
[Sat Jul 18 23:39:23.706583 2026] [security2:error] [pid 930223:tid 930379] [client 173.239.196.160:61777] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/install.php"] [unique_id "alxjC2pwVNghF8G0ENO7aAAAASI"]
[Sat Jul 18 23:39:24.348927 2026] [security2:error] [pid 930223:tid 930370] [client 4.194.24.143:14262] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/tfm.php"] [unique_id "alxjDGpwVNghF8G0ENO7igAAARk"]
[Sat Jul 18 23:39:24.356015 2026] [security2:error] [pid 930223:tid 930369] [client 154.57.197.145:56256] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.197.57.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "box5936.bluehost.com"] [uri "/xmlrpc.php"] [unique_id "alxjDGpwVNghF8G0ENO7iQAAARg"]
[Sat Jul 18 23:39:24.356112 2026] [security2:error] [pid 930223:tid 930369] [client 154.57.197.145:56256] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "box5936.bluehost.com"] [uri "/xmlrpc.php"] [unique_id "alxjDGpwVNghF8G0ENO7iQAAARg"]
[Sat Jul 18 23:39:24.542531 2026] [security2:error] [pid 930223:tid 930481] [client 173.239.196.161:41109] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/hehe.php"] [unique_id "alxjDGpwVNghF8G0ENO7mAAAAYg"]
[Sat Jul 18 23:39:25.071289 2026] [security2:error] [pid 930223:tid 930454] [client 4.194.24.143:57907] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/thebe.php"] [unique_id "alxjDWpwVNghF8G0ENO7uQAAAW0"]
[Sat Jul 18 23:39:25.411608 2026] [security2:error] [pid 930223:tid 930475] [client 173.239.196.160:54851] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "alxjDWpwVNghF8G0ENO7yAAAAYI"]
[Sat Jul 18 23:39:25.604455 2026] [security2:error] [pid 930223:tid 930277] [remote 31.42.184.154:38990] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.narv.co"] [uri "/wp-login.php"] [unique_id "alxjDWpwVNghF8G0ENO71QABIDM"]
[Sat Jul 18 23:39:25.647063 2026] [security2:error] [pid 930223:tid 930381] [client 4.194.24.143:55774] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/themes.php"] [unique_id "alxjDWpwVNghF8G0ENO71wAAASQ"]
[Sat Jul 18 23:39:25.832570 2026] [security2:error] [pid 930223:tid 930287] [remote 31.42.184.154:38990] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.narv.co"] [uri "/wp-login.php"] [unique_id "alxjDWpwVNghF8G0ENO74wABPj0"], referer: https://www.narv.co/wp-login.php
[Sat Jul 18 23:39:25.996812 2026] [security2:error] [pid 930223:tid 930431] [client 154.57.197.145:56272] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.197.57.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "box5936.bluehost.com"] [uri "/xmlrpc.php"] [unique_id "alxjDWpwVNghF8G0ENO79AAAAVY"]
[Sat Jul 18 23:39:25.996907 2026] [security2:error] [pid 930223:tid 930431] [client 154.57.197.145:56272] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "box5936.bluehost.com"] [uri "/xmlrpc.php"] [unique_id "alxjDWpwVNghF8G0ENO79AAAAVY"]
[Sat Jul 18 23:39:26.255788 2026] [security2:error] [pid 930223:tid 930368] [client 173.239.196.167:32103] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/css/slider.php"] [unique_id "alxjDmpwVNghF8G0ENO8AgAAARc"]
[Sat Jul 18 23:39:26.321942 2026] [security2:error] [pid 930223:tid 930447] [client 163.61.1.17:63883] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjDmpwVNghF8G0ENO8DAAAAWY"]
[Sat Jul 18 23:39:26.322059 2026] [security2:error] [pid 930223:tid 930447] [client 163.61.1.17:63883] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjDmpwVNghF8G0ENO8DAAAAWY"]
[Sat Jul 18 23:39:26.774834 2026] [security2:error] [pid 930223:tid 930417] [client 4.194.24.143:55802] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/tiny.php"] [unique_id "alxjDmpwVNghF8G0ENO8IQAAAUg"]
[Sat Jul 18 23:39:26.911432 2026] [security2:error] [pid 930223:tid 930339] [remote 57.141.18.28:62828] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 28.18.141.57.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/product/6417944"] [unique_id "alxjDmpwVNghF8G0ENO8LwABgnE"]
[Sat Jul 18 23:39:27.103057 2026] [security2:error] [pid 930223:tid 930376] [client 173.239.196.162:34365] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/dir.php"] [unique_id "alxjD2pwVNghF8G0ENO8QAAAAR8"]
[Sat Jul 18 23:39:27.325601 2026] [security2:error] [pid 930223:tid 930409] [client 4.194.24.143:52723] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "royalart-lb.com"] [uri "/tmp/byp.php"] [unique_id "alxjD2pwVNghF8G0ENO8SgAAAUA"]
[Sat Jul 18 23:39:27.939462 2026] [security2:error] [pid 930223:tid 930402] [client 154.57.197.145:56282] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.197.57.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "box5936.bluehost.com"] [uri "/blog/xmlrpc.php"] [unique_id "alxjD2pwVNghF8G0ENO8dgAAATk"]
[Sat Jul 18 23:39:27.939555 2026] [security2:error] [pid 930223:tid 930402] [client 154.57.197.145:56282] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "box5936.bluehost.com"] [uri "/blog/xmlrpc.php"] [unique_id "alxjD2pwVNghF8G0ENO8dgAAATk"]
[Sat Jul 18 23:39:27.971468 2026] [security2:error] [pid 930223:tid 930445] [client 173.239.196.164:57563] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/css/atomlib.php"] [unique_id "alxjD2pwVNghF8G0ENO8eAAAAWQ"]
[Sat Jul 18 23:39:28.010909 2026] [security2:error] [pid 930223:tid 930350] [remote 160.187.68.132:59086] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.68.187.160.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mcg.homes"] [uri "/wp-login.php"] [unique_id "alxjD2pwVNghF8G0ENO8ewABbnw"]
[Sat Jul 18 23:39:28.245412 2026] [security2:error] [pid 930223:tid 930376] [client 35.227.39.208:29118] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "sarahholyfield.com"] [uri "/wp-json/batch/v1"] [unique_id "alxjEGpwVNghF8G0ENO8ogAAAR8"]
[Sat Jul 18 23:39:28.457469 2026] [proxy:error] [pid 930223:tid 930456] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:39:28.457547 2026] [proxy_http:error] [pid 930223:tid 930456] [client 193.47.62.168:44890] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:39:28.458105 2026] [proxy:error] [pid 930223:tid 930456] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:39:28.458140 2026] [proxy_http:error] [pid 930223:tid 930456] [client 193.47.62.168:44890] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:39:28.568100 2026] [security2:error] [pid 930223:tid 930399] [client 154.57.197.145:56296] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.197.57.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "box5936.bluehost.com"] [uri "/wordpress/xmlrpc.php"] [unique_id "alxjEGpwVNghF8G0ENO8twAAATY"]
[Sat Jul 18 23:39:28.568189 2026] [security2:error] [pid 930223:tid 930399] [client 154.57.197.145:56296] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "box5936.bluehost.com"] [uri "/wordpress/xmlrpc.php"] [unique_id "alxjEGpwVNghF8G0ENO8twAAATY"]
[Sat Jul 18 23:39:28.616761 2026] [security2:error] [pid 930223:tid 930400] [client 35.227.39.208:29118] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "sarahholyfield.com"] [uri "/"] [unique_id "alxjEGpwVNghF8G0ENO8vQAAATc"]
[Sat Jul 18 23:39:28.627143 2026] [security2:error] [pid 930223:tid 930430] [client 223.228.182.224:20147] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjEGpwVNghF8G0ENO8vgAAAVU"]
[Sat Jul 18 23:39:28.627226 2026] [security2:error] [pid 930223:tid 930430] [client 223.228.182.224:20147] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjEGpwVNghF8G0ENO8vgAAAVU"]
[Sat Jul 18 23:39:28.804861 2026] [security2:error] [pid 930223:tid 930296] [remote 160.187.68.132:59086] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.68.187.160.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mcg.homes"] [uri "/wp-login.php"] [unique_id "alxjEGpwVNghF8G0ENO8zAABCkY"], referer: https://mcg.homes/wp-login.php
[Sat Jul 18 23:39:28.837023 2026] [security2:error] [pid 930223:tid 930419] [client 104.164.195.22:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxjEGpwVNghF8G0ENO8vAAAAUo"]
[Sat Jul 18 23:39:28.856815 2026] [security2:error] [pid 930223:tid 930472] [client 173.239.196.164:46099] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/style.php"] [unique_id "alxjEGpwVNghF8G0ENO80AAAAX8"]
[Sat Jul 18 23:39:29.126137 2026] [security2:error] [pid 930223:tid 930370] [client 106.222.249.209:13698] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjEWpwVNghF8G0ENO85gAAARk"]
[Sat Jul 18 23:39:29.126236 2026] [security2:error] [pid 930223:tid 930370] [client 106.222.249.209:13698] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjEWpwVNghF8G0ENO85gAAARk"]
[Sat Jul 18 23:39:29.150410 2026] [security2:error] [pid 930223:tid 930433] [client 138.252.89.100:63909] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjEWpwVNghF8G0ENO86gAAAVg"]
[Sat Jul 18 23:39:29.150492 2026] [security2:error] [pid 930223:tid 930433] [client 138.252.89.100:63909] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjEWpwVNghF8G0ENO86gAAAVg"]
[Sat Jul 18 23:39:29.202919 2026] [security2:error] [pid 930223:tid 930438] [client 154.57.197.145:56300] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.197.57.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "box5936.bluehost.com"] [uri "/news/xmlrpc.php"] [unique_id "alxjEWpwVNghF8G0ENO87QAAAV0"]
[Sat Jul 18 23:39:29.203043 2026] [security2:error] [pid 930223:tid 930438] [client 154.57.197.145:56300] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "box5936.bluehost.com"] [uri "/news/xmlrpc.php"] [unique_id "alxjEWpwVNghF8G0ENO87QAAAV0"]
[Sat Jul 18 23:39:29.284255 2026] [security2:error] [pid 930223:tid 930468] [client 57.141.18.104:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "falconarrowshop.com"] [uri "/index.php"] [unique_id "alxjEWpwVNghF8G0ENO84QAAAXs"]
[Sat Jul 18 23:39:29.750911 2026] [security2:error] [pid 930223:tid 930457] [client 173.239.196.161:23983] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/libraries/phpmailer/updates.php"] [unique_id "alxjEWpwVNghF8G0ENO9GQAAAXA"]
[Sat Jul 18 23:39:29.826839 2026] [security2:error] [pid 930223:tid 930385] [client 154.57.197.145:56316] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.197.57.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "box5936.bluehost.com"] [uri "/main/xmlrpc.php"] [unique_id "alxjEWpwVNghF8G0ENO9HQAAASg"]
[Sat Jul 18 23:39:29.826935 2026] [security2:error] [pid 930223:tid 930385] [client 154.57.197.145:56316] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "box5936.bluehost.com"] [uri "/main/xmlrpc.php"] [unique_id "alxjEWpwVNghF8G0ENO9HQAAASg"]
[Sat Jul 18 23:39:29.972093 2026] [security2:error] [pid 930223:tid 930382] [client 180.252.198.240:64658] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjEWpwVNghF8G0ENO9KgAAASU"]
[Sat Jul 18 23:39:29.972942 2026] [security2:error] [pid 930223:tid 930382] [client 180.252.198.240:64658] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjEWpwVNghF8G0ENO9KgAAASU"]
[Sat Jul 18 23:39:29.982929 2026] [security2:error] [pid 930223:tid 930278] [remote 91.142.222.105:45074] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "verdunestate.com"] [uri "/wp-login.php"] [unique_id "alxjEWpwVNghF8G0ENO9KQABazQ"]
[Sat Jul 18 23:39:30.378513 2026] [security2:error] [pid 930223:tid 930380] [client 154.57.197.145:56330] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.197.57.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "box5936.bluehost.com"] [uri "/wp-site/xmlrpc.php"] [unique_id "alxjEmpwVNghF8G0ENO9QgAAASM"]
[Sat Jul 18 23:39:30.378612 2026] [security2:error] [pid 930223:tid 930380] [client 154.57.197.145:56330] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "box5936.bluehost.com"] [uri "/wp-site/xmlrpc.php"] [unique_id "alxjEmpwVNghF8G0ENO9QgAAASM"]
[Sat Jul 18 23:39:30.406907 2026] [security2:error] [pid 930223:tid 930339] [remote 91.142.222.105:45074] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "verdunestate.com"] [uri "/wp-login.php"] [unique_id "alxjEmpwVNghF8G0ENO9RQABOHE"], referer: https://verdunestate.com/wp-login.php
[Sat Jul 18 23:39:30.560026 2026] [security2:error] [pid 930223:tid 930335] [remote 163.227.186.27:48838] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxjEmpwVNghF8G0ENO9SgABhW0"]
[Sat Jul 18 23:39:30.652314 2026] [security2:error] [pid 930223:tid 930415] [client 173.239.196.164:35825] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/nf_tracking.php"] [unique_id "alxjEmpwVNghF8G0ENO9UgAAAUY"]
[Sat Jul 18 23:39:30.938022 2026] [security2:error] [pid 930223:tid 930419] [client 154.57.197.145:56346] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.197.57.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "box5936.bluehost.com"] [uri "/old/xmlrpc.php"] [unique_id "alxjEmpwVNghF8G0ENO9YwAAAUo"]
[Sat Jul 18 23:39:30.938119 2026] [security2:error] [pid 930223:tid 930419] [client 154.57.197.145:56346] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "box5936.bluehost.com"] [uri "/old/xmlrpc.php"] [unique_id "alxjEmpwVNghF8G0ENO9YwAAAUo"]
[Sat Jul 18 23:39:30.951667 2026] [security2:error] [pid 930223:tid 930428] [client 35.227.39.208:29118] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "sarahholyfield.com"] [uri "/index.php"] [unique_id "alxjEWpwVNghF8G0ENO9FgAAAVM"], referer: http://sarahholyfield.com/wp-json/batch/v1
[Sat Jul 18 23:39:31.038587 2026] [security2:error] [pid 930223:tid 930226] [remote 163.227.186.27:48838] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxjE2pwVNghF8G0ENO9aAABTQA"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:39:31.549300 2026] [security2:error] [pid 930223:tid 930383] [client 139.167.225.146:64509] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjE2pwVNghF8G0ENO9iwAAASY"]
[Sat Jul 18 23:39:31.549398 2026] [security2:error] [pid 930223:tid 930383] [client 139.167.225.146:64509] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjE2pwVNghF8G0ENO9iwAAASY"]
[Sat Jul 18 23:39:31.566878 2026] [security2:error] [pid 930223:tid 930455] [client 173.239.196.165:43745] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/about.php7"] [unique_id "alxjE2pwVNghF8G0ENO9jAAAAW4"]
[Sat Jul 18 23:39:31.630640 2026] [security2:error] [pid 930223:tid 930447] [client 154.57.197.145:46852] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.197.57.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "box5936.bluehost.com"] [uri "/new/xmlrpc.php"] [unique_id "alxjE2pwVNghF8G0ENO9lAAAAWY"]
[Sat Jul 18 23:39:31.630716 2026] [security2:error] [pid 930223:tid 930447] [client 154.57.197.145:46852] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "box5936.bluehost.com"] [uri "/new/xmlrpc.php"] [unique_id "alxjE2pwVNghF8G0ENO9lAAAAWY"]
[Sat Jul 18 23:39:32.445793 2026] [security2:error] [pid 930223:tid 930481] [client 173.239.196.167:34177] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/filefuns.php"] [unique_id "alxjFGpwVNghF8G0ENO9ywAAAYg"]
[Sat Jul 18 23:39:32.722106 2026] [security2:error] [pid 930223:tid 930398] [client 154.57.197.145:34832] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.197.57.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "box5936.bluehost.com"] [uri "/xmlrpc.php"] [unique_id "alxjFGpwVNghF8G0ENO94gAAATU"]
[Sat Jul 18 23:39:32.722202 2026] [security2:error] [pid 930223:tid 930398] [client 154.57.197.145:34832] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "box5936.bluehost.com"] [uri "/xmlrpc.php"] [unique_id "alxjFGpwVNghF8G0ENO94gAAATU"]
[Sat Jul 18 23:39:32.978062 2026] [security2:error] [pid 930223:tid 930377] [client 154.57.197.145:46866] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.197.57.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "box5936.bluehost.com"] [uri "/wp-login.php"] [unique_id "alxjFGpwVNghF8G0ENO98wAAASA"]
[Sat Jul 18 23:39:33.306017 2026] [security2:error] [pid 930223:tid 930376] [client 173.239.196.162:24261] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/pki-validation/class_api.php"] [unique_id "alxjFWpwVNghF8G0ENO-CAAAAR8"]
[Sat Jul 18 23:39:33.523868 2026] [security2:error] [pid 930223:tid 930474] [client 138.122.221.189:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mtlegnews.gov"] [uri "/index.php"] [unique_id "alxjFWpwVNghF8G0ENO9_wAAAYE"]
[Sat Jul 18 23:39:33.731638 2026] [security2:error] [pid 930223:tid 930431] [client 74.7.227.179:37332] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxjFWpwVNghF8G0ENO-FQABVj8"], referer: https://tejasenvironmental.com/p=869153
[Sat Jul 18 23:39:33.848114 2026] [security2:error] [pid 930223:tid 930346] [remote 72.167.132.114:55568] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ivetstrategies.com"] [uri "/xmlrpc.php"] [unique_id "alxjFWpwVNghF8G0ENO-LAABP3g"]
[Sat Jul 18 23:39:33.848288 2026] [security2:error] [pid 930223:tid 930408] [client 72.167.132.114:55568] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ivetstrategies.com"] [uri "/xmlrpc.php"] [unique_id "alxjFWpwVNghF8G0ENO-LAABP3g"]
[Sat Jul 18 23:39:33.909373 2026] [security2:error] [pid 930223:tid 930457] [client 15.237.217.173:11156] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 173.217.237.15.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxjFWpwVNghF8G0ENO-LwAAAXA"]
[Sat Jul 18 23:39:33.909530 2026] [security2:error] [pid 930223:tid 930457] [client 15.237.217.173:11156] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxjFWpwVNghF8G0ENO-LwAAAXA"]
[Sat Jul 18 23:39:34.212009 2026] [security2:error] [pid 930223:tid 930374] [client 173.239.196.165:37479] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/l.php"] [unique_id "alxjFmpwVNghF8G0ENO-QgAAAR0"]
[Sat Jul 18 23:39:35.125144 2026] [security2:error] [pid 930223:tid 930418] [client 173.239.196.166:40347] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/repeater.php"] [unique_id "alxjF2pwVNghF8G0ENO-fAAAAUk"]
[Sat Jul 18 23:39:35.153299 2026] [security2:error] [pid 930223:tid 930366] [client 74.208.214.194:48432] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxjF2pwVNghF8G0ENO-fQAAARU"]
[Sat Jul 18 23:39:36.015434 2026] [security2:error] [pid 930223:tid 930396] [client 173.239.196.165:37131] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/wso.php"] [unique_id "alxjGGpwVNghF8G0ENO-vQAAATM"]
[Sat Jul 18 23:39:36.387102 2026] [security2:error] [pid 930223:tid 930407] [client 14.224.227.113:52126] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "50.116.64.31"] [uri "/wpad.dat"] [unique_id "alxjGGpwVNghF8G0ENO-zQAAAT4"]
[Sat Jul 18 23:39:36.387195 2026] [security2:error] [pid 930223:tid 930407] [client 14.224.227.113:52126] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "406"] [hostname "50.116.64.31"] [uri "/wpad.dat"] [unique_id "alxjGGpwVNghF8G0ENO-zQAAAT4"]
[Sat Jul 18 23:39:36.429141 2026] [security2:error] [pid 930223:tid 930433] [client 163.61.1.17:64371] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjGGpwVNghF8G0ENO-0QAAAVg"]
[Sat Jul 18 23:39:36.429236 2026] [security2:error] [pid 930223:tid 930433] [client 163.61.1.17:64371] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjGGpwVNghF8G0ENO-0QAAAVg"]
[Sat Jul 18 23:39:36.462595 2026] [security2:error] [pid 930223:tid 930460] [client 136.243.222.140:44082] ModSecurity: Warning. Matched phrase "DomainStatsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "www.ccsdifference.com"] [uri "/index.php"] [unique_id "alxjGGpwVNghF8G0ENO-wwAAAWk"]
[Sat Jul 18 23:39:36.802016 2026] [security2:error] [pid 930223:tid 930299] [remote 216.73.216.174:64187] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.216.73.216.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/training/"] [unique_id "alxjGGpwVNghF8G0ENO-5wABFUk"]
[Sat Jul 18 23:39:36.861219 2026] [security2:error] [pid 930223:tid 930405] [client 173.239.196.166:22607] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "alxjGGpwVNghF8G0ENO-6wAAATw"]
[Sat Jul 18 23:39:36.894184 2026] [security2:error] [pid 930223:tid 930481] [client 111.225.149.19:23728] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "xp-design.co"] [uri "/robots.txt"] [unique_id "alxjGGpwVNghF8G0ENO-7gAAAYg"]
[Sat Jul 18 23:39:37.704352 2026] [security2:error] [pid 930223:tid 930388] [client 173.239.196.164:21637] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/contacts.php"] [unique_id "alxjGWpwVNghF8G0ENO_FQAAASs"]
[Sat Jul 18 23:39:38.556177 2026] [security2:error] [pid 930223:tid 930393] [client 173.239.196.165:46105] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wsa.php"] [unique_id "alxjGmpwVNghF8G0ENO_TgAAATA"]
[Sat Jul 18 23:39:38.690996 2026] [security2:error] [pid 930223:tid 930451] [client 136.243.222.140:44506] ModSecurity: Warning. Matched phrase "DomainStatsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "www.ccsdifference.com"] [uri "/index.php"] [unique_id "alxjGmpwVNghF8G0ENO_PQAAAWo"]
[Sat Jul 18 23:39:38.856675 2026] [security2:error] [pid 930223:tid 930472] [client 3.109.49.224:55552] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.49.109.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxjGmpwVNghF8G0ENO_XwAAAX8"]
[Sat Jul 18 23:39:39.066637 2026] [security2:error] [pid 930223:tid 930438] [client 139.167.225.146:65119] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjG2pwVNghF8G0ENO_fgAAAV0"]
[Sat Jul 18 23:39:39.066740 2026] [security2:error] [pid 930223:tid 930438] [client 139.167.225.146:65119] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjG2pwVNghF8G0ENO_fgAAAV0"]
[Sat Jul 18 23:39:39.098618 2026] [security2:error] [pid 930223:tid 930407] [client 223.228.182.224:36814] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjG2pwVNghF8G0ENO_ggAAAT4"]
[Sat Jul 18 23:39:39.098741 2026] [security2:error] [pid 930223:tid 930407] [client 223.228.182.224:36814] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjG2pwVNghF8G0ENO_ggAAAT4"]
[Sat Jul 18 23:39:39.179569 2026] [security2:error] [pid 930223:tid 930360] [client 136.243.59.237:58700] ModSecurity: Warning. Matched phrase "DomainStatsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "www.ccsdifference.com"] [uri "/index.php"] [unique_id "alxjGmpwVNghF8G0ENO_YQAAAQ8"]
[Sat Jul 18 23:39:39.391778 2026] [security2:error] [pid 930223:tid 930447] [client 173.239.196.166:39495] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "alxjG2pwVNghF8G0ENO_kAAAAWY"]
[Sat Jul 18 23:39:39.544253 2026] [security2:error] [pid 930223:tid 930264] [remote 199.189.225.167:35791] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.225.189.199.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "adastra.love"] [uri "/wp-login.php"] [unique_id "alxjG2pwVNghF8G0ENO_lQABOCY"]
[Sat Jul 18 23:39:39.638083 2026] [security2:error] [pid 930223:tid 930283] [remote 31.42.184.154:42490] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxjG2pwVNghF8G0ENO_pAABhTk"]
[Sat Jul 18 23:39:39.671179 2026] [security2:error] [pid 930223:tid 930409] [client 35.227.39.208:4254] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "sarahsnyder.net"] [uri "/wp-json/batch/v1"] [unique_id "alxjG2pwVNghF8G0ENO_pQAAAUA"]
[Sat Jul 18 23:39:39.749557 2026] [security2:error] [pid 930223:tid 930290] [remote 199.189.225.167:35791] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.225.189.199.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "adastra.love"] [uri "/wp-login.php"] [unique_id "alxjG2pwVNghF8G0ENO_qgABiUA"], referer: https://adastra.love/wp-login.php
[Sat Jul 18 23:39:39.832005 2026] [security2:error] [pid 930223:tid 930424] [client 106.222.249.209:31643] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjG2pwVNghF8G0ENO_swAAAU8"]
[Sat Jul 18 23:39:39.832078 2026] [security2:error] [pid 930223:tid 930424] [client 106.222.249.209:31643] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjG2pwVNghF8G0ENO_swAAAU8"]
[Sat Jul 18 23:39:39.875687 2026] [security2:error] [pid 930223:tid 930292] [remote 31.42.184.154:42490] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxjG2pwVNghF8G0ENO_tAABNEI"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:39:39.990870 2026] [security2:error] [pid 930223:tid 930399] [client 35.227.39.208:4254] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "sarahsnyder.net"] [uri "/"] [unique_id "alxjG2pwVNghF8G0ENO_vQAAATY"]
[Sat Jul 18 23:39:40.007890 2026] [security2:error] [pid 930223:tid 930448] [client 3.108.60.216:21480] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxjG2pwVNghF8G0ENO_vgAAAWc"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:39:40.061263 2026] [security2:error] [pid 930223:tid 930392] [client 103.89.25.136:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "sergnotes.com"] [uri "/index.php"] [unique_id "alxjGmpwVNghF8G0ENO_YgAAAS8"]
[Sat Jul 18 23:39:40.219666 2026] [security2:error] [pid 930223:tid 930438] [client 173.239.196.160:58247] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/firewall.php7"] [unique_id "alxjHGpwVNghF8G0ENO_1AAAAV0"]
[Sat Jul 18 23:39:40.446966 2026] [security2:error] [pid 930223:tid 930481] [client 180.252.198.240:65126] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjHGpwVNghF8G0ENO_3wAAAYg"]
[Sat Jul 18 23:39:40.447063 2026] [security2:error] [pid 930223:tid 930481] [client 180.252.198.240:65126] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjHGpwVNghF8G0ENO_3wAAAYg"]
[Sat Jul 18 23:39:40.849487 2026] [security2:error] [pid 930223:tid 930244] [remote 157.66.47.83:33604] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tntcatholic.com"] [uri "/wp-login.php"] [unique_id "alxjHGpwVNghF8G0ENO__QABKxI"]
[Sat Jul 18 23:39:40.953683 2026] [security2:error] [pid 930223:tid 930433] [client 138.252.89.100:64433] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjHGpwVNghF8G0ENPABQAAAVg"]
[Sat Jul 18 23:39:40.953810 2026] [security2:error] [pid 930223:tid 930433] [client 138.252.89.100:64433] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjHGpwVNghF8G0ENPABQAAAVg"]
[Sat Jul 18 23:39:41.082378 2026] [security2:error] [pid 930223:tid 930411] [client 173.239.196.165:32255] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "alxjHWpwVNghF8G0ENPADgAAAUI"]
[Sat Jul 18 23:39:41.262102 2026] [security2:error] [pid 930223:tid 930239] [remote 157.66.47.83:33604] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tntcatholic.com"] [uri "/wp-login.php"] [unique_id "alxjHWpwVNghF8G0ENPAIAABDQ0"], referer: https://tntcatholic.com/wp-login.php
[Sat Jul 18 23:39:41.524969 2026] [security2:error] [pid 930223:tid 930243] [remote 31.42.184.154:42488] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.sk-financial.com"] [uri "/wp-login.php"] [unique_id "alxjHWpwVNghF8G0ENPALwABhxE"]
[Sat Jul 18 23:39:41.753017 2026] [security2:error] [pid 930223:tid 930341] [remote 31.42.184.154:42488] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.sk-financial.com"] [uri "/wp-login.php"] [unique_id "alxjHWpwVNghF8G0ENPAQAABfHM"], referer: https://mail.sk-financial.com/wp-login.php
[Sat Jul 18 23:39:41.957201 2026] [security2:error] [pid 930223:tid 930439] [client 173.239.196.161:39117] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/uploads/content.php"] [unique_id "alxjHWpwVNghF8G0ENPATwAAAV4"]
[Sat Jul 18 23:39:42.085401 2026] [security2:error] [pid 930223:tid 930303] [remote 216.73.216.174:12593] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.216.73.216.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/contact-us/"] [unique_id "alxjHmpwVNghF8G0ENPAUwABdk0"]
[Sat Jul 18 23:39:42.217676 2026] [security2:error] [pid 930223:tid 930252] [remote 47.86.33.52:15638] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxjHmpwVNghF8G0ENPAYgABNxo"]
[Sat Jul 18 23:39:42.604429 2026] [security2:error] [pid 930223:tid 930262] [remote 47.86.33.52:15638] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxjHmpwVNghF8G0ENPAcwABICQ"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:39:42.828457 2026] [security2:error] [pid 930223:tid 930465] [client 173.239.196.163:36855] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/lv.php"] [unique_id "alxjHmpwVNghF8G0ENPAhgAAAXg"]
[Sat Jul 18 23:39:42.980250 2026] [security2:error] [pid 930223:tid 930382] [client 35.227.39.208:4254] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "sarahsnyder.net"] [uri "/index.php"] [unique_id "alxjHWpwVNghF8G0ENPAHwAAASU"], referer: http://sarahsnyder.net/wp-json/batch/v1
[Sat Jul 18 23:39:43.060464 2026] [proxy:error] [pid 930223:tid 930453] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:39:43.060535 2026] [proxy_http:error] [pid 930223:tid 930453] [client 193.47.62.168:41332] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:39:43.060979 2026] [proxy:error] [pid 930223:tid 930453] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:39:43.061006 2026] [proxy_http:error] [pid 930223:tid 930453] [client 193.47.62.168:41332] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:39:43.444541 2026] [security2:error] [pid 930223:tid 930255] [remote 45.157.54.14:65451] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "website-389dbb4e.safe-systems.net"] [uri "/xmlrpc.php"] [unique_id "alxjH2pwVNghF8G0ENPArQABYx0"]
[Sat Jul 18 23:39:43.444666 2026] [security2:error] [pid 930223:tid 930444] [client 45.157.54.14:65451] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "website-389dbb4e.safe-systems.net"] [uri "/xmlrpc.php"] [unique_id "alxjH2pwVNghF8G0ENPArQABYx0"]
[Sat Jul 18 23:39:43.717256 2026] [security2:error] [pid 930223:tid 930248] [remote 74.235.96.117:39336] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.235.74.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lapietramedjugorje.com"] [uri "/wp-login.php"] [unique_id "alxjH2pwVNghF8G0ENPAvQABGBY"]
[Sat Jul 18 23:39:43.718928 2026] [security2:error] [pid 930223:tid 930417] [client 173.239.196.163:28057] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/images/js1.php"] [unique_id "alxjH2pwVNghF8G0ENPAvwAAAUg"]
[Sat Jul 18 23:39:43.877341 2026] [security2:error] [pid 930223:tid 930292] [remote 74.235.96.117:39336] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.235.74.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lapietramedjugorje.com"] [uri "/wp-login.php"] [unique_id "alxjH2pwVNghF8G0ENPAzAABLkI"], referer: https://lapietramedjugorje.com/wp-login.php
[Sat Jul 18 23:39:44.152124 2026] [security2:error] [pid 930223:tid 930410] [client 57.141.18.118:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxjH2pwVNghF8G0ENPA1QAAAUE"]
[Sat Jul 18 23:39:44.410086 2026] [security2:error] [pid 930223:tid 930461] [client 57.141.18.76:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxjIGpwVNghF8G0ENPA6wAAAXQ"]
[Sat Jul 18 23:39:44.616697 2026] [security2:error] [pid 930223:tid 930474] [client 173.239.196.162:27043] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/maint/file.php"] [unique_id "alxjIGpwVNghF8G0ENPBDgAAAYE"]
[Sat Jul 18 23:39:45.511982 2026] [security2:error] [pid 930223:tid 930243] [remote 57.141.18.105:46976] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.18.141.57.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/product/4480482"] [unique_id "alxjIWpwVNghF8G0ENPBVgABeBE"]
[Sat Jul 18 23:39:45.520576 2026] [security2:error] [pid 930223:tid 930369] [client 173.239.196.166:57955] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/acme-challenge/file.php"] [unique_id "alxjIWpwVNghF8G0ENPBVwAAARg"]
[Sat Jul 18 23:39:46.421037 2026] [security2:error] [pid 930223:tid 930379] [client 173.239.196.164:35781] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "alxjImpwVNghF8G0ENPBiwAAASI"]
[Sat Jul 18 23:39:47.300114 2026] [security2:error] [pid 930223:tid 930481] [client 173.239.196.163:53609] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "alxjI2pwVNghF8G0ENPB0wAAAYg"]
[Sat Jul 18 23:39:47.675654 2026] [security2:error] [pid 930223:tid 930472] [client 163.61.1.17:64854] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjI2pwVNghF8G0ENPB6wAAAX8"]
[Sat Jul 18 23:39:47.675813 2026] [security2:error] [pid 930223:tid 930472] [client 163.61.1.17:64854] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjI2pwVNghF8G0ENPB6wAAAX8"]
[Sat Jul 18 23:39:47.856169 2026] [security2:error] [pid 930223:tid 930382] [client 139.167.225.146:49403] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjI2pwVNghF8G0ENPB9QAAASU"]
[Sat Jul 18 23:39:47.859849 2026] [security2:error] [pid 930223:tid 930382] [client 139.167.225.146:49403] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjI2pwVNghF8G0ENPB9QAAASU"]
[Sat Jul 18 23:39:48.187044 2026] [security2:error] [pid 930223:tid 930388] [client 173.239.196.163:30189] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "alxjJGpwVNghF8G0ENPCEAAAASs"]
[Sat Jul 18 23:39:48.291608 2026] [security2:error] [pid 930223:tid 930346] [remote 47.86.33.52:15642] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxjJGpwVNghF8G0ENPCEwABH3g"]
[Sat Jul 18 23:39:48.332871 2026] [security2:error] [pid 930223:tid 930427] [client 35.227.39.208:19326] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "sarakety.com"] [uri "/wp-json/batch/v1"] [unique_id "alxjJGpwVNghF8G0ENPCGwAAAVI"]
[Sat Jul 18 23:39:48.688912 2026] [security2:error] [pid 930223:tid 930279] [remote 47.86.33.52:15642] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxjJGpwVNghF8G0ENPCNAABcjU"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:39:49.056639 2026] [security2:error] [pid 930223:tid 930380] [client 173.239.196.166:45169] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/theme-editor.php"] [unique_id "alxjJWpwVNghF8G0ENPCUgAAASM"]
[Sat Jul 18 23:39:49.093809 2026] [proxy:error] [pid 930223:tid 930440] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:39:49.093899 2026] [proxy_http:error] [pid 930223:tid 930440] [client 193.47.62.168:41344] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:39:49.095019 2026] [proxy:error] [pid 930223:tid 930440] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:39:49.095076 2026] [proxy_http:error] [pid 930223:tid 930440] [client 193.47.62.168:41344] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:39:49.129289 2026] [security2:error] [pid 930223:tid 930357] [client 47.128.42.101:17210] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "samdothan.org"] [uri "/robots.txt"] [unique_id "alxjJWpwVNghF8G0ENPCWgAAAQw"]
[Sat Jul 18 23:39:49.215867 2026] [security2:error] [pid 930223:tid 930249] [remote 152.53.111.131:35118] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.111.53.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ncsynchro.com"] [uri "/wp-login.php"] [unique_id "alxjJWpwVNghF8G0ENPCXQABIBc"]
[Sat Jul 18 23:39:49.566883 2026] [security2:error] [pid 930223:tid 930358] [client 35.227.39.208:19326] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "sarakety.com"] [uri "/"] [unique_id "alxjJWpwVNghF8G0ENPCbQAAAQ0"]
[Sat Jul 18 23:39:49.611866 2026] [security2:error] [pid 930223:tid 930270] [remote 152.53.111.131:35118] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.111.53.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ncsynchro.com"] [uri "/wp-login.php"] [unique_id "alxjJWpwVNghF8G0ENPCcQABSSw"], referer: https://ncsynchro.com/wp-login.php
[Sat Jul 18 23:39:49.654307 2026] [security2:error] [pid 930223:tid 930402] [client 50.116.65.227:22164] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "lifeisbetterlakeside.com"] [uri "/wp-content/uploads/2025/04/IMG_0045.jpeg"] [unique_id "alxjJWpwVNghF8G0ENPCdQAAAQ8"]
[Sat Jul 18 23:39:49.702220 2026] [security2:error] [pid 930223:tid 930315] [remote 31.42.184.154:50424] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxjJWpwVNghF8G0ENPCfgABclk"]
[Sat Jul 18 23:39:49.939241 2026] [security2:error] [pid 930223:tid 930415] [client 173.239.196.160:29033] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/blue/abc.php"] [unique_id "alxjJWpwVNghF8G0ENPCiQAAAUY"]
[Sat Jul 18 23:39:49.953578 2026] [security2:error] [pid 930223:tid 930341] [remote 31.42.184.154:50424] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxjJWpwVNghF8G0ENPCigABXnM"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:39:49.974978 2026] [security2:error] [pid 930223:tid 930242] [remote 31.42.184.154:38118] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "karimnawfal.com"] [uri "/wp-login.php"] [unique_id "alxjJWpwVNghF8G0ENPCjAABZxA"]
[Sat Jul 18 23:39:50.294974 2026] [security2:error] [pid 930223:tid 930282] [remote 31.42.184.154:38118] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "karimnawfal.com"] [uri "/wp-login.php"] [unique_id "alxjJmpwVNghF8G0ENPCowABVDg"], referer: https://karimnawfal.com/wp-login.php
[Sat Jul 18 23:39:50.361536 2026] [security2:error] [pid 930223:tid 930357] [client 106.222.249.209:18800] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjJmpwVNghF8G0ENPCpQAAAQw"]
[Sat Jul 18 23:39:50.362189 2026] [security2:error] [pid 930223:tid 930357] [client 106.222.249.209:18800] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjJmpwVNghF8G0ENPCpQAAAQw"]
[Sat Jul 18 23:39:50.803914 2026] [security2:error] [pid 930223:tid 930446] [client 173.239.196.164:46685] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/maint/wonder.php"] [unique_id "alxjJmpwVNghF8G0ENPCwQAAAWU"]
[Sat Jul 18 23:39:50.991688 2026] [security2:error] [pid 930223:tid 930359] [client 35.227.39.208:28456] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "sarakety.com"] [uri "/wp-json/batch/v1"] [unique_id "alxjJmpwVNghF8G0ENPCygAAAQ4"]
[Sat Jul 18 23:39:51.221589 2026] [security2:error] [pid 930223:tid 930390] [client 113.160.97.242:62635] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "wpad"] [uri "/wpad.dat"] [unique_id "alxjJ2pwVNghF8G0ENPC4AAAAS0"]
[Sat Jul 18 23:39:51.360616 2026] [security2:error] [pid 930223:tid 930277] [remote 31.42.184.154:38122] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "webgardensbypaula.com"] [uri "/wp-login.php"] [unique_id "alxjJ2pwVNghF8G0ENPC5wABPzM"]
[Sat Jul 18 23:39:51.375291 2026] [security2:error] [pid 930223:tid 930445] [client 35.227.39.208:28456] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "sarakety.com"] [uri "/"] [unique_id "alxjJ2pwVNghF8G0ENPC6AAAAWQ"]
[Sat Jul 18 23:39:51.415830 2026] [security2:error] [pid 930223:tid 930471] [client 223.228.182.224:20143] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjJ2pwVNghF8G0ENPC6QAAAX4"]
[Sat Jul 18 23:39:51.415968 2026] [security2:error] [pid 930223:tid 930471] [client 223.228.182.224:20143] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjJ2pwVNghF8G0ENPC6QAAAX4"]
[Sat Jul 18 23:39:51.630213 2026] [security2:error] [pid 930223:tid 930241] [remote 31.42.184.154:38122] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "webgardensbypaula.com"] [uri "/wp-login.php"] [unique_id "alxjJ2pwVNghF8G0ENPC_AABYQ8"], referer: https://webgardensbypaula.com/wp-login.php
[Sat Jul 18 23:39:51.666634 2026] [security2:error] [pid 930223:tid 930467] [client 173.239.196.167:29593] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/twentytwentyfour/wonder.php"] [unique_id "alxjJ2pwVNghF8G0ENPC_gAAAXo"]
[Sat Jul 18 23:39:51.767909 2026] [security2:error] [pid 930223:tid 930469] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxjJ2pwVNghF8G0ENPC-QAAAXw"]
[Sat Jul 18 23:39:52.162962 2026] [security2:error] [pid 930223:tid 930436] [client 95.137.192.133:36674] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "sergnotes.com"] [uri "/"] [unique_id "alxjKGpwVNghF8G0ENPDJQAAAVs"]
[Sat Jul 18 23:39:52.236184 2026] [security2:error] [pid 930223:tid 930449] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxjKGpwVNghF8G0ENPDGAAAAWg"]
[Sat Jul 18 23:39:52.377145 2026] [security2:error] [pid 930223:tid 930370] [client 180.252.198.240:49202] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjKGpwVNghF8G0ENPDMgAAARk"]
[Sat Jul 18 23:39:52.377269 2026] [security2:error] [pid 930223:tid 930370] [client 180.252.198.240:49202] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjKGpwVNghF8G0ENPDMgAAARk"]
[Sat Jul 18 23:39:52.549922 2026] [security2:error] [pid 930223:tid 930358] [client 173.239.196.163:25111] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/fix/as.php"] [unique_id "alxjKGpwVNghF8G0ENPDPwAAAQ0"]
[Sat Jul 18 23:39:52.633252 2026] [security2:error] [pid 930223:tid 930417] [client 138.252.89.100:64956] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjKGpwVNghF8G0ENPDQQAAAUg"]
[Sat Jul 18 23:39:52.633360 2026] [security2:error] [pid 930223:tid 930417] [client 138.252.89.100:64956] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjKGpwVNghF8G0ENPDQQAAAUg"]
[Sat Jul 18 23:39:53.596672 2026] [security2:error] [pid 930223:tid 930412] [client 104.210.56.226:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "jenfarley.com"] [uri "/index.php"] [unique_id "alxjKWpwVNghF8G0ENPDYgAAAUM"]
[Sat Jul 18 23:39:54.592090 2026] [security2:error] [pid 930223:tid 930446] [client 173.239.196.162:53823] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/tox.php"] [unique_id "alxjKmpwVNghF8G0ENPDywAAAWU"]
[Sat Jul 18 23:39:54.615291 2026] [security2:error] [pid 930223:tid 930417] [client 37.236.97.11:34574] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "sergnotes.com"] [uri "/wp-includes/fonts/dashicons.eot"] [unique_id "alxjKmpwVNghF8G0ENPDzwAAAUg"]
[Sat Jul 18 23:39:54.961133 2026] [security2:error] [pid 930223:tid 930375] [client 185.6.190.21:38332] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "sergnotes.com"] [uri "/wp-includes/fonts/dashicons.ttf"] [unique_id "alxjKmpwVNghF8G0ENPD5wAAAR4"]
[Sat Jul 18 23:39:55.249281 2026] [security2:error] [pid 930223:tid 930410] [client 103.87.215.72:39510] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "sergnotes.com"] [uri "/wp-includes/fonts/dashicons.eot"] [unique_id "alxjK2pwVNghF8G0ENPD9AAAAUE"]
[Sat Jul 18 23:39:55.268849 2026] [security2:error] [pid 930223:tid 930235] [remote 113.160.142.119:56736] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxjK2pwVNghF8G0ENPD9QABcwk"]
[Sat Jul 18 23:39:55.327132 2026] [security2:error] [pid 930223:tid 930260] [remote 91.142.222.105:48250] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxjK2pwVNghF8G0ENPD-wABhCI"]
[Sat Jul 18 23:39:55.445925 2026] [security2:error] [pid 930223:tid 930419] [client 173.239.196.166:48089] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/languages/index.php"] [unique_id "alxjK2pwVNghF8G0ENPECAAAAUo"]
[Sat Jul 18 23:39:55.777502 2026] [security2:error] [pid 930223:tid 930308] [remote 113.160.142.119:56736] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxjK2pwVNghF8G0ENPEFwABaFI"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:39:55.938575 2026] [security2:error] [pid 930223:tid 930296] [remote 91.142.222.105:48250] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxjK2pwVNghF8G0ENPEJgABh0Y"], referer: https://sesamegreenbeans.com/wp-login.php
[Sat Jul 18 23:39:56.144208 2026] [security2:error] [pid 930223:tid 930412] [client 57.141.18.28:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxjK2pwVNghF8G0ENPEJwAAAUM"]
[Sat Jul 18 23:39:56.292536 2026] [security2:error] [pid 930223:tid 930393] [client 173.239.196.166:34083] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/js/dist/default.php"] [unique_id "alxjLGpwVNghF8G0ENPEPAAAATA"]
[Sat Jul 18 23:39:57.164060 2026] [security2:error] [pid 930223:tid 930276] [remote 47.128.55.248:58404] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "villa-m-medjugorje.com"] [uri "/accommodation-facility/wired-and-wireless-broadband-internet-access/"] [unique_id "alxjLWpwVNghF8G0ENPEdQABLzI"]
[Sat Jul 18 23:39:57.199628 2026] [security2:error] [pid 930223:tid 930454] [client 173.239.196.160:43587] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/tfileman.php"] [unique_id "alxjLWpwVNghF8G0ENPEdwAAAW0"]
[Sat Jul 18 23:39:57.746735 2026] [security2:error] [pid 930223:tid 930378] [client 52.221.236.148:43048] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 148.236.221.52.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxjLWpwVNghF8G0ENPElgAAASE"]
[Sat Jul 18 23:39:58.024844 2026] [security2:error] [pid 930223:tid 930442] [client 163.61.1.17:65341] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjLmpwVNghF8G0ENPEpAAAAWE"]
[Sat Jul 18 23:39:58.024936 2026] [security2:error] [pid 930223:tid 930442] [client 163.61.1.17:65341] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjLmpwVNghF8G0ENPEpAAAAWE"]
[Sat Jul 18 23:39:58.097130 2026] [security2:error] [pid 930223:tid 930401] [client 173.239.196.160:27023] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/tiny.php"] [unique_id "alxjLmpwVNghF8G0ENPErwAAATg"]
[Sat Jul 18 23:39:58.507092 2026] [security2:error] [pid 930223:tid 930441] [client 139.167.225.146:50091] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjLmpwVNghF8G0ENPEwAAAAWA"]
[Sat Jul 18 23:39:58.507226 2026] [security2:error] [pid 930223:tid 930441] [client 139.167.225.146:50091] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjLmpwVNghF8G0ENPEwAAAAWA"]
[Sat Jul 18 23:39:58.561710 2026] [security2:error] [pid 930223:tid 930438] [client 113.31.186.195:20489] ModSecurity: Warning. Matched phrase "Custo" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "mtredistricting.gov"] [uri "/index.php"] [unique_id "alxjLmpwVNghF8G0ENPEuQAAAV0"]
[Sat Jul 18 23:39:58.724429 2026] [security2:error] [pid 930223:tid 930370] [client 18.139.208.24:39234] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.208.139.18.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxjLmpwVNghF8G0ENPE0gAAARk"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:39:59.022125 2026] [security2:error] [pid 930223:tid 930410] [client 173.239.196.163:64479] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "655"] [id "900155"] [msg "WP Brute UA block"] [hostname "sixpackminer.org"] [uri "/wp-admin/js/widgets/autoload_classmap.php"] [unique_id "alxjL2pwVNghF8G0ENPE4wAAAUE"]
[Sat Jul 18 23:39:59.922666 2026] [security2:error] [pid 930223:tid 930405] [client 173.239.196.160:32031] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/themes.php"] [unique_id "alxjL2pwVNghF8G0ENPFGAAAATw"]
[Sat Jul 18 23:40:00.787768 2026] [security2:error] [pid 930223:tid 930377] [client 173.239.196.160:22045] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-themes.php"] [unique_id "alxjMGpwVNghF8G0ENPFTAAAASA"]
[Sat Jul 18 23:40:00.999244 2026] [security2:error] [pid 930223:tid 930374] [client 106.222.249.209:16094] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjMGpwVNghF8G0ENPFVgAAAR0"]
[Sat Jul 18 23:40:00.999373 2026] [security2:error] [pid 930223:tid 930374] [client 106.222.249.209:16094] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjMGpwVNghF8G0ENPFVgAAAR0"]
[Sat Jul 18 23:40:01.371788 2026] [security2:error] [pid 930223:tid 930394] [client 180.252.198.240:49681] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjMWpwVNghF8G0ENPFdgAAATE"]
[Sat Jul 18 23:40:01.371943 2026] [security2:error] [pid 930223:tid 930394] [client 180.252.198.240:49681] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjMWpwVNghF8G0ENPFdgAAATE"]
[Sat Jul 18 23:40:01.650624 2026] [security2:error] [pid 930223:tid 930379] [client 173.239.196.165:58661] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "alxjMWpwVNghF8G0ENPFgwAAASI"]
[Sat Jul 18 23:40:01.713741 2026] [security2:error] [pid 930223:tid 930375] [client 57.141.18.28:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "samdothan.org"] [uri "/index.php"] [unique_id "alxjMGpwVNghF8G0ENPFKgAAAR4"]
[Sat Jul 18 23:40:01.816038 2026] [security2:error] [pid 930223:tid 930415] [client 223.228.182.224:36815] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjMWpwVNghF8G0ENPFkgAAAUY"]
[Sat Jul 18 23:40:01.820937 2026] [security2:error] [pid 930223:tid 930415] [client 223.228.182.224:36815] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjMWpwVNghF8G0ENPFkgAAAUY"]
[Sat Jul 18 23:40:02.253538 2026] [security2:error] [pid 930223:tid 930352] [remote 41.76.213.235:49356] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxjMmpwVNghF8G0ENPFrQABPX4"]
[Sat Jul 18 23:40:02.496555 2026] [security2:error] [pid 930223:tid 930469] [client 173.239.196.163:36035] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/erinyani/asasx.php"] [unique_id "alxjMmpwVNghF8G0ENPFvQAAAXw"]
[Sat Jul 18 23:40:02.747783 2026] [security2:error] [pid 930223:tid 930346] [remote 41.76.213.235:49356] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxjMmpwVNghF8G0ENPF0AABiHg"], referer: https://mezzacraft.com/wp-login.php
[Sat Jul 18 23:40:03.392715 2026] [security2:error] [pid 930223:tid 930405] [client 173.239.196.165:22591] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/mariju.php"] [unique_id "alxjM2pwVNghF8G0ENPF-AAAATw"]
[Sat Jul 18 23:40:03.699466 2026] [security2:error] [pid 930223:tid 930444] [client 57.141.18.58:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxjM2pwVNghF8G0ENPGAQAAAWM"]
[Sat Jul 18 23:40:04.273124 2026] [security2:error] [pid 930223:tid 930387] [client 173.239.196.165:51581] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/waf_defender.php"] [unique_id "alxjNGpwVNghF8G0ENPGOQAAASo"]
[Sat Jul 18 23:40:04.336318 2026] [security2:error] [pid 930223:tid 930419] [client 138.252.89.100:65483] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjNGpwVNghF8G0ENPGPgAAAUo"]
[Sat Jul 18 23:40:04.336457 2026] [security2:error] [pid 930223:tid 930419] [client 138.252.89.100:65483] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjNGpwVNghF8G0ENPGPgAAAUo"]
[Sat Jul 18 23:40:04.769246 2026] [security2:error] [pid 930223:tid 930228] [remote 91.142.222.105:54932] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxjNGpwVNghF8G0ENPGYAABDAI"]
[Sat Jul 18 23:40:04.785388 2026] [security2:error] [pid 930223:tid 930237] [remote 31.42.184.154:34616] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "christiancountytrumpet.com"] [uri "/wp-login.php"] [unique_id "alxjNGpwVNghF8G0ENPGYgABUws"]
[Sat Jul 18 23:40:05.085968 2026] [security2:error] [pid 930223:tid 930242] [remote 31.42.184.154:34616] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "christiancountytrumpet.com"] [uri "/wp-login.php"] [unique_id "alxjNWpwVNghF8G0ENPGeAABNBA"], referer: https://christiancountytrumpet.com/wp-login.php
[Sat Jul 18 23:40:05.159066 2026] [security2:error] [pid 930223:tid 930404] [client 173.239.196.160:30817] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/maint/cong.php"] [unique_id "alxjNWpwVNghF8G0ENPGewAAATs"]
[Sat Jul 18 23:40:05.380309 2026] [security2:error] [pid 930223:tid 930247] [remote 120.72.98.5:23010] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxjNWpwVNghF8G0ENPGgwABTRU"]
[Sat Jul 18 23:40:05.524696 2026] [security2:error] [pid 930223:tid 930433] [client 3.108.60.216:60394] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxjNWpwVNghF8G0ENPGlAAAAVg"]
[Sat Jul 18 23:40:05.524806 2026] [security2:error] [pid 930223:tid 930433] [client 3.108.60.216:60394] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxjNWpwVNghF8G0ENPGlAAAAVg"]
[Sat Jul 18 23:40:05.807505 2026] [security2:error] [pid 930223:tid 930390] [client 35.92.83.184:51790] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 184.83.92.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxjNWpwVNghF8G0ENPGoQAAAS0"]
[Sat Jul 18 23:40:05.840743 2026] [security2:error] [pid 930223:tid 930227] [remote 120.72.98.5:23010] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxjNWpwVNghF8G0ENPGpAABQQE"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:40:06.053999 2026] [security2:error] [pid 930223:tid 930472] [client 173.239.196.161:34481] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/av.php"] [unique_id "alxjNmpwVNghF8G0ENPGtwAAAX8"]
[Sat Jul 18 23:40:06.441999 2026] [security2:error] [pid 930223:tid 930241] [remote 113.160.142.119:47892] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxjNmpwVNghF8G0ENPG1wABMA8"]
[Sat Jul 18 23:40:06.442159 2026] [security2:error] [pid 930223:tid 930393] [client 113.160.142.119:47892] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxjNmpwVNghF8G0ENPG1wABMA8"]
[Sat Jul 18 23:40:06.944033 2026] [security2:error] [pid 930223:tid 930441] [client 173.239.196.166:25625] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/glex.php"] [unique_id "alxjNmpwVNghF8G0ENPG9QAAAWA"]
[Sat Jul 18 23:40:07.196064 2026] [security2:error] [pid 930223:tid 930272] [remote 91.142.222.105:54932] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxjN2pwVNghF8G0ENPHCgABNy4"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:40:07.832538 2026] [security2:error] [pid 930223:tid 930447] [client 173.239.196.165:28943] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/autoload_classmap.php"] [unique_id "alxjN2pwVNghF8G0ENPHLwAAAWY"]
[Sat Jul 18 23:40:08.067483 2026] [security2:error] [pid 930223:tid 930412] [client 163.61.1.17:49440] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjOGpwVNghF8G0ENPHOwAAAUM"]
[Sat Jul 18 23:40:08.069200 2026] [security2:error] [pid 930223:tid 930412] [client 163.61.1.17:49440] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjOGpwVNghF8G0ENPHOwAAAUM"]
[Sat Jul 18 23:40:08.233286 2026] [security2:error] [pid 930223:tid 930424] [client 34.136.134.112:42572] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "eduardsales.com"] [uri "/"] [unique_id "alxjOGpwVNghF8G0ENPHUAAAAU8"]
[Sat Jul 18 23:40:08.524198 2026] [security2:error] [pid 930223:tid 930328] [remote 31.42.184.154:34618] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "39ishlife.com"] [uri "/wp-login.php"] [unique_id "alxjOGpwVNghF8G0ENPHYAABfGY"]
[Sat Jul 18 23:40:08.705462 2026] [security2:error] [pid 930223:tid 930480] [client 173.239.196.165:30209] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "alxjOGpwVNghF8G0ENPHdwAAAYc"]
[Sat Jul 18 23:40:08.759239 2026] [security2:error] [pid 930223:tid 930325] [remote 31.42.184.154:34618] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "39ishlife.com"] [uri "/wp-login.php"] [unique_id "alxjOGpwVNghF8G0ENPHfAABPGM"], referer: https://39ishlife.com/wp-login.php
[Sat Jul 18 23:40:08.887852 2026] [security2:error] [pid 930223:tid 930468] [client 57.141.18.69:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxjOGpwVNghF8G0ENPHdgAAAXs"]
[Sat Jul 18 23:40:09.272648 2026] [security2:error] [pid 930223:tid 930449] [client 57.141.18.38:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "liquidationteam.com"] [uri "/index.php"] [unique_id "alxjOGpwVNghF8G0ENPHdAAAAWg"]
[Sat Jul 18 23:40:09.567980 2026] [security2:error] [pid 930223:tid 930401] [client 173.239.196.164:29645] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/acme-challenge/about.php"] [unique_id "alxjOWpwVNghF8G0ENPHrgAAATg"]
[Sat Jul 18 23:40:09.629827 2026] [security2:error] [pid 930223:tid 930457] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxjOWpwVNghF8G0ENPHrAAAAXA"]
[Sat Jul 18 23:40:09.810259 2026] [security2:error] [pid 930223:tid 930454] [client 139.167.225.146:50756] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjOWpwVNghF8G0ENPH0AAAAW0"]
[Sat Jul 18 23:40:09.810342 2026] [security2:error] [pid 930223:tid 930454] [client 139.167.225.146:50756] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjOWpwVNghF8G0ENPH0AAAAW0"]
[Sat Jul 18 23:40:09.907839 2026] [security2:error] [pid 930223:tid 930275] [remote 57.141.18.27:24782] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-config\\\\.php(?:\\\\W[a-z]*|bak)" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "300"] [id "900256"] [msg "Wp-Config Backup/edit file request"] [hostname "aviationsynergy.aero"] [uri "/product/3660474"] [unique_id "alxjOWpwVNghF8G0ENPH1QABaDE"]
[Sat Jul 18 23:40:09.995017 2026] [security2:error] [pid 930223:tid 930396] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxjOWpwVNghF8G0ENPH1AAAATM"]
[Sat Jul 18 23:40:10.355996 2026] [security2:error] [pid 930223:tid 930401] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxjOmpwVNghF8G0ENPH7QAAATg"]
[Sat Jul 18 23:40:10.461038 2026] [security2:error] [pid 930223:tid 930455] [client 173.239.196.163:32135] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/twentytwentyfour/system_cache.php"] [unique_id "alxjOmpwVNghF8G0ENPH-QAAAW4"]
[Sat Jul 18 23:40:11.046246 2026] [security2:error] [pid 930223:tid 930284] [remote 31.42.184.154:60378] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxjO2pwVNghF8G0ENPIIgABFzo"]
[Sat Jul 18 23:40:11.046443 2026] [security2:error] [pid 930223:tid 930368] [client 31.42.184.154:60378] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxjO2pwVNghF8G0ENPIIgABFzo"]
[Sat Jul 18 23:40:11.309091 2026] [security2:error] [pid 930223:tid 930393] [client 18.193.106.195:29902] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 195.106.193.18.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxjO2pwVNghF8G0ENPIOgAAATA"]
[Sat Jul 18 23:40:11.309221 2026] [security2:error] [pid 930223:tid 930393] [client 18.193.106.195:29902] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxjO2pwVNghF8G0ENPIOgAAATA"]
[Sat Jul 18 23:40:11.355493 2026] [security2:error] [pid 930223:tid 930398] [client 173.239.196.161:30435] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/sky-pro/js.php"] [unique_id "alxjO2pwVNghF8G0ENPIRAAAATU"]
[Sat Jul 18 23:40:11.469117 2026] [security2:error] [pid 930223:tid 930455] [client 206.62.143.186:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxjO2pwVNghF8G0ENPIMAAAAW4"]
[Sat Jul 18 23:40:11.710834 2026] [security2:error] [pid 930223:tid 930418] [client 106.222.249.209:20625] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjO2pwVNghF8G0ENPIUgAAAUk"]
[Sat Jul 18 23:40:11.710989 2026] [security2:error] [pid 930223:tid 930418] [client 106.222.249.209:20625] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjO2pwVNghF8G0ENPIUgAAAUk"]
[Sat Jul 18 23:40:11.772707 2026] [security2:error] [pid 930223:tid 930400] [client 223.228.182.224:27048] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjO2pwVNghF8G0ENPIVgAAATc"]
[Sat Jul 18 23:40:11.772824 2026] [security2:error] [pid 930223:tid 930400] [client 223.228.182.224:27048] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjO2pwVNghF8G0ENPIVgAAATc"]
[Sat Jul 18 23:40:11.824024 2026] [security2:error] [pid 930223:tid 930230] [remote 200.128.9.8:47740] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 8.9.128.200.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxjO2pwVNghF8G0ENPIYAABHQQ"]
[Sat Jul 18 23:40:11.942458 2026] [security2:error] [pid 930223:tid 930437] [client 180.252.198.240:50158] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjO2pwVNghF8G0ENPIawAAAVw"]
[Sat Jul 18 23:40:11.942606 2026] [security2:error] [pid 930223:tid 930437] [client 180.252.198.240:50158] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjO2pwVNghF8G0ENPIawAAAVw"]
[Sat Jul 18 23:40:12.255585 2026] [security2:error] [pid 930223:tid 930380] [client 173.239.196.166:30921] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "alxjPGpwVNghF8G0ENPIggAAASM"]
[Sat Jul 18 23:40:12.405595 2026] [security2:error] [pid 930223:tid 930329] [remote 200.128.9.8:47740] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 8.9.128.200.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxjPGpwVNghF8G0ENPIiwABCmc"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:40:12.413578 2026] [security2:error] [pid 930223:tid 930338] [remote 31.42.184.154:60380] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxjPGpwVNghF8G0ENPIjAABK3A"]
[Sat Jul 18 23:40:12.711342 2026] [security2:error] [pid 930223:tid 930421] [client 34.10.140.162:16228] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "greenport-us.com"] [uri "/"] [unique_id "alxjPGpwVNghF8G0ENPImAAAAUw"]
[Sat Jul 18 23:40:12.782291 2026] [security2:error] [pid 930223:tid 930243] [remote 31.42.184.154:60380] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxjPGpwVNghF8G0ENPInAABTRE"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:40:13.101138 2026] [security2:error] [pid 930223:tid 930358] [client 173.239.196.160:64539] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/pridmag/waf_defender.php"] [unique_id "alxjPWpwVNghF8G0ENPIuAAAAQ0"]
[Sat Jul 18 23:40:13.209953 2026] [security2:error] [pid 930223:tid 930472] [client 34.136.134.112:42572] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "eduardsales.com"] [uri "/index.php"] [unique_id "alxjO2pwVNghF8G0ENPIHwAAAX8"], referer: http://eduardsales.com/wp-json/batch/v1
[Sat Jul 18 23:40:13.984264 2026] [security2:error] [pid 930223:tid 930412] [client 173.239.196.161:23183] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/theme.php"] [unique_id "alxjPWpwVNghF8G0ENPI-AAAAUM"]
[Sat Jul 18 23:40:14.388154 2026] [security2:error] [pid 930223:tid 930384] [client 34.10.140.162:12174] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "greenport-us.com"] [uri "/wp-json/batch/v1"] [unique_id "alxjPmpwVNghF8G0ENPJBAAAASc"]
[Sat Jul 18 23:40:14.852705 2026] [security2:error] [pid 930223:tid 930417] [client 34.10.140.162:12174] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "greenport-us.com"] [uri "/"] [unique_id "alxjPmpwVNghF8G0ENPJKAAAAUg"]
[Sat Jul 18 23:40:14.863704 2026] [security2:error] [pid 930223:tid 930474] [client 173.239.196.162:44223] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/twentytwentytwo/waf_defender.php"] [unique_id "alxjPmpwVNghF8G0ENPJKgAAAYE"]
[Sat Jul 18 23:40:14.867340 2026] [security2:error] [pid 930223:tid 930482] [client 57.141.18.16:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "uninursity.com"] [uri "/index.php"] [unique_id "alxjOmpwVNghF8G0ENPIBAAAAYk"]
[Sat Jul 18 23:40:15.296216 2026] [security2:error] [pid 930223:tid 930399] [client 114.119.156.232:44941] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "suretybonds-california.com"] [uri "/portfolio/identity/_s/change_s.jpg"] [unique_id "alxjP2pwVNghF8G0ENPJRwAAATY"], referer: https://suretybonds-california.com/portfolio/identity/_s/change_s.jpg
[Sat Jul 18 23:40:15.753680 2026] [security2:error] [pid 930223:tid 930447] [client 173.239.196.166:20333] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/coffee/index.php"] [unique_id "alxjP2pwVNghF8G0ENPJXwAAAWY"]
[Sat Jul 18 23:40:15.843000 2026] [security2:error] [pid 930223:tid 930458] [client 138.252.89.100:49628] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjP2pwVNghF8G0ENPJYgAAAXE"]
[Sat Jul 18 23:40:15.843130 2026] [security2:error] [pid 930223:tid 930458] [client 138.252.89.100:49628] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjP2pwVNghF8G0ENPJYgAAAXE"]
[Sat Jul 18 23:40:16.218532 2026] [security2:error] [pid 930223:tid 930462] [client 43.138.8.109:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxjP2pwVNghF8G0ENPJbAABdUQ"], referer: https://www.aleishapenny.ca/listing/page/911?paged=1&view=grid&posts_per_page=48
[Sat Jul 18 23:40:16.666188 2026] [security2:error] [pid 930223:tid 930393] [client 173.239.196.161:56847] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/Simple.php"] [unique_id "alxjQGpwVNghF8G0ENPJmQAAATA"]
[Sat Jul 18 23:40:17.561548 2026] [security2:error] [pid 930223:tid 930407] [client 173.239.196.161:49347] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "alxjQWpwVNghF8G0ENPJyAAAAT4"]
[Sat Jul 18 23:40:18.439895 2026] [security2:error] [pid 930223:tid 930447] [client 173.239.196.167:63757] ModSecurity: Warning. Pattern match "/1\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1543"] [id "900921"] [msg "temporary TUW-72162 logging rule"] [hostname "sixpackminer.org"] [uri "/wp-admin/1.php"] [unique_id "alxjQmpwVNghF8G0ENPKAgAAAWY"]
[Sat Jul 18 23:40:18.439994 2026] [security2:error] [pid 930223:tid 930447] [client 173.239.196.167:63757] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/1.php"] [unique_id "alxjQmpwVNghF8G0ENPKAgAAAWY"]
[Sat Jul 18 23:40:18.559811 2026] [security2:error] [pid 930223:tid 930366] [client 163.61.1.17:49931] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjQmpwVNghF8G0ENPKEgAAARU"]
[Sat Jul 18 23:40:18.559921 2026] [security2:error] [pid 930223:tid 930366] [client 163.61.1.17:49931] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjQmpwVNghF8G0ENPKEgAAARU"]
[Sat Jul 18 23:40:19.394109 2026] [security2:error] [pid 930223:tid 930388] [client 173.239.196.167:26347] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "alxjQ2pwVNghF8G0ENPKRQAAASs"]
[Sat Jul 18 23:40:19.651496 2026] [security2:error] [pid 930223:tid 930481] [client 74.208.214.194:48232] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxjQ2pwVNghF8G0ENPKUgAAAYg"]
[Sat Jul 18 23:40:19.883815 2026] [security2:error] [pid 930223:tid 930403] [client 139.167.225.146:51394] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjQ2pwVNghF8G0ENPKXwAAATo"]
[Sat Jul 18 23:40:19.883920 2026] [security2:error] [pid 930223:tid 930403] [client 139.167.225.146:51394] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjQ2pwVNghF8G0ENPKXwAAATo"]
[Sat Jul 18 23:40:19.963007 2026] [security2:error] [pid 930223:tid 930310] [remote 91.142.222.105:48718] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "39ishlife.com"] [uri "/wp-login.php"] [unique_id "alxjQ2pwVNghF8G0ENPKYwABHlQ"]
[Sat Jul 18 23:40:20.235460 2026] [security2:error] [pid 930223:tid 930362] [client 173.239.196.163:39275] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/wp-conflg.php"] [unique_id "alxjRGpwVNghF8G0ENPKdAAAARE"]
[Sat Jul 18 23:40:20.612734 2026] [security2:error] [pid 930223:tid 930324] [remote 157.66.47.83:34686] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "39ishlife.com"] [uri "/wp-login.php"] [unique_id "alxjRGpwVNghF8G0ENPKgAABVmI"]
[Sat Jul 18 23:40:20.886483 2026] [security2:error] [pid 930223:tid 930363] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxjRGpwVNghF8G0ENPKkAAAARI"]
[Sat Jul 18 23:40:21.045144 2026] [security2:error] [pid 930223:tid 930286] [remote 157.66.47.83:34686] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "39ishlife.com"] [uri "/wp-login.php"] [unique_id "alxjRWpwVNghF8G0ENPKpwABaTw"], referer: https://39ishlife.com/wp-login.php
[Sat Jul 18 23:40:21.114821 2026] [security2:error] [pid 930223:tid 930383] [client 173.239.196.164:36485] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/classwithtostring.php"] [unique_id "alxjRWpwVNghF8G0ENPKrAAAASY"]
[Sat Jul 18 23:40:21.183848 2026] [security2:error] [pid 930223:tid 930451] [client 3.109.49.224:26530] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.49.109.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxjRWpwVNghF8G0ENPKsQAAAWo"]
[Sat Jul 18 23:40:21.334079 2026] [security2:error] [pid 930223:tid 930452] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxjRWpwVNghF8G0ENPKrgAAAWs"]
[Sat Jul 18 23:40:21.986434 2026] [security2:error] [pid 930223:tid 930394] [client 173.239.196.161:32137] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/css/av.php"] [unique_id "alxjRWpwVNghF8G0ENPK5QAAATE"]
[Sat Jul 18 23:40:22.052939 2026] [security2:error] [pid 930223:tid 930405] [client 3.109.49.224:26534] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.49.109.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxjRmpwVNghF8G0ENPK6AAAATw"]
[Sat Jul 18 23:40:22.053042 2026] [security2:error] [pid 930223:tid 930405] [client 3.109.49.224:26534] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxjRmpwVNghF8G0ENPK6AAAATw"]
[Sat Jul 18 23:40:22.457862 2026] [security2:error] [pid 930223:tid 930415] [client 3.108.60.216:63664] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxjRmpwVNghF8G0ENPLBQAAAUY"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:40:22.462954 2026] [security2:error] [pid 930223:tid 930389] [client 106.222.249.209:9289] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjRmpwVNghF8G0ENPLBgAAASw"]
[Sat Jul 18 23:40:22.463088 2026] [security2:error] [pid 930223:tid 930389] [client 106.222.249.209:9289] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjRmpwVNghF8G0ENPLBgAAASw"]
[Sat Jul 18 23:40:22.524921 2026] [security2:error] [pid 930223:tid 930239] [remote 57.141.18.29:50168] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 29.18.141.57.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/product/6131223"] [unique_id "alxjRmpwVNghF8G0ENPLCAABbg0"]
[Sat Jul 18 23:40:22.542095 2026] [security2:error] [pid 930223:tid 930475] [client 223.228.182.224:36814] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjRmpwVNghF8G0ENPLCQAAAYI"]
[Sat Jul 18 23:40:22.546948 2026] [security2:error] [pid 930223:tid 930475] [client 223.228.182.224:36814] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjRmpwVNghF8G0ENPLCQAAAYI"]
[Sat Jul 18 23:40:22.799612 2026] [security2:error] [pid 930223:tid 930391] [client 180.252.198.240:50634] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjRmpwVNghF8G0ENPLIQAAAS4"]
[Sat Jul 18 23:40:22.799697 2026] [security2:error] [pid 930223:tid 930391] [client 180.252.198.240:50634] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjRmpwVNghF8G0ENPLIQAAAS4"]
[Sat Jul 18 23:40:22.871296 2026] [security2:error] [pid 930223:tid 930446] [client 173.239.196.167:47869] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/images/waf_defender.php"] [unique_id "alxjRmpwVNghF8G0ENPLJwAAAWU"]
[Sat Jul 18 23:40:23.075189 2026] [security2:error] [pid 930223:tid 930309] [remote 91.142.222.105:48718] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "39ishlife.com"] [uri "/wp-login.php"] [unique_id "alxjR2pwVNghF8G0ENPLNgABW1M"], referer: https://39ishlife.com/wp-login.php
[Sat Jul 18 23:40:23.765566 2026] [security2:error] [pid 930223:tid 930408] [client 173.239.196.161:61701] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "alxjR2pwVNghF8G0ENPLYAAAAT8"]
[Sat Jul 18 23:40:24.090493 2026] [ssl:error] [pid 930223:tid 930458] [client 98.84.1.175:53834] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname autodiscover.tsx.wby.mybluehost.me provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:40:24.621115 2026] [security2:error] [pid 930223:tid 930477] [client 173.239.196.165:63779] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/small.php"] [unique_id "alxjSGpwVNghF8G0ENPLmAAAAYQ"]
[Sat Jul 18 23:40:25.379108 2026] [security2:error] [pid 930223:tid 930396] [client 104.210.56.226:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "koaconsultants.com"] [uri "/index.php"] [unique_id "alxjSWpwVNghF8G0ENPLygAAATM"]
[Sat Jul 18 23:40:25.451626 2026] [security2:error] [pid 930223:tid 930420] [client 173.239.196.161:39067] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "alxjSWpwVNghF8G0ENPL3AAAAUs"]
[Sat Jul 18 23:40:25.582922 2026] [security2:error] [pid 930223:tid 930391] [client 57.141.18.32:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxjSWpwVNghF8G0ENPL1QAAAS4"]
[Sat Jul 18 23:40:26.255501 2026] [security2:error] [pid 930223:tid 930376] [client 123.19.116.80:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.savilerowtravel.com"] [uri "/index.php"] [unique_id "alxjSWpwVNghF8G0ENPL9gAAAR8"]
[Sat Jul 18 23:40:26.293384 2026] [security2:error] [pid 930223:tid 930372] [client 173.239.196.164:39585] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/NewFile.php"] [unique_id "alxjSmpwVNghF8G0ENPMFgAAARs"]
[Sat Jul 18 23:40:26.622218 2026] [security2:error] [pid 930223:tid 930441] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxjSmpwVNghF8G0ENPMKwAAAWA"]
[Sat Jul 18 23:40:27.124217 2026] [security2:error] [pid 930223:tid 930464] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxjSmpwVNghF8G0ENPMSAAAAXc"]
[Sat Jul 18 23:40:27.163733 2026] [security2:error] [pid 930223:tid 930420] [client 173.239.196.164:53005] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/uploads/index.php"] [unique_id "alxjS2pwVNghF8G0ENPMaQAAAUs"]
[Sat Jul 18 23:40:27.393827 2026] [security2:error] [pid 930223:tid 930408] [client 138.252.89.100:50359] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjS2pwVNghF8G0ENPMewAAAT8"]
[Sat Jul 18 23:40:27.394582 2026] [security2:error] [pid 930223:tid 930408] [client 138.252.89.100:50359] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjS2pwVNghF8G0ENPMewAAAT8"]
[Sat Jul 18 23:40:27.574506 2026] [security2:error] [pid 930223:tid 930318] [remote 200.128.9.8:36848] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 8.9.128.200.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxjS2pwVNghF8G0ENPMigABe1w"]
[Sat Jul 18 23:40:27.574671 2026] [security2:error] [pid 930223:tid 930468] [client 200.128.9.8:36848] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxjS2pwVNghF8G0ENPMigABe1w"]
[Sat Jul 18 23:40:28.024965 2026] [security2:error] [pid 930223:tid 930375] [client 173.239.196.167:44785] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/error.php"] [unique_id "alxjTGpwVNghF8G0ENPMqAAAAR4"]
[Sat Jul 18 23:40:28.859053 2026] [security2:error] [pid 930223:tid 930417] [client 173.239.196.166:20533] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/pwnd/admin-footer.php"] [unique_id "alxjTGpwVNghF8G0ENPM2QAAAUg"]
[Sat Jul 18 23:40:29.164210 2026] [security2:error] [pid 930223:tid 930472] [client 14.191.154.202:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "youpositive.co"] [uri "/index.php"] [unique_id "alxjTGpwVNghF8G0ENPMvQAAAX8"]
[Sat Jul 18 23:40:29.358661 2026] [security2:error] [pid 930223:tid 930394] [client 163.61.1.17:50423] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjTWpwVNghF8G0ENPM8gAAATE"]
[Sat Jul 18 23:40:29.358801 2026] [security2:error] [pid 930223:tid 930394] [client 163.61.1.17:50423] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjTWpwVNghF8G0ENPM8gAAATE"]
[Sat Jul 18 23:40:29.722069 2026] [security2:error] [pid 930223:tid 930389] [client 173.239.196.165:54949] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "alxjTWpwVNghF8G0ENPNAwAAASw"]
[Sat Jul 18 23:40:30.361585 2026] [security2:error] [pid 930223:tid 930358] [client 57.141.18.28:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxjTmpwVNghF8G0ENPNHQAAAQ0"]
[Sat Jul 18 23:40:30.481682 2026] [security2:error] [pid 930223:tid 930437] [client 139.167.225.146:52014] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjTmpwVNghF8G0ENPNLgAAAVw"]
[Sat Jul 18 23:40:30.481887 2026] [security2:error] [pid 930223:tid 930437] [client 139.167.225.146:52014] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjTmpwVNghF8G0ENPNLgAAAVw"]
[Sat Jul 18 23:40:30.582642 2026] [security2:error] [pid 930223:tid 930388] [client 173.239.196.167:41803] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/languages/themes/index.php"] [unique_id "alxjTmpwVNghF8G0ENPNOAAAASs"]
[Sat Jul 18 23:40:30.957833 2026] [security2:error] [pid 930223:tid 930320] [remote 31.42.184.154:48224] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxjTmpwVNghF8G0ENPNTgABgF4"]
[Sat Jul 18 23:40:30.958098 2026] [security2:error] [pid 930223:tid 930473] [client 31.42.184.154:48224] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxjTmpwVNghF8G0ENPNTgABgF4"]
[Sat Jul 18 23:40:31.282279 2026] [security2:error] [pid 930223:tid 930269] [remote 104.131.116.82:47564] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.116.131.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "rrf.lcd.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxjT2pwVNghF8G0ENPNZAABPSs"]
[Sat Jul 18 23:40:31.282489 2026] [security2:error] [pid 930223:tid 930406] [client 104.131.116.82:47564] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "rrf.lcd.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxjT2pwVNghF8G0ENPNZAABPSs"]
[Sat Jul 18 23:40:31.448189 2026] [security2:error] [pid 930223:tid 930456] [client 173.239.196.161:61943] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-files.php"] [unique_id "alxjT2pwVNghF8G0ENPNbQAAAW8"]
[Sat Jul 18 23:40:31.605892 2026] [security2:error] [pid 930223:tid 930380] [client 217.216.60.151:11808] ModSecurity: Access denied with code 406 (phase 1). Pattern match "python-requests|python-urllib" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "1460"] [id "909111"] [msg "Python UA brute"] [hostname "aliveinspirit.com"] [uri "/"] [unique_id "alxjT2pwVNghF8G0ENPNdgAAASM"]
[Sat Jul 18 23:40:31.875403 2026] [security2:error] [pid 930223:tid 930426] [client 52.109.124.141:14368] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "msoid.quangminhltd.vn"] [uri "/index.cgi"] [unique_id "alxjT2pwVNghF8G0ENPNjwAAAVE"]
[Sat Jul 18 23:40:32.058896 2026] [security2:error] [pid 930223:tid 930399] [client 52.109.124.141:14368] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "404"] [hostname "msoid.quangminhltd.vn"] [uri "/404.html"] [unique_id "alxjUGpwVNghF8G0ENPNkwAAATY"]
[Sat Jul 18 23:40:32.337444 2026] [security2:error] [pid 930223:tid 930449] [client 173.239.196.161:51327] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/functions.php"] [unique_id "alxjUGpwVNghF8G0ENPNrAAAAWg"]
[Sat Jul 18 23:40:32.892690 2026] [security2:error] [pid 930223:tid 930410] [client 106.222.249.209:4766] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjUGpwVNghF8G0ENPNzgAAAUE"]
[Sat Jul 18 23:40:32.892791 2026] [security2:error] [pid 930223:tid 930410] [client 106.222.249.209:4766] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjUGpwVNghF8G0ENPNzgAAAUE"]
[Sat Jul 18 23:40:32.945178 2026] [security2:error] [pid 930223:tid 930480] [client 180.252.198.240:51102] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjUGpwVNghF8G0ENPN0AAAAYc"]
[Sat Jul 18 23:40:32.946564 2026] [security2:error] [pid 930223:tid 930480] [client 180.252.198.240:51102] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjUGpwVNghF8G0ENPN0AAAAYc"]
[Sat Jul 18 23:40:33.228079 2026] [security2:error] [pid 930223:tid 930472] [client 173.239.196.165:55667] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "alxjUWpwVNghF8G0ENPN2QAAAX8"]
[Sat Jul 18 23:40:33.463380 2026] [security2:error] [pid 930223:tid 930285] [remote 47.128.58.22:13034] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "gertoger.org"] [uri "/ulaanbaatar-city-tours-sukhbaatar-square"] [unique_id "alxjUWpwVNghF8G0ENPN6wABbjs"]
[Sat Jul 18 23:40:33.897562 2026] [security2:error] [pid 930223:tid 930272] [remote 74.235.96.117:32806] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.235.74.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "oqw.bur.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxjUWpwVNghF8G0ENPOCwABcC4"]
[Sat Jul 18 23:40:34.122933 2026] [security2:error] [pid 930223:tid 930434] [client 173.239.196.162:60059] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "alxjUmpwVNghF8G0ENPOGAAAAVk"]
[Sat Jul 18 23:40:34.193913 2026] [security2:error] [pid 930223:tid 930310] [remote 74.235.96.117:32806] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.235.74.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "oqw.bur.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxjUmpwVNghF8G0ENPOGgABe1Q"], referer: https://oqw.bur.mybluehost.me/wp-login.php
[Sat Jul 18 23:40:35.016098 2026] [security2:error] [pid 930223:tid 930390] [client 173.239.196.165:52079] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/aks.php"] [unique_id "alxjU2pwVNghF8G0ENPOTAAAAS0"]
[Sat Jul 18 23:40:35.464704 2026] [ssl:error] [pid 930223:tid 930443] [client 54.86.115.253:58875] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname www.website-7ca3a27a.sbd.wid.mybluehost.me provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:40:35.647139 2026] [security2:error] [pid 930223:tid 930366] [client 74.7.227.179:44162] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxjU2pwVNghF8G0ENPOagABFQ4"], referer: https://tejasenvironmental.com/p=838253
[Sat Jul 18 23:40:35.811906 2026] [security2:error] [pid 930223:tid 930407] [client 34.10.140.162:31794] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "greenvillemoving.com"] [uri "/wp-json/batch/v1"] [unique_id "alxjU2pwVNghF8G0ENPOgAAAAT4"]
[Sat Jul 18 23:40:35.890413 2026] [security2:error] [pid 930223:tid 930387] [client 173.239.196.164:55651] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/litespeed.php"] [unique_id "alxjU2pwVNghF8G0ENPOiQAAASo"]
[Sat Jul 18 23:40:36.037467 2026] [security2:error] [pid 930223:tid 930357] [client 223.228.182.224:32272] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjVGpwVNghF8G0ENPOjwAAAQw"]
[Sat Jul 18 23:40:36.037586 2026] [security2:error] [pid 930223:tid 930357] [client 223.228.182.224:32272] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjVGpwVNghF8G0ENPOjwAAAQw"]
[Sat Jul 18 23:40:36.054318 2026] [security2:error] [pid 930223:tid 930365] [client 34.10.140.162:31794] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "greenvillemoving.com"] [uri "/"] [unique_id "alxjVGpwVNghF8G0ENPOkAAAARQ"]
[Sat Jul 18 23:40:36.772967 2026] [security2:error] [pid 930223:tid 930408] [client 173.239.196.160:30365] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/img/about.php"] [unique_id "alxjVGpwVNghF8G0ENPOuwAAAT8"]
[Sat Jul 18 23:40:37.008542 2026] [security2:error] [pid 930223:tid 930350] [remote 165.232.173.236:60222] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 236.173.232.165.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "dadanetnet.net"] [uri "/wp-login.php"] [unique_id "alxjVGpwVNghF8G0ENPOzgABW3w"]
[Sat Jul 18 23:40:37.397336 2026] [security2:error] [pid 930223:tid 930353] [remote 165.232.173.236:60222] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 236.173.232.165.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "dadanetnet.net"] [uri "/wp-login.php"] [unique_id "alxjVWpwVNghF8G0ENPO3QABQ38"], referer: https://dadanetnet.net/wp-login.php
[Sat Jul 18 23:40:37.593334 2026] [security2:error] [pid 930223:tid 930392] [client 34.10.140.162:65530] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "greenvillemoving.com"] [uri "/wp-json/batch/v1"] [unique_id "alxjVWpwVNghF8G0ENPO8AAAAS8"]
[Sat Jul 18 23:40:37.635702 2026] [security2:error] [pid 930223:tid 930461] [client 173.239.196.164:25459] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/class-feed-index.php"] [unique_id "alxjVWpwVNghF8G0ENPO8gAAAXQ"]
[Sat Jul 18 23:40:38.111396 2026] [security2:error] [pid 930223:tid 930448] [client 34.10.140.162:65530] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "greenvillemoving.com"] [uri "/"] [unique_id "alxjVmpwVNghF8G0ENPPEwAAAWc"]
[Sat Jul 18 23:40:38.455051 2026] [security2:error] [pid 930223:tid 930433] [client 103.59.160.164:64501] ModSecurity: Access denied with code 406 (phase 1). Pattern match "^POST$" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "187"] [id "900401"] [msg "PHP Spam Botnet"] [hostname "webdisk.oyu.lcd.mybluehost.me"] [uri "/index.php"] [unique_id "alxjVmpwVNghF8G0ENPPJwAAAVg"]
[Sat Jul 18 23:40:38.488510 2026] [security2:error] [pid 930223:tid 930446] [client 173.239.196.167:58785] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wpn.php"] [unique_id "alxjVmpwVNghF8G0ENPPKgAAAWU"]
[Sat Jul 18 23:40:38.630110 2026] [security2:error] [pid 930223:tid 930300] [remote 182.77.62.24:55598] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.62.77.182.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "allandbeckson.com"] [uri "/wp-login.php"] [unique_id "alxjVmpwVNghF8G0ENPPNQABW0o"]
[Sat Jul 18 23:40:38.901959 2026] [security2:error] [pid 930223:tid 930361] [client 138.252.89.100:50885] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjVmpwVNghF8G0ENPPSwAAARA"]
[Sat Jul 18 23:40:38.902073 2026] [security2:error] [pid 930223:tid 930361] [client 138.252.89.100:50885] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjVmpwVNghF8G0ENPPSwAAARA"]
[Sat Jul 18 23:40:39.181307 2026] [security2:error] [pid 930223:tid 930230] [remote 182.77.62.24:55598] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.62.77.182.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "allandbeckson.com"] [uri "/wp-login.php"] [unique_id "alxjV2pwVNghF8G0ENPPYQABhgQ"], referer: https://allandbeckson.com/wp-login.php
[Sat Jul 18 23:40:39.196129 2026] [security2:error] [pid 930223:tid 930335] [remote 51.195.44.250:56888] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 250.44.195.51.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-login.php"] [unique_id "alxjV2pwVNghF8G0ENPPYAABLW0"]
[Sat Jul 18 23:40:39.333163 2026] [security2:error] [pid 930223:tid 930374] [client 173.239.196.161:50245] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/classwithtostring.php"] [unique_id "alxjV2pwVNghF8G0ENPPZwAAAR0"]
[Sat Jul 18 23:40:39.400196 2026] [security2:error] [pid 930223:tid 930351] [remote 51.195.44.250:56888] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 250.44.195.51.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-login.php"] [unique_id "alxjV2pwVNghF8G0ENPPaQABRn0"], referer: https://samdothan.org/wp-login.php
[Sat Jul 18 23:40:39.487817 2026] [security2:error] [pid 930223:tid 930416] [client 163.61.1.17:50900] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjV2pwVNghF8G0ENPPbQAAAUc"]
[Sat Jul 18 23:40:39.491433 2026] [security2:error] [pid 930223:tid 930416] [client 163.61.1.17:50900] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjV2pwVNghF8G0ENPPbQAAAUc"]
[Sat Jul 18 23:40:39.941700 2026] [security2:error] [pid 930223:tid 930244] [remote 152.228.213.32:50582] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/wp-login.php"] [unique_id "alxjV2pwVNghF8G0ENPPiwABFxI"]
[Sat Jul 18 23:40:40.132384 2026] [security2:error] [pid 930223:tid 930319] [remote 152.228.213.32:50582] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/wp-login.php"] [unique_id "alxjWGpwVNghF8G0ENPPlQABYF0"], referer: https://youpositive.co/wp-login.php
[Sat Jul 18 23:40:40.168730 2026] [security2:error] [pid 930223:tid 930416] [client 173.239.196.167:47285] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/acme-challenge/iR7SzrsOUEP.php"] [unique_id "alxjWGpwVNghF8G0ENPPmgAAAUc"]
[Sat Jul 18 23:40:41.056889 2026] [security2:error] [pid 930223:tid 930416] [client 173.239.196.167:33719] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "alxjWWpwVNghF8G0ENPPwwAAAUc"]
[Sat Jul 18 23:40:41.404376 2026] [security2:error] [pid 930223:tid 930364] [client 139.167.225.146:52638] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjWWpwVNghF8G0ENPP4QAAARM"]
[Sat Jul 18 23:40:41.404542 2026] [security2:error] [pid 930223:tid 930364] [client 139.167.225.146:52638] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjWWpwVNghF8G0ENPP4QAAARM"]
[Sat Jul 18 23:40:41.579446 2026] [security2:error] [pid 930223:tid 930231] [remote 97.74.93.24:37390] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lapietramedjugorje.com"] [uri "/wp-login.php"] [unique_id "alxjWWpwVNghF8G0ENPP6wABWAU"]
[Sat Jul 18 23:40:41.904571 2026] [security2:error] [pid 930223:tid 930452] [client 173.239.196.163:22027] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/twentytwentyfour/functions.php"] [unique_id "alxjWWpwVNghF8G0ENPQBAAAAWs"]
[Sat Jul 18 23:40:41.997313 2026] [security2:error] [pid 930223:tid 930337] [remote 97.74.93.24:37390] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lapietramedjugorje.com"] [uri "/wp-login.php"] [unique_id "alxjWWpwVNghF8G0ENPQCwABSW8"], referer: https://lapietramedjugorje.com/wp-login.php
[Sat Jul 18 23:40:42.034949 2026] [security2:error] [pid 930223:tid 930389] [client 192.71.142.232:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "drewsasburyparkbeachhouse.com"] [uri "/index.php"] [unique_id "alxjWWpwVNghF8G0ENPP7gAAASw"], referer: http://drewsasburyparkbeachhouse.com/about/#Walking-or-Biking-to-the-Beach
[Sat Jul 18 23:40:42.635466 2026] [security2:error] [pid 930223:tid 930365] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxjWmpwVNghF8G0ENPQKQAAARQ"]
[Sat Jul 18 23:40:42.735015 2026] [security2:error] [pid 930223:tid 930462] [client 173.239.196.160:58117] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/db.php"] [unique_id "alxjWmpwVNghF8G0ENPQRgAAAXU"]
[Sat Jul 18 23:40:43.113108 2026] [security2:error] [pid 930223:tid 930439] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxjWmpwVNghF8G0ENPQVQAAAV4"]
[Sat Jul 18 23:40:43.248948 2026] [security2:error] [pid 930223:tid 930473] [client 180.252.198.240:51752] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjW2pwVNghF8G0ENPQaQAAAYA"]
[Sat Jul 18 23:40:43.249322 2026] [security2:error] [pid 930223:tid 930473] [client 180.252.198.240:51752] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjW2pwVNghF8G0ENPQaQAAAYA"]
[Sat Jul 18 23:40:43.421068 2026] [security2:error] [pid 930223:tid 930422] [client 106.222.249.209:15827] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjW2pwVNghF8G0ENPQdQAAAU0"]
[Sat Jul 18 23:40:43.421431 2026] [security2:error] [pid 930223:tid 930422] [client 106.222.249.209:15827] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjW2pwVNghF8G0ENPQdQAAAU0"]
[Sat Jul 18 23:40:43.494273 2026] [security2:error] [pid 930223:tid 930348] [remote 31.42.184.154:35272] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxjW2pwVNghF8G0ENPQdwABdXo"]
[Sat Jul 18 23:40:43.518306 2026] [security2:error] [pid 930223:tid 930476] [client 47.128.34.4:15268] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "thelastgamestandingexp.com"] [uri "/robots.txt"] [unique_id "alxjW2pwVNghF8G0ENPQeQAAAYM"]
[Sat Jul 18 23:40:43.589991 2026] [security2:error] [pid 930223:tid 930436] [client 173.239.196.164:44261] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "alxjW2pwVNghF8G0ENPQfwAAAVs"]
[Sat Jul 18 23:40:43.768166 2026] [security2:error] [pid 930223:tid 930263] [remote 31.42.184.154:35272] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxjW2pwVNghF8G0ENPQkAABciU"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:40:44.369707 2026] [security2:error] [pid 930223:tid 930403] [client 74.208.214.194:56782] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxjXGpwVNghF8G0ENPQwQAAATo"]
[Sat Jul 18 23:40:44.461317 2026] [security2:error] [pid 930223:tid 930431] [client 173.239.196.162:63957] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "alxjXGpwVNghF8G0ENPQwwAAAVY"]
[Sat Jul 18 23:40:44.731680 2026] [security2:error] [pid 930223:tid 930454] [client 223.228.182.224:20156] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjXGpwVNghF8G0ENPQ2AAAAW0"]
[Sat Jul 18 23:40:44.735998 2026] [security2:error] [pid 930223:tid 930454] [client 223.228.182.224:20156] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjXGpwVNghF8G0ENPQ2AAAAW0"]
[Sat Jul 18 23:40:45.219727 2026] [security2:error] [pid 930223:tid 930442] [client 4.194.24.143:49691] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/nine2code.php"] [unique_id "alxjXWpwVNghF8G0ENPQ9QAAAWE"]
[Sat Jul 18 23:40:45.308823 2026] [security2:error] [pid 930223:tid 930388] [client 173.239.196.161:43121] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "alxjXWpwVNghF8G0ENPQ-QAAASs"]
[Sat Jul 18 23:40:45.700862 2026] [security2:error] [pid 930223:tid 930369] [client 50.116.65.227:56328] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.fkconstructionfunding.com"] [uri "/wp-content/plugins/contact-form-7/includes/css/styles.css"] [unique_id "alxjXWpwVNghF8G0ENPREgAAARg"]
[Sat Jul 18 23:40:45.709904 2026] [security2:error] [pid 930223:tid 930440] [client 50.116.65.227:56334] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.fkconstructionfunding.com"] [uri "/wp-content/plugins/contact-form-7/includes/css/styles-rtl.css"] [unique_id "alxjXWpwVNghF8G0ENPRFAAAAV8"]
[Sat Jul 18 23:40:46.183154 2026] [security2:error] [pid 930223:tid 930458] [client 173.239.196.163:27621] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "alxjXmpwVNghF8G0ENPRMQAAAXE"]
[Sat Jul 18 23:40:46.367125 2026] [security2:error] [pid 930223:tid 930433] [client 50.116.65.227:56352] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.fkconstructionfunding.com"] [uri "/index.php"] [unique_id "alxjXmpwVNghF8G0ENPRMAAAAVg"]
[Sat Jul 18 23:40:46.551922 2026] [security2:error] [pid 930223:tid 930460] [client 50.116.65.227:56358] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.fkconstructionfunding.com"] [uri "/index.php"] [unique_id "alxjXmpwVNghF8G0ENPRPwAAAXM"]
[Sat Jul 18 23:40:46.896314 2026] [security2:error] [pid 930223:tid 930426] [client 4.194.24.143:33292] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/num.php"] [unique_id "alxjXmpwVNghF8G0ENPRVAAAAVE"]
[Sat Jul 18 23:40:47.014880 2026] [security2:error] [pid 930223:tid 930268] [remote 4.205.168.44:36996] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "christiancountytrumpet.com"] [uri "/wp-login.php"] [unique_id "alxjXmpwVNghF8G0ENPRWwABYCo"]
[Sat Jul 18 23:40:47.022435 2026] [security2:error] [pid 930223:tid 930464] [client 173.239.196.165:48205] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "alxjX2pwVNghF8G0ENPRXQAAAXc"]
[Sat Jul 18 23:40:47.190305 2026] [security2:error] [pid 930223:tid 930296] [remote 4.205.168.44:36996] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "christiancountytrumpet.com"] [uri "/wp-login.php"] [unique_id "alxjX2pwVNghF8G0ENPRbAABQ0Y"], referer: https://christiancountytrumpet.com/wp-login.php
[Sat Jul 18 23:40:47.379653 2026] [security2:error] [pid 930223:tid 930378] [client 18.212.127.231:53050] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 231.127.212.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxjX2pwVNghF8G0ENPRewAAASE"], referer: https://curlsnpearlsss.com/es/category/food/dinners/page/3/
[Sat Jul 18 23:40:47.754470 2026] [security2:error] [pid 930223:tid 930405] [client 4.194.24.143:49696] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/odf7udtspqtpxzyxmw2rccdefault.php"] [unique_id "alxjX2pwVNghF8G0ENPRmwAAATw"]
[Sat Jul 18 23:40:47.876680 2026] [security2:error] [pid 930223:tid 930367] [client 173.239.196.160:49319] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/tinyfilemanager/tinyfilemanager.php"] [unique_id "alxjX2pwVNghF8G0ENPRowAAARY"]
[Sat Jul 18 23:40:48.487439 2026] [security2:error] [pid 930223:tid 930358] [client 57.141.18.96:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxjYGpwVNghF8G0ENPRwgAAAQ0"]
[Sat Jul 18 23:40:48.539816 2026] [security2:error] [pid 930223:tid 930387] [client 4.194.24.143:33311] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/option.php"] [unique_id "alxjYGpwVNghF8G0ENPR1AAAASo"]
[Sat Jul 18 23:40:48.543110 2026] [security2:error] [pid 930223:tid 930405] [client 52.201.135.180:49372] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 180.135.201.52.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxjYGpwVNghF8G0ENPR1QAAATw"], referer: https://curlsnpearlsss.com/es/category/food/dinners/page/3/
[Sat Jul 18 23:40:48.745876 2026] [security2:error] [pid 930223:tid 930448] [client 173.239.196.166:32177] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/light/colors.min.php"] [unique_id "alxjYGpwVNghF8G0ENPR4wAAAWc"]
[Sat Jul 18 23:40:49.149533 2026] [security2:error] [pid 930223:tid 930479] [client 4.194.24.143:49699] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/p.php"] [unique_id "alxjYWpwVNghF8G0ENPR_gAAAYY"]
[Sat Jul 18 23:40:49.504815 2026] [security2:error] [pid 930223:tid 930261] [remote 31.42.184.154:40554] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "alchemygroup.ca"] [uri "/wp-login.php"] [unique_id "alxjYWpwVNghF8G0ENPSGQABcyM"]
[Sat Jul 18 23:40:49.628153 2026] [security2:error] [pid 930223:tid 930476] [client 173.239.196.161:24963] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "alxjYWpwVNghF8G0ENPSJAAAAYM"]
[Sat Jul 18 23:40:49.742412 2026] [security2:error] [pid 930223:tid 930456] [client 4.194.24.143:33314] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/past.php"] [unique_id "alxjYWpwVNghF8G0ENPSKgAAAW8"]
[Sat Jul 18 23:40:49.756719 2026] [security2:error] [pid 930223:tid 930246] [remote 31.42.184.154:40554] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "alchemygroup.ca"] [uri "/wp-login.php"] [unique_id "alxjYWpwVNghF8G0ENPSKwABMxQ"], referer: https://alchemygroup.ca/wp-login.php
[Sat Jul 18 23:40:49.906872 2026] [security2:error] [pid 930223:tid 930309] [remote 217.182.128.41:33848] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.128.182.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxjYWpwVNghF8G0ENPSMgABdlM"]
[Sat Jul 18 23:40:50.112685 2026] [security2:error] [pid 930223:tid 930274] [remote 217.182.128.41:33848] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.128.182.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxjYmpwVNghF8G0ENPSPwABEjA"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:40:50.147650 2026] [security2:error] [pid 930223:tid 930227] [remote 103.255.134.61:53398] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.134.255.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.innspace.ca"] [uri "/wp-login.php"] [unique_id "alxjYmpwVNghF8G0ENPSQwABQAE"]
[Sat Jul 18 23:40:50.253448 2026] [security2:error] [pid 930223:tid 930242] [remote 20.153.140.50:41908] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "maa.hws.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxjYmpwVNghF8G0ENPSTwABXxA"]
[Sat Jul 18 23:40:50.445622 2026] [security2:error] [pid 930223:tid 930446] [client 163.61.1.17:51384] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjYmpwVNghF8G0ENPSYAAAAWU"]
[Sat Jul 18 23:40:50.445843 2026] [security2:error] [pid 930223:tid 930446] [client 163.61.1.17:51384] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjYmpwVNghF8G0ENPSYAAAAWU"]
[Sat Jul 18 23:40:50.473813 2026] [security2:error] [pid 930223:tid 930397] [client 173.239.196.161:56723] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "alxjYmpwVNghF8G0ENPSZAAAATQ"]
[Sat Jul 18 23:40:50.478905 2026] [security2:error] [pid 930223:tid 930445] [client 4.194.24.143:33283] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/php.php"] [unique_id "alxjYmpwVNghF8G0ENPSZQAAAWQ"]
[Sat Jul 18 23:40:50.483572 2026] [security2:error] [pid 930223:tid 930392] [client 138.252.89.100:51407] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjYmpwVNghF8G0ENPSZgAAAS8"]
[Sat Jul 18 23:40:50.483680 2026] [security2:error] [pid 930223:tid 930392] [client 138.252.89.100:51407] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjYmpwVNghF8G0ENPSZgAAAS8"]
[Sat Jul 18 23:40:50.686924 2026] [security2:error] [pid 930223:tid 930288] [remote 103.255.134.61:53398] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.134.255.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.innspace.ca"] [uri "/wp-login.php"] [unique_id "alxjYmpwVNghF8G0ENPSdwABPz4"], referer: https://mail.innspace.ca/wp-login.php
[Sat Jul 18 23:40:50.790724 2026] [security2:error] [pid 930223:tid 930257] [remote 182.77.62.24:49752] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.62.77.182.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "intelligentengineeringsolutions.com"] [uri "/wp-login.php"] [unique_id "alxjYmpwVNghF8G0ENPSewABVh8"]
[Sat Jul 18 23:40:50.853907 2026] [security2:error] [pid 930223:tid 930375] [client 180.74.68.26:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.adambergeron.com"] [uri "/index.php"] [unique_id "alxjYWpwVNghF8G0ENPSFwAAAR4"]
[Sat Jul 18 23:40:51.072456 2026] [security2:error] [pid 930223:tid 930445] [client 4.194.24.143:49664] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/php8.php"] [unique_id "alxjY2pwVNghF8G0ENPSjAAAAWQ"]
[Sat Jul 18 23:40:51.328629 2026] [security2:error] [pid 930223:tid 930254] [remote 182.77.62.24:49752] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.62.77.182.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "intelligentengineeringsolutions.com"] [uri "/wp-login.php"] [unique_id "alxjY2pwVNghF8G0ENPSnAABGhw"], referer: https://intelligentengineeringsolutions.com/wp-login.php
[Sat Jul 18 23:40:51.340661 2026] [security2:error] [pid 930223:tid 930440] [client 173.239.196.162:39509] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "alxjY2pwVNghF8G0ENPSnQAAAV8"]
[Sat Jul 18 23:40:51.361603 2026] [security2:error] [pid 930223:tid 930287] [remote 20.153.140.50:41908] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "maa.hws.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxjY2pwVNghF8G0ENPSngABGz0"], referer: https://maa.hws.mybluehost.me/wp-login.php
[Sat Jul 18 23:40:51.612987 2026] [security2:error] [pid 930223:tid 930433] [client 4.194.24.143:33308] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/phpinfo.php"] [unique_id "alxjY2pwVNghF8G0ENPSrgAAAVg"]
[Sat Jul 18 23:40:51.907552 2026] [security2:error] [pid 930223:tid 930448] [client 139.167.225.146:53262] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjY2pwVNghF8G0ENPSyQAAAWc"]
[Sat Jul 18 23:40:51.907676 2026] [security2:error] [pid 930223:tid 930448] [client 139.167.225.146:53262] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjY2pwVNghF8G0ENPSyQAAAWc"]
[Sat Jul 18 23:40:51.951303 2026] [autoindex:error] [pid 930223:tid 930361] [client 170.106.35.153:0] AH01276: Cannot serve directory /home2/youposit/public_html/upositive/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:40:52.206830 2026] [security2:error] [pid 930223:tid 930447] [client 173.239.196.161:38417] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "alxjZGpwVNghF8G0ENPS4QAAAWY"]
[Sat Jul 18 23:40:52.252138 2026] [security2:error] [pid 930223:tid 930385] [client 57.141.18.76:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxjZGpwVNghF8G0ENPS1AAAASg"]
[Sat Jul 18 23:40:52.447549 2026] [security2:error] [pid 930223:tid 930452] [client 4.194.24.143:33326] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/post.php"] [unique_id "alxjZGpwVNghF8G0ENPS8wAAAWs"]
[Sat Jul 18 23:40:52.988380 2026] [security2:error] [pid 930223:tid 930426] [client 4.194.24.143:7588] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/public/assets/design_1/css/parts/course_cards/grid_card_1.min.php"] [unique_id "alxjZGpwVNghF8G0ENPTHAAAAVE"]
[Sat Jul 18 23:40:53.050182 2026] [security2:error] [pid 930223:tid 930451] [client 173.239.196.166:42373] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/Text/options.php"] [unique_id "alxjZWpwVNghF8G0ENPTHgAAAWo"]
[Sat Jul 18 23:40:53.116819 2026] [security2:error] [pid 930223:tid 930406] [client 145.239.10.137:50313] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 137.10.239.145.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-rahudsongallery-com/class.php"] [unique_id "alxjZWpwVNghF8G0ENPTIAAAAT0"], referer: https://sustaintheart.com/press-release-sustaintheart-com-acquires-rahudsongallery-com/class.php
[Sat Jul 18 23:40:53.575766 2026] [security2:error] [pid 930223:tid 930355] [client 180.252.198.240:52385] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjZWpwVNghF8G0ENPTOwAAAQo"]
[Sat Jul 18 23:40:53.575877 2026] [security2:error] [pid 930223:tid 930355] [client 180.252.198.240:52385] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjZWpwVNghF8G0ENPTOwAAAQo"]
[Sat Jul 18 23:40:53.583966 2026] [security2:error] [pid 930223:tid 930457] [client 4.194.24.143:7754] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/public/css.php"] [unique_id "alxjZWpwVNghF8G0ENPTPAAAAXA"]
[Sat Jul 18 23:40:53.696521 2026] [security2:error] [pid 930223:tid 930349] [remote 20.153.140.50:41912] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxjZWpwVNghF8G0ENPTPwABFns"]
[Sat Jul 18 23:40:53.882092 2026] [security2:error] [pid 930223:tid 930448] [client 173.239.196.163:34549] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/acme-challenge/wp-load.php"] [unique_id "alxjZWpwVNghF8G0ENPTVgAAAWc"]
[Sat Jul 18 23:40:54.100190 2026] [security2:error] [pid 930223:tid 930236] [remote 20.153.140.50:41912] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxjZmpwVNghF8G0ENPTYwABKgo"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:40:54.124024 2026] [security2:error] [pid 930223:tid 930404] [client 4.194.24.143:7596] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/r.php"] [unique_id "alxjZmpwVNghF8G0ENPTZQAAATs"]
[Sat Jul 18 23:40:54.156242 2026] [security2:error] [pid 930223:tid 930394] [client 106.222.249.209:31477] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjZmpwVNghF8G0ENPTZwAAATE"]
[Sat Jul 18 23:40:54.156349 2026] [security2:error] [pid 930223:tid 930394] [client 106.222.249.209:31477] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjZmpwVNghF8G0ENPTZwAAATE"]
[Sat Jul 18 23:40:54.264116 2026] [security2:error] [pid 930223:tid 930419] [client 181.124.147.164:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "adambergeron.com"] [uri "/index.php"] [unique_id "alxjZmpwVNghF8G0ENPTZAAAAUo"]
[Sat Jul 18 23:40:54.647051 2026] [security2:error] [pid 930223:tid 930325] [remote 192.249.127.213:33424] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 213.127.249.192.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "zlp.omk.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxjZmpwVNghF8G0ENPTgwABVGM"]
[Sat Jul 18 23:40:54.647325 2026] [security2:error] [pid 930223:tid 930429] [client 192.249.127.213:33424] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "zlp.omk.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxjZmpwVNghF8G0ENPTgwABVGM"]
[Sat Jul 18 23:40:54.680061 2026] [security2:error] [pid 930223:tid 930378] [client 4.194.24.143:33337] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/radio.php"] [unique_id "alxjZmpwVNghF8G0ENPThQAAASE"]
[Sat Jul 18 23:40:54.742822 2026] [security2:error] [pid 930223:tid 930371] [client 173.239.196.162:38261] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/upgrade/cc.php"] [unique_id "alxjZmpwVNghF8G0ENPTiQAAARo"]
[Sat Jul 18 23:40:54.802355 2026] [security2:error] [pid 930223:tid 930449] [client 57.141.18.82:60766] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "bigwormfishing.com"] [uri "/index.php"] [unique_id "alxjZmpwVNghF8G0ENPTeAABaFk"]
[Sat Jul 18 23:40:55.283591 2026] [security2:error] [pid 930223:tid 930369] [client 223.228.182.224:27046] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjZ2pwVNghF8G0ENPTmgAAARg"]
[Sat Jul 18 23:40:55.283686 2026] [security2:error] [pid 930223:tid 930369] [client 223.228.182.224:27046] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjZ2pwVNghF8G0ENPTmgAAARg"]
[Sat Jul 18 23:40:55.299603 2026] [security2:error] [pid 930223:tid 930411] [client 4.194.24.143:49727] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/randkeyword.php7"] [unique_id "alxjZ2pwVNghF8G0ENPTnQAAAUI"]
[Sat Jul 18 23:40:55.605196 2026] [security2:error] [pid 930223:tid 930250] [remote 199.189.225.167:53231] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.225.189.199.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxjZ2pwVNghF8G0ENPTrgABPxg"]
[Sat Jul 18 23:40:55.633110 2026] [security2:error] [pid 930223:tid 930469] [client 173.239.196.163:32799] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/aahana/worksec.php"] [unique_id "alxjZ2pwVNghF8G0ENPTsQAAAXw"]
[Sat Jul 18 23:40:55.801085 2026] [security2:error] [pid 930223:tid 930350] [remote 199.189.225.167:53231] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.225.189.199.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxjZ2pwVNghF8G0ENPTuAABaHw"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:40:55.902326 2026] [security2:error] [pid 930223:tid 930388] [client 4.194.24.143:49722] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/readme.php"] [unique_id "alxjZ2pwVNghF8G0ENPTwgAAASs"]
[Sat Jul 18 23:40:56.453234 2026] [security2:error] [pid 930223:tid 930420] [client 4.194.24.143:7747] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/reze.php"] [unique_id "alxjaGpwVNghF8G0ENPT4QAAAUs"]
[Sat Jul 18 23:40:56.555764 2026] [security2:error] [pid 930223:tid 930472] [client 173.239.196.160:33505] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "alxjaGpwVNghF8G0ENPT6wAAAX8"]
[Sat Jul 18 23:40:56.593738 2026] [security2:error] [pid 930223:tid 930272] [remote 4.205.168.44:48594] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxjaGpwVNghF8G0ENPT7wABUS4"]
[Sat Jul 18 23:40:56.762410 2026] [security2:error] [pid 930223:tid 930352] [remote 4.205.168.44:48594] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxjaGpwVNghF8G0ENPT9gABhH4"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:40:56.793223 2026] [security2:error] [pid 930223:tid 930292] [remote 152.228.213.32:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "innovativecleaningsvs.com"] [uri "/xmlrpc.php"] [unique_id "alxjaGpwVNghF8G0ENPT-AABQ0I"]
[Sat Jul 18 23:40:56.793412 2026] [security2:error] [pid 930223:tid 930412] [client 152.228.213.32:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "innovativecleaningsvs.com"] [uri "/xmlrpc.php"] [unique_id "alxjaGpwVNghF8G0ENPT-AABQ0I"]
[Sat Jul 18 23:40:56.993178 2026] [security2:error] [pid 930223:tid 930476] [client 4.194.24.143:7772] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/rh.php"] [unique_id "alxjaGpwVNghF8G0ENPT_QAAAYM"]
[Sat Jul 18 23:40:57.034920 2026] [http2:info] [pid 938041:tid 938041] h2_workers: created with min=128 max=192 idle_ms=600000
[Sat Jul 18 23:40:57.434730 2026] [security2:error] [pid 938041:tid 938217] [client 173.239.196.164:65143] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/includes/class_api.php"] [unique_id "alxjaSNrzsYMDd5sB10VrgAAAC0"]
[Sat Jul 18 23:40:57.444180 2026] [security2:error] [pid 938041:tid 938199] [client 34.62.208.217:47192] ModSecurity: Access denied with code 406 (phase 1). Pattern match "python-requests|python-urllib" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "1460"] [id "909111"] [msg "Python UA brute"] [hostname "mail.genesisventureglobal.com"] [uri "/"] [unique_id "alxjaSNrzsYMDd5sB10VrwAAABs"]
[Sat Jul 18 23:40:57.557198 2026] [security2:error] [pid 938041:tid 938223] [client 52.207.32.99:55044] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.32.207.52.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxjaSNrzsYMDd5sB10VvAAAADM"], referer: https://curlsnpearlsss.com/es/category/food/dinners/page/3/
[Sat Jul 18 23:40:57.563731 2026] [security2:error] [pid 938041:tid 938208] [client 4.194.24.143:49706] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/rip.php"] [unique_id "alxjaSNrzsYMDd5sB10VvQAAACQ"]
[Sat Jul 18 23:40:58.101903 2026] [security2:error] [pid 938041:tid 938273] [client 4.194.24.143:33336] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/root.php"] [unique_id "alxjaiNrzsYMDd5sB10V3AAAAGU"]
[Sat Jul 18 23:40:58.340975 2026] [security2:error] [pid 938041:tid 938210] [client 173.239.196.160:32705] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/plugins/content/apismtp/apismtp.php"] [unique_id "alxjaiNrzsYMDd5sB10V6gAAACY"]
[Sat Jul 18 23:40:58.572936 2026] [security2:error] [pid 938041:tid 938212] [client 57.141.18.36:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxjaiNrzsYMDd5sB10V8AAAACg"]
[Sat Jul 18 23:40:58.795968 2026] [security2:error] [pid 938041:tid 938219] [client 4.194.24.143:60196] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/s.php"] [unique_id "alxjaiNrzsYMDd5sB10WCQAAAC8"]
[Sat Jul 18 23:40:59.255589 2026] [security2:error] [pid 938041:tid 938291] [client 173.239.196.164:26125] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/includes/class-core-upgrader-first.php"] [unique_id "alxjayNrzsYMDd5sB10WJgAAAHc"]
[Sat Jul 18 23:40:59.421889 2026] [security2:error] [pid 938041:tid 938187] [client 4.194.24.143:7570] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/sang.php"] [unique_id "alxjayNrzsYMDd5sB10WKwAAAA8"]
[Sat Jul 18 23:41:00.004308 2026] [security2:error] [pid 938041:tid 938249] [client 4.194.24.143:33317] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/scxy.php"] [unique_id "alxjbCNrzsYMDd5sB10WSQAAAE0"]
[Sat Jul 18 23:41:00.121052 2026] [security2:error] [pid 938041:tid 938294] [client 173.239.196.163:52989] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/wp-css.php"] [unique_id "alxjbCNrzsYMDd5sB10WVAAAAHo"]
[Sat Jul 18 23:41:00.593480 2026] [security2:error] [pid 938041:tid 938184] [client 4.194.24.143:60167] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/sd.php"] [unique_id "alxjbCNrzsYMDd5sB10WeAAAAAw"]
[Sat Jul 18 23:41:00.830176 2026] [security2:error] [pid 938041:tid 938268] [client 163.61.1.17:51857] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjbCNrzsYMDd5sB10WjAAAAGA"]
[Sat Jul 18 23:41:00.830331 2026] [security2:error] [pid 938041:tid 938268] [client 163.61.1.17:51857] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjbCNrzsYMDd5sB10WjAAAAGA"]
[Sat Jul 18 23:41:00.984484 2026] [security2:error] [pid 938041:tid 938285] [client 173.239.196.163:34081] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/IXR/goto.php"] [unique_id "alxjbCNrzsYMDd5sB10WkwAAAHE"]
[Sat Jul 18 23:41:01.272606 2026] [security2:error] [pid 938041:tid 938297] [client 4.194.24.143:7574] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/sf.php"] [unique_id "alxjbSNrzsYMDd5sB10WqQAAAH0"]
[Sat Jul 18 23:41:01.416563 2026] [security2:error] [pid 938041:tid 938219] [client 57.141.18.51:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "idigress.group"] [uri "/index.php"] [unique_id "alxjayNrzsYMDd5sB10WRQAAAC8"]
[Sat Jul 18 23:41:01.691091 2026] [security2:error] [pid 938041:tid 938255] [client 57.141.18.110:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxjbSNrzsYMDd5sB10WtgAAAFM"]
[Sat Jul 18 23:41:01.869429 2026] [security2:error] [pid 938041:tid 938287] [client 173.239.196.161:36903] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/blue/xboom.php"] [unique_id "alxjbSNrzsYMDd5sB10WxQAAAHM"]
[Sat Jul 18 23:41:02.082005 2026] [security2:error] [pid 938041:tid 938214] [client 138.252.89.100:51927] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjbiNrzsYMDd5sB10W3QAAACo"]
[Sat Jul 18 23:41:02.082830 2026] [security2:error] [pid 938041:tid 938214] [client 138.252.89.100:51927] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjbiNrzsYMDd5sB10W3QAAACo"]
[Sat Jul 18 23:41:02.143744 2026] [security2:error] [pid 938041:tid 938253] [client 139.167.225.146:53889] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjbiNrzsYMDd5sB10W5AAAAFE"]
[Sat Jul 18 23:41:02.143888 2026] [security2:error] [pid 938041:tid 938253] [client 139.167.225.146:53889] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjbiNrzsYMDd5sB10W5AAAAFE"]
[Sat Jul 18 23:41:02.212812 2026] [security2:error] [pid 938041:tid 938177] [client 4.194.24.143:33318] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/shell.php"] [unique_id "alxjbiNrzsYMDd5sB10W6gAAAAU"]
[Sat Jul 18 23:41:02.724472 2026] [security2:error] [pid 938041:tid 938230] [client 173.239.196.165:42655] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/kadence/functions.php"] [unique_id "alxjbiNrzsYMDd5sB10XGQAAADo"]
[Sat Jul 18 23:41:03.136270 2026] [fcgid:warn] [pid 938041:tid 938219] (70014)End of file found: [client 198.235.24.84:58474] mod_fcgid: can't get data from http client
[Sat Jul 18 23:41:03.180371 2026] [security2:error] [pid 938041:tid 938179] [client 4.194.24.143:60199] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/sid3.php"] [unique_id "alxjbyNrzsYMDd5sB10XOwAAAAc"]
[Sat Jul 18 23:41:03.410800 2026] [fcgid:warn] [pid 938041:tid 938278] (70014)End of file found: [client 198.235.24.84:58486] mod_fcgid: can't get data from http client
[Sat Jul 18 23:41:03.555983 2026] [security2:error] [pid 938041:tid 938282] [client 173.239.196.164:31367] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/Sanskrit.php"] [unique_id "alxjbyNrzsYMDd5sB10XUQAAAG4"]
[Sat Jul 18 23:41:03.886668 2026] [security2:error] [pid 938041:tid 938299] [client 4.194.24.143:60220] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/simple.php"] [unique_id "alxjbyNrzsYMDd5sB10XbQAAAH8"]
[Sat Jul 18 23:41:04.414781 2026] [security2:error] [pid 938041:tid 938258] [client 173.239.196.166:52385] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-fmfile.php"] [unique_id "alxjcCNrzsYMDd5sB10XkgAAAFY"]
[Sat Jul 18 23:41:04.665455 2026] [security2:error] [pid 938041:tid 938201] [client 4.194.24.143:54792] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/sitemap.php"] [unique_id "alxjcCNrzsYMDd5sB10XpgAAAB0"]
[Sat Jul 18 23:41:04.727862 2026] [security2:error] [pid 938041:tid 938235] [client 106.222.249.209:21966] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjcCNrzsYMDd5sB10XsQAAAD8"]
[Sat Jul 18 23:41:04.727953 2026] [security2:error] [pid 938041:tid 938235] [client 106.222.249.209:21966] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjcCNrzsYMDd5sB10XsQAAAD8"]
[Sat Jul 18 23:41:04.926075 2026] [security2:error] [pid 938041:tid 938241] [client 180.252.198.240:52887] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjcCNrzsYMDd5sB10XvAAAAEU"]
[Sat Jul 18 23:41:04.926214 2026] [security2:error] [pid 938041:tid 938241] [client 180.252.198.240:52887] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjcCNrzsYMDd5sB10XvAAAAEU"]
[Sat Jul 18 23:41:05.286539 2026] [security2:error] [pid 938041:tid 938186] [client 173.239.196.161:40411] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.trash7309/index.php"] [unique_id "alxjcSNrzsYMDd5sB10X3QAAAA4"]
[Sat Jul 18 23:41:05.336197 2026] [security2:error] [pid 938041:tid 938257] [client 4.194.24.143:60172] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/size.php"] [unique_id "alxjcSNrzsYMDd5sB10X4QAAAFU"]
[Sat Jul 18 23:41:05.981886 2026] [security2:error] [pid 938041:tid 938213] [client 223.228.182.224:53146] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjcSNrzsYMDd5sB10YGAAAACk"]
[Sat Jul 18 23:41:05.982017 2026] [security2:error] [pid 938041:tid 938213] [client 223.228.182.224:53146] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjcSNrzsYMDd5sB10YGAAAACk"]
[Sat Jul 18 23:41:06.086623 2026] [security2:error] [pid 938041:tid 938251] [client 4.194.24.143:60163] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/sm.php"] [unique_id "alxjciNrzsYMDd5sB10YHwAAAE8"]
[Sat Jul 18 23:41:06.132111 2026] [security2:error] [pid 938041:tid 938257] [client 173.239.196.163:46807] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/revslider/includes/external/page/index.php"] [unique_id "alxjciNrzsYMDd5sB10YJAAAAFU"]
[Sat Jul 18 23:41:06.282191 2026] [security2:error] [pid 938041:tid 938205] [client 43.135.107.245:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "timespans.org"] [uri "/index.php"] [unique_id "alxjcSNrzsYMDd5sB10X9gAAACE"]
[Sat Jul 18 23:41:06.689490 2026] [security2:error] [pid 938041:tid 938219] [client 4.194.24.143:54834] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/sql.php"] [unique_id "alxjciNrzsYMDd5sB10YUQAAAC8"]
[Sat Jul 18 23:41:07.006227 2026] [security2:error] [pid 938041:tid 938182] [client 173.239.196.162:55439] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/ioxi/ioxi/dropdown.php"] [unique_id "alxjcyNrzsYMDd5sB10YaQAAAAo"]
[Sat Jul 18 23:41:07.299147 2026] [security2:error] [pid 938041:tid 938224] [client 4.194.24.143:54820] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/ss.php"] [unique_id "alxjcyNrzsYMDd5sB10YgQAAADQ"]
[Sat Jul 18 23:41:07.422535 2026] [security2:error] [pid 938041:tid 938239] [client 34.172.185.49:42100] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "aandarealtygroup.com"] [uri "/wp-json/batch/v1"] [unique_id "alxjcyNrzsYMDd5sB10YkwAAAEM"]
[Sat Jul 18 23:41:07.509318 2026] [security2:error] [pid 938041:tid 938053] [remote 216.73.216.174:20845] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.216.73.216.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/training/"] [unique_id "alxjcyNrzsYMDd5sB10YlwAAFQo"]
[Sat Jul 18 23:41:07.897176 2026] [security2:error] [pid 938041:tid 938201] [client 173.239.196.166:32003] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/memberfuns.php"] [unique_id "alxjcyNrzsYMDd5sB10YqwAAAB0"]
[Sat Jul 18 23:41:07.998810 2026] [security2:error] [pid 938041:tid 938068] [remote 113.160.142.119:44036] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxjcyNrzsYMDd5sB10YtAAAURk"]
[Sat Jul 18 23:41:07.998951 2026] [security2:error] [pid 938041:tid 938253] [client 113.160.142.119:44036] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxjcyNrzsYMDd5sB10YtAAAURk"]
[Sat Jul 18 23:41:08.033255 2026] [security2:error] [pid 938041:tid 938210] [client 4.194.24.143:49723] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/stats.php"] [unique_id "alxjdCNrzsYMDd5sB10YuAAAACY"]
[Sat Jul 18 23:41:08.574610 2026] [security2:error] [pid 938041:tid 938278] [client 4.194.24.143:7579] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/sump1.php"] [unique_id "alxjdCNrzsYMDd5sB10Y5AAAAGo"]
[Sat Jul 18 23:41:08.628410 2026] [security2:error] [pid 938041:tid 938075] [remote 160.187.68.132:36478] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.68.187.160.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxjdCNrzsYMDd5sB10Y5gAASiA"]
[Sat Jul 18 23:41:08.776612 2026] [security2:error] [pid 938041:tid 938263] [client 173.239.196.160:43087] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/infos.php"] [unique_id "alxjdCNrzsYMDd5sB10Y7AAAAFs"]
[Sat Jul 18 23:41:08.981448 2026] [security2:error] [pid 938041:tid 938239] [client 34.172.185.49:42100] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "aandarealtygroup.com"] [uri "/"] [unique_id "alxjdCNrzsYMDd5sB10ZBAAAAEM"]
[Sat Jul 18 23:41:09.116892 2026] [security2:error] [pid 938041:tid 938252] [client 4.194.24.143:60203] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/system.php"] [unique_id "alxjdSNrzsYMDd5sB10ZEQAAAFA"]
[Sat Jul 18 23:41:09.411175 2026] [security2:error] [pid 938041:tid 938094] [remote 113.160.142.119:44046] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.holistichealthmassagenz.com"] [uri "/xmlrpc.php"] [unique_id "alxjdSNrzsYMDd5sB10ZKAAAUTM"]
[Sat Jul 18 23:41:09.411343 2026] [security2:error] [pid 938041:tid 938253] [client 113.160.142.119:44046] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "mail.holistichealthmassagenz.com"] [uri "/xmlrpc.php"] [unique_id "alxjdSNrzsYMDd5sB10ZKAAAUTM"]
[Sat Jul 18 23:41:09.653055 2026] [security2:error] [pid 938041:tid 938187] [client 173.239.196.161:53489] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/modules/file.php"] [unique_id "alxjdSNrzsYMDd5sB10ZOQAAAA8"]
[Sat Jul 18 23:41:09.657610 2026] [security2:error] [pid 938041:tid 938198] [client 4.194.24.143:35460] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/system/03n1hob7p03r2npdefault.php"] [unique_id "alxjdSNrzsYMDd5sB10ZOgAAABo"]
[Sat Jul 18 23:41:09.716777 2026] [security2:error] [pid 938041:tid 938275] [client 34.10.140.162:40566] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "gregoryanicholas.com"] [uri "/wp-json/batch/v1"] [unique_id "alxjdSNrzsYMDd5sB10ZPwAAAGc"]
[Sat Jul 18 23:41:09.869921 2026] [security2:error] [pid 938041:tid 938219] [client 168.205.15.4:55518] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "gertoger.org"] [uri "/index.php"] [unique_id "alxjdSNrzsYMDd5sB10ZRwAAL0U"], referer: https://www.yahoo.org/
[Sat Jul 18 23:41:10.268257 2026] [security2:error] [pid 938041:tid 938248] [client 34.10.140.162:40566] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "gregoryanicholas.com"] [uri "/"] [unique_id "alxjdiNrzsYMDd5sB10ZYQAAAEw"]
[Sat Jul 18 23:41:10.290299 2026] [security2:error] [pid 938041:tid 938204] [client 4.194.24.143:31724] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/system/cj5ha2rah8lyiqqdefault.php"] [unique_id "alxjdiNrzsYMDd5sB10ZYwAAACA"]
[Sat Jul 18 23:41:10.508918 2026] [security2:error] [pid 938041:tid 938129] [remote 41.186.86.12:23605] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.sarahholyfield.com"] [uri "/wp-login.php"] [unique_id "alxjdiNrzsYMDd5sB10ZfwAAfFY"]
[Sat Jul 18 23:41:10.547483 2026] [security2:error] [pid 938041:tid 938181] [client 173.239.196.160:42471] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/x.php"] [unique_id "alxjdiNrzsYMDd5sB10ZhgAAAAk"]
[Sat Jul 18 23:41:10.917719 2026] [security2:error] [pid 938041:tid 938240] [client 4.194.24.143:31690] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/system_log.php"] [unique_id "alxjdiNrzsYMDd5sB10ZoQAAAEQ"]
[Sat Jul 18 23:41:10.996606 2026] [security2:error] [pid 938041:tid 938142] [remote 41.186.86.12:23605] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.sarahholyfield.com"] [uri "/wp-login.php"] [unique_id "alxjdiNrzsYMDd5sB10ZqgAAeGM"], referer: https://mail.sarahholyfield.com/wp-login.php
[Sat Jul 18 23:41:11.396631 2026] [security2:error] [pid 938041:tid 938191] [client 173.239.196.166:64657] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/wp.php"] [unique_id "alxjdyNrzsYMDd5sB10ZyQAAABM"]
[Sat Jul 18 23:41:11.402105 2026] [security2:error] [pid 938041:tid 938232] [client 45.133.7.63:50783] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/bless.php"] [unique_id "alxjdyNrzsYMDd5sB10ZxgAAADw"]
[Sat Jul 18 23:41:11.458115 2026] [security2:error] [pid 938041:tid 938260] [client 4.194.24.143:60214] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/t.php"] [unique_id "alxjdyNrzsYMDd5sB10Z0AAAAFg"]
[Sat Jul 18 23:41:11.728819 2026] [security2:error] [pid 938041:tid 938163] [remote 97.74.93.24:48378] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "soloceos.com"] [uri "/wp-login.php"] [unique_id "alxjdyNrzsYMDd5sB10Z5wAAFng"]
[Sat Jul 18 23:41:12.014837 2026] [security2:error] [pid 938041:tid 938288] [client 4.194.24.143:7580] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/term.php"] [unique_id "alxjeCNrzsYMDd5sB10aAQAAAHQ"]
[Sat Jul 18 23:41:12.044933 2026] [security2:error] [pid 938041:tid 938046] [remote 160.187.68.132:36478] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.68.187.160.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxjeCNrzsYMDd5sB10aBgAALwM"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:41:12.114725 2026] [security2:error] [pid 938041:tid 938252] [client 45.133.7.97:63811] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 97.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/O-Simple.php"] [unique_id "alxjeCNrzsYMDd5sB10aCAAAAFA"]
[Sat Jul 18 23:41:12.216569 2026] [security2:error] [pid 938041:tid 938052] [remote 78.46.99.182:42032] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 182.99.46.78.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxjeCNrzsYMDd5sB10aEgAADQk"]
[Sat Jul 18 23:41:12.221653 2026] [security2:error] [pid 938041:tid 938054] [remote 97.74.93.24:48378] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "soloceos.com"] [uri "/wp-login.php"] [unique_id "alxjeCNrzsYMDd5sB10aFgAARAs"], referer: https://soloceos.com/wp-login.php
[Sat Jul 18 23:41:12.254948 2026] [security2:error] [pid 938041:tid 938242] [client 173.239.196.165:55915] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/options-writing.php"] [unique_id "alxjeCNrzsYMDd5sB10aGgAAAEY"]
[Sat Jul 18 23:41:12.416793 2026] [security2:error] [pid 938041:tid 938059] [remote 78.46.99.182:42032] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 182.99.46.78.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxjeCNrzsYMDd5sB10aIgAABBA"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:41:12.555352 2026] [security2:error] [pid 938041:tid 938214] [client 4.194.24.143:7755] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/test.php"] [unique_id "alxjeCNrzsYMDd5sB10aNQAAACo"]
[Sat Jul 18 23:41:12.712633 2026] [security2:error] [pid 938041:tid 938232] [client 163.61.1.17:52343] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjeCNrzsYMDd5sB10aQgAAADw"]
[Sat Jul 18 23:41:12.714273 2026] [security2:error] [pid 938041:tid 938232] [client 163.61.1.17:52343] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjeCNrzsYMDd5sB10aQgAAADw"]
[Sat Jul 18 23:41:12.770834 2026] [security2:error] [pid 938041:tid 938211] [client 139.167.225.146:54510] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjeCNrzsYMDd5sB10aRQAAACc"]
[Sat Jul 18 23:41:12.770997 2026] [security2:error] [pid 938041:tid 938211] [client 139.167.225.146:54510] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjeCNrzsYMDd5sB10aRQAAACc"]
[Sat Jul 18 23:41:12.803127 2026] [security2:error] [pid 938041:tid 938183] [client 45.133.7.82:59723] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/lock360.php"] [unique_id "alxjeCNrzsYMDd5sB10aRwAAAAs"]
[Sat Jul 18 23:41:13.117351 2026] [security2:error] [pid 938041:tid 938273] [client 4.194.24.143:54816] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/test1.php"] [unique_id "alxjeSNrzsYMDd5sB10aYAAAAGU"]
[Sat Jul 18 23:41:13.130148 2026] [security2:error] [pid 938041:tid 938290] [client 173.239.196.166:43277] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/options-reading.php"] [unique_id "alxjeSNrzsYMDd5sB10aZAAAAHY"]
[Sat Jul 18 23:41:13.208042 2026] [security2:error] [pid 938041:tid 938193] [client 14.251.3.155:51438] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxjeSNrzsYMDd5sB10aawAAABU"]
[Sat Jul 18 23:41:13.228471 2026] [security2:error] [pid 938041:tid 938213] [client 14.224.227.113:51439] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxjeSNrzsYMDd5sB10acAAAACk"]
[Sat Jul 18 23:41:13.530305 2026] [security2:error] [pid 938041:tid 938219] [client 45.133.7.83:26535] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/zwso.php"] [unique_id "alxjeSNrzsYMDd5sB10afAAAAC8"]
[Sat Jul 18 23:41:13.680444 2026] [security2:error] [pid 938041:tid 938181] [client 138.252.89.100:52449] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjeSNrzsYMDd5sB10aigAAAAk"]
[Sat Jul 18 23:41:13.680546 2026] [security2:error] [pid 938041:tid 938181] [client 138.252.89.100:52449] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjeSNrzsYMDd5sB10aigAAAAk"]
[Sat Jul 18 23:41:13.688772 2026] [security2:error] [pid 938041:tid 938279] [client 4.194.24.143:54819] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/tfm.php"] [unique_id "alxjeSNrzsYMDd5sB10ajwAAAGs"]
[Sat Jul 18 23:41:14.049309 2026] [security2:error] [pid 938041:tid 938261] [client 173.239.196.161:45689] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wsad.php"] [unique_id "alxjeiNrzsYMDd5sB10aqQAAAFk"]
[Sat Jul 18 23:41:14.226397 2026] [security2:error] [pid 938041:tid 938257] [client 45.133.7.60:64569] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 60.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/chosen.php"] [unique_id "alxjeiNrzsYMDd5sB10avAAAAFU"]
[Sat Jul 18 23:41:14.254144 2026] [security2:error] [pid 938041:tid 938282] [client 4.194.24.143:35484] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/thebe.php"] [unique_id "alxjeiNrzsYMDd5sB10avwAAAG4"]
[Sat Jul 18 23:41:14.732775 2026] [security2:error] [pid 938041:tid 938174] [client 180.252.198.240:53360] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjeiNrzsYMDd5sB10a4QAAAAI"]
[Sat Jul 18 23:41:14.732911 2026] [security2:error] [pid 938041:tid 938174] [client 180.252.198.240:53360] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjeiNrzsYMDd5sB10a4QAAAAI"]
[Sat Jul 18 23:41:14.794023 2026] [security2:error] [pid 938041:tid 938262] [client 4.194.24.143:54793] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/themes.php"] [unique_id "alxjeiNrzsYMDd5sB10a5wAAAFo"]
[Sat Jul 18 23:41:14.850361 2026] [security2:error] [pid 938041:tid 938229] [client 3.109.49.224:11442] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.49.109.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxjeiNrzsYMDd5sB10a7AAAADk"]
[Sat Jul 18 23:41:14.943161 2026] [security2:error] [pid 938041:tid 938298] [client 173.239.196.163:31511] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/nation.php"] [unique_id "alxjeiNrzsYMDd5sB10a9wAAAH4"]
[Sat Jul 18 23:41:14.947911 2026] [security2:error] [pid 938041:tid 938194] [client 45.133.7.59:27629] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 59.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/about.php"] [unique_id "alxjeiNrzsYMDd5sB10a8gAAABY"]
[Sat Jul 18 23:41:15.388432 2026] [security2:error] [pid 938041:tid 938255] [client 4.194.24.143:54788] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/tiny.php"] [unique_id "alxjeyNrzsYMDd5sB10bGgAAAFM"]
[Sat Jul 18 23:41:15.418088 2026] [security2:error] [pid 938041:tid 938185] [client 34.123.137.137:36278] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "benreyesconstruction.com"] [uri "/wp-json/batch/v1"] [unique_id "alxjeyNrzsYMDd5sB10bHAAAAA0"]
[Sat Jul 18 23:41:15.475165 2026] [security2:error] [pid 938041:tid 938231] [client 106.222.249.209:29829] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjeyNrzsYMDd5sB10bHQAAADs"]
[Sat Jul 18 23:41:15.475283 2026] [security2:error] [pid 938041:tid 938231] [client 106.222.249.209:29829] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjeyNrzsYMDd5sB10bHQAAADs"]
[Sat Jul 18 23:41:15.658987 2026] [security2:error] [pid 938041:tid 938204] [client 45.133.7.66:38565] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 66.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/admin.php"] [unique_id "alxjeyNrzsYMDd5sB10bKAAAACA"]
[Sat Jul 18 23:41:15.777226 2026] [security2:error] [pid 938041:tid 938201] [client 3.21.39.251:50184] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/phpinfo.php"] [unique_id "alxjeyNrzsYMDd5sB10bNwAAAB0"]
[Sat Jul 18 23:41:15.831256 2026] [security2:error] [pid 938041:tid 938197] [client 173.239.196.167:28229] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "alxjeyNrzsYMDd5sB10bOwAAABk"]
[Sat Jul 18 23:41:15.929740 2026] [security2:error] [pid 938041:tid 938230] [client 4.194.24.143:31681] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "immigrationlawyers.io"] [uri "/tmp/byp.php"] [unique_id "alxjeyNrzsYMDd5sB10bQgAAADo"]
[Sat Jul 18 23:41:15.930192 2026] [security2:error] [pid 938041:tid 938190] [client 3.21.39.251:52340] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/info.php"] [unique_id "alxjeyNrzsYMDd5sB10bQwAAABI"]
[Sat Jul 18 23:41:16.083043 2026] [security2:error] [pid 938041:tid 938232] [client 3.21.39.251:52346] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/php.php"] [unique_id "alxjfCNrzsYMDd5sB10bRgAAADw"]
[Sat Jul 18 23:41:16.109838 2026] [security2:error] [pid 938041:tid 938219] [client 3.108.60.216:20328] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxjfCNrzsYMDd5sB10bSAAAAC8"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:41:16.110731 2026] [security2:error] [pid 938041:tid 938252] [client 46.110.96.34:65330] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "wpad.tsctanks.com"] [uri "/wpad.dat"] [unique_id "alxjfCNrzsYMDd5sB10bSQAAAFA"]
[Sat Jul 18 23:41:16.217260 2026] [security2:error] [pid 938041:tid 938272] [client 213.239.200.253:45806] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.vfcthomasville.org"] [uri "/index.php"] [unique_id "alxjfCNrzsYMDd5sB10bTgAAZGU"]
[Sat Jul 18 23:41:16.235151 2026] [security2:error] [pid 938041:tid 938263] [client 3.21.39.251:52356] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/i.php"] [unique_id "alxjfCNrzsYMDd5sB10bVAAAAFs"]
[Sat Jul 18 23:41:16.248922 2026] [security2:error] [pid 938041:tid 938281] [client 34.172.185.49:42100] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "aandarealtygroup.com"] [uri "/index.php"] [unique_id "alxjeCNrzsYMDd5sB10aGAAAAG0"], referer: http://aandarealtygroup.com/wp-json/batch/v1
[Sat Jul 18 23:41:16.257933 2026] [security2:error] [pid 938041:tid 938242] [client 34.123.137.137:36278] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "benreyesconstruction.com"] [uri "/"] [unique_id "alxjfCNrzsYMDd5sB10bWQAAAEY"]
[Sat Jul 18 23:41:16.340147 2026] [security2:error] [pid 938041:tid 938229] [client 45.133.7.64:59863] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 64.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/mah.php"] [unique_id "alxjfCNrzsYMDd5sB10bZQAAADk"]
[Sat Jul 18 23:41:16.387860 2026] [security2:error] [pid 938041:tid 938245] [client 3.21.39.251:52368] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/pi.php"] [unique_id "alxjfCNrzsYMDd5sB10bagAAAEk"]
[Sat Jul 18 23:41:16.540189 2026] [security2:error] [pid 938041:tid 938282] [client 3.21.39.251:52376] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/pinfo.php"] [unique_id "alxjfCNrzsYMDd5sB10bcQAAAG4"]
[Sat Jul 18 23:41:16.682456 2026] [security2:error] [pid 938041:tid 938295] [client 173.239.196.167:27265] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "alxjfCNrzsYMDd5sB10beAAAAHs"]
[Sat Jul 18 23:41:16.692869 2026] [security2:error] [pid 938041:tid 938197] [client 3.21.39.251:52384] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/test.php"] [unique_id "alxjfCNrzsYMDd5sB10beQAAABk"]
[Sat Jul 18 23:41:16.903845 2026] [security2:error] [pid 938041:tid 938299] [client 3.21.39.251:52386] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/p.php"] [unique_id "alxjfCNrzsYMDd5sB10bhQAAAH8"]
[Sat Jul 18 23:41:16.980164 2026] [security2:error] [pid 938041:tid 938259] [client 223.228.182.224:24923] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjfCNrzsYMDd5sB10bjgAAAFc"]
[Sat Jul 18 23:41:16.980261 2026] [security2:error] [pid 938041:tid 938259] [client 223.228.182.224:24923] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjfCNrzsYMDd5sB10bjgAAAFc"]
[Sat Jul 18 23:41:17.051406 2026] [security2:error] [pid 938041:tid 938223] [client 45.133.7.77:51287] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 77.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.wp/wso.php"] [unique_id "alxjfSNrzsYMDd5sB10blAAAADM"]
[Sat Jul 18 23:41:17.055216 2026] [security2:error] [pid 938041:tid 938244] [client 3.21.39.251:52394] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/debug.php"] [unique_id "alxjfSNrzsYMDd5sB10bmwAAAEg"]
[Sat Jul 18 23:41:17.208235 2026] [security2:error] [pid 938041:tid 938213] [client 3.21.39.251:52402] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/admin/phpinfo.php"] [unique_id "alxjfSNrzsYMDd5sB10boQAAACk"]
[Sat Jul 18 23:41:17.288412 2026] [security2:error] [pid 938041:tid 938156] [remote 74.235.96.117:50262] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.235.74.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxjfSNrzsYMDd5sB10bpQAATXE"]
[Sat Jul 18 23:41:17.359727 2026] [security2:error] [pid 938041:tid 938216] [client 3.21.39.251:52412] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/test/phpinfo.php"] [unique_id "alxjfSNrzsYMDd5sB10brQAAACw"]
[Sat Jul 18 23:41:17.439291 2026] [security2:error] [pid 938041:tid 938190] [client 34.123.137.137:11988] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "benreyesconstruction.com"] [uri "/wp-json/batch/v1"] [unique_id "alxjfSNrzsYMDd5sB10btwAAABI"]
[Sat Jul 18 23:41:17.512418 2026] [security2:error] [pid 938041:tid 938236] [client 3.21.39.251:52420] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/dev/phpinfo.php"] [unique_id "alxjfSNrzsYMDd5sB10bugAAAEA"]
[Sat Jul 18 23:41:17.543334 2026] [security2:error] [pid 938041:tid 938291] [client 173.239.196.167:39881] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "alxjfSNrzsYMDd5sB10bvwAAAHc"]
[Sat Jul 18 23:41:17.545204 2026] [security2:error] [pid 938041:tid 938049] [remote 74.235.96.117:50262] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.235.74.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxjfSNrzsYMDd5sB10bwAAAPwY"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:41:17.664309 2026] [security2:error] [pid 938041:tid 938269] [client 3.21.39.251:52430] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/old/phpinfo.php"] [unique_id "alxjfSNrzsYMDd5sB10bxAAAAGE"]
[Sat Jul 18 23:41:17.731727 2026] [security2:error] [pid 938041:tid 938259] [client 45.133.7.63:53991] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/core.php"] [unique_id "alxjfSNrzsYMDd5sB10byQAAAFc"]
[Sat Jul 18 23:41:17.813722 2026] [security2:error] [pid 938041:tid 938221] [client 34.123.137.137:11988] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "benreyesconstruction.com"] [uri "/"] [unique_id "alxjfSNrzsYMDd5sB10bzgAAADE"]
[Sat Jul 18 23:41:17.833383 2026] [security2:error] [pid 938041:tid 938223] [client 3.21.39.251:52436] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/tmp/phpinfo.php"] [unique_id "alxjfSNrzsYMDd5sB10b0QAAADM"]
[Sat Jul 18 23:41:17.984156 2026] [security2:error] [pid 938041:tid 938217] [client 3.21.39.251:52452] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/public/phpinfo.php"] [unique_id "alxjfSNrzsYMDd5sB10b4QAAAC0"]
[Sat Jul 18 23:41:18.212725 2026] [security2:error] [pid 938041:tid 938205] [client 3.21.39.251:52464] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/php-info.php"] [unique_id "alxjfiNrzsYMDd5sB10b7gAAACE"]
[Sat Jul 18 23:41:18.284190 2026] [security2:error] [pid 938041:tid 938197] [client 3.108.60.216:20340] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cryptomeaning.com"] [uri "/wp-login.php"] [unique_id "alxjfiNrzsYMDd5sB10b9gAAABk"]
[Sat Jul 18 23:41:18.367454 2026] [security2:error] [pid 938041:tid 938189] [client 3.21.39.251:52480] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/phpversion.php"] [unique_id "alxjfiNrzsYMDd5sB10b_wAAABE"]
[Sat Jul 18 23:41:18.388721 2026] [security2:error] [pid 938041:tid 938226] [client 173.239.196.165:46109] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/autoload_classmap/wso.php"] [unique_id "alxjfiNrzsYMDd5sB10cAAAAADY"]
[Sat Jul 18 23:41:18.426828 2026] [security2:error] [pid 938041:tid 938227] [client 45.133.7.67:39903] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/robots.php"] [unique_id "alxjfiNrzsYMDd5sB10cBQAAADc"]
[Sat Jul 18 23:41:18.497926 2026] [security2:error] [pid 938041:tid 938268] [client 3.85.217.58:17818] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.217.85.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxjfiNrzsYMDd5sB10cCgAAAGA"], referer: https://curlsnpearlsss.com/es/category/food/dinners/page/3/
[Sat Jul 18 23:41:18.520993 2026] [security2:error] [pid 938041:tid 938270] [client 3.21.39.251:52484] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/_phpinfo.php"] [unique_id "alxjfiNrzsYMDd5sB10cCwAAAGI"]
[Sat Jul 18 23:41:18.674878 2026] [security2:error] [pid 938041:tid 938265] [client 3.21.39.251:52490] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/old_phpinfo.php"] [unique_id "alxjfiNrzsYMDd5sB10cEgAAAF0"]
[Sat Jul 18 23:41:18.827201 2026] [security2:error] [pid 938041:tid 938228] [client 3.21.39.251:52498] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/server-info.php"] [unique_id "alxjfiNrzsYMDd5sB10cHQAAADg"]
[Sat Jul 18 23:41:18.978715 2026] [security2:error] [pid 938041:tid 938286] [client 3.21.39.251:52500] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/server-status.php"] [unique_id "alxjfiNrzsYMDd5sB10cKgAAAHI"]
[Sat Jul 18 23:41:19.232938 2026] [security2:error] [pid 938041:tid 938268] [client 173.239.196.162:32889] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-atomx.php"] [unique_id "alxjfyNrzsYMDd5sB10cPAAAAGA"]
[Sat Jul 18 23:41:19.256551 2026] [security2:error] [pid 938041:tid 938281] [client 3.21.39.251:52510] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/webroot/index.php/_environment"] [unique_id "alxjfyNrzsYMDd5sB10cPgAAAG0"]
[Sat Jul 18 23:41:19.413699 2026] [security2:error] [pid 938041:tid 938213] [client 3.21.39.251:52516] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/mail/phpinfo.php"] [unique_id "alxjfyNrzsYMDd5sB10cSwAAACk"]
[Sat Jul 18 23:41:19.420447 2026] [security2:error] [pid 938041:tid 938191] [client 13.232.206.133:17854] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.206.232.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cryptomeaning.com"] [uri "/wp-login.php"] [unique_id "alxjfyNrzsYMDd5sB10cSQAAABM"], referer: https://cryptomeaning.com/wp-login.php
[Sat Jul 18 23:41:19.481247 2026] [security2:error] [pid 938041:tid 938185] [client 45.133.7.54:55037] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/inputs.php"] [unique_id "alxjfyNrzsYMDd5sB10cUQAAAA0"]
[Sat Jul 18 23:41:19.567593 2026] [security2:error] [pid 938041:tid 938239] [client 3.21.39.251:52520] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/cpanel/phpinfo.php"] [unique_id "alxjfyNrzsYMDd5sB10cXQAAAEM"]
[Sat Jul 18 23:41:19.718625 2026] [security2:error] [pid 938041:tid 938269] [client 3.21.39.251:52528] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/hosting/phpinfo.php"] [unique_id "alxjfyNrzsYMDd5sB10caQAAAGE"]
[Sat Jul 18 23:41:19.870551 2026] [security2:error] [pid 938041:tid 938292] [client 3.21.39.251:52538] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/webmail/phpinfo.php"] [unique_id "alxjfyNrzsYMDd5sB10cbgAAAHg"]
[Sat Jul 18 23:41:20.022625 2026] [security2:error] [pid 938041:tid 938197] [client 3.21.39.251:52544] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/smtp/phpinfo.php"] [unique_id "alxjgCNrzsYMDd5sB10chAAAABk"]
[Sat Jul 18 23:41:20.127818 2026] [security2:error] [pid 938041:tid 938215] [client 173.239.196.165:21945] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/admin-footer.php"] [unique_id "alxjgCNrzsYMDd5sB10chgAAACs"]
[Sat Jul 18 23:41:20.165934 2026] [security2:error] [pid 938041:tid 938257] [client 45.133.7.94:24811] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 94.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/mini.php"] [unique_id "alxjgCNrzsYMDd5sB10ciAAAAFU"]
[Sat Jul 18 23:41:20.176948 2026] [security2:error] [pid 938041:tid 938240] [client 3.21.39.251:52558] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/phpinfo.php.bak"] [unique_id "alxjgCNrzsYMDd5sB10ciQAAAEQ"]
[Sat Jul 18 23:41:20.328352 2026] [security2:error] [pid 938041:tid 938298] [client 3.21.39.251:52574] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/phpinfo.php.old"] [unique_id "alxjgCNrzsYMDd5sB10ckQAAAH4"]
[Sat Jul 18 23:41:20.480413 2026] [security2:error] [pid 938041:tid 938263] [client 3.21.39.251:52576] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/phpinfo.php~"] [unique_id "alxjgCNrzsYMDd5sB10cnQAAAFs"]
[Sat Jul 18 23:41:20.630668 2026] [security2:error] [pid 938041:tid 938214] [client 3.21.39.251:52580] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/info.php.bak"] [unique_id "alxjgCNrzsYMDd5sB10cqAAAACo"]
[Sat Jul 18 23:41:20.782689 2026] [security2:error] [pid 938041:tid 938241] [client 3.21.39.251:52596] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/phpinfo.php.save"] [unique_id "alxjgCNrzsYMDd5sB10ctAAAAEU"]
[Sat Jul 18 23:41:20.851292 2026] [security2:error] [pid 938041:tid 938209] [client 45.133.7.96:34629] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 96.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/goods.php"] [unique_id "alxjgCNrzsYMDd5sB10ctgAAACU"]
[Sat Jul 18 23:41:20.936783 2026] [security2:error] [pid 938041:tid 938185] [client 3.21.39.251:52604] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/staging/phpinfo.php"] [unique_id "alxjgCNrzsYMDd5sB10cvwAAAA0"]
[Sat Jul 18 23:41:20.938967 2026] [security2:error] [pid 938041:tid 938141] [remote 117.0.21.154:38812] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.factsandminds.com"] [uri "/wp-login.php"] [unique_id "alxjgCNrzsYMDd5sB10cvQAAeGI"]
[Sat Jul 18 23:41:20.983561 2026] [security2:error] [pid 938041:tid 938286] [client 173.239.196.166:60629] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/maint/wp-conflg.php"] [unique_id "alxjgCNrzsYMDd5sB10cxAAAAHI"]
[Sat Jul 18 23:41:21.088778 2026] [security2:error] [pid 938041:tid 938299] [client 3.21.39.251:52610] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/beta/phpinfo.php"] [unique_id "alxjgSNrzsYMDd5sB10c0AAAAH8"]
[Sat Jul 18 23:41:21.240223 2026] [security2:error] [pid 938041:tid 938246] [client 3.21.39.251:52616] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/uat/phpinfo.php"] [unique_id "alxjgSNrzsYMDd5sB10c1QAAAEo"]
[Sat Jul 18 23:41:21.255528 2026] [proxy:error] [pid 938041:tid 938227] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:41:21.255570 2026] [proxy_http:error] [pid 938041:tid 938227] [client 94.154.43.179:45336] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:41:21.256030 2026] [proxy:error] [pid 938041:tid 938227] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:41:21.256055 2026] [proxy_http:error] [pid 938041:tid 938227] [client 94.154.43.179:45336] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:41:21.343239 2026] [security2:error] [pid 938041:tid 938169] [remote 41.76.213.235:60012] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ironcitywellness.com"] [uri "/wp-login.php"] [unique_id "alxjgSNrzsYMDd5sB10c7gAAbX4"]
[Sat Jul 18 23:41:21.392960 2026] [security2:error] [pid 938041:tid 938260] [client 3.21.39.251:52622] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/qa/phpinfo.php"] [unique_id "alxjgSNrzsYMDd5sB10c9AAAAFg"]
[Sat Jul 18 23:41:21.411729 2026] [security2:error] [pid 938041:tid 938163] [remote 131.72.236.158:39046] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 158.236.72.131.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.pfl.ail.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxjgSNrzsYMDd5sB10c8wAAPng"]
[Sat Jul 18 23:41:21.411905 2026] [security2:error] [pid 938041:tid 938234] [client 131.72.236.158:39046] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "mail.pfl.ail.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxjgSNrzsYMDd5sB10c8wAAPng"]
[Sat Jul 18 23:41:21.417687 2026] [security2:error] [pid 938041:tid 938161] [remote 117.0.21.154:38812] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.factsandminds.com"] [uri "/wp-login.php"] [unique_id "alxjgSNrzsYMDd5sB10c9gAAU3Y"], referer: https://mail.factsandminds.com/wp-login.php
[Sat Jul 18 23:41:21.539875 2026] [security2:error] [pid 938041:tid 938230] [client 45.133.7.101:52155] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 101.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/file5.php"] [unique_id "alxjgSNrzsYMDd5sB10dAQAAADo"]
[Sat Jul 18 23:41:21.549141 2026] [security2:error] [pid 938041:tid 938275] [client 3.21.39.251:52628] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/preview/phpinfo.php"] [unique_id "alxjgSNrzsYMDd5sB10dAgAAAGc"]
[Sat Jul 18 23:41:21.701304 2026] [security2:error] [pid 938041:tid 938217] [client 3.21.39.251:52644] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/www/phpinfo.php"] [unique_id "alxjgSNrzsYMDd5sB10dEwAAAC0"]
[Sat Jul 18 23:41:21.827778 2026] [security2:error] [pid 938041:tid 938178] [client 173.239.196.160:45959] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/XxX.php"] [unique_id "alxjgSNrzsYMDd5sB10dGwAAAAY"]
[Sat Jul 18 23:41:21.831853 2026] [security2:error] [pid 938041:tid 938167] [remote 41.76.213.235:60012] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ironcitywellness.com"] [uri "/wp-login.php"] [unique_id "alxjgSNrzsYMDd5sB10dHAAAaHw"], referer: https://ironcitywellness.com/wp-login.php
[Sat Jul 18 23:41:21.852985 2026] [security2:error] [pid 938041:tid 938296] [client 3.21.39.251:52656] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/htdocs/phpinfo.php"] [unique_id "alxjgSNrzsYMDd5sB10dHgAAAHw"]
[Sat Jul 18 23:41:21.858415 2026] [security2:error] [pid 938041:tid 938269] [client 163.61.1.17:52836] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjgSNrzsYMDd5sB10dHwAAAGE"]
[Sat Jul 18 23:41:21.858495 2026] [security2:error] [pid 938041:tid 938269] [client 163.61.1.17:52836] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjgSNrzsYMDd5sB10dHwAAAGE"]
403 (Forbidden): 403 Forbidden
Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157.
[Sat Jul 18 23:41:22.008890 2026] [security2:error] [pid 938041:tid 938213] [client 3.21.39.251:52668] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/public_html/phpinfo.php"] [unique_id "alxjgiNrzsYMDd5sB10dJwAAACk"]
[Sat Jul 18 23:41:22.107328 2026] [security2:error] [pid 938041:tid 938282] [client 104.250.39.107:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "mrbambooplus.com"] [uri "/index.php"] [unique_id "alxjfyNrzsYMDd5sB10cXwAAAG4"]
[Sat Jul 18 23:41:22.166317 2026] [security2:error] [pid 938041:tid 938275] [client 3.21.39.251:52682] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/site/phpinfo.php"] [unique_id "alxjgiNrzsYMDd5sB10dNAAAAGc"]
[Sat Jul 18 23:41:22.249441 2026] [security2:error] [pid 938041:tid 938242] [client 45.133.7.81:29259] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 81.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/ahax.php"] [unique_id "alxjgiNrzsYMDd5sB10dNQAAAEY"]
[Sat Jul 18 23:41:22.318191 2026] [security2:error] [pid 938041:tid 938176] [client 3.21.39.251:52694] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/docs/phpinfo.php"] [unique_id "alxjgiNrzsYMDd5sB10dPAAAAAQ"]
[Sat Jul 18 23:41:22.472002 2026] [security2:error] [pid 938041:tid 938228] [client 3.21.39.251:52708] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/wp-admin/phpinfo.php"] [unique_id "alxjgiNrzsYMDd5sB10dRwAAADg"]
[Sat Jul 18 23:41:22.623598 2026] [security2:error] [pid 938041:tid 938188] [client 113.160.97.242:60153] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "wpad"] [uri "/wpad.dat"] [unique_id "alxjgiNrzsYMDd5sB10dXAAAABA"]
[Sat Jul 18 23:41:22.627117 2026] [security2:error] [pid 938041:tid 938284] [client 3.21.39.251:52716] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/administrator/phpinfo.php"] [unique_id "alxjgiNrzsYMDd5sB10dXgAAAHA"]
[Sat Jul 18 23:41:22.701565 2026] [security2:error] [pid 938041:tid 938244] [client 173.239.196.161:45719] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/ubh/install.php"] [unique_id "alxjgiNrzsYMDd5sB10dYQAAAEg"]
[Sat Jul 18 23:41:22.779018 2026] [security2:error] [pid 938041:tid 938200] [client 3.21.39.251:52728] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/core/phpinfo.php"] [unique_id "alxjgiNrzsYMDd5sB10dYwAAABw"]
[Sat Jul 18 23:41:22.931413 2026] [security2:error] [pid 938041:tid 938212] [client 3.21.39.251:52734] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 251.39.21.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webdisk.oej.eek.mybluehost.me"] [uri "/includes/phpinfo.php"] [unique_id "alxjgiNrzsYMDd5sB10dbgAAACg"]
[Sat Jul 18 23:41:22.932925 2026] [security2:error] [pid 938041:tid 938215] [client 45.133.7.90:32021] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 90.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/f35.php"] [unique_id "alxjgiNrzsYMDd5sB10dbQAAACs"]
[Sat Jul 18 23:41:23.308740 2026] [security2:error] [pid 938041:tid 938223] [client 13.232.206.133:17858] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.206.232.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cryptomeaning.com"] [uri "/wp-login.php"] [unique_id "alxjgyNrzsYMDd5sB10dkQAAADM"]
[Sat Jul 18 23:41:23.584905 2026] [security2:error] [pid 938041:tid 938222] [client 173.239.196.167:54479] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "alxjgyNrzsYMDd5sB10dpwAAADI"]
[Sat Jul 18 23:41:23.624068 2026] [security2:error] [pid 938041:tid 938172] [client 45.133.7.104:55399] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/simple.php"] [unique_id "alxjgyNrzsYMDd5sB10dqQAAAAA"]
[Sat Jul 18 23:41:23.656795 2026] [security2:error] [pid 938041:tid 938232] [client 139.167.225.146:55134] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjgyNrzsYMDd5sB10drwAAADw"]
[Sat Jul 18 23:41:23.656901 2026] [security2:error] [pid 938041:tid 938232] [client 139.167.225.146:55134] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjgyNrzsYMDd5sB10drwAAADw"]
[Sat Jul 18 23:41:24.255117 2026] [security2:error] [pid 938041:tid 938111] [remote 5.182.209.54:46952] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.209.182.5.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "processorstudio.com"] [uri "/wp-login.php"] [unique_id "alxjhCNrzsYMDd5sB10d1wAAe0Q"]
[Sat Jul 18 23:41:24.296262 2026] [security2:error] [pid 938041:tid 938247] [client 45.133.7.59:34179] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 59.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/amax.php"] [unique_id "alxjhCNrzsYMDd5sB10d2QAAAEs"]
[Sat Jul 18 23:41:24.296650 2026] [security2:error] [pid 938041:tid 938279] [client 3.108.60.216:49362] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cryptomeaning.com"] [uri "/wp-login.php"] [unique_id "alxjhCNrzsYMDd5sB10d2gAAAGs"], referer: https://cryptomeaning.com/wp-login.php
[Sat Jul 18 23:41:24.443154 2026] [security2:error] [pid 938041:tid 938187] [client 173.239.196.163:50433] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "alxjhCNrzsYMDd5sB10d3wAAAA8"]
[Sat Jul 18 23:41:24.447378 2026] [security2:error] [pid 938041:tid 938120] [remote 5.182.209.54:46952] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.209.182.5.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "processorstudio.com"] [uri "/wp-login.php"] [unique_id "alxjhCNrzsYMDd5sB10d4AAAfk0"], referer: https://processorstudio.com/wp-login.php
[Sat Jul 18 23:41:24.967687 2026] [security2:error] [pid 938041:tid 938229] [client 45.133.7.82:64867] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/update/f35.php"] [unique_id "alxjhCNrzsYMDd5sB10eAAAAADk"]
[Sat Jul 18 23:41:25.051848 2026] [security2:error] [pid 938041:tid 938197] [client 180.252.198.240:53849] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjhSNrzsYMDd5sB10eBAAAABk"]
[Sat Jul 18 23:41:25.051977 2026] [security2:error] [pid 938041:tid 938197] [client 180.252.198.240:53849] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjhSNrzsYMDd5sB10eBAAAABk"]
[Sat Jul 18 23:41:25.323643 2026] [security2:error] [pid 938041:tid 938223] [client 173.239.196.165:45983] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "alxjhSNrzsYMDd5sB10eGQAAADM"]
[Sat Jul 18 23:41:25.465024 2026] [security2:error] [pid 938041:tid 938295] [client 138.252.89.100:52985] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjhSNrzsYMDd5sB10eIwAAAHs"]
[Sat Jul 18 23:41:25.465200 2026] [security2:error] [pid 938041:tid 938295] [client 138.252.89.100:52985] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjhSNrzsYMDd5sB10eIwAAAHs"]
[Sat Jul 18 23:41:25.558736 2026] [security2:error] [pid 938041:tid 938154] [remote 157.66.47.83:49644] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxjhSNrzsYMDd5sB10eJQAAS28"]
[Sat Jul 18 23:41:25.558943 2026] [security2:error] [pid 938041:tid 938247] [client 157.66.47.83:49644] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxjhSNrzsYMDd5sB10eJQAAS28"]
[Sat Jul 18 23:41:25.653156 2026] [security2:error] [pid 938041:tid 938177] [client 45.133.7.73:25977] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 73.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/hello.php"] [unique_id "alxjhSNrzsYMDd5sB10eLQAAAAU"]
[Sat Jul 18 23:41:25.661967 2026] [core:error] [pid 938041:tid 938281] [client 185.226.197.57:26428] AH10244: invalid URI path (/icons/.%%32%65/.%%32%65/apache2/icons/non-existant-image.png)
[Sat Jul 18 23:41:26.153685 2026] [security2:error] [pid 938041:tid 938274] [client 106.222.249.209:11528] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjhiNrzsYMDd5sB10eQwAAAGY"]
[Sat Jul 18 23:41:26.153829 2026] [security2:error] [pid 938041:tid 938274] [client 106.222.249.209:11528] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjhiNrzsYMDd5sB10eQwAAAGY"]
[Sat Jul 18 23:41:26.196796 2026] [security2:error] [pid 938041:tid 938185] [client 173.239.196.167:59275] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/twentytwentyfour/content-index.php"] [unique_id "alxjhiNrzsYMDd5sB10eSQAAAA0"]
[Sat Jul 18 23:41:26.314317 2026] [security2:error] [pid 938041:tid 938216] [client 35.205.47.236:59478] ModSecurity: Access denied with code 406 (phase 1). Pattern match "python-requests|python-urllib" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "1460"] [id "909111"] [msg "Python UA brute"] [hostname "mail.genesisventureglobal.com"] [uri "/"] [unique_id "alxjhiNrzsYMDd5sB10eUwAAACw"]
[Sat Jul 18 23:41:26.319286 2026] [core:error] [pid 938041:tid 938206] [client 185.226.197.57:26442] AH10244: invalid URI path (/icons/.%%32%65/.%%32%65/apache2/icons/sphere1.png)
[Sat Jul 18 23:41:26.369219 2026] [security2:error] [pid 938041:tid 938264] [client 45.133.7.88:24493] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 88.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/maint/bootstrap.php"] [unique_id "alxjhiNrzsYMDd5sB10eVwAAAFw"]
[Sat Jul 18 23:41:26.718227 2026] [security2:error] [pid 938041:tid 938282] [client 185.226.197.60:27610] ModSecurity: Warning. Pattern match "%2e.%2e%2e" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1522"] [id "900917"] [msg "temporary CVE-2021-41773 logging rule"] [hostname "www.zonemist.com"] [uri "/icons/.%2e/%2e%2e/apache2/icons/sphere1.png"] [unique_id "alxjhiNrzsYMDd5sB10eawAAAG4"]
[Sat Jul 18 23:41:26.718265 2026] [core:error] [pid 938041:tid 938282] [client 185.226.197.60:27610] AH10244: invalid URI path (/icons/.%2e/%2e%2e/apache2/icons/sphere1.png)
[Sat Jul 18 23:41:27.012183 2026] [security2:error] [pid 938041:tid 938043] [remote 163.227.186.27:50366] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tntcatholic.com"] [uri "/wp-login.php"] [unique_id "alxjhyNrzsYMDd5sB10egAAABwA"]
[Sat Jul 18 23:41:27.045525 2026] [security2:error] [pid 938041:tid 938234] [client 173.239.196.164:29735] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/admin/controller/extension/extension/alfa.php"] [unique_id "alxjhyNrzsYMDd5sB10eggAAAD4"]
[Sat Jul 18 23:41:27.082700 2026] [security2:error] [pid 938041:tid 938185] [client 45.133.7.58:21035] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/themes/zMousse/otuz1.php"] [unique_id "alxjhyNrzsYMDd5sB10egQAAAA0"]
[Sat Jul 18 23:41:27.502134 2026] [security2:error] [pid 938041:tid 938058] [remote 163.227.186.27:50366] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tntcatholic.com"] [uri "/wp-login.php"] [unique_id "alxjhyNrzsYMDd5sB10emgAAGA8"], referer: https://tntcatholic.com/wp-login.php
[Sat Jul 18 23:41:27.759308 2026] [security2:error] [pid 938041:tid 938184] [client 223.228.182.224:20135] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjhyNrzsYMDd5sB10eqgAAAAw"]
[Sat Jul 18 23:41:27.759415 2026] [security2:error] [pid 938041:tid 938184] [client 223.228.182.224:20135] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjhyNrzsYMDd5sB10eqgAAAAw"]
[Sat Jul 18 23:41:27.767294 2026] [security2:error] [pid 938041:tid 938229] [client 45.133.7.80:44735] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/edit-wolf.php"] [unique_id "alxjhyNrzsYMDd5sB10eqQAAADk"]
[Sat Jul 18 23:41:27.898636 2026] [security2:error] [pid 938041:tid 938234] [client 173.239.196.165:64527] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/twentytwentyfour/system_cache.php%20"] [unique_id "alxjhyNrzsYMDd5sB10euAAAAD4"]
[Sat Jul 18 23:41:28.458238 2026] [security2:error] [pid 938041:tid 938267] [client 45.133.7.72:41717] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 72.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/ubh/up.php"] [unique_id "alxjiCNrzsYMDd5sB10e4wAAAF8"]
[Sat Jul 18 23:41:28.583016 2026] [ssl:error] [pid 938041:tid 938219] [client 54.86.115.253:39489] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname gertoger-org.zanjan-fromer.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:41:28.610334 2026] [security2:error] [pid 938041:tid 938245] [client 13.232.206.133:39108] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.206.232.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxjiCNrzsYMDd5sB10e7AAAAEk"]
[Sat Jul 18 23:41:28.610420 2026] [security2:error] [pid 938041:tid 938245] [client 13.232.206.133:39108] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxjiCNrzsYMDd5sB10e7AAAAEk"]
[Sat Jul 18 23:41:28.789230 2026] [security2:error] [pid 938041:tid 938284] [client 173.239.196.167:40789] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/modern/colors.css.php"] [unique_id "alxjiCNrzsYMDd5sB10e8QAAAHA"]
[Sat Jul 18 23:41:28.918536 2026] [security2:error] [pid 938041:tid 938182] [client 74.208.214.194:44572] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxjiCNrzsYMDd5sB10e_QAAAAo"]
[Sat Jul 18 23:41:29.141252 2026] [security2:error] [pid 938041:tid 938215] [client 45.133.7.91:58807] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 91.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/images/bootstrap.php"] [unique_id "alxjiSNrzsYMDd5sB10fDgAAACs"]
[Sat Jul 18 23:41:29.690650 2026] [security2:error] [pid 938041:tid 938294] [client 173.239.196.160:55161] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "alxjiSNrzsYMDd5sB10fOAAAAHo"]
[Sat Jul 18 23:41:29.854454 2026] [security2:error] [pid 938041:tid 938206] [client 45.133.7.103:31157] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/images/upload.php"] [unique_id "alxjiSNrzsYMDd5sB10fPwAAACI"]
[Sat Jul 18 23:41:30.530406 2026] [security2:error] [pid 938041:tid 938275] [client 45.133.7.77:36141] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 77.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/seoplugins/db.php"] [unique_id "alxjiiNrzsYMDd5sB10fbQAAAGc"]
[Sat Jul 18 23:41:30.564571 2026] [security2:error] [pid 938041:tid 938212] [client 173.239.196.166:50865] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/css/media-widget-vide02.php"] [unique_id "alxjiiNrzsYMDd5sB10fbwAAACg"]
[Sat Jul 18 23:41:31.106136 2026] [security2:error] [pid 938041:tid 938107] [remote 152.228.213.32:39422] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxjiyNrzsYMDd5sB10flwAAAEA"]
[Sat Jul 18 23:41:31.106308 2026] [security2:error] [pid 938041:tid 938172] [client 152.228.213.32:39422] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxjiyNrzsYMDd5sB10flwAAAEA"]
[Sat Jul 18 23:41:31.130068 2026] [security2:error] [pid 938041:tid 938284] [client 74.208.214.194:44582] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxjiyNrzsYMDd5sB10fmgAAAHA"]
[Sat Jul 18 23:41:31.256305 2026] [security2:error] [pid 938041:tid 938275] [client 45.133.7.84:36803] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 84.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/pridmag/db.php"] [unique_id "alxjiyNrzsYMDd5sB10fowAAAGc"]
[Sat Jul 18 23:41:31.445623 2026] [security2:error] [pid 938041:tid 938259] [client 173.239.196.161:64709] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "alxjiyNrzsYMDd5sB10fsQAAAFc"]
[Sat Jul 18 23:41:31.463847 2026] [security2:error] [pid 938041:tid 938268] [client 104.253.108.203:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxjiyNrzsYMDd5sB10fpAAAAGA"]
[Sat Jul 18 23:41:31.971039 2026] [security2:error] [pid 938041:tid 938276] [client 45.133.7.92:39413] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/linkpreview/db.php"] [unique_id "alxjiyNrzsYMDd5sB10fzQAAAGg"]
[Sat Jul 18 23:41:32.283851 2026] [security2:error] [pid 938041:tid 938239] [client 163.61.1.17:53315] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjjCNrzsYMDd5sB10f4gAAAEM"]
[Sat Jul 18 23:41:32.283984 2026] [security2:error] [pid 938041:tid 938239] [client 163.61.1.17:53315] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjjCNrzsYMDd5sB10f4gAAAEM"]
[Sat Jul 18 23:41:32.311735 2026] [security2:error] [pid 938041:tid 938260] [client 173.239.196.160:47865] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/images/buy.php"] [unique_id "alxjjCNrzsYMDd5sB10f4wAAAFg"]
[Sat Jul 18 23:41:32.585948 2026] [security2:error] [pid 938041:tid 938234] [client 57.141.18.21:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxjjCNrzsYMDd5sB10f6QAAAD4"]
[Sat Jul 18 23:41:32.996780 2026] [security2:error] [pid 938041:tid 938297] [client 45.133.7.86:24825] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 86.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/modules/mod_simplefileuploadv1.3/elements/udd.php"] [unique_id "alxjjCNrzsYMDd5sB10gFQAAAH0"]
[Sat Jul 18 23:41:33.150993 2026] [security2:error] [pid 938041:tid 938184] [client 173.239.196.163:64627] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/templates/beez3/av.php"] [unique_id "alxjjSNrzsYMDd5sB10gJAAAAAw"]
[Sat Jul 18 23:41:33.691223 2026] [security2:error] [pid 938041:tid 938214] [client 45.133.7.80:58561] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "alxjjSNrzsYMDd5sB10gPwAAACo"]
[Sat Jul 18 23:41:34.020245 2026] [security2:error] [pid 938041:tid 938228] [client 173.239.196.163:36027] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "alxjjiNrzsYMDd5sB10gUQAAADg"]
[Sat Jul 18 23:41:34.053150 2026] [security2:error] [pid 938041:tid 938223] [client 139.167.225.146:55761] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjjiNrzsYMDd5sB10gUwAAADM"]
[Sat Jul 18 23:41:34.053258 2026] [security2:error] [pid 938041:tid 938223] [client 139.167.225.146:55761] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjjiNrzsYMDd5sB10gUwAAADM"]
[Sat Jul 18 23:41:34.403387 2026] [security2:error] [pid 938041:tid 938249] [client 45.133.7.56:44403] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 56.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/pwnd-1/pwnd.php"] [unique_id "alxjjiNrzsYMDd5sB10gdAAAAE0"]
[Sat Jul 18 23:41:34.723207 2026] [security2:error] [pid 938041:tid 938244] [client 62.45.36.212:40427] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxjjiNrzsYMDd5sB10ggAAAAEg"]
[Sat Jul 18 23:41:34.852188 2026] [security2:error] [pid 938041:tid 938234] [client 173.239.196.166:55593] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/install.php"] [unique_id "alxjjiNrzsYMDd5sB10gmAAAAD4"]
[Sat Jul 18 23:41:35.076292 2026] [security2:error] [pid 938041:tid 938249] [client 45.133.7.81:30685] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 81.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/midnight/admin.php"] [unique_id "alxjjyNrzsYMDd5sB10grAAAAE0"]
[Sat Jul 18 23:41:35.498846 2026] [security2:error] [pid 938041:tid 938295] [client 180.252.198.240:54328] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjjyNrzsYMDd5sB10gywAAAHs"]
[Sat Jul 18 23:41:35.498988 2026] [security2:error] [pid 938041:tid 938295] [client 180.252.198.240:54328] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjjyNrzsYMDd5sB10gywAAAHs"]
[Sat Jul 18 23:41:35.692508 2026] [security2:error] [pid 938041:tid 938253] [client 173.239.196.165:29445] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/plugins/function.php"] [unique_id "alxjjyNrzsYMDd5sB10g1gAAAFE"]
[Sat Jul 18 23:41:35.791216 2026] [security2:error] [pid 938041:tid 938280] [client 45.133.7.57:23505] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 57.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/kill.php"] [unique_id "alxjjyNrzsYMDd5sB10g2wAAAGw"]
[Sat Jul 18 23:41:36.486643 2026] [security2:error] [pid 938041:tid 938241] [client 45.133.7.87:62059] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 87.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "alxjkCNrzsYMDd5sB10hBQAAAEU"]
[Sat Jul 18 23:41:36.527599 2026] [security2:error] [pid 938041:tid 938221] [client 173.239.196.162:42637] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/header.php"] [unique_id "alxjkCNrzsYMDd5sB10hBwAAADE"]
[Sat Jul 18 23:41:36.670343 2026] [security2:error] [pid 938041:tid 938233] [client 148.251.41.182:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxjkCNrzsYMDd5sB10g-gAAPWE"]
[Sat Jul 18 23:41:36.783573 2026] [security2:error] [pid 938041:tid 938266] [client 106.222.249.209:31785] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjkCNrzsYMDd5sB10hIAAAAF4"]
[Sat Jul 18 23:41:36.783703 2026] [security2:error] [pid 938041:tid 938266] [client 106.222.249.209:31785] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjkCNrzsYMDd5sB10hIAAAAF4"]
[Sat Jul 18 23:41:37.065126 2026] [security2:error] [pid 938041:tid 938175] [client 138.252.89.100:53513] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjkSNrzsYMDd5sB10hKwAAAAM"]
[Sat Jul 18 23:41:37.065233 2026] [security2:error] [pid 938041:tid 938175] [client 138.252.89.100:53513] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjkSNrzsYMDd5sB10hKwAAAAM"]
[Sat Jul 18 23:41:37.170723 2026] [security2:error] [pid 938041:tid 938222] [client 45.133.7.96:44117] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 96.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "alxjkSNrzsYMDd5sB10hLwAAADI"]
[Sat Jul 18 23:41:37.386696 2026] [security2:error] [pid 938041:tid 938250] [client 173.239.196.167:46813] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wordpress/wp-content/uploads/install.php"] [unique_id "alxjkSNrzsYMDd5sB10hRgAAAE4"]
[Sat Jul 18 23:41:37.699473 2026] [security2:error] [pid 938041:tid 938074] [remote 91.142.222.105:39908] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/wp-login.php"] [unique_id "alxjkSNrzsYMDd5sB10hWAAAYx8"]
[Sat Jul 18 23:41:37.861993 2026] [security2:error] [pid 938041:tid 938263] [client 45.133.7.74:64585] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/core-plugin/include.php"] [unique_id "alxjkSNrzsYMDd5sB10hagAAAFs"]
[Sat Jul 18 23:41:38.129904 2026] [fcgid:warn] [pid 938041:tid 938298] (70014)End of file found: [client 165.154.172.140:43036] mod_fcgid: can't get data from http client
[Sat Jul 18 23:41:38.240780 2026] [security2:error] [pid 938041:tid 938081] [remote 165.232.173.236:50566] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 236.173.232.165.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxjkiNrzsYMDd5sB10hhwAAMiY"]
[Sat Jul 18 23:41:38.270978 2026] [security2:error] [pid 938041:tid 938265] [client 173.239.196.166:26579] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/pki-validation/server.php"] [unique_id "alxjkiNrzsYMDd5sB10hjQAAAF0"]
[Sat Jul 18 23:41:38.354276 2026] [security2:error] [pid 938041:tid 938084] [remote 91.142.222.105:39908] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/wp-login.php"] [unique_id "alxjkiNrzsYMDd5sB10hkAAAEyk"], referer: https://lutheranphilosopher.com/wp-login.php
[Sat Jul 18 23:41:38.585800 2026] [security2:error] [pid 938041:tid 938273] [client 45.133.7.78:40631] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 78.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/envato-css.php"] [unique_id "alxjkiNrzsYMDd5sB10hmgAAAGU"]
[Sat Jul 18 23:41:38.614522 2026] [security2:error] [pid 938041:tid 938078] [remote 165.232.173.236:50566] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 236.173.232.165.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxjkiNrzsYMDd5sB10hnwAAFCM"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:41:39.121549 2026] [security2:error] [pid 938041:tid 938231] [client 173.239.196.160:54801] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/autoload_classmap/install.php"] [unique_id "alxjkyNrzsYMDd5sB10hugAAADs"]
[Sat Jul 18 23:41:39.236848 2026] [security2:error] [pid 938041:tid 938125] [remote 31.42.184.154:41864] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "maa.hws.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxjkyNrzsYMDd5sB10hvwAATFI"]
[Sat Jul 18 23:41:39.265944 2026] [security2:error] [pid 938041:tid 938210] [client 45.133.7.66:39263] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 66.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/classwithtostring.php"] [unique_id "alxjkyNrzsYMDd5sB10hwQAAACY"]
[Sat Jul 18 23:41:39.401511 2026] [security2:error] [pid 938041:tid 938104] [remote 157.66.47.83:44768] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "alexsandbergmusic.com"] [uri "/wp-login.php"] [unique_id "alxjkyNrzsYMDd5sB10hygAAOT0"]
[Sat Jul 18 23:41:39.802566 2026] [security2:error] [pid 938041:tid 938116] [remote 157.66.47.83:44768] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "alexsandbergmusic.com"] [uri "/wp-login.php"] [unique_id "alxjkyNrzsYMDd5sB10h6QAAREk"], referer: https://alexsandbergmusic.com/wp-login.php
[Sat Jul 18 23:41:39.884146 2026] [security2:error] [pid 938041:tid 938217] [client 103.122.66.175:37558] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "primests.com"] [uri "/wp-comments-post.php"] [unique_id "alxjkyNrzsYMDd5sB10h6AAAAC0"]
[Sat Jul 18 23:41:39.970372 2026] [security2:error] [pid 938041:tid 938151] [remote 31.42.184.154:41864] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "maa.hws.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxjkyNrzsYMDd5sB10h9wAAM2w"], referer: https://maa.hws.mybluehost.me/wp-login.php
[Sat Jul 18 23:41:39.998032 2026] [security2:error] [pid 938041:tid 938282] [client 173.239.196.161:27411] ModSecurity: Warning. Pattern match "/1\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1543"] [id "900921"] [msg "temporary TUW-72162 logging rule"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/pwnd/1.php"] [unique_id "alxjkyNrzsYMDd5sB10h-AAAAG4"]
[Sat Jul 18 23:41:39.998138 2026] [security2:error] [pid 938041:tid 938282] [client 173.239.196.161:27411] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/pwnd/1.php"] [unique_id "alxjkyNrzsYMDd5sB10h-AAAAG4"]
[Sat Jul 18 23:41:40.054020 2026] [security2:error] [pid 938041:tid 938217] [client 103.122.66.175:37558] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "403"] [hostname "primests.com"] [uri "/wp-comments-post.php"] [unique_id "alxjkyNrzsYMDd5sB10h6AAAAC0"]
[Sat Jul 18 23:41:40.288844 2026] [security2:error] [pid 938041:tid 938200] [client 45.133.7.65:37941] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 65.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/index/function.php"] [unique_id "alxjlCNrzsYMDd5sB10iCAAAABw"]
[Sat Jul 18 23:41:40.385414 2026] [security2:error] [pid 938041:tid 938280] [client 74.7.227.179:47666] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxjlCNrzsYMDd5sB10iBAAAbGQ"], referer: https://tejasenvironmental.com/p=960898
[Sat Jul 18 23:41:40.778463 2026] [security2:error] [pid 938041:tid 938100] [remote 103.90.234.13:46776] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.234.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxjlCNrzsYMDd5sB10iIAAARzk"]
[Sat Jul 18 23:41:40.916227 2026] [security2:error] [pid 938041:tid 938254] [client 173.239.196.162:28477] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/ubh/av.php"] [unique_id "alxjlCNrzsYMDd5sB10iLQAAAFI"]
[Sat Jul 18 23:41:40.962052 2026] [security2:error] [pid 938041:tid 938224] [client 45.133.7.65:57419] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 65.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/tinyfilemanager.php"] [unique_id "alxjlCNrzsYMDd5sB10iMgAAADQ"]
[Sat Jul 18 23:41:40.987796 2026] [security2:error] [pid 938041:tid 938138] [remote 57.141.18.84:48102] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 84.18.141.57.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/product/5584465"] [unique_id "alxjlCNrzsYMDd5sB10iOQAASl8"]
[Sat Jul 18 23:41:41.193391 2026] [security2:error] [pid 938041:tid 938241] [client 47.128.17.121:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.thescarystory.com"] [uri "/%27/2015/5"] [unique_id "alxjlSNrzsYMDd5sB10iRgAAAEU"]
[Sat Jul 18 23:41:41.645448 2026] [security2:error] [pid 938041:tid 938235] [client 45.133.7.100:48777] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/js/bas.php"] [unique_id "alxjlSNrzsYMDd5sB10iXgAAAD8"]
[Sat Jul 18 23:41:41.810838 2026] [security2:error] [pid 938041:tid 938194] [client 173.239.196.161:59299] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/uploads/anas.php"] [unique_id "alxjlSNrzsYMDd5sB10ibwAAABY"]
[Sat Jul 18 23:41:42.334263 2026] [security2:error] [pid 938041:tid 938251] [client 45.133.7.85:38841] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 85.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/pki-validation/moon.php"] [unique_id "alxjliNrzsYMDd5sB10ijgAAAE8"]
[Sat Jul 18 23:41:42.397983 2026] [security2:error] [pid 938041:tid 938092] [remote 103.75.185.95:35620] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxjliNrzsYMDd5sB10ikgAAHjE"]
[Sat Jul 18 23:41:42.667513 2026] [security2:error] [pid 938041:tid 938226] [client 173.239.196.167:34237] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/blue/shell.php"] [unique_id "alxjliNrzsYMDd5sB10ipQAAADY"]
[Sat Jul 18 23:41:42.904150 2026] [security2:error] [pid 938041:tid 938088] [remote 103.75.185.95:35620] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxjliNrzsYMDd5sB10itAAAey0"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:41:42.972550 2026] [security2:error] [pid 938041:tid 938173] [client 84.17.43.206:53962] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "miaimminiatures.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "alxjliNrzsYMDd5sB10ivQAAAAE"]
[Sat Jul 18 23:41:43.010877 2026] [security2:error] [pid 938041:tid 938253] [client 45.133.7.59:47851] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 59.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/file.php"] [unique_id "alxjlyNrzsYMDd5sB10iwAAAAFE"]
[Sat Jul 18 23:41:43.321503 2026] [security2:error] [pid 938041:tid 938215] [client 84.17.43.206:1953] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 206.43.17.84.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "miaimminiatures.com"] [uri "/xmlrpc.php"] [unique_id "alxjlyNrzsYMDd5sB10i2AAAACs"]
[Sat Jul 18 23:41:43.587349 2026] [security2:error] [pid 938041:tid 938192] [client 163.61.1.17:53796] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjlyNrzsYMDd5sB10i8AAAABQ"]
[Sat Jul 18 23:41:43.592964 2026] [security2:error] [pid 938041:tid 938192] [client 163.61.1.17:53796] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjlyNrzsYMDd5sB10i8AAAABQ"]
[Sat Jul 18 23:41:43.654338 2026] [security2:error] [pid 938041:tid 938288] [client 223.228.182.224:32287] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjlyNrzsYMDd5sB10i9wAAAHQ"]
[Sat Jul 18 23:41:43.654446 2026] [security2:error] [pid 938041:tid 938288] [client 223.228.182.224:32287] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjlyNrzsYMDd5sB10i9wAAAHQ"]
[Sat Jul 18 23:41:43.709499 2026] [security2:error] [pid 938041:tid 938180] [client 45.133.7.69:54977] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 69.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/js/index.php"] [unique_id "alxjlyNrzsYMDd5sB10i-gAAAAg"]
[Sat Jul 18 23:41:43.858134 2026] [security2:error] [pid 938041:tid 938263] [client 84.17.43.206:53980] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "miaimminiatures.com"] [uri "/blog/wp-includes/wlwmanifest.xml"] [unique_id "alxjlyNrzsYMDd5sB10jAgAAAFs"]
[Sat Jul 18 23:41:44.194580 2026] [security2:error] [pid 938041:tid 938279] [client 84.17.43.206:41729] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "miaimminiatures.com"] [uri "/web/wp-includes/wlwmanifest.xml"] [unique_id "alxjmCNrzsYMDd5sB10jGQAAAGs"]
[Sat Jul 18 23:41:44.330234 2026] [security2:error] [pid 938041:tid 938191] [client 104.28.228.198:15080] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "elevatewithemma.com"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "alxjmCNrzsYMDd5sB10jHAAAABM"]
[Sat Jul 18 23:41:44.390599 2026] [security2:error] [pid 938041:tid 938212] [client 45.133.7.92:22469] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/upgrade/item.php"] [unique_id "alxjmCNrzsYMDd5sB10jHgAAACg"]
[Sat Jul 18 23:41:44.394679 2026] [security2:error] [pid 938041:tid 938207] [client 103.122.66.175:37700] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "primests.com"] [uri "/wp-comments-post.php"] [unique_id "alxjmCNrzsYMDd5sB10jHwAAACM"]
[Sat Jul 18 23:41:44.514696 2026] [security2:error] [pid 938041:tid 938180] [client 84.17.43.206:53986] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "miaimminiatures.com"] [uri "/wordpress/wp-includes/wlwmanifest.xml"] [unique_id "alxjmCNrzsYMDd5sB10jKgAAAAg"]
[Sat Jul 18 23:41:44.570800 2026] [security2:error] [pid 938041:tid 938207] [client 103.122.66.175:37700] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "403"] [hostname "primests.com"] [uri "/wp-comments-post.php"] [unique_id "alxjmCNrzsYMDd5sB10jHwAAACM"]
[Sat Jul 18 23:41:44.718530 2026] [security2:error] [pid 938041:tid 938283] [client 173.239.196.165:61299] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/erinyani/default.php"] [unique_id "alxjmCNrzsYMDd5sB10jNwAAAG8"]
[Sat Jul 18 23:41:44.838386 2026] [security2:error] [pid 938041:tid 938291] [client 139.167.225.146:56375] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjmCNrzsYMDd5sB10jOQAAAHc"]
[Sat Jul 18 23:41:44.838511 2026] [security2:error] [pid 938041:tid 938291] [client 139.167.225.146:56375] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjmCNrzsYMDd5sB10jOQAAAHc"]
[Sat Jul 18 23:41:44.858727 2026] [security2:error] [pid 938041:tid 938232] [client 84.17.43.206:53998] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "miaimminiatures.com"] [uri "/wp/wp-includes/wlwmanifest.xml"] [unique_id "alxjmCNrzsYMDd5sB10jPAAAADw"]
[Sat Jul 18 23:41:45.065784 2026] [security2:error] [pid 938041:tid 938267] [client 45.133.7.85:42157] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 85.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/buy.php"] [unique_id "alxjmSNrzsYMDd5sB10jSgAAAF8"]
[Sat Jul 18 23:41:45.191032 2026] [security2:error] [pid 938041:tid 938175] [client 84.17.43.206:45047] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "miaimminiatures.com"] [uri "/news/wp-includes/wlwmanifest.xml"] [unique_id "alxjmSNrzsYMDd5sB10jVgAAAAM"]
[Sat Jul 18 23:41:45.378077 2026] [security2:error] [pid 938041:tid 938082] [remote 134.209.147.209:36812] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.147.209.134.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathybuffini.com"] [uri "/wp-login.php"] [unique_id "alxjmSNrzsYMDd5sB10jXgAAJSc"]
[Sat Jul 18 23:41:45.512876 2026] [security2:error] [pid 938041:tid 938276] [client 84.17.43.206:54014] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "miaimminiatures.com"] [uri "/2018/wp-includes/wlwmanifest.xml"] [unique_id "alxjmSNrzsYMDd5sB10jbQAAAGg"]
[Sat Jul 18 23:41:45.602769 2026] [security2:error] [pid 938041:tid 938187] [client 173.239.196.161:28007] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/Text/index.php"] [unique_id "alxjmSNrzsYMDd5sB10jdwAAAA8"]
[Sat Jul 18 23:41:45.740471 2026] [security2:error] [pid 938041:tid 938295] [client 45.133.7.92:53291] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/languages/wp-conflg.php"] [unique_id "alxjmSNrzsYMDd5sB10jgAAAAHs"]
[Sat Jul 18 23:41:45.779406 2026] [security2:error] [pid 938041:tid 938137] [remote 134.209.147.209:36812] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.147.209.134.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cathybuffini.com"] [uri "/wp-login.php"] [unique_id "alxjmSNrzsYMDd5sB10jggAADV4"], referer: https://cathybuffini.com/wp-login.php
[Sat Jul 18 23:41:45.827806 2026] [security2:error] [pid 938041:tid 938192] [client 84.17.43.206:22512] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "miaimminiatures.com"] [uri "/2019/wp-includes/wlwmanifest.xml"] [unique_id "alxjmSNrzsYMDd5sB10jhAAAABQ"]
[Sat Jul 18 23:41:46.094065 2026] [security2:error] [pid 938041:tid 938214] [client 180.252.198.240:54811] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjmiNrzsYMDd5sB10jkgAAACo"]
[Sat Jul 18 23:41:46.094177 2026] [security2:error] [pid 938041:tid 938214] [client 180.252.198.240:54811] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjmiNrzsYMDd5sB10jkgAAACo"]
[Sat Jul 18 23:41:46.114231 2026] [security2:error] [pid 938041:tid 938170] [remote 47.86.33.52:40410] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxjmiNrzsYMDd5sB10jkQAAWX8"]
[Sat Jul 18 23:41:46.162518 2026] [security2:error] [pid 938041:tid 938296] [client 84.17.43.206:54044] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "miaimminiatures.com"] [uri "/shop/wp-includes/wlwmanifest.xml"] [unique_id "alxjmiNrzsYMDd5sB10jlwAAAHw"]
[Sat Jul 18 23:41:46.412490 2026] [security2:error] [pid 938041:tid 938253] [client 45.133.7.65:57979] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 65.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/classwithtostring.php"] [unique_id "alxjmiNrzsYMDd5sB10jrAAAAFE"]
[Sat Jul 18 23:41:46.471710 2026] [security2:error] [pid 938041:tid 938264] [client 173.239.196.161:44561] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/xex.php"] [unique_id "alxjmiNrzsYMDd5sB10jrQAAAFw"]
[Sat Jul 18 23:41:46.490975 2026] [security2:error] [pid 938041:tid 938052] [remote 47.86.33.52:40410] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxjmiNrzsYMDd5sB10jsgAAEgk"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:41:46.512154 2026] [security2:error] [pid 938041:tid 938250] [client 84.17.43.206:54923] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "miaimminiatures.com"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "alxjmiNrzsYMDd5sB10jtgAAAE4"]
[Sat Jul 18 23:41:46.556565 2026] [security2:error] [pid 938041:tid 938205] [client 171.245.26.255:49636] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxjmiNrzsYMDd5sB10jtwAAACE"]
[Sat Jul 18 23:41:46.828117 2026] [security2:error] [pid 938041:tid 938224] [client 84.17.43.206:5238] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "miaimminiatures.com"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "alxjmiNrzsYMDd5sB10jzQAAADQ"]
[Sat Jul 18 23:41:47.089298 2026] [security2:error] [pid 938041:tid 938219] [client 45.133.7.73:26837] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 73.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/elementor/wp-wjvngrh.php"] [unique_id "alxjmyNrzsYMDd5sB10j2AAAAC8"]
[Sat Jul 18 23:41:47.185904 2026] [security2:error] [pid 938041:tid 938206] [client 84.17.43.206:54078] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "miaimminiatures.com"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "alxjmyNrzsYMDd5sB10j5QAAACI"]
[Sat Jul 18 23:41:47.325559 2026] [security2:error] [pid 938041:tid 938186] [client 173.239.196.165:23755] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/about.php"] [unique_id "alxjmyNrzsYMDd5sB10j9QAAAA4"]
[Sat Jul 18 23:41:47.435990 2026] [security2:error] [pid 938041:tid 938287] [client 178.20.43.173:56312] ModSecurity: Access denied with code 406 (phase 1). IPmatchFromFile: "178.20.43.173" matched at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1090"] [id "999022"] [msg "Blacklisted IP Address for POST data StopForumSpam List"] [hostname "mezzacraft.com"] [uri "/wp-comments-post.php"] [unique_id "alxjmyNrzsYMDd5sB10j9wAAAHM"], referer: https://mezzacraft.com/making-a-top-with-the-cartwheels-clovers-motif/#comment-14534
[Sat Jul 18 23:41:47.436106 2026] [security2:error] [pid 938041:tid 938287] [client 178.20.43.173:56312] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "406"] [hostname "mezzacraft.com"] [uri "/wp-comments-post.php"] [unique_id "alxjmyNrzsYMDd5sB10j9wAAAHM"], referer: https://mezzacraft.com/making-a-top-with-the-cartwheels-clovers-motif/#comment-14534
[Sat Jul 18 23:41:47.491560 2026] [security2:error] [pid 938041:tid 938255] [client 106.222.249.209:3198] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjmyNrzsYMDd5sB10j-QAAAFM"]
[Sat Jul 18 23:41:47.491820 2026] [security2:error] [pid 938041:tid 938255] [client 106.222.249.209:3198] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjmyNrzsYMDd5sB10j-QAAAFM"]
[Sat Jul 18 23:41:47.505286 2026] [security2:error] [pid 938041:tid 938182] [client 84.17.43.206:54092] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "miaimminiatures.com"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "alxjmyNrzsYMDd5sB10j-gAAAAo"]
[Sat Jul 18 23:41:47.803902 2026] [security2:error] [pid 938041:tid 938299] [client 45.133.7.62:64073] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/IXR/fix.php7"] [unique_id "alxjmyNrzsYMDd5sB10kEQAAAH8"]
[Sat Jul 18 23:41:47.820778 2026] [security2:error] [pid 938041:tid 938181] [client 84.17.43.206:54096] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "miaimminiatures.com"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "alxjmyNrzsYMDd5sB10kGwAAAAk"]
[Sat Jul 18 23:41:48.148773 2026] [security2:error] [pid 938041:tid 938268] [client 84.17.43.206:54098] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "miaimminiatures.com"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "alxjnCNrzsYMDd5sB10kKAAAAGA"]
[Sat Jul 18 23:41:48.196566 2026] [security2:error] [pid 938041:tid 938176] [client 173.239.196.164:20477] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/pwnd/install.php"] [unique_id "alxjnCNrzsYMDd5sB10kKQAAAAQ"]
[Sat Jul 18 23:41:48.332550 2026] [security2:error] [pid 938041:tid 938279] [client 103.122.66.175:37984] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "primests.com"] [uri "/wp-comments-post.php"] [unique_id "alxjnCNrzsYMDd5sB10kNwAAAGs"]
[Sat Jul 18 23:41:48.486527 2026] [security2:error] [pid 938041:tid 938234] [client 45.133.7.90:25757] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 90.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "alxjnCNrzsYMDd5sB10kRgAAAD4"]
[Sat Jul 18 23:41:48.499188 2026] [security2:error] [pid 938041:tid 938207] [client 84.17.43.206:54112] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "miaimminiatures.com"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "alxjnCNrzsYMDd5sB10kSgAAACM"]
[Sat Jul 18 23:41:48.507592 2026] [security2:error] [pid 938041:tid 938279] [client 103.122.66.175:37984] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "403"] [hostname "primests.com"] [uri "/wp-comments-post.php"] [unique_id "alxjnCNrzsYMDd5sB10kNwAAAGs"]
[Sat Jul 18 23:41:48.716008 2026] [security2:error] [pid 938041:tid 938179] [client 138.252.89.100:54046] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjnCNrzsYMDd5sB10kUwAAAAc"]
[Sat Jul 18 23:41:48.716772 2026] [security2:error] [pid 938041:tid 938179] [client 138.252.89.100:54046] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjnCNrzsYMDd5sB10kUwAAAAc"]
[Sat Jul 18 23:41:49.082813 2026] [security2:error] [pid 938041:tid 938222] [client 173.239.196.164:38861] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/upload/install.php"] [unique_id "alxjnSNrzsYMDd5sB10kcgAAADI"]
[Sat Jul 18 23:41:49.159589 2026] [security2:error] [pid 938041:tid 938251] [client 45.133.7.72:37855] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 72.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/admin/function.php"] [unique_id "alxjnSNrzsYMDd5sB10kdgAAAE8"]
[Sat Jul 18 23:41:49.322915 2026] [security2:error] [pid 938041:tid 938266] [client 223.228.182.224:35397] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjnSNrzsYMDd5sB10kgQAAAF4"]
[Sat Jul 18 23:41:49.327367 2026] [security2:error] [pid 938041:tid 938266] [client 223.228.182.224:35397] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjnSNrzsYMDd5sB10kgQAAAF4"]
[Sat Jul 18 23:41:49.669312 2026] [security2:error] [pid 938041:tid 938277] [client 202.28.194.139:45542] ModSecurity: Access denied with code 406 (phase 1). IPmatchFromFile: "202.28.194.139" matched at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1090"] [id "999022"] [msg "Blacklisted IP Address for POST data StopForumSpam List"] [hostname "mezzacraft.com"] [uri "/wp-comments-post.php"] [unique_id "alxjnSNrzsYMDd5sB10klgAAAGk"], referer: https://mezzacraft.com/making-a-top-with-the-cartwheels-clovers-motif/#comment-14534
[Sat Jul 18 23:41:49.669434 2026] [security2:error] [pid 938041:tid 938277] [client 202.28.194.139:45542] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "406"] [hostname "mezzacraft.com"] [uri "/wp-comments-post.php"] [unique_id "alxjnSNrzsYMDd5sB10klgAAAGk"], referer: https://mezzacraft.com/making-a-top-with-the-cartwheels-clovers-motif/#comment-14534
[Sat Jul 18 23:41:49.750152 2026] [security2:error] [pid 938041:tid 938207] [client 216.73.216.122:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.ali-alghanim.com"] [uri "/index.php"] [unique_id "alxjnSNrzsYMDd5sB10kigAAI2w"]
[Sat Jul 18 23:41:49.870623 2026] [security2:error] [pid 938041:tid 938256] [client 45.133.7.70:39655] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "alxjnSNrzsYMDd5sB10kqAAAAFQ"]
[Sat Jul 18 23:41:49.970170 2026] [security2:error] [pid 938041:tid 938204] [client 173.239.196.160:50335] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-head.php"] [unique_id "alxjnSNrzsYMDd5sB10ktgAAACA"]
[Sat Jul 18 23:41:50.075658 2026] [security2:error] [pid 938041:tid 938194] [client 216.73.216.122:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.ali-alghanim.com"] [uri "/index.php"] [unique_id "alxjnSNrzsYMDd5sB10ktQAAFic"]
[Sat Jul 18 23:41:50.545522 2026] [security2:error] [pid 938041:tid 938267] [client 45.133.7.65:63469] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 65.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "alxjniNrzsYMDd5sB10k2AAAAF8"]
[Sat Jul 18 23:41:50.869776 2026] [security2:error] [pid 938041:tid 938212] [client 173.239.196.161:33161] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/admin-footer.php"] [unique_id "alxjniNrzsYMDd5sB10k6wAAACg"]
[Sat Jul 18 23:41:51.200089 2026] [security2:error] [pid 938041:tid 938202] [client 103.122.66.175:38176] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "primests.com"] [uri "/wp-comments-post.php"] [unique_id "alxjnyNrzsYMDd5sB10k_QAAAB4"]
[Sat Jul 18 23:41:51.229556 2026] [security2:error] [pid 938041:tid 938215] [client 45.133.7.85:28129] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 85.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "alxjnyNrzsYMDd5sB10lAQAAACs"]
[Sat Jul 18 23:41:51.353244 2026] [security2:error] [pid 938041:tid 938202] [client 103.122.66.175:38176] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "403"] [hostname "primests.com"] [uri "/wp-comments-post.php"] [unique_id "alxjnyNrzsYMDd5sB10k_QAAAB4"]
[Sat Jul 18 23:41:51.761233 2026] [security2:error] [pid 938041:tid 938298] [client 173.239.196.160:58581] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/upgrade/wp-conflg.php"] [unique_id "alxjnyNrzsYMDd5sB10lIgAAAH4"]
[Sat Jul 18 23:41:51.901683 2026] [security2:error] [pid 938041:tid 938189] [client 45.133.7.62:27419] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "alxjnyNrzsYMDd5sB10lLgAAABE"]
[Sat Jul 18 23:41:52.354648 2026] [security2:error] [pid 938041:tid 938096] [remote 41.76.213.235:41026] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "christiancountytrumpet.com"] [uri "/wp-login.php"] [unique_id "alxjoCNrzsYMDd5sB10lQgAACDU"]
[Sat Jul 18 23:41:52.632411 2026] [security2:error] [pid 938041:tid 938259] [client 45.133.7.56:31369] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 56.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "alxjoCNrzsYMDd5sB10lUgAAAFc"]
[Sat Jul 18 23:41:52.634687 2026] [security2:error] [pid 938041:tid 938295] [client 173.239.196.162:32007] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/makeasmtp.php"] [unique_id "alxjoCNrzsYMDd5sB10lWwAAAHs"]
[Sat Jul 18 23:41:52.870212 2026] [security2:error] [pid 938041:tid 938086] [remote 41.76.213.235:41026] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "christiancountytrumpet.com"] [uri "/wp-login.php"] [unique_id "alxjoCNrzsYMDd5sB10lZAAAMis"], referer: https://christiancountytrumpet.com/wp-login.php
[Sat Jul 18 23:41:53.147876 2026] [security2:error] [pid 938041:tid 938093] [remote 167.71.132.111:40992] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.132.71.167.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tejasenvironmental.com"] [uri "/wp-login.php"] [unique_id "alxjoSNrzsYMDd5sB10lewAATDI"]
[Sat Jul 18 23:41:53.303113 2026] [security2:error] [pid 938041:tid 938200] [client 45.133.7.66:26811] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 66.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/files/index.php"] [unique_id "alxjoSNrzsYMDd5sB10lhwAAABw"]
[Sat Jul 18 23:41:53.370772 2026] [security2:error] [pid 938041:tid 938128] [remote 167.71.132.111:40992] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.132.71.167.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tejasenvironmental.com"] [uri "/wp-login.php"] [unique_id "alxjoSNrzsYMDd5sB10liQAAa1U"], referer: https://tejasenvironmental.com/wp-login.php
[Sat Jul 18 23:41:53.380873 2026] [security2:error] [pid 938041:tid 938294] [client 163.61.1.17:54270] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjoSNrzsYMDd5sB10ligAAAHo"]
[Sat Jul 18 23:41:53.380951 2026] [security2:error] [pid 938041:tid 938294] [client 163.61.1.17:54270] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjoSNrzsYMDd5sB10ligAAAHo"]
[Sat Jul 18 23:41:53.468873 2026] [security2:error] [pid 938041:tid 938204] [client 173.239.196.164:38303] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/wp-sup.php"] [unique_id "alxjoSNrzsYMDd5sB10llQAAACA"]
[Sat Jul 18 23:41:53.841549 2026] [security2:error] [pid 938041:tid 938148] [remote 152.228.213.32:38426] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.ait.afz.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxjoSNrzsYMDd5sB10lqgAAQWk"]
[Sat Jul 18 23:41:53.841731 2026] [security2:error] [pid 938041:tid 938237] [client 152.228.213.32:38426] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "mail.ait.afz.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxjoSNrzsYMDd5sB10lqgAAQWk"]
[Sat Jul 18 23:41:53.983667 2026] [security2:error] [pid 938041:tid 938210] [client 45.133.7.88:41481] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 88.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "alxjoSNrzsYMDd5sB10ltAAAACY"]
[Sat Jul 18 23:41:54.330135 2026] [security2:error] [pid 938041:tid 938272] [client 173.239.196.164:41527] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wordpress/wp-includes/class-wp-http-ixr-client-view.php"] [unique_id "alxjoiNrzsYMDd5sB10lxwAAAGQ"]
[Sat Jul 18 23:41:54.667111 2026] [security2:error] [pid 938041:tid 938256] [client 45.133.7.79:20681] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 79.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/inc.php"] [unique_id "alxjoiNrzsYMDd5sB10l4QAAAFQ"]
[Sat Jul 18 23:41:55.225209 2026] [security2:error] [pid 938041:tid 938274] [client 173.239.196.164:26655] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/images/bypass.php"] [unique_id "alxjoyNrzsYMDd5sB10l_wAAAGY"]
[Sat Jul 18 23:41:55.341079 2026] [security2:error] [pid 938041:tid 938214] [client 45.133.7.63:22077] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/index.php"] [unique_id "alxjoyNrzsYMDd5sB10mCAAAACo"]
[Sat Jul 18 23:41:55.733923 2026] [security2:error] [pid 938041:tid 938198] [client 103.122.66.175:38342] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "primests.com"] [uri "/wp-comments-post.php"] [unique_id "alxjoyNrzsYMDd5sB10mGwAAABo"]
[Sat Jul 18 23:41:55.744131 2026] [security2:error] [pid 938041:tid 938213] [client 139.167.225.146:57029] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjoyNrzsYMDd5sB10mHQAAACk"]
[Sat Jul 18 23:41:55.744213 2026] [security2:error] [pid 938041:tid 938213] [client 139.167.225.146:57029] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjoyNrzsYMDd5sB10mHQAAACk"]
[Sat Jul 18 23:41:55.911901 2026] [security2:error] [pid 938041:tid 938198] [client 103.122.66.175:38342] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "403"] [hostname "primests.com"] [uri "/wp-comments-post.php"] [unique_id "alxjoyNrzsYMDd5sB10mGwAAABo"]
[Sat Jul 18 23:41:56.013512 2026] [security2:error] [pid 938041:tid 938268] [client 45.133.7.72:62911] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 72.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/filemanager.php"] [unique_id "alxjpCNrzsYMDd5sB10mLwAAAGA"]
[Sat Jul 18 23:41:56.142683 2026] [security2:error] [pid 938041:tid 938271] [client 173.239.196.161:45631] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "alxjpCNrzsYMDd5sB10mOgAAAGM"]
[Sat Jul 18 23:41:56.595925 2026] [security2:error] [pid 938041:tid 938047] [remote 91.142.222.105:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "innovativecleaningsvs.com"] [uri "/wp-login.php"] [unique_id "alxjpCNrzsYMDd5sB10mVQAAWwQ"]
[Sat Jul 18 23:41:56.675350 2026] [security2:error] [pid 938041:tid 938287] [client 180.252.198.240:55300] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjpCNrzsYMDd5sB10mXAAAAHM"]
[Sat Jul 18 23:41:56.675481 2026] [security2:error] [pid 938041:tid 938287] [client 180.252.198.240:55300] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjpCNrzsYMDd5sB10mXAAAAHM"]
[Sat Jul 18 23:41:56.696311 2026] [security2:error] [pid 938041:tid 938246] [client 45.133.7.80:28973] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/cgi-bin/bypass.php"] [unique_id "alxjpCNrzsYMDd5sB10mXQAAAEo"]
[Sat Jul 18 23:41:57.071551 2026] [security2:error] [pid 938041:tid 938265] [client 173.239.196.163:35039] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/edit.php"] [unique_id "alxjpSNrzsYMDd5sB10mawAAAF0"]
[Sat Jul 18 23:41:57.369294 2026] [security2:error] [pid 938041:tid 938250] [client 45.133.7.87:43813] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 87.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/pki-validation/admin.php"] [unique_id "alxjpSNrzsYMDd5sB10mgwAAAE4"]
[Sat Jul 18 23:41:57.834190 2026] [security2:error] [pid 938041:tid 938055] [remote 31.42.184.154:46702] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "narv.co"] [uri "/xmlrpc.php"] [unique_id "alxjpSNrzsYMDd5sB10moQAAQQw"]
[Sat Jul 18 23:41:57.834401 2026] [security2:error] [pid 938041:tid 938237] [client 31.42.184.154:46702] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "narv.co"] [uri "/xmlrpc.php"] [unique_id "alxjpSNrzsYMDd5sB10moQAAQQw"]
[Sat Jul 18 23:41:57.951735 2026] [security2:error] [pid 938041:tid 938236] [client 173.239.196.165:60903] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/info.php"] [unique_id "alxjpSNrzsYMDd5sB10mogAAAEA"]
[Sat Jul 18 23:41:58.046007 2026] [security2:error] [pid 938041:tid 938179] [client 45.133.7.79:37747] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 79.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/IXR/admin.php"] [unique_id "alxjpiNrzsYMDd5sB10mowAAAAc"]
[Sat Jul 18 23:41:58.163299 2026] [security2:error] [pid 938041:tid 938285] [client 57.141.18.123:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "nextlvlmarketingco.com"] [uri "/index.php"] [unique_id "alxjoiNrzsYMDd5sB10l8gAAAHE"]
[Sat Jul 18 23:41:58.257169 2026] [security2:error] [pid 938041:tid 938180] [client 106.222.249.209:12753] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjpiNrzsYMDd5sB10mtQAAAAg"]
[Sat Jul 18 23:41:58.257332 2026] [security2:error] [pid 938041:tid 938180] [client 106.222.249.209:12753] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjpiNrzsYMDd5sB10mtQAAAAg"]
[Sat Jul 18 23:41:58.451580 2026] [security2:error] [pid 938041:tid 938099] [remote 120.72.98.5:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aleishapenny.ca"] [uri "/wp-login.php"] [unique_id "alxjpiNrzsYMDd5sB10mxAAALzg"]
[Sat Jul 18 23:41:58.729077 2026] [security2:error] [pid 938041:tid 938196] [client 45.133.7.71:64073] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 71.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/js/index.php"] [unique_id "alxjpiNrzsYMDd5sB10m5gAAABg"]
[Sat Jul 18 23:41:58.848899 2026] [security2:error] [pid 938041:tid 938262] [client 173.239.196.161:57597] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/autoload_classmap.php"] [unique_id "alxjpiNrzsYMDd5sB10m7wAAAFo"]
[Sat Jul 18 23:41:58.951267 2026] [security2:error] [pid 938041:tid 938148] [remote 120.72.98.5:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aleishapenny.ca"] [uri "/wp-login.php"] [unique_id "alxjpiNrzsYMDd5sB10m9AAACWk"], referer: https://aleishapenny.ca/wp-login.php
[Sat Jul 18 23:41:59.197090 2026] [security2:error] [pid 938041:tid 938124] [remote 97.74.93.24:60308] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxjpyNrzsYMDd5sB10nAwAAIFE"]
[Sat Jul 18 23:41:59.197334 2026] [security2:error] [pid 938041:tid 938204] [client 97.74.93.24:60308] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxjpyNrzsYMDd5sB10nAwAAIFE"]
[Sat Jul 18 23:41:59.422081 2026] [security2:error] [pid 938041:tid 938173] [client 45.133.7.105:26605] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "alxjpyNrzsYMDd5sB10nFwAAAAE"]
[Sat Jul 18 23:41:59.442325 2026] [security2:error] [pid 938041:tid 938147] [remote 41.76.213.235:43260] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.nvy.ppp.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxjpyNrzsYMDd5sB10nHQAAZGg"]
[Sat Jul 18 23:41:59.738089 2026] [security2:error] [pid 938041:tid 938244] [client 173.239.196.165:61423] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/blue/navi.php"] [unique_id "alxjpyNrzsYMDd5sB10nLgAAAEg"]
[Sat Jul 18 23:41:59.963256 2026] [security2:error] [pid 938041:tid 938100] [remote 41.76.213.235:43260] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.nvy.ppp.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxjpyNrzsYMDd5sB10nQAAADzk"], referer: https://mail.nvy.ppp.mybluehost.me/wp-login.php
[Sat Jul 18 23:42:00.097231 2026] [security2:error] [pid 938041:tid 938278] [client 45.133.7.103:23127] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/function.php"] [unique_id "alxjqCNrzsYMDd5sB10nSgAAAGo"]
[Sat Jul 18 23:42:00.299364 2026] [security2:error] [pid 938041:tid 938299] [client 138.252.89.100:54574] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjqCNrzsYMDd5sB10nWgAAAH8"]
[Sat Jul 18 23:42:00.299481 2026] [security2:error] [pid 938041:tid 938299] [client 138.252.89.100:54574] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjqCNrzsYMDd5sB10nWgAAAH8"]
[Sat Jul 18 23:42:00.463089 2026] [security2:error] [pid 938041:tid 938236] [client 223.228.182.224:60706] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjqCNrzsYMDd5sB10nYwAAAEA"]
[Sat Jul 18 23:42:00.463201 2026] [security2:error] [pid 938041:tid 938236] [client 223.228.182.224:60706] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjqCNrzsYMDd5sB10nYwAAAEA"]
[Sat Jul 18 23:42:00.684198 2026] [security2:error] [pid 938041:tid 938240] [client 173.239.196.160:45481] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "alxjqCNrzsYMDd5sB10naQAAAEQ"]
[Sat Jul 18 23:42:00.783321 2026] [security2:error] [pid 938041:tid 938190] [client 45.133.7.66:58965] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 66.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "alxjqCNrzsYMDd5sB10ncwAAABI"]
[Sat Jul 18 23:42:00.786824 2026] [security2:error] [pid 938041:tid 938222] [client 190.5.37.217:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "taskidsvirginia.com"] [uri "/index.php"] [unique_id "alxjqCNrzsYMDd5sB10nUgAAADI"]
[Sat Jul 18 23:42:00.914804 2026] [security2:error] [pid 938041:tid 938291] [client 103.122.66.175:38474] ModSecurity: Warning. Pattern match "/(contact(o|.?us)?|wp-comments-post|(send)?.?(form.)?e?mail(er)?|memberlist|send|contact.form(.handler)?|thankyou|leafmailer[0-9.]*)\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1546"] [id "900923"] [msg "contact form logging"] [hostname "primests.com"] [uri "/wp-comments-post.php"] [unique_id "alxjqCNrzsYMDd5sB10nfwAAAHc"]
[Sat Jul 18 23:42:00.949308 2026] [security2:error] [pid 938041:tid 938167] [remote 57.141.18.69:65180] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 69.18.141.57.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/index.php/checkout/"] [unique_id "alxjqCNrzsYMDd5sB10nggAAH3w"]
[Sat Jul 18 23:42:01.097867 2026] [security2:error] [pid 938041:tid 938291] [client 103.122.66.175:38474] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "403"] [hostname "primests.com"] [uri "/wp-comments-post.php"] [unique_id "alxjqCNrzsYMDd5sB10nfwAAAHc"]
[Sat Jul 18 23:42:01.235047 2026] [security2:error] [pid 938041:tid 938053] [remote 160.187.68.132:54370] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.68.187.160.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nextlevelpressurewashing.nextlvlmarketingco.com"] [uri "/wp-login.php"] [unique_id "alxjqSNrzsYMDd5sB10njgAAHAo"]
[Sat Jul 18 23:42:01.391205 2026] [security2:error] [pid 938041:tid 938219] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "alxjqSNrzsYMDd5sB10nowAAAC8"]
[Sat Jul 18 23:42:01.391375 2026] [security2:error] [pid 938041:tid 938219] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "alxjqSNrzsYMDd5sB10nowAAAC8"]
[Sat Jul 18 23:42:01.479280 2026] [security2:error] [pid 938041:tid 938241] [client 45.133.7.68:20283] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 68.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-signup.php"] [unique_id "alxjqSNrzsYMDd5sB10nqQAAAEU"]
[Sat Jul 18 23:42:01.551392 2026] [security2:error] [pid 938041:tid 938242] [client 173.239.196.167:27141] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/xp.php%20"] [unique_id "alxjqSNrzsYMDd5sB10nrAAAAEY"]
[Sat Jul 18 23:42:01.904707 2026] [security2:error] [pid 938041:tid 938248] [client 3.108.60.216:44642] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxjqSNrzsYMDd5sB10nxwAAAEw"]
[Sat Jul 18 23:42:02.155479 2026] [security2:error] [pid 938041:tid 938203] [client 45.133.7.78:60291] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 78.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/network/network.php"] [unique_id "alxjqiNrzsYMDd5sB10n3gAAAB8"]
[Sat Jul 18 23:42:02.189627 2026] [security2:error] [pid 938041:tid 938081] [remote 57.141.18.28:48304] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 28.18.141.57.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/product/6015466"] [unique_id "alxjqiNrzsYMDd5sB10n4AAAWiY"]
[Sat Jul 18 23:42:02.399804 2026] [security2:error] [pid 938041:tid 938230] [client 173.239.196.160:36025] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/languages/bypass.php"] [unique_id "alxjqiNrzsYMDd5sB10n9QAAADo"]
[Sat Jul 18 23:42:02.765940 2026] [security2:error] [pid 938041:tid 938067] [remote 120.72.98.5:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "innovativecleaningsvs.com"] [uri "/wp-login.php"] [unique_id "alxjqiNrzsYMDd5sB10oDwAAWxg"]
[Sat Jul 18 23:42:02.780070 2026] [security2:error] [pid 938041:tid 938271] [client 14.231.127.235:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.savilerowtravel.com"] [uri "/index.php"] [unique_id "alxjqiNrzsYMDd5sB10n2gAAAGM"]
[Sat Jul 18 23:42:02.819597 2026] [security2:error] [pid 938041:tid 938120] [remote 103.74.116.239:51100] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 239.116.74.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "technicalseohouse.com"] [uri "/wp-login.php"] [unique_id "alxjqiNrzsYMDd5sB10oEAAAeU0"]
[Sat Jul 18 23:42:02.845496 2026] [security2:error] [pid 938041:tid 938245] [client 45.133.7.76:46061] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 76.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/admin/upload/css.php"] [unique_id "alxjqiNrzsYMDd5sB10oFQAAAEk"]
[Sat Jul 18 23:42:03.075594 2026] [security2:error] [pid 938041:tid 938243] [client 13.232.206.133:41466] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.206.232.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxjqyNrzsYMDd5sB10oJQAAAEc"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:42:03.215294 2026] [security2:error] [pid 938041:tid 938125] [remote 103.74.116.239:51100] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 239.116.74.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "technicalseohouse.com"] [uri "/wp-login.php"] [unique_id "alxjqyNrzsYMDd5sB10oMwAAb1I"], referer: https://technicalseohouse.com/wp-login.php
[Sat Jul 18 23:42:03.282454 2026] [security2:error] [pid 938041:tid 938208] [client 173.239.196.162:59759] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/bypass_1.php"] [unique_id "alxjqyNrzsYMDd5sB10oNwAAACQ"]
[Sat Jul 18 23:42:03.531660 2026] [security2:error] [pid 938041:tid 938273] [client 45.133.7.62:26991] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-blog.php"] [unique_id "alxjqyNrzsYMDd5sB10oRgAAAGU"]
[Sat Jul 18 23:42:03.627073 2026] [security2:error] [pid 938041:tid 938113] [remote 120.72.98.5:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "innovativecleaningsvs.com"] [uri "/wp-login.php"] [unique_id "alxjqyNrzsYMDd5sB10oSgAAGUY"], referer: https://innovativecleaningsvs.com/wp-login.php
[Sat Jul 18 23:42:03.786537 2026] [security2:error] [pid 938041:tid 938212] [client 163.61.1.17:54753] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjqyNrzsYMDd5sB10oUgAAACg"]
[Sat Jul 18 23:42:03.786665 2026] [security2:error] [pid 938041:tid 938212] [client 163.61.1.17:54753] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjqyNrzsYMDd5sB10oUgAAACg"]
[Sat Jul 18 23:42:04.036362 2026] [security2:error] [pid 938041:tid 938110] [remote 91.142.222.105:54278] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxjrCNrzsYMDd5sB10oXQAAZkM"]
[Sat Jul 18 23:42:04.136936 2026] [security2:error] [pid 938041:tid 938256] [client 173.239.196.167:24273] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/js/elementskit.php"] [unique_id "alxjrCNrzsYMDd5sB10oawAAAFQ"]
[Sat Jul 18 23:42:04.155478 2026] [security2:error] [pid 938041:tid 938144] [remote 113.160.142.119:40490] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxjrCNrzsYMDd5sB10obAAAXWU"]
[Sat Jul 18 23:42:04.155650 2026] [security2:error] [pid 938041:tid 938265] [client 113.160.142.119:40490] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxjrCNrzsYMDd5sB10obAAAXWU"]
[Sat Jul 18 23:42:04.218925 2026] [security2:error] [pid 938041:tid 938174] [client 45.133.7.77:23061] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 77.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/file.php"] [unique_id "alxjrCNrzsYMDd5sB10ocwAAAAI"]
[Sat Jul 18 23:42:04.496027 2026] [security2:error] [pid 938041:tid 938239] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/this_is_a_new_hello_world.php"] [unique_id "alxjrCNrzsYMDd5sB10oggAAAEM"]
[Sat Jul 18 23:42:04.496130 2026] [security2:error] [pid 938041:tid 938239] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/this_is_a_new_hello_world.php"] [unique_id "alxjrCNrzsYMDd5sB10oggAAAEM"]
[Sat Jul 18 23:42:04.891443 2026] [security2:error] [pid 938041:tid 938191] [client 45.133.7.92:41163] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/admin.php"] [unique_id "alxjrCNrzsYMDd5sB10omwAAABM"]
[Sat Jul 18 23:42:04.990722 2026] [security2:error] [pid 938041:tid 938276] [client 173.239.196.164:46405] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "alxjrCNrzsYMDd5sB10oowAAAGg"]
[Sat Jul 18 23:42:05.373487 2026] [security2:error] [pid 938041:tid 938183] [client 188.39.109.162:41313] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxjrSNrzsYMDd5sB10ouQAAAAs"]
[Sat Jul 18 23:42:05.564277 2026] [security2:error] [pid 938041:tid 938277] [client 45.133.7.74:25365] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "alxjrSNrzsYMDd5sB10oxgAAAGk"]
[Sat Jul 18 23:42:05.905162 2026] [security2:error] [pid 938041:tid 938299] [client 173.239.196.164:65189] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/pki-validation/kur.php"] [unique_id "alxjrSNrzsYMDd5sB10o5QAAAH8"]
[Sat Jul 18 23:42:06.237846 2026] [security2:error] [pid 938041:tid 938257] [client 45.133.7.105:34955] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-l0gin.php"] [unique_id "alxjriNrzsYMDd5sB10o8wAAAFU"]
[Sat Jul 18 23:42:06.338569 2026] [security2:error] [pid 938041:tid 938250] [client 139.167.225.146:57663] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjriNrzsYMDd5sB10o_AAAAE4"]
[Sat Jul 18 23:42:06.338698 2026] [security2:error] [pid 938041:tid 938250] [client 139.167.225.146:57663] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjriNrzsYMDd5sB10o_AAAAE4"]
[Sat Jul 18 23:42:06.373020 2026] [security2:error] [pid 938041:tid 938072] [remote 91.142.222.105:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "innovativecleaningsvs.com"] [uri "/wp-login.php"] [unique_id "alxjriNrzsYMDd5sB10o_QAABB0"], referer: https://innovativecleaningsvs.com/wp-login.php
[Sat Jul 18 23:42:06.481208 2026] [security2:error] [pid 938041:tid 938242] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/x.php"] [unique_id "alxjriNrzsYMDd5sB10pAQAAAEY"]
[Sat Jul 18 23:42:06.481301 2026] [security2:error] [pid 938041:tid 938242] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/x.php"] [unique_id "alxjriNrzsYMDd5sB10pAQAAAEY"]
[Sat Jul 18 23:42:06.797308 2026] [security2:error] [pid 938041:tid 938230] [client 173.239.196.161:54691] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/click.php"] [unique_id "alxjriNrzsYMDd5sB10pIgAAADo"]
[Sat Jul 18 23:42:06.910480 2026] [security2:error] [pid 938041:tid 938253] [client 45.133.7.97:59279] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 97.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "alxjriNrzsYMDd5sB10pJwAAAFE"]
[Sat Jul 18 23:42:07.086139 2026] [security2:error] [pid 938041:tid 938263] [client 180.252.198.240:55818] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjryNrzsYMDd5sB10pNAAAAFs"]
[Sat Jul 18 23:42:07.086270 2026] [security2:error] [pid 938041:tid 938263] [client 180.252.198.240:55818] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjryNrzsYMDd5sB10pNAAAAFs"]
[Sat Jul 18 23:42:07.581990 2026] [security2:error] [pid 938041:tid 938238] [client 45.133.7.76:47653] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 76.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/new.php"] [unique_id "alxjryNrzsYMDd5sB10pUgAAAEI"]
[Sat Jul 18 23:42:07.690174 2026] [security2:error] [pid 938041:tid 938204] [client 173.239.196.167:43041] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "alxjryNrzsYMDd5sB10pYgAAACA"]
[Sat Jul 18 23:42:07.707189 2026] [security2:error] [pid 938041:tid 938135] [remote 91.142.222.105:54278] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxjryNrzsYMDd5sB10pZAAAUFw"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:42:08.162705 2026] [security2:error] [pid 938041:tid 938196] [client 206.189.196.255:37324] ModSecurity: Access denied with code 406 (phase 1). Pattern match "python-requests|python-urllib" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "1460"] [id "909111"] [msg "Python UA brute"] [hostname "autodiscover.irs-eintaxnumber.com"] [uri "/"] [unique_id "alxjsCNrzsYMDd5sB10pfAAAABg"]
[Sat Jul 18 23:42:08.263210 2026] [security2:error] [pid 938041:tid 938288] [client 45.133.7.65:60861] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 65.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/pwnd-1/admin.php"] [unique_id "alxjsCNrzsYMDd5sB10pggAAAHQ"]
[Sat Jul 18 23:42:08.564242 2026] [security2:error] [pid 938041:tid 938262] [client 173.239.196.163:46091] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "alxjsCNrzsYMDd5sB10plwAAAFo"]
[Sat Jul 18 23:42:08.802359 2026] [security2:error] [pid 938041:tid 938172] [client 106.222.249.209:22213] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjsCNrzsYMDd5sB10ppwAAAAA"]
[Sat Jul 18 23:42:08.802482 2026] [security2:error] [pid 938041:tid 938172] [client 106.222.249.209:22213] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjsCNrzsYMDd5sB10ppwAAAAA"]
[Sat Jul 18 23:42:08.937366 2026] [security2:error] [pid 938041:tid 938278] [client 45.133.7.105:64231] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/defaults.php"] [unique_id "alxjsCNrzsYMDd5sB10ptAAAAGo"]
[Sat Jul 18 23:42:09.429656 2026] [security2:error] [pid 938041:tid 938226] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/j260624_13.php"] [unique_id "alxjsSNrzsYMDd5sB10pzwAAADY"]
[Sat Jul 18 23:42:09.429730 2026] [security2:error] [pid 938041:tid 938226] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/j260624_13.php"] [unique_id "alxjsSNrzsYMDd5sB10pzwAAADY"]
[Sat Jul 18 23:42:09.473972 2026] [security2:error] [pid 938041:tid 938172] [client 173.239.196.165:55689] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/error.php"] [unique_id "alxjsSNrzsYMDd5sB10p0gAAAAA"]
[Sat Jul 18 23:42:09.625920 2026] [security2:error] [pid 938041:tid 938204] [client 45.133.7.66:50827] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 66.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/images/DJP9.php"] [unique_id "alxjsSNrzsYMDd5sB10p1gAAACA"]
[Sat Jul 18 23:42:10.064069 2026] [security2:error] [pid 938041:tid 938166] [remote 152.228.213.32:59306] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.transamericagrid.com"] [uri "/wp-login.php"] [unique_id "alxjsiNrzsYMDd5sB10p8AAANXs"]
[Sat Jul 18 23:42:10.253159 2026] [security2:error] [pid 938041:tid 938165] [remote 152.228.213.32:59306] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.transamericagrid.com"] [uri "/wp-login.php"] [unique_id "alxjsiNrzsYMDd5sB10p-gAAP3o"], referer: https://mail.transamericagrid.com/wp-login.php
[Sat Jul 18 23:42:10.317371 2026] [security2:error] [pid 938041:tid 938255] [client 45.133.7.90:29827] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 90.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/customize/index.php"] [unique_id "alxjsiNrzsYMDd5sB10qAAAAAFM"]
[Sat Jul 18 23:42:10.357111 2026] [security2:error] [pid 938041:tid 938273] [client 173.239.196.165:57177] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/ALFA_DATA/alfacgiapi/all.php"] [unique_id "alxjsiNrzsYMDd5sB10qBAAAAGU"]
[Sat Jul 18 23:42:10.448787 2026] [lsapi:warn] [pid 938041:tid 938140] [remote 216.73.216.153:56778] [host www.oswegooperatheater.com] Backend log: PHP Warning:  Invalid "max_input_time" setting. Invalid quantity "60000000000000000000000": value is out of range, using overflow result for backwards compatibility in Unknown on line 0\n
[Sat Jul 18 23:42:10.448806 2026] [lsapi:warn] [pid 938041:tid 938140] [remote 216.73.216.153:56778] [host www.oswegooperatheater.com] Backend log: PHP Warning:  Invalid "max_input_vars" setting. Invalid quantity "100000000000000000000": value is out of range, using overflow result for backwards compatibility in Unknown on line 0\n
[Sat Jul 18 23:42:10.650616 2026] [security2:error] [pid 938041:tid 938259] [client 34.162.230.222:1313] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxjsiNrzsYMDd5sB10qEQAAAFc"]
[Sat Jul 18 23:42:10.670037 2026] [security2:error] [pid 938041:tid 938294] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/d62.php"] [unique_id "alxjsiNrzsYMDd5sB10qGQAAAHo"]
[Sat Jul 18 23:42:10.670148 2026] [security2:error] [pid 938041:tid 938294] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/d62.php"] [unique_id "alxjsiNrzsYMDd5sB10qGQAAAHo"]
[Sat Jul 18 23:42:10.679808 2026] [security2:error] [pid 938041:tid 938047] [remote 103.90.234.13:40920] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.234.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "longevityperformanceclinic.com"] [uri "/wp-login.php"] [unique_id "alxjsiNrzsYMDd5sB10qFwAAHAQ"]
[Sat Jul 18 23:42:11.000987 2026] [security2:error] [pid 938041:tid 938262] [client 45.133.7.76:40441] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 76.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/shell20211028.php"] [unique_id "alxjsyNrzsYMDd5sB10qNgAAAFo"]
[Sat Jul 18 23:42:11.063252 2026] [lsapi:warn] [pid 938041:tid 938194] [client 50.116.65.227:52008] [host www.oswegooperatheater.com] Backend log: PHP Warning:  Invalid "max_input_time" setting. Invalid quantity "60000000000000000000000": value is out of range, using overflow result for backwards compatibility in Unknown on line 0\n
[Sat Jul 18 23:42:11.063271 2026] [lsapi:warn] [pid 938041:tid 938194] [client 50.116.65.227:52008] [host www.oswegooperatheater.com] Backend log: PHP Warning:  Invalid "max_input_vars" setting. Invalid quantity "100000000000000000000": value is out of range, using overflow result for backwards compatibility in Unknown on line 0\n
[Sat Jul 18 23:42:11.079813 2026] [security2:error] [pid 938041:tid 938207] [client 34.162.230.222:1216] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxjsiNrzsYMDd5sB10qLAAAACM"]
[Sat Jul 18 23:42:11.134836 2026] [lsapi:warn] [pid 938041:tid 938149] [remote 216.73.216.153:56778] [host www.oswegooperatheater.com] Backend log: PHP Warning:  Invalid "max_input_time" setting. Invalid quantity "60000000000000000000000": value is out of range, using overflow result for backwards compatibility in Unknown on line 0\n
[Sat Jul 18 23:42:11.134853 2026] [lsapi:warn] [pid 938041:tid 938149] [remote 216.73.216.153:56778] [host www.oswegooperatheater.com] Backend log: PHP Warning:  Invalid "max_input_vars" setting. Invalid quantity "100000000000000000000": value is out of range, using overflow result for backwards compatibility in Unknown on line 0\n
[Sat Jul 18 23:42:11.159050 2026] [security2:error] [pid 938041:tid 938286] [client 223.228.182.224:15610] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjsyNrzsYMDd5sB10qPgAAAHI"]
[Sat Jul 18 23:42:11.163334 2026] [security2:error] [pid 938041:tid 938286] [client 223.228.182.224:15610] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjsyNrzsYMDd5sB10qPgAAAHI"]
[Sat Jul 18 23:42:11.223075 2026] [security2:error] [pid 938041:tid 938237] [client 173.239.196.166:55645] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/images/autoload_classmap.php"] [unique_id "alxjsyNrzsYMDd5sB10qQAAAAEE"]
[Sat Jul 18 23:42:11.689432 2026] [security2:error] [pid 938041:tid 938295] [client 45.133.7.89:43547] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 89.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/natural.php"] [unique_id "alxjsyNrzsYMDd5sB10qVQAAAHs"]
[Sat Jul 18 23:42:11.956681 2026] [security2:error] [pid 938041:tid 938210] [client 138.252.89.100:55098] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjsyNrzsYMDd5sB10qawAAACY"]
[Sat Jul 18 23:42:11.956784 2026] [security2:error] [pid 938041:tid 938210] [client 138.252.89.100:55098] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjsyNrzsYMDd5sB10qawAAACY"]
[Sat Jul 18 23:42:12.113476 2026] [security2:error] [pid 938041:tid 938206] [client 173.239.196.163:29851] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/pki-validation/xmrlpc.php"] [unique_id "alxjtCNrzsYMDd5sB10qcgAAACI"]
[Sat Jul 18 23:42:12.361110 2026] [security2:error] [pid 938041:tid 938265] [client 45.133.7.69:49679] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 69.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/item.php"] [unique_id "alxjtCNrzsYMDd5sB10qhQAAAF0"]
[Sat Jul 18 23:42:12.370371 2026] [security2:error] [pid 938041:tid 938278] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/ups.php"] [unique_id "alxjtCNrzsYMDd5sB10qiAAAAGo"]
[Sat Jul 18 23:42:12.370449 2026] [security2:error] [pid 938041:tid 938278] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/ups.php"] [unique_id "alxjtCNrzsYMDd5sB10qiAAAAGo"]
[Sat Jul 18 23:42:12.991784 2026] [security2:error] [pid 938041:tid 938288] [client 173.239.196.161:39099] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/maint/repairs.php"] [unique_id "alxjtCNrzsYMDd5sB10quAAAAHQ"]
[Sat Jul 18 23:42:13.034091 2026] [security2:error] [pid 938041:tid 938192] [client 45.133.7.101:50215] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 101.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/function/function.php"] [unique_id "alxjtSNrzsYMDd5sB10qvAAAABQ"]
[Sat Jul 18 23:42:13.104318 2026] [security2:error] [pid 938041:tid 938147] [remote 188.138.102.156:33240] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxjtSNrzsYMDd5sB10qvwAAfWg"]
[Sat Jul 18 23:42:13.299173 2026] [security2:error] [pid 938041:tid 938108] [remote 188.138.102.156:33240] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxjtSNrzsYMDd5sB10qyAAAR0E"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:42:13.716231 2026] [security2:error] [pid 938041:tid 938246] [client 45.133.7.57:26099] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 57.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "alxjtSNrzsYMDd5sB10q6AAAAEo"]
[Sat Jul 18 23:42:13.864183 2026] [security2:error] [pid 938041:tid 938258] [client 173.239.196.160:36991] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "alxjtSNrzsYMDd5sB10q7QAAAFY"]
[Sat Jul 18 23:42:14.167629 2026] [security2:error] [pid 938041:tid 938162] [remote 103.90.234.13:40920] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.234.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "longevityperformanceclinic.com"] [uri "/wp-login.php"] [unique_id "alxjtiNrzsYMDd5sB10rBwAAAHc"], referer: https://longevityperformanceclinic.com/wp-login.php
[Sat Jul 18 23:42:14.307453 2026] [security2:error] [pid 938041:tid 938241] [client 163.61.1.17:55236] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjtiNrzsYMDd5sB10rCQAAAEU"]
[Sat Jul 18 23:42:14.307544 2026] [security2:error] [pid 938041:tid 938241] [client 163.61.1.17:55236] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjtiNrzsYMDd5sB10rCQAAAEU"]
[Sat Jul 18 23:42:14.406894 2026] [security2:error] [pid 938041:tid 938231] [client 45.133.7.104:22779] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/images/admin.php"] [unique_id "alxjtiNrzsYMDd5sB10rDQAAADs"]
[Sat Jul 18 23:42:14.740542 2026] [security2:error] [pid 938041:tid 938276] [client 173.239.196.165:40551] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin.php"] [unique_id "alxjtiNrzsYMDd5sB10rKgAAAGg"]
[Sat Jul 18 23:42:14.820209 2026] [security2:error] [pid 938041:tid 938203] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/k.php"] [unique_id "alxjtiNrzsYMDd5sB10rLQAAAB8"]
[Sat Jul 18 23:42:14.820301 2026] [security2:error] [pid 938041:tid 938203] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/k.php"] [unique_id "alxjtiNrzsYMDd5sB10rLQAAAB8"]
[Sat Jul 18 23:42:14.828108 2026] [security2:error] [pid 938041:tid 938180] [client 3.109.49.224:39520] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.49.109.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxjtiNrzsYMDd5sB10rLgAAAAg"]
[Sat Jul 18 23:42:15.078453 2026] [security2:error] [pid 938041:tid 938253] [client 45.133.7.65:43613] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 65.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "alxjtyNrzsYMDd5sB10rPQAAAFE"]
[Sat Jul 18 23:42:15.586964 2026] [security2:error] [pid 938041:tid 938204] [client 173.239.196.163:57839] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-header.php%20"] [unique_id "alxjtyNrzsYMDd5sB10rZQAAACA"]
[Sat Jul 18 23:42:15.755031 2026] [security2:error] [pid 938041:tid 938172] [client 45.133.7.66:58905] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 66.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/about/function.php"] [unique_id "alxjtyNrzsYMDd5sB10rcAAAAAA"]
[Sat Jul 18 23:42:15.782256 2026] [security2:error] [pid 938041:tid 938297] [client 13.232.206.133:46414] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.206.232.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxjtyNrzsYMDd5sB10rcQAAAH0"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:42:16.424479 2026] [security2:error] [pid 938041:tid 938237] [client 45.133.7.89:31653] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 89.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/Requests/index.php"] [unique_id "alxjuCNrzsYMDd5sB10rjwAAAEE"]
[Sat Jul 18 23:42:16.454483 2026] [security2:error] [pid 938041:tid 938174] [client 173.239.196.161:41699] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/file.php%20"] [unique_id "alxjuCNrzsYMDd5sB10rkQAAAAI"]
[Sat Jul 18 23:42:17.092566 2026] [security2:error] [pid 938041:tid 938268] [client 45.133.7.96:58401] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 96.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "alxjuSNrzsYMDd5sB10rvwAAAGA"]
[Sat Jul 18 23:42:17.214099 2026] [security2:error] [pid 938041:tid 938253] [client 139.167.225.146:58303] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjuSNrzsYMDd5sB10rzAAAAFE"]
[Sat Jul 18 23:42:17.214207 2026] [security2:error] [pid 938041:tid 938253] [client 139.167.225.146:58303] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjuSNrzsYMDd5sB10rzAAAAFE"]
[Sat Jul 18 23:42:17.346409 2026] [security2:error] [pid 938041:tid 938250] [client 173.239.196.163:51667] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.tmb/doc.php"] [unique_id "alxjuSNrzsYMDd5sB10r1AAAAE4"]
[Sat Jul 18 23:42:17.435999 2026] [security2:error] [pid 938041:tid 938121] [remote 31.42.184.154:52422] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxjuSNrzsYMDd5sB10r3wAAVk4"]
[Sat Jul 18 23:42:17.618528 2026] [security2:error] [pid 938041:tid 938218] [client 180.252.198.240:56312] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjuSNrzsYMDd5sB10r6QAAAC4"]
[Sat Jul 18 23:42:17.618646 2026] [security2:error] [pid 938041:tid 938218] [client 180.252.198.240:56312] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjuSNrzsYMDd5sB10r6QAAAC4"]
[Sat Jul 18 23:42:17.727243 2026] [security2:error] [pid 938041:tid 938134] [remote 31.42.184.154:52422] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxjuSNrzsYMDd5sB10r8wAAN1s"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:42:17.758178 2026] [security2:error] [pid 938041:tid 938240] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/k2.php"] [unique_id "alxjuSNrzsYMDd5sB10r9QAAAEQ"]
[Sat Jul 18 23:42:17.758290 2026] [security2:error] [pid 938041:tid 938240] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/k2.php"] [unique_id "alxjuSNrzsYMDd5sB10r9QAAAEQ"]
[Sat Jul 18 23:42:17.770673 2026] [security2:error] [pid 938041:tid 938242] [client 45.133.7.57:39097] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 57.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/ID3/about.php"] [unique_id "alxjuSNrzsYMDd5sB10r9wAAAEY"]
[Sat Jul 18 23:42:18.230701 2026] [security2:error] [pid 938041:tid 938192] [client 173.239.196.163:37253] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-editor.php"] [unique_id "alxjuiNrzsYMDd5sB10sCQAAABQ"]
[Sat Jul 18 23:42:18.446329 2026] [security2:error] [pid 938041:tid 938252] [client 45.133.7.92:21495] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/languages/404.php"] [unique_id "alxjuiNrzsYMDd5sB10sGAAAAFA"]
[Sat Jul 18 23:42:19.010781 2026] [security2:error] [pid 938041:tid 938211] [client 3.108.60.216:63054] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.60.108.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxjuyNrzsYMDd5sB10sQgAAACc"]
[Sat Jul 18 23:42:19.010860 2026] [security2:error] [pid 938041:tid 938211] [client 3.108.60.216:63054] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxjuyNrzsYMDd5sB10sQgAAACc"]
[Sat Jul 18 23:42:19.084645 2026] [security2:error] [pid 938041:tid 938279] [client 173.239.196.161:40227] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/style-engine-session.php"] [unique_id "alxjuyNrzsYMDd5sB10sRwAAAGs"]
[Sat Jul 18 23:42:19.119731 2026] [security2:error] [pid 938041:tid 938197] [client 45.133.7.62:35707] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/update/403.php"] [unique_id "alxjuyNrzsYMDd5sB10sSQAAABk"]
[Sat Jul 18 23:42:19.313606 2026] [security2:error] [pid 938041:tid 938167] [remote 97.74.93.24:56844] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxjuyNrzsYMDd5sB10sUgAAEHw"]
[Sat Jul 18 23:42:19.495399 2026] [security2:error] [pid 938041:tid 938272] [client 106.222.249.209:15053] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjuyNrzsYMDd5sB10sXgAAAGQ"]
[Sat Jul 18 23:42:19.495491 2026] [security2:error] [pid 938041:tid 938272] [client 106.222.249.209:15053] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjuyNrzsYMDd5sB10sXgAAAGQ"]
[Sat Jul 18 23:42:19.654534 2026] [security2:error] [pid 938041:tid 938079] [remote 71.25.173.17:57286] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.173.25.71.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxjuyNrzsYMDd5sB10sZgAAPiQ"]
[Sat Jul 18 23:42:19.712092 2026] [security2:error] [pid 938041:tid 938053] [remote 97.74.93.24:56844] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxjuyNrzsYMDd5sB10saAAAbwo"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:42:19.819917 2026] [security2:error] [pid 938041:tid 938226] [client 45.133.7.61:24091] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/default.php"] [unique_id "alxjuyNrzsYMDd5sB10sawAAADY"]
[Sat Jul 18 23:42:19.859489 2026] [security2:error] [pid 938041:tid 938048] [remote 71.25.173.17:57286] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.173.25.71.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxjuyNrzsYMDd5sB10scQAAKwU"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:42:19.956806 2026] [security2:error] [pid 938041:tid 938182] [client 173.239.196.167:53285] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/images/install.php"] [unique_id "alxjuyNrzsYMDd5sB10sfAAAAAo"]
[Sat Jul 18 23:42:20.080072 2026] [security2:error] [pid 938041:tid 938140] [remote 97.74.93.24:56848] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "wathenbartlett.co.uk"] [uri "/wp-login.php"] [unique_id "alxjvCNrzsYMDd5sB10sgAAAFGE"]
[Sat Jul 18 23:42:20.466925 2026] [security2:error] [pid 938041:tid 938074] [remote 97.74.93.24:56848] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "wathenbartlett.co.uk"] [uri "/wp-login.php"] [unique_id "alxjvCNrzsYMDd5sB10sowAAbx8"], referer: https://wathenbartlett.co.uk/wp-login.php
[Sat Jul 18 23:42:20.490967 2026] [security2:error] [pid 938041:tid 938184] [client 45.133.7.89:23207] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 89.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/assets/info.php"] [unique_id "alxjvCNrzsYMDd5sB10spAAAAAw"]
[Sat Jul 18 23:42:20.840422 2026] [security2:error] [pid 938041:tid 938284] [client 173.239.196.165:65187] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/adminfusm.php"] [unique_id "alxjvCNrzsYMDd5sB10suAAAAHA"]
[Sat Jul 18 23:42:21.161367 2026] [security2:error] [pid 938041:tid 938202] [client 45.133.7.58:46837] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/class.api.php"] [unique_id "alxjvSNrzsYMDd5sB10sxgAAAB4"]
[Sat Jul 18 23:42:21.702789 2026] [security2:error] [pid 938041:tid 938245] [client 173.239.196.161:29587] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/adminfusm.php"] [unique_id "alxjvSNrzsYMDd5sB10s7QAAAEk"]
[Sat Jul 18 23:42:21.761712 2026] [security2:error] [pid 938041:tid 938285] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/k3.php"] [unique_id "alxjvSNrzsYMDd5sB10s9AAAAHE"]
[Sat Jul 18 23:42:21.761838 2026] [security2:error] [pid 938041:tid 938285] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/k3.php"] [unique_id "alxjvSNrzsYMDd5sB10s9AAAAHE"]
[Sat Jul 18 23:42:21.804246 2026] [security2:error] [pid 938041:tid 938209] [client 50.116.65.227:28456] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Jin-Wee-Feature-Image.jpg"] [unique_id "alxjvSNrzsYMDd5sB10s9QAAACU"]
[Sat Jul 18 23:42:21.815164 2026] [security2:error] [pid 938041:tid 938230] [client 50.116.65.227:45458] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Jin-Wee-Feature-Image.jpg"] [unique_id "alxjvSNrzsYMDd5sB10s9wAAAC4"]
[Sat Jul 18 23:42:21.836631 2026] [security2:error] [pid 938041:tid 938243] [client 45.133.7.64:39787] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 64.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/fonts/index.php"] [unique_id "alxjvSNrzsYMDd5sB10s-QAAAEc"]
[Sat Jul 18 23:42:21.885346 2026] [security2:error] [pid 938041:tid 938130] [remote 31.42.184.154:38694] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxjvSNrzsYMDd5sB10s_gAAC1c"]
[Sat Jul 18 23:42:22.109038 2026] [security2:error] [pid 938041:tid 938211] [client 223.228.182.224:28413] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjviNrzsYMDd5sB10tDAAAACc"]
[Sat Jul 18 23:42:22.109137 2026] [security2:error] [pid 938041:tid 938211] [client 223.228.182.224:28413] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjviNrzsYMDd5sB10tDAAAACc"]
[Sat Jul 18 23:42:22.546492 2026] [security2:error] [pid 938041:tid 938278] [client 45.133.7.99:29697] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/chosen.php"] [unique_id "alxjviNrzsYMDd5sB10tIwAAAGo"]
[Sat Jul 18 23:42:22.562385 2026] [security2:error] [pid 938041:tid 938204] [client 173.239.196.165:47029] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/js/js1.php"] [unique_id "alxjviNrzsYMDd5sB10tKQAAACA"]
[Sat Jul 18 23:42:22.723147 2026] [security2:error] [pid 938041:tid 938133] [remote 31.42.184.154:38694] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxjviNrzsYMDd5sB10tOQAAcFo"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:42:22.929870 2026] [security2:error] [pid 938041:tid 938218] [client 34.171.141.44:25232] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "darkknightsolutions.com"] [uri "/wp-json/batch/v1"] [unique_id "alxjviNrzsYMDd5sB10tRgAAAC4"]
[Sat Jul 18 23:42:23.215271 2026] [security2:error] [pid 938041:tid 938224] [client 45.133.7.65:29617] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 65.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/autoload_classmap/bypass.php"] [unique_id "alxjvyNrzsYMDd5sB10tVAAAADQ"]
[Sat Jul 18 23:42:23.387541 2026] [security2:error] [pid 938041:tid 938179] [client 152.42.242.202:60921] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "tacticaltreeoperations.com"] [uri "/"] [unique_id "alxjvyNrzsYMDd5sB10tXQAAAAc"]
[Sat Jul 18 23:42:23.440041 2026] [security2:error] [pid 938041:tid 938237] [client 173.239.196.166:63749] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "alxjvyNrzsYMDd5sB10tYwAAAEE"]
[Sat Jul 18 23:42:23.468360 2026] [security2:error] [pid 938041:tid 938209] [client 138.252.89.100:55616] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjvyNrzsYMDd5sB10taAAAACU"]
[Sat Jul 18 23:42:23.468446 2026] [security2:error] [pid 938041:tid 938209] [client 138.252.89.100:55616] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjvyNrzsYMDd5sB10taAAAACU"]
[Sat Jul 18 23:42:23.690121 2026] [security2:error] [pid 938041:tid 938057] [remote 41.186.86.12:48404] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "viennarotaryfoundation.com"] [uri "/wp-login.php"] [unique_id "alxjvyNrzsYMDd5sB10tcgAAGA4"]
[Sat Jul 18 23:42:23.886072 2026] [security2:error] [pid 938041:tid 938178] [client 45.133.7.56:25405] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 56.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/dropdown.php"] [unique_id "alxjvyNrzsYMDd5sB10tfQAAAAY"]
[Sat Jul 18 23:42:24.124372 2026] [security2:error] [pid 938041:tid 938183] [client 34.171.141.44:25232] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "darkknightsolutions.com"] [uri "/"] [unique_id "alxjwCNrzsYMDd5sB10tlAAAAAs"]
[Sat Jul 18 23:42:24.187515 2026] [security2:error] [pid 938041:tid 938048] [remote 41.186.86.12:48404] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "viennarotaryfoundation.com"] [uri "/wp-login.php"] [unique_id "alxjwCNrzsYMDd5sB10tlwAAQQU"], referer: https://viennarotaryfoundation.com/wp-login.php
[Sat Jul 18 23:42:24.200456 2026] [security2:error] [pid 938041:tid 938096] [remote 113.160.142.119:42576] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.dotx.com"] [uri "/wp-login.php"] [unique_id "alxjwCNrzsYMDd5sB10tlQAAPjU"]
[Sat Jul 18 23:42:24.324575 2026] [security2:error] [pid 938041:tid 938200] [client 173.239.196.160:24549] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "alxjwCNrzsYMDd5sB10trgAAABw"]
[Sat Jul 18 23:42:24.556180 2026] [security2:error] [pid 938041:tid 938217] [client 45.133.7.100:47915] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/images/admin.php"] [unique_id "alxjwCNrzsYMDd5sB10tzgAAAC0"]
[Sat Jul 18 23:42:24.660279 2026] [security2:error] [pid 938041:tid 938274] [client 34.91.36.231:24576] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "fajarbaru.online"] [uri "/"] [unique_id "alxjwCNrzsYMDd5sB10t0wAAAGY"]
[Sat Jul 18 23:42:24.660381 2026] [security2:error] [pid 938041:tid 938274] [client 34.91.36.231:24576] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "fajarbaru.online"] [uri "/"] [unique_id "alxjwCNrzsYMDd5sB10t0wAAAGY"]
[Sat Jul 18 23:42:24.691225 2026] [security2:error] [pid 938041:tid 938135] [remote 113.160.142.119:42576] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.dotx.com"] [uri "/wp-login.php"] [unique_id "alxjwCNrzsYMDd5sB10t1AAALFw"], referer: https://mail.dotx.com/wp-login.php
[Sat Jul 18 23:42:24.896183 2026] [security2:error] [pid 938041:tid 938070] [remote 160.187.68.132:33638] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.68.187.160.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxjwCNrzsYMDd5sB10t2QAAJhs"]
[Sat Jul 18 23:42:25.062631 2026] [security2:error] [pid 938041:tid 938229] [client 163.61.1.17:55718] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjwSNrzsYMDd5sB10t6QAAADk"]
[Sat Jul 18 23:42:25.062724 2026] [security2:error] [pid 938041:tid 938229] [client 163.61.1.17:55718] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjwSNrzsYMDd5sB10t6QAAADk"]
[Sat Jul 18 23:42:25.221824 2026] [security2:error] [pid 938041:tid 938231] [client 173.239.196.160:41845] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/mu-plugins/admin.php"] [unique_id "alxjwSNrzsYMDd5sB10t8wAAADs"]
[Sat Jul 18 23:42:25.226481 2026] [security2:error] [pid 938041:tid 938193] [client 45.133.7.65:49733] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 65.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/db.php"] [unique_id "alxjwSNrzsYMDd5sB10t9AAAABU"]
[Sat Jul 18 23:42:25.514369 2026] [security2:error] [pid 938041:tid 938187] [client 34.171.141.44:42892] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "darkknightsolutions.com"] [uri "/wp-json/batch/v1"] [unique_id "alxjwSNrzsYMDd5sB10uEQAAAA8"]
[Sat Jul 18 23:42:25.731692 2026] [security2:error] [pid 938041:tid 938281] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/k4.php"] [unique_id "alxjwSNrzsYMDd5sB10uIQAAAG0"]
[Sat Jul 18 23:42:25.731796 2026] [security2:error] [pid 938041:tid 938281] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/k4.php"] [unique_id "alxjwSNrzsYMDd5sB10uIQAAAG0"]
[Sat Jul 18 23:42:25.838842 2026] [security2:error] [pid 938041:tid 938272] [client 34.171.141.44:42892] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "darkknightsolutions.com"] [uri "/"] [unique_id "alxjwSNrzsYMDd5sB10uJAAAAGQ"]
[Sat Jul 18 23:42:25.901265 2026] [security2:error] [pid 938041:tid 938188] [client 45.133.7.100:40483] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/pki-validation/mariju.php"] [unique_id "alxjwSNrzsYMDd5sB10uKgAAABA"]
[Sat Jul 18 23:42:26.117178 2026] [security2:error] [pid 938041:tid 938297] [client 173.239.196.165:30503] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "alxjwiNrzsYMDd5sB10uOQAAAH0"]
[Sat Jul 18 23:42:26.575959 2026] [security2:error] [pid 938041:tid 938281] [client 45.133.7.82:41665] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/mah/function.php"] [unique_id "alxjwiNrzsYMDd5sB10uVQAAAG0"]
[Sat Jul 18 23:42:27.254086 2026] [security2:error] [pid 938041:tid 938279] [client 45.133.7.66:27965] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 66.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/bypass.php"] [unique_id "alxjwyNrzsYMDd5sB10uiQAAAGs"]
[Sat Jul 18 23:42:27.413385 2026] [security2:error] [pid 938041:tid 938272] [client 173.239.196.166:26991] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/about/function.php%20"] [unique_id "alxjwyNrzsYMDd5sB10ulQAAAGQ"]
[Sat Jul 18 23:42:27.444804 2026] [security2:error] [pid 938041:tid 938294] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/k5.php"] [unique_id "alxjwyNrzsYMDd5sB10ulgAAAHo"]
[Sat Jul 18 23:42:27.444899 2026] [security2:error] [pid 938041:tid 938294] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/k5.php"] [unique_id "alxjwyNrzsYMDd5sB10ulgAAAHo"]
[Sat Jul 18 23:42:27.638649 2026] [security2:error] [pid 938041:tid 938081] [remote 120.72.98.5:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "innovativecleaningsvs.com"] [uri "/xmlrpc.php"] [unique_id "alxjwyNrzsYMDd5sB10unQAAPSY"]
[Sat Jul 18 23:42:27.638828 2026] [security2:error] [pid 938041:tid 938233] [client 120.72.98.5:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "innovativecleaningsvs.com"] [uri "/xmlrpc.php"] [unique_id "alxjwyNrzsYMDd5sB10unQAAPSY"]
[Sat Jul 18 23:42:27.789434 2026] [security2:error] [pid 938041:tid 938117] [remote 31.42.184.154:54764] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxjwyNrzsYMDd5sB10usAAAdEo"]
[Sat Jul 18 23:42:27.797661 2026] [security2:error] [pid 938041:tid 938281] [client 180.252.198.240:56782] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjwyNrzsYMDd5sB10usQAAAG0"]
[Sat Jul 18 23:42:27.797767 2026] [security2:error] [pid 938041:tid 938281] [client 180.252.198.240:56782] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjwyNrzsYMDd5sB10usQAAAG0"]
[Sat Jul 18 23:42:27.923687 2026] [security2:error] [pid 938041:tid 938230] [client 139.167.225.146:58934] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjwyNrzsYMDd5sB10uuAAAADo"]
[Sat Jul 18 23:42:27.923880 2026] [security2:error] [pid 938041:tid 938230] [client 139.167.225.146:58934] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjwyNrzsYMDd5sB10uuAAAADo"]
[Sat Jul 18 23:42:27.931960 2026] [security2:error] [pid 938041:tid 938207] [client 45.133.7.64:29059] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 64.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/admin.php"] [unique_id "alxjwyNrzsYMDd5sB10uuQAAACM"]
[Sat Jul 18 23:42:28.015263 2026] [security2:error] [pid 938041:tid 938129] [remote 31.42.184.154:54764] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxjxCNrzsYMDd5sB10uwwAAPlY"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:42:28.292892 2026] [security2:error] [pid 938041:tid 938284] [client 173.239.196.162:26925] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/images/install.php"] [unique_id "alxjxCNrzsYMDd5sB10u1gAAAHA"]
[Sat Jul 18 23:42:28.394492 2026] [security2:error] [pid 938041:tid 938209] [client 3.85.217.58:54562] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.217.85.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxjxCNrzsYMDd5sB10u2gAAACU"]
[Sat Jul 18 23:42:28.437384 2026] [security2:error] [pid 938041:tid 938158] [remote 160.187.68.132:33638] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.68.187.160.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxjxCNrzsYMDd5sB10u3gAARXM"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:42:28.603615 2026] [security2:error] [pid 938041:tid 938242] [client 45.133.7.89:57183] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 89.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/tflow/up.php"] [unique_id "alxjxCNrzsYMDd5sB10u5AAAAEY"]
[Sat Jul 18 23:42:28.763129 2026] [security2:error] [pid 938041:tid 938274] [client 32.198.12.77:37682] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 77.12.198.32.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxjxCNrzsYMDd5sB10u8gAAAGY"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:42:29.189290 2026] [security2:error] [pid 938041:tid 938203] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/w.php"] [unique_id "alxjxSNrzsYMDd5sB10vEAAAAB8"]
[Sat Jul 18 23:42:29.189407 2026] [security2:error] [pid 938041:tid 938203] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/w.php"] [unique_id "alxjxSNrzsYMDd5sB10vEAAAAB8"]
[Sat Jul 18 23:42:29.208861 2026] [security2:error] [pid 938041:tid 938241] [client 173.239.196.167:52077] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "alxjxSNrzsYMDd5sB10vEgAAAEU"]
[Sat Jul 18 23:42:29.275287 2026] [security2:error] [pid 938041:tid 938227] [client 45.133.7.70:23743] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/function.php"] [unique_id "alxjxSNrzsYMDd5sB10vGwAAADc"]
[Sat Jul 18 23:42:29.954015 2026] [security2:error] [pid 938041:tid 938203] [client 45.133.7.84:31515] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 84.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/templates/beez3/index.php"] [unique_id "alxjxSNrzsYMDd5sB10vQQAAAB8"]
[Sat Jul 18 23:42:30.085242 2026] [security2:error] [pid 938041:tid 938282] [client 173.239.196.166:53935] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/js/widgets/doc.php"] [unique_id "alxjxiNrzsYMDd5sB10vSQAAAG4"]
[Sat Jul 18 23:42:30.241634 2026] [security2:error] [pid 938041:tid 938192] [client 106.222.249.209:9404] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjxiNrzsYMDd5sB10vVAAAABQ"]
[Sat Jul 18 23:42:30.241801 2026] [security2:error] [pid 938041:tid 938192] [client 106.222.249.209:9404] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxjxiNrzsYMDd5sB10vVAAAABQ"]
[Sat Jul 18 23:42:30.714650 2026] [security2:error] [pid 938041:tid 938191] [client 45.133.7.82:30825] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/js/wp-login.php"] [unique_id "alxjxiNrzsYMDd5sB10vbQAAABM"]
[Sat Jul 18 23:42:30.825329 2026] [security2:error] [pid 938041:tid 938235] [client 142.250.32.8:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "eduardsales.com"] [uri "/index.php"] [unique_id "alxjxSNrzsYMDd5sB10vKwAAAD8"]
[Sat Jul 18 23:42:30.843313 2026] [security2:error] [pid 938041:tid 938251] [client 57.141.18.47:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxjxiNrzsYMDd5sB10vbAAAAE8"]
[Sat Jul 18 23:42:30.870325 2026] [security2:error] [pid 938041:tid 938273] [client 18.117.74.87:51832] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "nurturemarple.co.uk"] [uri "/index.php"] [unique_id "alxjxCNrzsYMDd5sB10u9gAAAGU"]
[Sat Jul 18 23:42:30.889677 2026] [security2:error] [pid 938041:tid 938279] [client 18.117.74.87:51826] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "nurturemarple.co.uk"] [uri "/index.php"] [unique_id "alxjxCNrzsYMDd5sB10u8wAAAGs"]
[Sat Jul 18 23:42:30.945170 2026] [security2:error] [pid 938041:tid 938291] [client 173.239.196.164:58793] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/f35_SpaceTn.php"] [unique_id "alxjxiNrzsYMDd5sB10vgwAAAHc"]
[Sat Jul 18 23:42:30.997945 2026] [security2:error] [pid 938041:tid 938174] [client 18.117.74.87:51830] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "nurturemarple.co.uk"] [uri "/index.php"] [unique_id "alxjxCNrzsYMDd5sB10u9QAAAAI"]
[Sat Jul 18 23:42:31.354451 2026] [security2:error] [pid 938041:tid 938204] [client 50.116.65.227:21204] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.nurturemarple.co.uk"] [uri "/index.php"] [unique_id "alxjxiNrzsYMDd5sB10vhgAAACA"]
[Sat Jul 18 23:42:31.360284 2026] [security2:error] [pid 938041:tid 938292] [client 50.116.65.227:21208] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.nurturemarple.co.uk"] [uri "/index.php"] [unique_id "alxjxiNrzsYMDd5sB10vhwAAAHg"]
[Sat Jul 18 23:42:31.392503 2026] [security2:error] [pid 938041:tid 938219] [client 45.133.7.62:50331] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/install.php"] [unique_id "alxjxyNrzsYMDd5sB10vowAAAC8"]
[Sat Jul 18 23:42:31.553544 2026] [security2:error] [pid 938041:tid 938282] [client 50.116.65.227:21224] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.nurturemarple.co.uk"] [uri "/index.php"] [unique_id "alxjxyNrzsYMDd5sB10vngAAAG4"]
[Sat Jul 18 23:42:31.561902 2026] [security2:error] [pid 938041:tid 938248] [client 50.116.65.227:21240] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.nurturemarple.co.uk"] [uri "/index.php"] [unique_id "alxjxyNrzsYMDd5sB10voAAAAEw"]
[Sat Jul 18 23:42:31.837437 2026] [security2:error] [pid 938041:tid 938269] [client 173.239.196.167:29503] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/sunrise/bypass.php"] [unique_id "alxjxyNrzsYMDd5sB10vugAAAGE"]
[Sat Jul 18 23:42:32.063170 2026] [security2:error] [pid 938041:tid 938247] [client 45.133.7.62:48929] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/blue/rk2.php"] [unique_id "alxjyCNrzsYMDd5sB10v0QAAAEs"]
[Sat Jul 18 23:42:32.175077 2026] [security2:error] [pid 938041:tid 938258] [client 50.116.65.227:47656] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/South-Africa-Day-8-Feature-Image.jpg"] [unique_id "alxjyCNrzsYMDd5sB10v2QAAAFY"]
[Sat Jul 18 23:42:32.188321 2026] [security2:error] [pid 938041:tid 938193] [client 50.116.65.227:21242] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/South-Africa-Day-8-Feature-Image.jpg"] [unique_id "alxjyCNrzsYMDd5sB10v2gAAABU"]
[Sat Jul 18 23:42:32.262458 2026] [security2:error] [pid 938041:tid 938237] [client 104.210.56.224:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "mezzacraft.com"] [uri "/index.php"] [unique_id "alxjyCNrzsYMDd5sB10vzwAAAEE"]
[Sat Jul 18 23:42:32.345420 2026] [security2:error] [pid 938041:tid 938067] [remote 120.48.93.232:58199] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 232.93.48.120.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bruceledewitz.com"] [uri "/wp-comments-post.php"] [unique_id "alxjyCNrzsYMDd5sB10v4QAADBg"], referer: https://bruceledewitz.com/?p=4757
[Sat Jul 18 23:42:32.345611 2026] [security2:error] [pid 938041:tid 938184] [client 120.48.93.232:58199] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "409"] [hostname "bruceledewitz.com"] [uri "/wp-comments-post.php"] [unique_id "alxjyCNrzsYMDd5sB10v4QAADBg"], referer: https://bruceledewitz.com/?p=4757
[Sat Jul 18 23:42:32.748555 2026] [security2:error] [pid 938041:tid 938172] [client 173.239.196.163:48971] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/fixed.php"] [unique_id "alxjyCNrzsYMDd5sB10wAwAAAAA"]
[Sat Jul 18 23:42:32.779598 2026] [security2:error] [pid 938041:tid 938211] [client 45.133.7.93:26933] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 93.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/images/class-config.php"] [unique_id "alxjyCNrzsYMDd5sB10wAAAAACc"]
[Sat Jul 18 23:42:32.812147 2026] [security2:error] [pid 938041:tid 938277] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/fpwch.php"] [unique_id "alxjyCNrzsYMDd5sB10wBgAAAGk"]
[Sat Jul 18 23:42:32.812259 2026] [security2:error] [pid 938041:tid 938277] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/fpwch.php"] [unique_id "alxjyCNrzsYMDd5sB10wBgAAAGk"]
[Sat Jul 18 23:42:32.830202 2026] [security2:error] [pid 938041:tid 938296] [client 223.228.182.224:43224] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjyCNrzsYMDd5sB10wCAAAAHw"]
[Sat Jul 18 23:42:32.830316 2026] [security2:error] [pid 938041:tid 938296] [client 223.228.182.224:43224] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxjyCNrzsYMDd5sB10wCAAAAHw"]
[Sat Jul 18 23:42:33.134156 2026] [security2:error] [pid 938041:tid 938223] [client 216.73.216.197:37824] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "iagdevelopments.com"] [uri "/index.php"] [unique_id "alxjxyNrzsYMDd5sB10vvAAAM2w"]
[Sat Jul 18 23:42:33.149870 2026] [security2:error] [pid 938041:tid 938186] [client 113.169.76.48:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "taskidsvirginia.com"] [uri "/index.php"] [unique_id "alxjyCNrzsYMDd5sB10v8wAAAA4"]
[Sat Jul 18 23:42:33.434622 2026] [security2:error] [pid 938041:tid 938261] [client 145.223.130.38:43022] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 38.130.223.145.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.marscafe.com"] [uri "/php/costing1-dl/download.php"] [unique_id "alxjySNrzsYMDd5sB10wOQAAAFk"]
[Sat Jul 18 23:42:33.452400 2026] [security2:error] [pid 938041:tid 938206] [client 45.133.7.94:64245] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 94.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/components/com_jea/views/form/tmpl/size.php"] [unique_id "alxjySNrzsYMDd5sB10wPAAAACI"]
[Sat Jul 18 23:42:33.561997 2026] [security2:error] [pid 938041:tid 938147] [remote 120.48.93.232:58199] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 232.93.48.120.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "bruceledewitz.com"] [uri "/wp-comments-post.php"] [unique_id "alxjySNrzsYMDd5sB10wRQAAcmg"], referer: https://bruceledewitz.com/?p=4757
[Sat Jul 18 23:42:33.562156 2026] [security2:error] [pid 938041:tid 938286] [client 120.48.93.232:58199] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "409"] [hostname "bruceledewitz.com"] [uri "/wp-comments-post.php"] [unique_id "alxjySNrzsYMDd5sB10wRQAAcmg"], referer: https://bruceledewitz.com/?p=4757
[Sat Jul 18 23:42:33.612396 2026] [security2:error] [pid 938041:tid 938194] [client 173.239.196.163:29037] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/js/widgets/themes.php"] [unique_id "alxjySNrzsYMDd5sB10wSQAAABY"]
[Sat Jul 18 23:42:33.616342 2026] [security2:error] [pid 938041:tid 938246] [client 18.117.74.87:52656] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.nurturemarple.co.uk"] [uri "/index.php"] [unique_id "alxjySNrzsYMDd5sB10wNwAAAEo"]
[Sat Jul 18 23:42:33.660265 2026] [security2:error] [pid 938041:tid 938223] [client 18.117.74.87:52652] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.nurturemarple.co.uk"] [uri "/index.php"] [unique_id "alxjySNrzsYMDd5sB10wOAAAAAU"]
[Sat Jul 18 23:42:33.660866 2026] [security2:error] [pid 938041:tid 938294] [client 18.117.74.87:52654] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.nurturemarple.co.uk"] [uri "/index.php"] [unique_id "alxjySNrzsYMDd5sB10wNgAAAGM"]
[Sat Jul 18 23:42:33.668959 2026] [security2:error] [pid 938041:tid 938254] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/w2025.php"] [unique_id "alxjySNrzsYMDd5sB10wSwAAAFI"]
[Sat Jul 18 23:42:33.669084 2026] [security2:error] [pid 938041:tid 938254] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/w2025.php"] [unique_id "alxjySNrzsYMDd5sB10wSwAAAFI"]
[Sat Jul 18 23:42:34.121597 2026] [security2:error] [pid 938041:tid 938191] [client 45.133.7.100:51537] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/templates/beez/index.php"] [unique_id "alxjyiNrzsYMDd5sB10wYwAAABM"]
[Sat Jul 18 23:42:34.216439 2026] [security2:error] [pid 938041:tid 938133] [remote 91.142.222.105:36314] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxjyiNrzsYMDd5sB10waQAAHFo"]
[Sat Jul 18 23:42:34.216614 2026] [security2:error] [pid 938041:tid 938200] [client 91.142.222.105:36314] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxjyiNrzsYMDd5sB10waQAAHFo"]
[Sat Jul 18 23:42:34.249056 2026] [security2:error] [pid 938041:tid 938189] [client 74.208.214.194:53012] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxjyiNrzsYMDd5sB10wbAAAABE"]
[Sat Jul 18 23:42:34.459447 2026] [security2:error] [pid 938041:tid 938202] [client 173.239.196.163:32955] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/fix/bypass.php"] [unique_id "alxjyiNrzsYMDd5sB10wdQAAAB4"]
[Sat Jul 18 23:42:34.798124 2026] [security2:error] [pid 938041:tid 938228] [client 45.133.7.96:43839] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 96.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/bypass.php"] [unique_id "alxjyiNrzsYMDd5sB10wkwAAADg"]
[Sat Jul 18 23:42:34.913072 2026] [security2:error] [pid 938041:tid 938225] [client 35.92.83.184:35506] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 184.83.92.35.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxjyiNrzsYMDd5sB10wlgAAADU"]
[Sat Jul 18 23:42:34.968215 2026] [security2:error] [pid 938041:tid 938249] [client 216.73.216.170:14310] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "pattyspractice.com"] [uri "/index.php"] [unique_id "alxjyiNrzsYMDd5sB10wlAAATXU"]
[Sat Jul 18 23:42:35.015210 2026] [security2:error] [pid 938041:tid 938172] [client 138.252.89.100:56136] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjyyNrzsYMDd5sB10wngAAAAA"]
[Sat Jul 18 23:42:35.015316 2026] [security2:error] [pid 938041:tid 938172] [client 138.252.89.100:56136] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxjyyNrzsYMDd5sB10wngAAAAA"]
[Sat Jul 18 23:42:35.206642 2026] [security2:error] [pid 938041:tid 938254] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/scxy.php"] [unique_id "alxjyyNrzsYMDd5sB10wswAAAFI"]
[Sat Jul 18 23:42:35.206743 2026] [security2:error] [pid 938041:tid 938254] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/scxy.php"] [unique_id "alxjyyNrzsYMDd5sB10wswAAAFI"]
[Sat Jul 18 23:42:35.312348 2026] [security2:error] [pid 938041:tid 938268] [client 163.61.1.17:56198] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjyyNrzsYMDd5sB10wuQAAAGA"]
[Sat Jul 18 23:42:35.313987 2026] [security2:error] [pid 938041:tid 938268] [client 163.61.1.17:56198] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxjyyNrzsYMDd5sB10wuQAAAGA"]
[Sat Jul 18 23:42:35.335444 2026] [security2:error] [pid 938041:tid 938211] [client 173.239.196.167:38941] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/category-double.php"] [unique_id "alxjyyNrzsYMDd5sB10wuwAAACc"]
[Sat Jul 18 23:42:35.476385 2026] [security2:error] [pid 938041:tid 938285] [client 45.133.7.82:45887] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/class.php"] [unique_id "alxjyyNrzsYMDd5sB10wvwAAAHE"]
[Sat Jul 18 23:42:35.692272 2026] [security2:error] [pid 938041:tid 938092] [remote 31.42.184.154:45780] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxjyyNrzsYMDd5sB10w0AAAFjE"]
[Sat Jul 18 23:42:35.920803 2026] [security2:error] [pid 938041:tid 938081] [remote 31.42.184.154:45780] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxjyyNrzsYMDd5sB10w5AAAUSY"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:42:35.984461 2026] [security2:error] [pid 938041:tid 938149] [remote 152.53.111.131:53102] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.111.53.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thelastgamestandingexp.com"] [uri "/wp-login.php"] [unique_id "alxjyyNrzsYMDd5sB10w6gAALmo"]
[Sat Jul 18 23:42:36.147910 2026] [security2:error] [pid 938041:tid 938185] [client 45.133.7.78:54709] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 78.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/light/profile.php"] [unique_id "alxjzCNrzsYMDd5sB10w9gAAAA0"]
[Sat Jul 18 23:42:36.171390 2026] [security2:error] [pid 938041:tid 938196] [client 173.239.196.162:22299] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/maint/admin.php"] [unique_id "alxjzCNrzsYMDd5sB10w-wAAABg"]
[Sat Jul 18 23:42:36.219418 2026] [security2:error] [pid 938041:tid 938142] [remote 152.53.111.131:53102] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.111.53.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thelastgamestandingexp.com"] [uri "/wp-login.php"] [unique_id "alxjzCNrzsYMDd5sB10w_gAAXGM"], referer: https://thelastgamestandingexp.com/wp-login.php
[Sat Jul 18 23:42:36.576006 2026] [security2:error] [pid 938041:tid 938150] [remote 34.21.157.37:33028] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.sw[a-z]$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1275"] [id "390587"] [rev "5"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .sw)"] [severity "CRITICAL"] [hostname "icemarc.org"] [uri "/.env.swp"] [unique_id "alxjzCNrzsYMDd5sB10xEAAAK2s"]
[Sat Jul 18 23:42:36.821840 2026] [security2:error] [pid 938041:tid 938286] [client 45.133.7.68:20587] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 68.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/product.php"] [unique_id "alxjzCNrzsYMDd5sB10xKQAAAHI"]
[Sat Jul 18 23:42:36.845945 2026] [security2:error] [pid 938041:tid 938185] [client 50.116.65.227:47662] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Jin-Wee-Feature-Image.jpg"] [unique_id "alxjzCNrzsYMDd5sB10xKwAAAA0"]
[Sat Jul 18 23:42:36.857616 2026] [security2:error] [pid 938041:tid 938288] [client 50.116.65.227:21312] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Jin-Wee-Feature-Image.jpg"] [unique_id "alxjzCNrzsYMDd5sB10xLAAAAEs"]
[Sat Jul 18 23:42:37.042404 2026] [security2:error] [pid 938041:tid 938191] [client 173.239.196.164:47809] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/blog/signatur.php"] [unique_id "alxjzSNrzsYMDd5sB10xLwAAABM"]
[Sat Jul 18 23:42:37.275018 2026] [security2:error] [pid 938041:tid 938291] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/FWAZ.php"] [unique_id "alxjzSNrzsYMDd5sB10xRgAAAHc"]
[Sat Jul 18 23:42:37.275160 2026] [security2:error] [pid 938041:tid 938291] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/FWAZ.php"] [unique_id "alxjzSNrzsYMDd5sB10xRgAAAHc"]
[Sat Jul 18 23:42:37.497056 2026] [security2:error] [pid 938041:tid 938225] [client 45.133.7.76:26843] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 76.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/uploads/autoload_classmap.php"] [unique_id "alxjzSNrzsYMDd5sB10xUQAAADU"]
[Sat Jul 18 23:42:37.830045 2026] [security2:error] [pid 938041:tid 938154] [remote 45.157.54.14:37165] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ironcitywellness.com"] [uri "/xmlrpc.php"] [unique_id "alxjzSNrzsYMDd5sB10xbQAAWG8"]
[Sat Jul 18 23:42:37.830220 2026] [security2:error] [pid 938041:tid 938260] [client 45.157.54.14:37165] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ironcitywellness.com"] [uri "/xmlrpc.php"] [unique_id "alxjzSNrzsYMDd5sB10xbQAAWG8"]
[Sat Jul 18 23:42:37.844317 2026] [security2:error] [pid 938041:tid 938253] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/qterm.php"] [unique_id "alxjzSNrzsYMDd5sB10xbgAAAFE"]
[Sat Jul 18 23:42:37.844397 2026] [security2:error] [pid 938041:tid 938253] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/qterm.php"] [unique_id "alxjzSNrzsYMDd5sB10xbgAAAFE"]
[Sat Jul 18 23:42:37.906126 2026] [security2:error] [pid 938041:tid 938276] [client 173.239.196.167:58709] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/assets/db.php"] [unique_id "alxjzSNrzsYMDd5sB10xdQAAAGg"]
[Sat Jul 18 23:42:38.033960 2026] [security2:error] [pid 938041:tid 938124] [remote 45.157.54.14:37379] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ironcitywellness.com"] [uri "/xmlrpc.php"] [unique_id "alxjziNrzsYMDd5sB10xewAAP1E"]
[Sat Jul 18 23:42:38.034104 2026] [security2:error] [pid 938041:tid 938235] [client 45.157.54.14:37379] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ironcitywellness.com"] [uri "/xmlrpc.php"] [unique_id "alxjziNrzsYMDd5sB10xewAAP1E"]
[Sat Jul 18 23:42:38.152880 2026] [security2:error] [pid 938041:tid 938218] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxjzCNrzsYMDd5sB10xFwAAAC4"]
[Sat Jul 18 23:42:38.211613 2026] [security2:error] [pid 938041:tid 938217] [client 45.133.7.105:45517] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/ask.php"] [unique_id "alxjziNrzsYMDd5sB10xiAAAAC0"]
[Sat Jul 18 23:42:38.238082 2026] [security2:error] [pid 938041:tid 938222] [client 180.252.198.240:57253] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjziNrzsYMDd5sB10xiQAAADI"]
[Sat Jul 18 23:42:38.238196 2026] [security2:error] [pid 938041:tid 938222] [client 180.252.198.240:57253] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxjziNrzsYMDd5sB10xiQAAADI"]
[Sat Jul 18 23:42:38.327510 2026] [security2:error] [pid 938041:tid 938095] [remote 34.21.157.37:33028] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "icemarc.org"] [uri "/rclone.conf"] [unique_id "alxjziNrzsYMDd5sB10xmAAAQzQ"]
[Sat Jul 18 23:42:38.328440 2026] [security2:error] [pid 938041:tid 938100] [remote 34.21.157.37:33028] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "icemarc.org"] [uri "/public/.env"] [unique_id "alxjziNrzsYMDd5sB10xlwAAQzk"]
[Sat Jul 18 23:42:38.328490 2026] [security2:error] [pid 938041:tid 938161] [remote 34.21.157.37:33028] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "icemarc.org"] [uri "/web/.env"] [unique_id "alxjziNrzsYMDd5sB10xlQAAQ3Y"]
[Sat Jul 18 23:42:38.627285 2026] [security2:error] [pid 938041:tid 938288] [client 139.167.225.146:59571] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjziNrzsYMDd5sB10xtQAAAHQ"]
[Sat Jul 18 23:42:38.627395 2026] [security2:error] [pid 938041:tid 938288] [client 139.167.225.146:59571] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxjziNrzsYMDd5sB10xtQAAAHQ"]
[Sat Jul 18 23:42:38.779831 2026] [security2:error] [pid 938041:tid 938289] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/blurbs.php"] [unique_id "alxjziNrzsYMDd5sB10xyQAAAHU"]
[Sat Jul 18 23:42:38.779924 2026] [security2:error] [pid 938041:tid 938289] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/blurbs.php"] [unique_id "alxjziNrzsYMDd5sB10xyQAAAHU"]
[Sat Jul 18 23:42:38.787216 2026] [security2:error] [pid 938041:tid 938229] [client 173.239.196.165:23579] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/widgets/security.php"] [unique_id "alxjziNrzsYMDd5sB10xzgAAADk"]
[Sat Jul 18 23:42:38.889278 2026] [security2:error] [pid 938041:tid 938190] [client 45.133.7.69:23765] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 69.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/rest-api/about.php"] [unique_id "alxjziNrzsYMDd5sB10x0wAAABI"]
[Sat Jul 18 23:42:39.222583 2026] [proxy:error] [pid 938041:tid 938172] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:42:39.222616 2026] [proxy_http:error] [pid 938041:tid 938172] [client 207.241.173.42:36744] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:42:39.223219 2026] [proxy:error] [pid 938041:tid 938172] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:42:39.223244 2026] [proxy_http:error] [pid 938041:tid 938172] [client 207.241.173.42:36744] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:42:39.310662 2026] [core:error] [pid 938041:tid 938231] [client 207.241.173.42:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:42:39.310681 2026] [core:error] [pid 938041:tid 938231] [client 207.241.173.42:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:42:39.362848 2026] [security2:error] [pid 938041:tid 938294] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/v543.php"] [unique_id "alxjzyNrzsYMDd5sB10x9AAAAHo"]
[Sat Jul 18 23:42:39.362955 2026] [security2:error] [pid 938041:tid 938294] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/v543.php"] [unique_id "alxjzyNrzsYMDd5sB10x9AAAAHo"]
[Sat Jul 18 23:42:39.424875 2026] [security2:error] [pid 938041:tid 938200] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxjziNrzsYMDd5sB10xnwAAABw"]
[Sat Jul 18 23:42:39.448089 2026] [core:error] [pid 938041:tid 938226] [client 207.241.173.42:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:42:39.448109 2026] [core:error] [pid 938041:tid 938226] [client 207.241.173.42:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:42:39.457258 2026] [core:error] [pid 938041:tid 938210] [client 207.241.173.42:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:42:39.457275 2026] [core:error] [pid 938041:tid 938210] [client 207.241.173.42:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:42:39.561618 2026] [security2:error] [pid 938041:tid 938284] [client 45.133.7.79:60473] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 79.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/css/css.php"] [unique_id "alxjzyNrzsYMDd5sB10yBQAAAHA"]
[Sat Jul 18 23:42:39.573098 2026] [security2:error] [pid 938041:tid 938286] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxjziNrzsYMDd5sB10xrAAAAHI"]
[Sat Jul 18 23:42:39.576348 2026] [security2:error] [pid 938041:tid 938260] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxjziNrzsYMDd5sB10xngAAAFg"]
[Sat Jul 18 23:42:39.585328 2026] [security2:error] [pid 938041:tid 938211] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxjziNrzsYMDd5sB10xrQAAACc"]
[Sat Jul 18 23:42:39.689998 2026] [security2:error] [pid 938041:tid 938236] [client 173.239.196.164:58113] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/include/install.php"] [unique_id "alxjzyNrzsYMDd5sB10yCgAAAEA"]
[Sat Jul 18 23:42:40.040378 2026] [security2:error] [pid 938041:tid 938083] [remote 34.21.157.37:33028] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "icemarc.org"] [uri "/env.json"] [unique_id "alxj0CNrzsYMDd5sB10yIgAAQyg"]
[Sat Jul 18 23:42:40.231296 2026] [security2:error] [pid 938041:tid 938114] [remote 34.21.157.37:33028] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "icemarc.org"] [uri "/api/v2/config"] [unique_id "alxj0CNrzsYMDd5sB10yLwAAQ0c"]
[Sat Jul 18 23:42:40.243921 2026] [security2:error] [pid 938041:tid 938271] [client 45.133.7.82:31337] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/init.php"] [unique_id "alxj0CNrzsYMDd5sB10yMgAAAGM"]
[Sat Jul 18 23:42:40.577005 2026] [security2:error] [pid 938041:tid 938247] [client 173.239.196.164:31651] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/gm.php"] [unique_id "alxj0CNrzsYMDd5sB10yPgAAAEs"]
[Sat Jul 18 23:42:41.018033 2026] [security2:error] [pid 938041:tid 938202] [client 45.133.7.95:61295] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/user/wp-login.php"] [unique_id "alxj0CNrzsYMDd5sB10yWwAAAB4"]
[Sat Jul 18 23:42:41.035767 2026] [security2:error] [pid 938041:tid 938288] [client 106.222.249.209:26015] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxj0SNrzsYMDd5sB10yYQAAAHQ"]
[Sat Jul 18 23:42:41.035891 2026] [security2:error] [pid 938041:tid 938288] [client 106.222.249.209:26015] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxj0SNrzsYMDd5sB10yYQAAAHQ"]
[Sat Jul 18 23:42:41.187691 2026] [security2:error] [pid 938041:tid 938205] [client 104.210.56.226:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "packerjanitorial.com"] [uri "/index.php"] [unique_id "alxj0CNrzsYMDd5sB10yQAAAIUo"]
[Sat Jul 18 23:42:41.461426 2026] [security2:error] [pid 938041:tid 938282] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/w3lls.php"] [unique_id "alxj0SNrzsYMDd5sB10yhgAAAG4"]
[Sat Jul 18 23:42:41.461542 2026] [security2:error] [pid 938041:tid 938282] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/w3lls.php"] [unique_id "alxj0SNrzsYMDd5sB10yhgAAAG4"]
[Sat Jul 18 23:42:41.465976 2026] [security2:error] [pid 938041:tid 938294] [client 173.239.196.164:48139] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "alxj0SNrzsYMDd5sB10yhwAAAHo"]
[Sat Jul 18 23:42:41.572051 2026] [security2:error] [pid 938041:tid 938268] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxj0CNrzsYMDd5sB10yMwAAAGA"]
[Sat Jul 18 23:42:41.628605 2026] [security2:error] [pid 938041:tid 938281] [client 57.141.18.96:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "bandsir.com"] [uri "/index.php"] [unique_id "alxj0CNrzsYMDd5sB10yKAAAAG0"]
[Sat Jul 18 23:42:41.654087 2026] [security2:error] [pid 938041:tid 938259] [client 95.181.238.20:51675] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "404"] [hostname "www.thegoulashconcept.org"] [uri "/cgi-sys/404.html"] [unique_id "alxj0SNrzsYMDd5sB10ykQAAAFc"]
[Sat Jul 18 23:42:41.695004 2026] [security2:error] [pid 938041:tid 938174] [client 45.133.7.92:40383] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/autoload_classmap/function.php"] [unique_id "alxj0SNrzsYMDd5sB10ykwAAAAI"]
[Sat Jul 18 23:42:42.155342 2026] [ssl:error] [pid 938041:tid 938242] [client 54.86.115.253:27368] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname autoconfig.carolinapressurewashers.nextlvlmarketingco.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:42:42.316437 2026] [security2:error] [pid 938041:tid 938202] [client 173.239.196.167:38471] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/js/content-type.php"] [unique_id "alxj0iNrzsYMDd5sB10ytAAAAB4"]
[Sat Jul 18 23:42:42.368419 2026] [security2:error] [pid 938041:tid 938268] [client 45.133.7.97:31977] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 97.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/item.php"] [unique_id "alxj0iNrzsYMDd5sB10yuQAAAGA"]
[Sat Jul 18 23:42:42.560461 2026] [security2:error] [pid 938041:tid 938230] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxj0SNrzsYMDd5sB10yowAAADo"]
[Sat Jul 18 23:42:42.636171 2026] [security2:error] [pid 938041:tid 938144] [remote 34.21.157.37:33028] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "icemarc.org"] [uri "/graphql"] [unique_id "alxj0iNrzsYMDd5sB10yzQAAIWU"]
[Sat Jul 18 23:42:42.980024 2026] [security2:error] [pid 938041:tid 938160] [remote 34.21.157.37:33028] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "icemarc.org"] [uri "/app-config.json"] [unique_id "alxj0iNrzsYMDd5sB10y8QAAZHU"]
[Sat Jul 18 23:42:42.980255 2026] [security2:error] [pid 938041:tid 938272] [client 34.21.157.37:33028] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "icemarc.org"] [uri "/app-config.json"] [unique_id "alxj0iNrzsYMDd5sB10y8QAAZHU"]
[Sat Jul 18 23:42:43.041621 2026] [security2:error] [pid 938041:tid 938288] [client 45.133.7.61:39035] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/assets/index.php"] [unique_id "alxj0yNrzsYMDd5sB10zAAAAAHQ"]
[Sat Jul 18 23:42:43.167995 2026] [security2:error] [pid 938041:tid 938057] [remote 34.21.157.37:33028] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "icemarc.org"] [uri "/api/graphql"] [unique_id "alxj0yNrzsYMDd5sB10zBgAAZA4"]
[Sat Jul 18 23:42:43.176809 2026] [security2:error] [pid 938041:tid 938249] [client 173.239.196.163:22771] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "alxj0yNrzsYMDd5sB10zBwAAAE0"]
[Sat Jul 18 23:42:43.496125 2026] [security2:error] [pid 938041:tid 938214] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxj0iNrzsYMDd5sB10y3QAAACo"]
[Sat Jul 18 23:42:43.629590 2026] [security2:error] [pid 938041:tid 938272] [client 34.21.157.37:33028] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxj0iNrzsYMDd5sB10y7QAAZEg"]
[Sat Jul 18 23:42:43.685013 2026] [security2:error] [pid 938041:tid 938155] [remote 34.21.157.37:33028] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "icemarc.org"] [uri "/v1/graphql"] [unique_id "alxj0yNrzsYMDd5sB10zLgAAZHA"]
[Sat Jul 18 23:42:43.710205 2026] [security2:error] [pid 938041:tid 938162] [remote 34.21.157.37:33028] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "icemarc.org"] [uri "/ngsw.json"] [unique_id "alxj0yNrzsYMDd5sB10zMgAAZHc"]
[Sat Jul 18 23:42:43.710365 2026] [security2:error] [pid 938041:tid 938272] [client 34.21.157.37:33028] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "icemarc.org"] [uri "/ngsw.json"] [unique_id "alxj0yNrzsYMDd5sB10zMgAAZHc"]
[Sat Jul 18 23:42:43.716556 2026] [security2:error] [pid 938041:tid 938232] [client 45.133.7.70:34831] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/pki-validation/index.php"] [unique_id "alxj0yNrzsYMDd5sB10zMwAAADw"]
[Sat Jul 18 23:42:43.811476 2026] [security2:error] [pid 938041:tid 938241] [client 213.239.200.253:40654] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.vfcthomasville.org"] [uri "/index.php"] [unique_id "alxj0yNrzsYMDd5sB10zNQAARRc"]
[Sat Jul 18 23:42:44.022190 2026] [security2:error] [pid 938041:tid 938190] [client 173.239.196.163:39667] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/about/goods.php"] [unique_id "alxj1CNrzsYMDd5sB10zUQAAABI"]
[Sat Jul 18 23:42:44.159205 2026] [security2:error] [pid 938041:tid 938296] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxj0yNrzsYMDd5sB10y_AAAAHw"]
[Sat Jul 18 23:42:44.178397 2026] [security2:error] [pid 938041:tid 938299] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxj0yNrzsYMDd5sB10y-gAAAH8"]
[Sat Jul 18 23:42:44.197459 2026] [security2:error] [pid 938041:tid 938285] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxj0yNrzsYMDd5sB10y-wAAAHE"]
[Sat Jul 18 23:42:44.198551 2026] [security2:error] [pid 938041:tid 938204] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxj0yNrzsYMDd5sB10y-QAAACA"]
[Sat Jul 18 23:42:44.382192 2026] [autoindex:error] [pid 938041:tid 938102] [remote 91.92.42.30:50026] AH01276: Cannot serve directory /home2/dpbkxwmy/public_html/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: http://mail.dpb.kxw.mybluehost.me
[Sat Jul 18 23:42:44.404971 2026] [security2:error] [pid 938041:tid 938191] [client 45.133.7.104:61919] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/uploads/admin.php"] [unique_id "alxj1CNrzsYMDd5sB10zbwAAABM"]
[Sat Jul 18 23:42:44.410011 2026] [security2:error] [pid 938041:tid 938198] [client 23.160.60.220:32861] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.ccsdifference.com"] [uri "/index.php"] [unique_id "alxj1CNrzsYMDd5sB10zXgAAABo"]
[Sat Jul 18 23:42:44.901806 2026] [security2:error] [pid 938041:tid 938267] [client 173.239.196.162:32577] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/file/function.php"] [unique_id "alxj1CNrzsYMDd5sB10zjgAAAF8"]
[Sat Jul 18 23:42:45.078275 2026] [security2:error] [pid 938041:tid 938255] [client 45.133.7.68:35381] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 68.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/css/admin.php"] [unique_id "alxj1SNrzsYMDd5sB10zmwAAAFM"]
[Sat Jul 18 23:42:45.141301 2026] [security2:error] [pid 938041:tid 938214] [client 50.116.65.227:16018] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Jin-Wee-Feature-Image.jpg"] [unique_id "alxj1SNrzsYMDd5sB10znQAAACo"]
[Sat Jul 18 23:42:45.152886 2026] [security2:error] [pid 938041:tid 938198] [client 50.116.65.227:24104] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Jin-Wee-Feature-Image.jpg"] [unique_id "alxj1SNrzsYMDd5sB10znwAAABM"]
[Sat Jul 18 23:42:45.239781 2026] [security2:error] [pid 938041:tid 938265] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/wp-ws68.php"] [unique_id "alxj1SNrzsYMDd5sB10zpgAAAF0"]
[Sat Jul 18 23:42:45.239944 2026] [security2:error] [pid 938041:tid 938265] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/wp-ws68.php"] [unique_id "alxj1SNrzsYMDd5sB10zpgAAAF0"]
[Sat Jul 18 23:42:45.628724 2026] [security2:error] [pid 938041:tid 938077] [remote 34.21.157.37:33028] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 37.157.21.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "icemarc.org"] [uri "/pi.php"] [unique_id "alxj1SNrzsYMDd5sB10zwQAAZCI"]
[Sat Jul 18 23:42:45.644508 2026] [security2:error] [pid 938041:tid 938132] [remote 34.21.157.37:33028] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 37.157.21.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "icemarc.org"] [uri "/info.php"] [unique_id "alxj1SNrzsYMDd5sB10zxQAAZFk"]
[Sat Jul 18 23:42:45.644584 2026] [security2:error] [pid 938041:tid 938060] [remote 34.21.157.37:33028] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 37.157.21.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "icemarc.org"] [uri "/test.php"] [unique_id "alxj1SNrzsYMDd5sB10zxAAAZBE"]
[Sat Jul 18 23:42:45.743416 2026] [security2:error] [pid 938041:tid 938097] [remote 34.21.157.37:33028] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 37.157.21.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "icemarc.org"] [uri "/phpinfo.php"] [unique_id "alxj1SNrzsYMDd5sB10zxwAAZDY"]
[Sat Jul 18 23:42:45.758878 2026] [security2:error] [pid 938041:tid 938273] [client 45.133.7.57:44217] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 57.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/adminfuns.php"] [unique_id "alxj1SNrzsYMDd5sB10z1AAAAGU"]
[Sat Jul 18 23:42:45.811660 2026] [security2:error] [pid 938041:tid 938271] [client 173.239.196.161:42717] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/function/goods.php"] [unique_id "alxj1SNrzsYMDd5sB10z3QAAAGM"]
[Sat Jul 18 23:42:45.897261 2026] [security2:error] [pid 938041:tid 938211] [client 74.7.227.179:39406] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxj1SNrzsYMDd5sB10z1QAAJ2I"], referer: https://tejasenvironmental.com/p=935385
[Sat Jul 18 23:42:45.909044 2026] [security2:error] [pid 938041:tid 938252] [client 163.61.1.17:56672] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxj1SNrzsYMDd5sB10z4QAAAFA"]
[Sat Jul 18 23:42:45.909158 2026] [security2:error] [pid 938041:tid 938252] [client 163.61.1.17:56672] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxj1SNrzsYMDd5sB10z4QAAAFA"]
[Sat Jul 18 23:42:46.123277 2026] [security2:error] [pid 938041:tid 938134] [remote 34.21.157.37:33028] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 37.157.21.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "icemarc.org"] [uri "/app_dev.php"] [unique_id "alxj1iNrzsYMDd5sB10z_AAAZFs"]
[Sat Jul 18 23:42:46.137380 2026] [security2:error] [pid 938041:tid 938105] [remote 34.21.157.37:33028] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 37.157.21.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "icemarc.org"] [uri "/i.php"] [unique_id "alxj1iNrzsYMDd5sB100AAAAZD4"]
[Sat Jul 18 23:42:46.152249 2026] [http2:info] [pid 943918:tid 943918] h2_workers: created with min=128 max=192 idle_ms=600000
[Sat Jul 18 23:42:46.195376 2026] [security2:error] [pid 938041:tid 938174] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxj0yNrzsYMDd5sB10zPwAAAAI"]
[Sat Jul 18 23:42:46.196550 2026] [security2:error] [pid 938041:tid 938208] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxj0yNrzsYMDd5sB10zQQAAACQ"]
[Sat Jul 18 23:42:46.224155 2026] [security2:error] [pid 938041:tid 938279] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxj0yNrzsYMDd5sB10zQAAAAGs"]
[Sat Jul 18 23:42:46.257381 2026] [security2:error] [pid 938041:tid 938277] [client 18.97.9.97:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "locketsandcharms.com"] [uri "/index.php"] [unique_id "alxj1SNrzsYMDd5sB10z7QAAAGk"]
[Sat Jul 18 23:42:46.334108 2026] [security2:error] [pid 938041:tid 938257] [client 109.205.137.6:48676] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cephasnext.com"] [uri "/wp-content/themes/industrial/webfonts/fa-regular-400.woff2"] [unique_id "alxj1iNrzsYMDd5sB100EAAAAFU"]
[Sat Jul 18 23:42:46.349668 2026] [security2:error] [pid 938041:tid 938255] [client 81.153.3.13:59098] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cephasnext.com"] [uri "/wp-content/plugins/js_composer/assets/fonts/vc_grid/vc_grid_v1.ttf"] [unique_id "alxj1iNrzsYMDd5sB100EQAAAFM"]
[Sat Jul 18 23:42:46.369323 2026] [security2:error] [pid 938041:tid 938213] [client 88.164.253.100:60731] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cephasnext.com"] [uri "/wp-content/plugins/js_composer/assets/fonts/vc_grid/vc_grid_v1.eot"] [unique_id "alxj1iNrzsYMDd5sB100EwAAACk"]
[Sat Jul 18 23:42:46.409624 2026] [security2:error] [pid 938041:tid 938188] [client 77.198.12.119:57190] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cephasnext.com"] [uri "/wp-content/themes/industrial/webfonts/fa-solid-900.woff2"] [unique_id "alxj1iNrzsYMDd5sB100FwAAABA"]
[Sat Jul 18 23:42:46.413798 2026] [security2:error] [pid 938041:tid 938214] [client 81.65.69.99:14622] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cephasnext.com"] [uri "/wp-content/plugins/js_composer/assets/fonts/vc_icons_v3/fonts/vcpb-plugin-icons.ttf"] [unique_id "alxj1iNrzsYMDd5sB100GAAAACo"]
[Sat Jul 18 23:42:46.418715 2026] [security2:error] [pid 938041:tid 938179] [client 151.48.226.233:50734] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cephasnext.com"] [uri "/wp-content/plugins/js_composer/assets/fonts/vc_grid/vc_grid_v1.eot"] [unique_id "alxj1iNrzsYMDd5sB100GQAAAAc"]
[Sat Jul 18 23:42:46.435292 2026] [security2:error] [pid 938041:tid 938296] [client 45.133.7.82:41267] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/autoload_classmap.php"] [unique_id "alxj1iNrzsYMDd5sB100GgAAAHw"]
[Sat Jul 18 23:42:46.457894 2026] [security2:error] [pid 938041:tid 938191] [client 92.208.141.13:40526] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cephasnext.com"] [uri "/wp-content/plugins/js_composer/assets/fonts/vc_icons_v3/fonts/vcpb-plugin-icons.eot"] [unique_id "alxj1iNrzsYMDd5sB100HQAAABM"]
[Sat Jul 18 23:42:46.495072 2026] [security2:error] [pid 938041:tid 938261] [client 223.228.182.224:60733] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxj1iNrzsYMDd5sB100IQAAAFk"]
[Sat Jul 18 23:42:46.495343 2026] [security2:error] [pid 938041:tid 938261] [client 223.228.182.224:60733] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxj1iNrzsYMDd5sB100IQAAAFk"]
[Sat Jul 18 23:42:46.524053 2026] [security2:error] [pid 938041:tid 938197] [client 138.252.89.100:56661] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxj1iNrzsYMDd5sB100JAAAABk"]
[Sat Jul 18 23:42:46.524162 2026] [security2:error] [pid 938041:tid 938197] [client 138.252.89.100:56661] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxj1iNrzsYMDd5sB100JAAAABk"]
[Sat Jul 18 23:42:46.528089 2026] [security2:error] [pid 938041:tid 938256] [client 85.217.139.219:4447] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cephasnext.com"] [uri "/wp-content/themes/industrial/webfonts/fa-regular-400.eot"] [unique_id "alxj1iNrzsYMDd5sB100JQAAAFQ"]
[Sat Jul 18 23:42:46.593803 2026] [security2:error] [pid 938041:tid 938294] [client 79.9.119.51:53706] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cephasnext.com"] [uri "/wp-content/themes/industrial/webfonts/fa-regular-400.ttf"] [unique_id "alxj1iNrzsYMDd5sB100KwAAAHo"]
[Sat Jul 18 23:42:46.624940 2026] [security2:error] [pid 938041:tid 938182] [client 77.244.183.71:56915] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cephasnext.com"] [uri "/wp-content/themes/industrial/webfonts/fa-brands-400.eot"] [unique_id "alxj1iNrzsYMDd5sB100LAAAAAo"]
[Sat Jul 18 23:42:46.645134 2026] [security2:error] [pid 938041:tid 938133] [remote 34.21.157.37:33028] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "icemarc.org"] [uri "/app_dev.php/_profiler"] [unique_id "alxj1iNrzsYMDd5sB100LgAAZFo"]
[Sat Jul 18 23:42:46.650573 2026] [security2:error] [pid 938041:tid 938247] [client 189.168.231.231:36338] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cephasnext.com"] [uri "/wp-content/themes/industrial/webfonts/fa-regular-400.eot"] [unique_id "alxj1iNrzsYMDd5sB100MAAAAEs"]
[Sat Jul 18 23:42:46.651231 2026] [security2:error] [pid 938041:tid 938254] [client 83.214.153.56:40746] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cephasnext.com"] [uri "/wp-content/themes/industrial/webfonts/fa-regular-400.woff"] [unique_id "alxj1iNrzsYMDd5sB100LwAAAFI"]
[Sat Jul 18 23:42:46.673139 2026] [security2:error] [pid 938041:tid 938274] [client 70.51.100.32:45092] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cephasnext.com"] [uri "/wp-content/themes/industrial/webfonts/fa-brands-400.eot"] [unique_id "alxj1iNrzsYMDd5sB100MQAAAGY"]
[Sat Jul 18 23:42:46.679935 2026] [security2:error] [pid 938041:tid 938207] [client 87.17.170.115:58846] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cephasnext.com"] [uri "/wp-content/themes/industrial/webfonts/fa-solid-900.woff"] [unique_id "alxj1iNrzsYMDd5sB100MwAAACM"]
[Sat Jul 18 23:42:46.682256 2026] [security2:error] [pid 943918:tid 944064] [client 173.239.196.166:58207] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/bypass.php"] [unique_id "alxj1h70hbVC6SnzbhoTKwAAAJQ"]
[Sat Jul 18 23:42:46.799500 2026] [security2:error] [pid 938041:tid 938233] [client 92.234.37.134:48826] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cephasnext.com"] [uri "/wp-content/themes/industrial/webfonts/fa-brands-400.woff"] [unique_id "alxj1iNrzsYMDd5sB100OwAAAD0"]
[Sat Jul 18 23:42:46.816704 2026] [security2:error] [pid 938041:tid 938260] [client 86.15.0.8:35130] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cephasnext.com"] [uri "/wp-content/themes/industrial/webfonts/fa-solid-900.eot"] [unique_id "alxj1iNrzsYMDd5sB100PQAAAFg"]
[Sat Jul 18 23:42:46.822474 2026] [security2:error] [pid 938041:tid 938267] [client 37.65.222.238:41674] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cephasnext.com"] [uri "/wp-content/plugins/js_composer/assets/fonts/vc_icons_v3/fonts/vcpb-plugin-icons.woff"] [unique_id "alxj1iNrzsYMDd5sB100PgAAAF8"]
[Sat Jul 18 23:42:46.836415 2026] [security2:error] [pid 938041:tid 938259] [client 86.30.188.144:37784] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cephasnext.com"] [uri "/wp-content/plugins/js_composer/assets/fonts/vc_grid/vc_grid_v1.woff"] [unique_id "alxj1iNrzsYMDd5sB100QgAAAFc"]
[Sat Jul 18 23:42:46.861129 2026] [security2:error] [pid 938041:tid 938181] [client 95.181.238.20:5882] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "www.thegoulashconcept.org"] [uri "/index.php"] [unique_id "alxj0SNrzsYMDd5sB10yqQAAAAk"]
[Sat Jul 18 23:42:46.978483 2026] [security2:error] [pid 938041:tid 938190] [client 23.233.181.164:50870] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cephasnext.com"] [uri "/wp-content/themes/industrial/webfonts/fa-solid-900.eot"] [unique_id "alxj1iNrzsYMDd5sB100RwAAABI"]
[Sat Jul 18 23:42:47.108486 2026] [security2:error] [pid 943918:tid 944080] [client 45.133.7.100:50493] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp_wlx.php"] [unique_id "alxj1x70hbVC6SnzbhoTNQAAAKQ"]
[Sat Jul 18 23:42:47.110161 2026] [security2:error] [pid 943918:tid 944054] [client 62.183.17.218:13005] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cephasnext.com"] [uri "/wp-content/themes/industrial/webfonts/fa-brands-400.ttf"] [unique_id "alxj1x70hbVC6SnzbhoTNgAAAIo"]
[Sat Jul 18 23:42:47.111833 2026] [security2:error] [pid 943918:tid 944050] [client 94.3.82.39:59863] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cephasnext.com"] [uri "/wp-content/themes/industrial/webfonts/fa-solid-900.ttf"] [unique_id "alxj1x70hbVC6SnzbhoTNwAAAIY"]
[Sat Jul 18 23:42:47.237119 2026] [security2:error] [pid 943918:tid 944088] [client 136.243.222.140:51972] ModSecurity: Warning. Matched phrase "DomainStatsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "www.ccsdifference.com"] [uri "/index.php"] [unique_id "alxj1h70hbVC6SnzbhoTMgAAAJE"]
[Sat Jul 18 23:42:47.304938 2026] [security2:error] [pid 938041:tid 938064] [remote 34.21.157.37:33028] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "icemarc.org"] [uri "/_ignition/health-check"] [unique_id "alxj1yNrzsYMDd5sB100XQAAZBU"]
[Sat Jul 18 23:42:47.350504 2026] [security2:error] [pid 938041:tid 938234] [client 95.181.238.20:52295] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "thegoulashconcept.org"] [uri "/index.php"] [unique_id "alxj1yNrzsYMDd5sB100VwAAAD4"]
[Sat Jul 18 23:42:47.351171 2026] [security2:error] [pid 938041:tid 938045] [remote 34.21.157.37:33028] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "icemarc.org"] [uri "/__debug__/"] [unique_id "alxj1yNrzsYMDd5sB100YAAAZAI"]
[Sat Jul 18 23:42:47.374650 2026] [security2:error] [pid 938041:tid 938048] [remote 103.75.185.95:39354] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxj1yNrzsYMDd5sB100YgAAAgU"]
[Sat Jul 18 23:42:47.459828 2026] [security2:error] [pid 938041:tid 938173] [client 95.33.184.94:46334] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cephasnext.com"] [uri "/wp-content/themes/industrial/webfonts/fa-brands-400.woff2"] [unique_id "alxj1yNrzsYMDd5sB100ZwAAAAE"]
[Sat Jul 18 23:42:47.517837 2026] [security2:error] [pid 943918:tid 944097] [client 173.239.196.165:41357] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/upgrade/index.php"] [unique_id "alxj1x70hbVC6SnzbhoTPAAAALU"]
[Sat Jul 18 23:42:47.576518 2026] [security2:error] [pid 943918:tid 944093] [client 95.181.238.20:37235] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "404"] [hostname "thegoulashconcept.org"] [uri "/cgi-sys/404.html"] [unique_id "alxj1x70hbVC6SnzbhoTQAAAALE"]
[Sat Jul 18 23:42:47.786849 2026] [security2:error] [pid 943918:tid 944116] [client 45.133.7.95:21313] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "alxj1x70hbVC6SnzbhoTSgAAAMg"]
[Sat Jul 18 23:42:47.849143 2026] [security2:error] [pid 943918:tid 944120] [client 95.181.238.20:4091] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "www.thegoulashconcept.org"] [uri "/robots.txt"] [unique_id "alxj1x70hbVC6SnzbhoTTAAAAMw"]
[Sat Jul 18 23:42:47.928230 2026] [security2:error] [pid 938041:tid 938159] [remote 103.75.185.95:39354] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxj1yNrzsYMDd5sB100fAAAGnQ"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:42:47.944910 2026] [security2:error] [pid 943918:tid 944123] [client 95.181.238.20:4091] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "www.thegoulashconcept.org"] [uri "/"] [unique_id "alxj1x70hbVC6SnzbhoTTgAAAM8"]
[Sat Jul 18 23:42:48.128346 2026] [security2:error] [pid 943918:tid 944133] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/xyn.php"] [unique_id "alxj2B70hbVC6SnzbhoTUQAAANk"]
[Sat Jul 18 23:42:48.128470 2026] [security2:error] [pid 943918:tid 944133] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/xyn.php"] [unique_id "alxj2B70hbVC6SnzbhoTUQAAANk"]
[Sat Jul 18 23:42:48.379935 2026] [security2:error] [pid 943918:tid 944155] [client 173.239.196.161:36031] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "alxj2B70hbVC6SnzbhoTWQAAAO8"]
[Sat Jul 18 23:42:48.467117 2026] [security2:error] [pid 943918:tid 944160] [client 45.133.7.83:51085] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/assets/husky301.php"] [unique_id "alxj2B70hbVC6SnzbhoTXQAAAPQ"]
[Sat Jul 18 23:42:48.542203 2026] [security2:error] [pid 943918:tid 944154] [client 95.181.238.20:57531] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 20.238.181.95.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "thegoulashconcept.org"] [uri "/wp-login.php"] [unique_id "alxj2B70hbVC6SnzbhoTXAAAAO4"]
[Sat Jul 18 23:42:48.542332 2026] [security2:error] [pid 943918:tid 944154] [client 95.181.238.20:57531] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "409"] [hostname "thegoulashconcept.org"] [uri "/wp-login.php"] [unique_id "alxj2B70hbVC6SnzbhoTXAAAAO4"]
[Sat Jul 18 23:42:49.138854 2026] [security2:error] [pid 938041:tid 938265] [client 45.133.7.57:48935] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 57.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp.php"] [unique_id "alxj2SNrzsYMDd5sB100tgAAAF0"]
[Sat Jul 18 23:42:49.183225 2026] [security2:error] [pid 938041:tid 938219] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxj1SNrzsYMDd5sB10z2wAAAC8"]
[Sat Jul 18 23:42:49.186717 2026] [security2:error] [pid 943918:tid 944049] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxj1h70hbVC6SnzbhoTJAAAAIU"]
[Sat Jul 18 23:42:49.193800 2026] [security2:error] [pid 938041:tid 938285] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxj1SNrzsYMDd5sB10z1wAAAHE"]
[Sat Jul 18 23:42:49.197618 2026] [security2:error] [pid 938041:tid 938297] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxj1SNrzsYMDd5sB10z2QAAAH0"]
[Sat Jul 18 23:42:49.198486 2026] [security2:error] [pid 938041:tid 938232] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxj1iNrzsYMDd5sB100AgAAADw"]
[Sat Jul 18 23:42:49.202725 2026] [security2:error] [pid 938041:tid 938230] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxj1SNrzsYMDd5sB10z2AAAADo"]
[Sat Jul 18 23:42:49.204067 2026] [security2:error] [pid 938041:tid 938268] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxj1SNrzsYMDd5sB10z2gAAAGA"]
[Sat Jul 18 23:42:49.236919 2026] [security2:error] [pid 938041:tid 938228] [client 173.239.196.167:35541] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/pridmag/db.php"] [unique_id "alxj2SNrzsYMDd5sB100wQAAADg"]
[Sat Jul 18 23:42:49.362005 2026] [security2:error] [pid 943918:tid 944072] [client 139.167.225.146:60273] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxj2R70hbVC6SnzbhoTfwAAAJw"]
[Sat Jul 18 23:42:49.362109 2026] [security2:error] [pid 943918:tid 944072] [client 139.167.225.146:60273] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxj2R70hbVC6SnzbhoTfwAAAJw"]
[Sat Jul 18 23:42:49.385252 2026] [security2:error] [pid 943918:tid 944164] [client 180.252.198.240:57743] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxj2R70hbVC6SnzbhoTgAAAAPg"]
[Sat Jul 18 23:42:49.385509 2026] [security2:error] [pid 943918:tid 944164] [client 180.252.198.240:57743] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxj2R70hbVC6SnzbhoTgAAAAPg"]
[Sat Jul 18 23:42:49.814989 2026] [security2:error] [pid 938041:tid 938176] [client 45.133.7.58:25587] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/blue/wp-trackback.php"] [unique_id "alxj2SNrzsYMDd5sB1004AAAAAQ"]
[Sat Jul 18 23:42:50.010935 2026] [security2:error] [pid 943918:tid 944111] [client 95.181.238.20:41541] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "www.thegoulashconcept.org"] [uri "/index.php"] [unique_id "alxj2R70hbVC6SnzbhoTkAAAAMM"]
[Sat Jul 18 23:42:50.106663 2026] [security2:error] [pid 943918:tid 944051] [client 173.239.196.166:36383] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/plugin-install.php"] [unique_id "alxj2h70hbVC6SnzbhoTnwAAAIc"]
[Sat Jul 18 23:42:50.201359 2026] [security2:error] [pid 938041:tid 938188] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxj1iNrzsYMDd5sB100RQAAABA"]
[Sat Jul 18 23:42:50.349770 2026] [security2:error] [pid 938041:tid 938295] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/green3.php"] [unique_id "alxj2iNrzsYMDd5sB1009wAAAHs"]
[Sat Jul 18 23:42:50.349895 2026] [security2:error] [pid 938041:tid 938295] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/green3.php"] [unique_id "alxj2iNrzsYMDd5sB1009wAAAHs"]
[Sat Jul 18 23:42:50.432938 2026] [security2:error] [pid 943918:tid 944059] [client 95.181.238.20:7094] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "thegoulashconcept.org"] [uri "/index.php"] [unique_id "alxj2h70hbVC6SnzbhoTpQAAAI8"]
[Sat Jul 18 23:42:50.489426 2026] [security2:error] [pid 938041:tid 938283] [client 45.133.7.103:49171] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/chosen.php"] [unique_id "alxj2iNrzsYMDd5sB101AAAAAG8"]
[Sat Jul 18 23:42:50.745132 2026] [security2:error] [pid 938041:tid 938256] [client 95.181.238.20:44654] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 20.238.181.95.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "thegoulashconcept.org"] [uri "/wp-login.php"] [unique_id "alxj2iNrzsYMDd5sB101EgAAAFQ"]
[Sat Jul 18 23:42:50.745232 2026] [security2:error] [pid 938041:tid 938256] [client 95.181.238.20:44654] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "409"] [hostname "thegoulashconcept.org"] [uri "/wp-login.php"] [unique_id "alxj2iNrzsYMDd5sB101EgAAAFQ"]
[Sat Jul 18 23:42:50.977175 2026] [security2:error] [pid 938041:tid 938188] [client 173.239.196.160:25209] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "alxj2iNrzsYMDd5sB101JwAAABA"]
[Sat Jul 18 23:42:51.120220 2026] [security2:error] [pid 943918:tid 944122] [client 85.204.70.112:58534] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "blaizeaccountingservices.com"] [uri "/wp-admin/css/"] [unique_id "alxj2x70hbVC6SnzbhoTuAAAAM4"]
[Sat Jul 18 23:42:51.174064 2026] [security2:error] [pid 943918:tid 944065] [client 45.133.7.61:57155] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-header.php"] [unique_id "alxj2x70hbVC6SnzbhoTugAAAJU"]
[Sat Jul 18 23:42:51.198598 2026] [security2:error] [pid 943918:tid 944114] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxj1x70hbVC6SnzbhoTSQAAAMY"]
[Sat Jul 18 23:42:51.205649 2026] [security2:error] [pid 938041:tid 938251] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxj1yNrzsYMDd5sB100YQAAAE8"]
[Sat Jul 18 23:42:51.242288 2026] [security2:error] [pid 938041:tid 938213] [client 95.181.238.20:64029] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "www.thegoulashconcept.org"] [uri "/index.php"] [unique_id "alxj2yNrzsYMDd5sB101KQAAACk"]
[Sat Jul 18 23:42:51.527420 2026] [security2:error] [pid 943918:tid 944064] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxj2B70hbVC6SnzbhoTZgAAAJQ"]
[Sat Jul 18 23:42:51.594859 2026] [security2:error] [pid 938041:tid 938196] [client 54.158.23.200:0] ModSecurity: Warning. Matched phrase "ADmantX" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "curlsnpearlsss.com"] [uri "/index.php"] [unique_id "alxj2iNrzsYMDd5sB101FwAAABg"]
[Sat Jul 18 23:42:51.616022 2026] [security2:error] [pid 938041:tid 938218] [client 95.181.238.20:19486] ModSecurity: Warning. Matched phrase "Panscient" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "thegoulashconcept.org"] [uri "/index.php"] [unique_id "alxj2yNrzsYMDd5sB101RgAAAC4"]
[Sat Jul 18 23:42:51.641309 2026] [security2:error] [pid 938041:tid 938294] [client 54.158.23.200:45850] ModSecurity: Warning. Matched phrase "ADmantX" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "curlsnpearlsss.com"] [uri "/"] [unique_id "alxj2iNrzsYMDd5sB101EwAAAHo"]
[Sat Jul 18 23:42:51.674598 2026] [security2:error] [pid 943918:tid 944119] [client 185.147.157.239:46648] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "ait.afz.mybluehost.me"] [uri "/index.php"] [unique_id "alxj2x70hbVC6SnzbhoTxwAAAMs"]
[Sat Jul 18 23:42:51.782245 2026] [security2:error] [pid 943918:tid 944105] [client 106.222.249.209:23623] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxj2x70hbVC6SnzbhoTzQAAAL0"]
[Sat Jul 18 23:42:51.782432 2026] [security2:error] [pid 943918:tid 944105] [client 106.222.249.209:23623] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxj2x70hbVC6SnzbhoTzQAAAL0"]
[Sat Jul 18 23:42:51.848396 2026] [security2:error] [pid 943918:tid 944166] [client 45.133.7.88:58745] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 88.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/admin.php"] [unique_id "alxj2x70hbVC6SnzbhoTzgAAAPo"]
[Sat Jul 18 23:42:51.876166 2026] [security2:error] [pid 943918:tid 944154] [client 173.239.196.162:37509] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/js/load.php"] [unique_id "alxj2x70hbVC6SnzbhoT0AAAAO4"]
[Sat Jul 18 23:42:52.282305 2026] [security2:error] [pid 943918:tid 944086] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/ccs.php"] [unique_id "alxj3B70hbVC6SnzbhoT4AAAAKo"]
[Sat Jul 18 23:42:52.282433 2026] [security2:error] [pid 943918:tid 944086] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/ccs.php"] [unique_id "alxj3B70hbVC6SnzbhoT4AAAAKo"]
[Sat Jul 18 23:42:52.357293 2026] [security2:error] [pid 938041:tid 938262] [client 74.208.214.194:37004] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxj3CNrzsYMDd5sB101YQAAAFo"]
[Sat Jul 18 23:42:52.524466 2026] [security2:error] [pid 943918:tid 944102] [client 45.133.7.89:40901] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 89.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/Marvins.php"] [unique_id "alxj3B70hbVC6SnzbhoT5wAAALo"]
[Sat Jul 18 23:42:52.762242 2026] [security2:error] [pid 943918:tid 944072] [client 173.239.196.164:43897] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/images/firewall.php7"] [unique_id "alxj3B70hbVC6SnzbhoT6QAAAJw"]
[Sat Jul 18 23:42:52.926573 2026] [security2:error] [pid 943918:tid 944087] [client 47.130.151.169:64668] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 169.151.130.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxj3B70hbVC6SnzbhoT7QAAAKs"]
[Sat Jul 18 23:42:53.200988 2026] [security2:error] [pid 943918:tid 944054] [client 45.133.7.62:63455] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/about.php"] [unique_id "alxj3R70hbVC6SnzbhoT8gAAAIo"]
[Sat Jul 18 23:42:53.602262 2026] [security2:error] [pid 938041:tid 938226] [client 173.239.196.164:63503] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "alxj3SNrzsYMDd5sB101hgAAADY"]
[Sat Jul 18 23:42:53.881074 2026] [security2:error] [pid 938041:tid 938289] [client 45.133.7.76:23531] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 76.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-class.php"] [unique_id "alxj3SNrzsYMDd5sB101jQAAAHU"]
[Sat Jul 18 23:42:54.328734 2026] [security2:error] [pid 938041:tid 938252] [client 195.250.27.224:33994] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.27.250.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/xmlrpc.php"] [unique_id "alxj3iNrzsYMDd5sB101nAAAAFA"]
[Sat Jul 18 23:42:54.328848 2026] [security2:error] [pid 938041:tid 938252] [client 195.250.27.224:33994] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "youpositive.co"] [uri "/xmlrpc.php"] [unique_id "alxj3iNrzsYMDd5sB101nAAAAFA"]
[Sat Jul 18 23:42:54.428965 2026] [security2:error] [pid 938041:tid 938208] [client 195.250.27.224:33996] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.27.250.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/xmlrpc.php"] [unique_id "alxj3iNrzsYMDd5sB101owAAACQ"]
[Sat Jul 18 23:42:54.429055 2026] [security2:error] [pid 938041:tid 938208] [client 195.250.27.224:33996] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "youpositive.co"] [uri "/xmlrpc.php"] [unique_id "alxj3iNrzsYMDd5sB101owAAACQ"]
[Sat Jul 18 23:42:54.464730 2026] [security2:error] [pid 938041:tid 938212] [client 173.239.196.166:48029] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/upgrade/pdf.php"] [unique_id "alxj3iNrzsYMDd5sB101pwAAACg"]
[Sat Jul 18 23:42:54.577957 2026] [security2:error] [pid 938041:tid 938246] [client 45.133.7.97:38271] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 97.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "alxj3iNrzsYMDd5sB101qwAAAEo"]
[Sat Jul 18 23:42:54.617125 2026] [security2:error] [pid 938041:tid 938282] [client 223.228.182.224:20152] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxj3iNrzsYMDd5sB101rwAAAG4"]
[Sat Jul 18 23:42:54.617220 2026] [security2:error] [pid 938041:tid 938282] [client 223.228.182.224:20152] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxj3iNrzsYMDd5sB101rwAAAG4"]
[Sat Jul 18 23:42:54.788322 2026] [security2:error] [pid 943918:tid 944093] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/ccc.php"] [unique_id "alxj3h70hbVC6SnzbhoUEwAAALE"]
[Sat Jul 18 23:42:54.788423 2026] [security2:error] [pid 943918:tid 944093] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/ccc.php"] [unique_id "alxj3h70hbVC6SnzbhoUEwAAALE"]
[Sat Jul 18 23:42:54.789555 2026] [security2:error] [pid 943918:tid 943961] [remote 45.228.136.75:17436] ModSecurity: Access denied with code 406 (phase 1). Pattern match "python-requests|python-urllib" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "1460"] [id "909111"] [msg "Python UA brute"] [hostname "areitoproducciones.com"] [uri "/"] [unique_id "alxj3h70hbVC6SnzbhoUFAAArSk"]
[Sat Jul 18 23:42:55.258112 2026] [security2:error] [pid 943918:tid 944065] [client 18.141.144.104:16986] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.144.141.18.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxj3x70hbVC6SnzbhoUKAAAAJU"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:42:55.261478 2026] [security2:error] [pid 938041:tid 938202] [client 45.133.7.82:33767] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/xx.php"] [unique_id "alxj3yNrzsYMDd5sB101wgAAAB4"]
[Sat Jul 18 23:42:55.309900 2026] [security2:error] [pid 943918:tid 944056] [client 173.239.196.163:23393] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/as.php"] [unique_id "alxj3x70hbVC6SnzbhoULAAAAIw"]
[Sat Jul 18 23:42:55.787621 2026] [security2:error] [pid 943918:tid 944051] [client 149.102.230.118:29782] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "areitoproducciones.com"] [uri "/"] [unique_id "alxj3x70hbVC6SnzbhoUOQAAAIc"]
[Sat Jul 18 23:42:55.939438 2026] [security2:error] [pid 943918:tid 944090] [client 45.133.7.88:32659] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 88.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/autoload_classmap.php"] [unique_id "alxj3x70hbVC6SnzbhoUOwAAAK4"]
[Sat Jul 18 23:42:56.143467 2026] [security2:error] [pid 943918:tid 944151] [client 173.239.196.161:38963] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/item.php"] [unique_id "alxj4B70hbVC6SnzbhoUQwAAAOs"]
[Sat Jul 18 23:42:56.259234 2026] [security2:error] [pid 943918:tid 944078] [client 149.102.230.118:29796] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "areitoproducciones.com"] [uri "/"] [unique_id "alxj4B70hbVC6SnzbhoURgAAAKI"]
[Sat Jul 18 23:42:56.645217 2026] [security2:error] [pid 943918:tid 944124] [client 45.133.7.99:64721] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/classwithtostring.php"] [unique_id "alxj4B70hbVC6SnzbhoUTAAAANA"]
[Sat Jul 18 23:42:56.727180 2026] [security2:error] [pid 943918:tid 944157] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/get.php"] [unique_id "alxj4B70hbVC6SnzbhoUUAAAAPE"]
[Sat Jul 18 23:42:56.727313 2026] [security2:error] [pid 943918:tid 944157] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/get.php"] [unique_id "alxj4B70hbVC6SnzbhoUUAAAAPE"]
[Sat Jul 18 23:42:56.739320 2026] [security2:error] [pid 938041:tid 938264] [client 149.102.230.119:59978] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "areitoproducciones.com"] [uri "/"] [unique_id "alxj4CNrzsYMDd5sB1017QAAAFw"]
[Sat Jul 18 23:42:56.762491 2026] [proxy:error] [pid 943918:tid 944104] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:42:56.762541 2026] [proxy_http:error] [pid 943918:tid 944104] [client 193.47.62.168:34288] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:42:56.763435 2026] [proxy:error] [pid 943918:tid 944104] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:42:56.763477 2026] [proxy_http:error] [pid 943918:tid 944104] [client 193.47.62.168:34288] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:42:56.922057 2026] [security2:error] [pid 943918:tid 944098] [client 163.61.1.17:57148] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxj4B70hbVC6SnzbhoUVwAAALY"]
[Sat Jul 18 23:42:56.922187 2026] [security2:error] [pid 943918:tid 944098] [client 163.61.1.17:57148] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxj4B70hbVC6SnzbhoUVwAAALY"]
[Sat Jul 18 23:42:56.983530 2026] [security2:error] [pid 938041:tid 938249] [client 173.239.196.160:53433] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "alxj4CNrzsYMDd5sB1018gAAAE0"]
[Sat Jul 18 23:42:57.037680 2026] [security2:error] [pid 938041:tid 938297] [client 63.179.105.113:35672] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.105.179.63.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxj4SNrzsYMDd5sB101-QAAAH0"]
[Sat Jul 18 23:42:57.037845 2026] [security2:error] [pid 938041:tid 938297] [client 63.179.105.113:35672] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxj4SNrzsYMDd5sB101-QAAAH0"]
[Sat Jul 18 23:42:57.335133 2026] [security2:error] [pid 938041:tid 938242] [client 45.133.7.59:47153] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 59.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/blue.php"] [unique_id "alxj4SNrzsYMDd5sB102BQAAAEY"]
[Sat Jul 18 23:42:57.503713 2026] [proxy:error] [pid 943918:tid 944059] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:42:57.503807 2026] [proxy_http:error] [pid 943918:tid 944059] [client 193.47.62.168:39986] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:42:57.504394 2026] [proxy:error] [pid 943918:tid 944059] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:42:57.504418 2026] [proxy_http:error] [pid 943918:tid 944059] [client 193.47.62.168:39986] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:42:57.854672 2026] [security2:error] [pid 938041:tid 938176] [client 173.239.196.163:20155] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/install.php"] [unique_id "alxj4SNrzsYMDd5sB102FgAAAAQ"]
[Sat Jul 18 23:42:57.917083 2026] [security2:error] [pid 938041:tid 938214] [client 185.8.106.147:55242] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "cira.org"] [uri "/index.php"] [unique_id "alxj3yNrzsYMDd5sB101zgAAKmI"]
[Sat Jul 18 23:42:58.021468 2026] [security2:error] [pid 943918:tid 943981] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "alxj4h70hbVC6SnzbhoUfAAArT0"]
[Sat Jul 18 23:42:58.021691 2026] [security2:error] [pid 943918:tid 944089] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "alxj4h70hbVC6SnzbhoUfAAArT0"]
[Sat Jul 18 23:42:58.051843 2026] [security2:error] [pid 943918:tid 944088] [client 45.133.7.98:63191] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 98.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/content.php"] [unique_id "alxj4h70hbVC6SnzbhoUewAAAKw"]
[Sat Jul 18 23:42:58.128619 2026] [security2:error] [pid 943918:tid 943979] [remote 57.141.18.84:31896] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 84.18.141.57.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/product/4040476"] [unique_id "alxj4h70hbVC6SnzbhoUggAAtDs"]
[Sat Jul 18 23:42:58.160043 2026] [security2:error] [pid 943918:tid 944151] [client 138.252.89.100:57201] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxj4h70hbVC6SnzbhoUhAAAAOs"]
[Sat Jul 18 23:42:58.160174 2026] [security2:error] [pid 943918:tid 944151] [client 138.252.89.100:57201] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxj4h70hbVC6SnzbhoUhAAAAOs"]
[Sat Jul 18 23:42:58.416538 2026] [security2:error] [pid 943918:tid 943983] [remote 31.42.184.154:56962] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.upf.ztf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxj4h70hbVC6SnzbhoUkQAA8T8"]
[Sat Jul 18 23:42:58.589300 2026] [security2:error] [pid 943918:tid 943985] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/this_is_a_new_hello_world.php"] [unique_id "alxj4h70hbVC6SnzbhoUkwAAy0E"]
[Sat Jul 18 23:42:58.589463 2026] [security2:error] [pid 943918:tid 944119] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/this_is_a_new_hello_world.php"] [unique_id "alxj4h70hbVC6SnzbhoUkwAAy0E"]
[Sat Jul 18 23:42:58.652642 2026] [security2:error] [pid 943918:tid 943965] [remote 31.42.184.154:56962] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.upf.ztf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxj4h70hbVC6SnzbhoUmAAA4i0"], referer: https://mail.upf.ztf.mybluehost.me/wp-login.php
[Sat Jul 18 23:42:58.657551 2026] [security2:error] [pid 943918:tid 944162] [client 195.250.27.224:48606] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.27.250.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/ar/xmlrpc.php"] [unique_id "alxj4h70hbVC6SnzbhoUmQAAAPY"]
[Sat Jul 18 23:42:58.657638 2026] [security2:error] [pid 943918:tid 944162] [client 195.250.27.224:48606] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "youpositive.co"] [uri "/ar/xmlrpc.php"] [unique_id "alxj4h70hbVC6SnzbhoUmQAAAPY"]
[Sat Jul 18 23:42:58.724210 2026] [security2:error] [pid 943918:tid 944049] [client 45.133.7.81:55355] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 81.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/uploads/about.php"] [unique_id "alxj4h70hbVC6SnzbhoUoAAAAIU"]
[Sat Jul 18 23:42:58.764957 2026] [security2:error] [pid 943918:tid 944097] [client 173.239.196.164:60163] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/customize/db.php"] [unique_id "alxj4h70hbVC6SnzbhoUoQAAALU"]
[Sat Jul 18 23:42:58.781527 2026] [security2:error] [pid 943918:tid 943988] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/x.php"] [unique_id "alxj4h70hbVC6SnzbhoUowAA-UQ"]
[Sat Jul 18 23:42:58.781727 2026] [security2:error] [pid 943918:tid 944165] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/x.php"] [unique_id "alxj4h70hbVC6SnzbhoUowAA-UQ"]
[Sat Jul 18 23:42:58.800719 2026] [security2:error] [pid 943918:tid 944113] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/images.php"] [unique_id "alxj4h70hbVC6SnzbhoUpgAAAMU"]
[Sat Jul 18 23:42:58.800819 2026] [security2:error] [pid 943918:tid 944113] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/images.php"] [unique_id "alxj4h70hbVC6SnzbhoUpgAAAMU"]
[Sat Jul 18 23:42:58.813982 2026] [security2:error] [pid 943918:tid 944052] [client 195.250.27.224:48616] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.27.250.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/xmlrpc.php"] [unique_id "alxj4h70hbVC6SnzbhoUqAAAAIg"]
[Sat Jul 18 23:42:58.814063 2026] [security2:error] [pid 943918:tid 944052] [client 195.250.27.224:48616] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "youpositive.co"] [uri "/xmlrpc.php"] [unique_id "alxj4h70hbVC6SnzbhoUqAAAAIg"]
[Sat Jul 18 23:42:58.864200 2026] [security2:error] [pid 938041:tid 938297] [client 195.250.27.224:34006] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.27.250.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/blog/xmlrpc.php"] [unique_id "alxj4iNrzsYMDd5sB102MwAAAH0"]
[Sat Jul 18 23:42:58.864289 2026] [security2:error] [pid 938041:tid 938297] [client 195.250.27.224:34006] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "youpositive.co"] [uri "/blog/xmlrpc.php"] [unique_id "alxj4iNrzsYMDd5sB102MwAAAH0"]
[Sat Jul 18 23:42:58.964100 2026] [security2:error] [pid 943918:tid 944054] [client 195.250.27.224:34632] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.27.250.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/wordpress/xmlrpc.php"] [unique_id "alxj4h70hbVC6SnzbhoUtAAAAIo"]
[Sat Jul 18 23:42:58.964192 2026] [security2:error] [pid 943918:tid 944054] [client 195.250.27.224:34632] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "youpositive.co"] [uri "/wordpress/xmlrpc.php"] [unique_id "alxj4h70hbVC6SnzbhoUtAAAAIo"]
[Sat Jul 18 23:42:58.995299 2026] [security2:error] [pid 943918:tid 943992] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/aa.php"] [unique_id "alxj4h70hbVC6SnzbhoUtQAAtkg"]
[Sat Jul 18 23:42:58.995457 2026] [security2:error] [pid 943918:tid 944098] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/aa.php"] [unique_id "alxj4h70hbVC6SnzbhoUtQAAtkg"]
[Sat Jul 18 23:42:59.063626 2026] [security2:error] [pid 943918:tid 944122] [client 195.250.27.224:34642] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.27.250.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/site/xmlrpc.php"] [unique_id "alxj4x70hbVC6SnzbhoUuAAAAM4"]
[Sat Jul 18 23:42:59.063717 2026] [security2:error] [pid 943918:tid 944122] [client 195.250.27.224:34642] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "youpositive.co"] [uri "/site/xmlrpc.php"] [unique_id "alxj4x70hbVC6SnzbhoUuAAAAM4"]
[Sat Jul 18 23:42:59.164502 2026] [security2:error] [pid 943918:tid 944057] [client 195.250.27.224:34658] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.27.250.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/web/xmlrpc.php"] [unique_id "alxj4x70hbVC6SnzbhoUwwAAAI0"]
[Sat Jul 18 23:42:59.164596 2026] [security2:error] [pid 943918:tid 944057] [client 195.250.27.224:34658] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "youpositive.co"] [uri "/web/xmlrpc.php"] [unique_id "alxj4x70hbVC6SnzbhoUwwAAAI0"]
[Sat Jul 18 23:42:59.197043 2026] [security2:error] [pid 943918:tid 943997] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/blue.php"] [unique_id "alxj4x70hbVC6SnzbhoUxAAA3U0"]
[Sat Jul 18 23:42:59.197226 2026] [security2:error] [pid 943918:tid 944137] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/blue.php"] [unique_id "alxj4x70hbVC6SnzbhoUxAAA3U0"]
[Sat Jul 18 23:42:59.268127 2026] [security2:error] [pid 943918:tid 944139] [client 195.250.27.224:34672] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.27.250.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/cms/xmlrpc.php"] [unique_id "alxj4x70hbVC6SnzbhoUyQAAAN8"]
[Sat Jul 18 23:42:59.268210 2026] [security2:error] [pid 943918:tid 944139] [client 195.250.27.224:34672] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "youpositive.co"] [uri "/cms/xmlrpc.php"] [unique_id "alxj4x70hbVC6SnzbhoUyQAAAN8"]
[Sat Jul 18 23:42:59.305965 2026] [security2:error] [pid 943918:tid 944066] [client 180.252.198.240:58223] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxj4x70hbVC6SnzbhoUzQAAAJY"]
[Sat Jul 18 23:42:59.306139 2026] [security2:error] [pid 943918:tid 944066] [client 180.252.198.240:58223] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxj4x70hbVC6SnzbhoUzQAAAJY"]
[Sat Jul 18 23:42:59.371495 2026] [security2:error] [pid 938041:tid 938280] [client 195.250.27.224:34684] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.27.250.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/wp-site/xmlrpc.php"] [unique_id "alxj4yNrzsYMDd5sB102QAAAAGw"]
[Sat Jul 18 23:42:59.371601 2026] [security2:error] [pid 938041:tid 938280] [client 195.250.27.224:34684] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "youpositive.co"] [uri "/wp-site/xmlrpc.php"] [unique_id "alxj4yNrzsYMDd5sB102QAAAAGw"]
[Sat Jul 18 23:42:59.395594 2026] [security2:error] [pid 943918:tid 944002] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/num.php"] [unique_id "alxj4x70hbVC6SnzbhoU0AAApVI"]
[Sat Jul 18 23:42:59.395787 2026] [security2:error] [pid 943918:tid 944081] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/num.php"] [unique_id "alxj4x70hbVC6SnzbhoU0AAApVI"]
[Sat Jul 18 23:42:59.455494 2026] [security2:error] [pid 943918:tid 944059] [client 45.133.7.86:61061] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 86.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/wp-login.php"] [unique_id "alxj4x70hbVC6SnzbhoU0QAAAI8"]
[Sat Jul 18 23:42:59.474550 2026] [security2:error] [pid 938041:tid 938210] [client 195.250.27.224:34686] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.27.250.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/old/xmlrpc.php"] [unique_id "alxj4yNrzsYMDd5sB102QgAAACY"]
[Sat Jul 18 23:42:59.474623 2026] [security2:error] [pid 938041:tid 938210] [client 195.250.27.224:34686] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "youpositive.co"] [uri "/old/xmlrpc.php"] [unique_id "alxj4yNrzsYMDd5sB102QgAAACY"]
[Sat Jul 18 23:42:59.595970 2026] [security2:error] [pid 943918:tid 944006] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/rh.php"] [unique_id "alxj4x70hbVC6SnzbhoU2AAA-1Y"]
[Sat Jul 18 23:42:59.596100 2026] [security2:error] [pid 943918:tid 944167] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/rh.php"] [unique_id "alxj4x70hbVC6SnzbhoU2AAA-1Y"]
[Sat Jul 18 23:42:59.647395 2026] [security2:error] [pid 938041:tid 938268] [client 195.250.27.224:34694] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.27.250.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/new/xmlrpc.php"] [unique_id "alxj4yNrzsYMDd5sB102RQAAAGA"]
[Sat Jul 18 23:42:59.647478 2026] [security2:error] [pid 938041:tid 938268] [client 195.250.27.224:34694] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "youpositive.co"] [uri "/new/xmlrpc.php"] [unique_id "alxj4yNrzsYMDd5sB102RQAAAGA"]
[Sat Jul 18 23:42:59.656224 2026] [security2:error] [pid 943918:tid 944077] [client 5.161.194.92:57998] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "windowtx.com"] [uri "/index.php"] [unique_id "alxj4x70hbVC6SnzbhoUwAAAAKE"], referer: https://windowtx.com
[Sat Jul 18 23:42:59.675924 2026] [security2:error] [pid 943918:tid 944103] [client 173.239.196.165:32755] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/css/fan.php"] [unique_id "alxj4x70hbVC6SnzbhoU3gAAALs"]
[Sat Jul 18 23:42:59.697399 2026] [security2:error] [pid 943918:tid 944174] [client 90.38.244.123:47698] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "cephasnext.com"] [uri "/wp-content/plugins/js_composer/assets/fonts/vc_icons_v3/fonts/vcpb-plugin-icons.eot"] [unique_id "alxj4x70hbVC6SnzbhoU4QAAAQI"]
[Sat Jul 18 23:43:00.068118 2026] [security2:error] [pid 938041:tid 938278] [client 116.103.90.29:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "taskidsvirginia.com"] [uri "/index.php"] [unique_id "alxj4yNrzsYMDd5sB102OwAAAGo"]
[Sat Jul 18 23:43:00.129346 2026] [security2:error] [pid 943918:tid 944095] [client 45.133.7.64:26721] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 64.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "alxj5B70hbVC6SnzbhoU8gAAALM"]
[Sat Jul 18 23:43:00.407479 2026] [security2:error] [pid 943918:tid 944155] [client 37.27.59.176:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxj5B70hbVC6SnzbhoU9gAAAO8"]
[Sat Jul 18 23:43:00.477444 2026] [security2:error] [pid 938041:tid 938236] [client 139.167.225.146:60939] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxj5CNrzsYMDd5sB102XQAAAEA"]
[Sat Jul 18 23:43:00.477549 2026] [security2:error] [pid 938041:tid 938236] [client 139.167.225.146:60939] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxj5CNrzsYMDd5sB102XQAAAEA"]
[Sat Jul 18 23:43:00.553989 2026] [security2:error] [pid 938041:tid 938263] [client 173.239.196.167:54613] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/blue/colors.php"] [unique_id "alxj5CNrzsYMDd5sB102YAAAAFs"]
[Sat Jul 18 23:43:00.580361 2026] [security2:error] [pid 943918:tid 944023] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/sh.php"] [unique_id "alxj5B70hbVC6SnzbhoVBQAAqGc"]
[Sat Jul 18 23:43:00.580554 2026] [security2:error] [pid 943918:tid 944084] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/sh.php"] [unique_id "alxj5B70hbVC6SnzbhoVBQAAqGc"]
[Sat Jul 18 23:43:00.780533 2026] [security2:error] [pid 943918:tid 944027] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/css.php"] [unique_id "alxj5B70hbVC6SnzbhoVDQAAiWs"]
[Sat Jul 18 23:43:00.780734 2026] [security2:error] [pid 943918:tid 944053] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/css.php"] [unique_id "alxj5B70hbVC6SnzbhoVDQAAiWs"]
[Sat Jul 18 23:43:00.857547 2026] [security2:error] [pid 943918:tid 944165] [client 45.133.7.95:31545] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/languages/about.php"] [unique_id "alxj5B70hbVC6SnzbhoVEQAAAPk"]
[Sat Jul 18 23:43:00.909769 2026] [security2:error] [pid 943918:tid 944106] [client 195.250.27.224:48622] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.27.250.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/wp-login.php"] [unique_id "alxj5B70hbVC6SnzbhoVFQAAAL4"], referer: https://youpositive.co/wp-admin/
[Sat Jul 18 23:43:00.960979 2026] [security2:error] [pid 943918:tid 944126] [client 195.250.27.224:34708] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.27.250.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/wp-login.php"] [unique_id "alxj5B70hbVC6SnzbhoVFwAAANI"]
[Sat Jul 18 23:43:00.971609 2026] [security2:error] [pid 943918:tid 944032] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/thai.php"] [unique_id "alxj5B70hbVC6SnzbhoVGgAArXA"]
[Sat Jul 18 23:43:00.971847 2026] [security2:error] [pid 943918:tid 944089] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/thai.php"] [unique_id "alxj5B70hbVC6SnzbhoVGgAArXA"]
[Sat Jul 18 23:43:01.161506 2026] [security2:error] [pid 943918:tid 944035] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/filei.php"] [unique_id "alxj5R70hbVC6SnzbhoVIwAArHM"]
[Sat Jul 18 23:43:01.161683 2026] [security2:error] [pid 943918:tid 944088] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/filei.php"] [unique_id "alxj5R70hbVC6SnzbhoVIwAArHM"]
[Sat Jul 18 23:43:01.339113 2026] [security2:error] [pid 938041:tid 938280] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/alls.php"] [unique_id "alxj5SNrzsYMDd5sB102dQAAAGw"]
[Sat Jul 18 23:43:01.339204 2026] [security2:error] [pid 938041:tid 938280] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/alls.php"] [unique_id "alxj5SNrzsYMDd5sB102dQAAAGw"]
[Sat Jul 18 23:43:01.402765 2026] [security2:error] [pid 938041:tid 938284] [client 173.239.196.164:27203] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/images/mah.php"] [unique_id "alxj5SNrzsYMDd5sB102dgAAAHA"]
[Sat Jul 18 23:43:01.533282 2026] [security2:error] [pid 943918:tid 944065] [client 45.133.7.79:33839] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 79.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/wp-theme-editor/include.php"] [unique_id "alxj5R70hbVC6SnzbhoVMgAAAJU"]
[Sat Jul 18 23:43:01.595396 2026] [security2:error] [pid 943918:tid 944042] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/v2.php"] [unique_id "alxj5R70hbVC6SnzbhoVMwAA8Ho"]
[Sat Jul 18 23:43:01.595577 2026] [security2:error] [pid 943918:tid 944156] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/v2.php"] [unique_id "alxj5R70hbVC6SnzbhoVMwAA8Ho"]
[Sat Jul 18 23:43:01.951304 2026] [security2:error] [pid 943918:tid 943923] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/3.php"] [unique_id "alxj5R70hbVC6SnzbhoVQgAA9QM"]
[Sat Jul 18 23:43:01.951482 2026] [security2:error] [pid 943918:tid 944161] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/3.php"] [unique_id "alxj5R70hbVC6SnzbhoVQgAA9QM"]
[Sat Jul 18 23:43:02.141926 2026] [security2:error] [pid 943918:tid 943928] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/10.php"] [unique_id "alxj5h70hbVC6SnzbhoVSQAAmQg"]
[Sat Jul 18 23:43:02.142121 2026] [security2:error] [pid 943918:tid 944069] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/10.php"] [unique_id "alxj5h70hbVC6SnzbhoVSQAAmQg"]
[Sat Jul 18 23:43:02.207609 2026] [security2:error] [pid 938041:tid 938223] [client 45.133.7.105:20151] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/up/main.php"] [unique_id "alxj5iNrzsYMDd5sB102iQAAADM"]
[Sat Jul 18 23:43:02.255829 2026] [security2:error] [pid 943918:tid 944053] [client 173.239.196.162:44477] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/waf_defender.php"] [unique_id "alxj5h70hbVC6SnzbhoVTQAAAIk"]
[Sat Jul 18 23:43:02.354822 2026] [security2:error] [pid 943918:tid 943932] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/.well-known/info.php"] [unique_id "alxj5h70hbVC6SnzbhoVUQAA-Qw"]
[Sat Jul 18 23:43:02.354974 2026] [security2:error] [pid 943918:tid 944165] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/.well-known/info.php"] [unique_id "alxj5h70hbVC6SnzbhoVUQAA-Qw"]
[Sat Jul 18 23:43:02.361127 2026] [security2:error] [pid 943918:tid 944163] [client 106.222.249.209:16581] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxj5h70hbVC6SnzbhoVUgAAAPc"]
[Sat Jul 18 23:43:02.361252 2026] [security2:error] [pid 943918:tid 944163] [client 106.222.249.209:16581] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxj5h70hbVC6SnzbhoVUgAAAPc"]
[Sat Jul 18 23:43:02.555480 2026] [security2:error] [pid 943918:tid 943927] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/ee.php"] [unique_id "alxj5h70hbVC6SnzbhoVVwAAiAc"]
[Sat Jul 18 23:43:02.555677 2026] [security2:error] [pid 943918:tid 944052] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/ee.php"] [unique_id "alxj5h70hbVC6SnzbhoVVwAAiAc"]
[Sat Jul 18 23:43:02.747172 2026] [security2:error] [pid 943918:tid 943938] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/rsnu.php"] [unique_id "alxj5h70hbVC6SnzbhoVXwAArBI"]
[Sat Jul 18 23:43:02.747288 2026] [security2:error] [pid 943918:tid 944088] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/rsnu.php"] [unique_id "alxj5h70hbVC6SnzbhoVXwAArBI"]
[Sat Jul 18 23:43:02.882821 2026] [security2:error] [pid 943918:tid 944135] [client 45.133.7.85:58889] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 85.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/fonts/fontawesome-webfont.php"] [unique_id "alxj5h70hbVC6SnzbhoVcAAAANs"]
[Sat Jul 18 23:43:02.909941 2026] [security2:error] [pid 943918:tid 944119] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/yyu.php"] [unique_id "alxj5h70hbVC6SnzbhoVcQAAAMs"]
[Sat Jul 18 23:43:02.910050 2026] [security2:error] [pid 943918:tid 944119] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/yyu.php"] [unique_id "alxj5h70hbVC6SnzbhoVcQAAAMs"]
[Sat Jul 18 23:43:02.937495 2026] [security2:error] [pid 943918:tid 943941] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/x4.php"] [unique_id "alxj5h70hbVC6SnzbhoVcgAA3hU"]
[Sat Jul 18 23:43:02.937673 2026] [security2:error] [pid 943918:tid 944138] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/x4.php"] [unique_id "alxj5h70hbVC6SnzbhoVcgAA3hU"]
[Sat Jul 18 23:43:03.108918 2026] [security2:error] [pid 943918:tid 944071] [client 173.239.196.164:62193] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/ectoplasm/content.php"] [unique_id "alxj5x70hbVC6SnzbhoVgQAAAJs"]
[Sat Jul 18 23:43:03.169127 2026] [security2:error] [pid 943918:tid 944174] [client 36.83.95.75:63597] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxj5x70hbVC6SnzbhoVgwAAAQI"]
[Sat Jul 18 23:43:03.169253 2026] [security2:error] [pid 943918:tid 944174] [client 36.83.95.75:63597] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxj5x70hbVC6SnzbhoVgwAAAQI"]
[Sat Jul 18 23:43:03.407631 2026] [security2:error] [pid 943918:tid 944124] [client 98.82.181.200:0] ModSecurity: Warning. Matched phrase "ADmantX" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "curlsnpearlsss.com"] [uri "/index.php"] [unique_id "alxj5h70hbVC6SnzbhoVWgAAANA"]
[Sat Jul 18 23:43:03.456850 2026] [security2:error] [pid 943918:tid 944068] [client 98.82.181.200:10318] ModSecurity: Warning. Matched phrase "ADmantX" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "curlsnpearlsss.com"] [uri "/"] [unique_id "alxj5h70hbVC6SnzbhoVWAAAAJg"]
[Sat Jul 18 23:43:03.477288 2026] [security2:error] [pid 943918:tid 943959] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/kk.php"] [unique_id "alxj5x70hbVC6SnzbhoVlgAA1yc"]
[Sat Jul 18 23:43:03.477430 2026] [security2:error] [pid 943918:tid 944131] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/kk.php"] [unique_id "alxj5x70hbVC6SnzbhoVlgAA1yc"]
[Sat Jul 18 23:43:03.512137 2026] [security2:error] [pid 943918:tid 944152] [client 103.160.26.178:51506] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxj5x70hbVC6SnzbhoVkwAAAOw"]
[Sat Jul 18 23:43:03.512235 2026] [security2:error] [pid 943918:tid 944152] [client 103.160.26.178:51506] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxj5x70hbVC6SnzbhoVkwAAAOw"]
[Sat Jul 18 23:43:03.560258 2026] [security2:error] [pid 943918:tid 944126] [client 45.133.7.63:30229] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/wp-conflg.php"] [unique_id "alxj5x70hbVC6SnzbhoVmgAAANI"]
[Sat Jul 18 23:43:03.680633 2026] [security2:error] [pid 943918:tid 943962] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/bless3.php"] [unique_id "alxj5x70hbVC6SnzbhoVngAAkSo"]
[Sat Jul 18 23:43:03.680822 2026] [security2:error] [pid 943918:tid 944061] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/bless3.php"] [unique_id "alxj5x70hbVC6SnzbhoVngAAkSo"]
[Sat Jul 18 23:43:03.899293 2026] [security2:error] [pid 943918:tid 943966] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/456.php"] [unique_id "alxj5x70hbVC6SnzbhoVpAAA-i4"]
[Sat Jul 18 23:43:03.899531 2026] [security2:error] [pid 943918:tid 944166] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/456.php"] [unique_id "alxj5x70hbVC6SnzbhoVpAAA-i4"]
[Sat Jul 18 23:43:03.947329 2026] [security2:error] [pid 938041:tid 938191] [client 173.239.196.166:48005] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/install.php"] [unique_id "alxj5yNrzsYMDd5sB102qQAAABM"]
[Sat Jul 18 23:43:04.153672 2026] [security2:error] [pid 943918:tid 943971] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/z.php"] [unique_id "alxj6B70hbVC6SnzbhoVsgAA7TM"]
[Sat Jul 18 23:43:04.153875 2026] [security2:error] [pid 943918:tid 944153] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/z.php"] [unique_id "alxj6B70hbVC6SnzbhoVsgAA7TM"]
[Sat Jul 18 23:43:04.243120 2026] [security2:error] [pid 943918:tid 944110] [client 45.133.7.56:60605] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 56.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/includes/about.php"] [unique_id "alxj6B70hbVC6SnzbhoVtAAAAMI"]
[Sat Jul 18 23:43:04.474878 2026] [security2:error] [pid 943918:tid 943979] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/Sanskrit.php"] [unique_id "alxj6B70hbVC6SnzbhoVxQAAtTs"]
[Sat Jul 18 23:43:04.475065 2026] [security2:error] [pid 943918:tid 944097] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/Sanskrit.php"] [unique_id "alxj6B70hbVC6SnzbhoVxQAAtTs"]
[Sat Jul 18 23:43:04.594814 2026] [security2:error] [pid 943918:tid 943982] [remote 154.61.75.100:35614] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory-com.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxj6B70hbVC6SnzbhoVywAAqT4"]
[Sat Jul 18 23:43:04.678372 2026] [security2:error] [pid 943918:tid 943985] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/naxc.php"] [unique_id "alxj6B70hbVC6SnzbhoVzwAAw0E"]
[Sat Jul 18 23:43:04.678565 2026] [security2:error] [pid 943918:tid 944111] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/naxc.php"] [unique_id "alxj6B70hbVC6SnzbhoVzwAAw0E"]
[Sat Jul 18 23:43:04.762651 2026] [security2:error] [pid 943918:tid 944072] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/by.php"] [unique_id "alxj6B70hbVC6SnzbhoV0QAAAJw"]
[Sat Jul 18 23:43:04.762788 2026] [security2:error] [pid 943918:tid 944072] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/by.php"] [unique_id "alxj6B70hbVC6SnzbhoV0QAAAJw"]
[Sat Jul 18 23:43:04.778320 2026] [security2:error] [pid 943918:tid 944123] [client 173.239.196.160:57673] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "alxj6B70hbVC6SnzbhoV0gAAAM8"]
[Sat Jul 18 23:43:04.869455 2026] [security2:error] [pid 943918:tid 943988] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/asasx.php"] [unique_id "alxj6B70hbVC6SnzbhoV2AAA50Q"]
[Sat Jul 18 23:43:04.869670 2026] [security2:error] [pid 943918:tid 944147] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/asasx.php"] [unique_id "alxj6B70hbVC6SnzbhoV2AAA50Q"]
[Sat Jul 18 23:43:04.917712 2026] [security2:error] [pid 943918:tid 944062] [client 45.133.7.67:57611] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "alxj6B70hbVC6SnzbhoV3AAAAJI"]
[Sat Jul 18 23:43:04.986384 2026] [security2:error] [pid 943918:tid 943991] [remote 154.61.75.100:35614] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nzfoodstory-com.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxj6B70hbVC6SnzbhoV4AAA9Ec"], referer: https://nzfoodstory-com.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:43:05.420988 2026] [security2:error] [pid 943918:tid 944061] [client 223.228.182.224:53131] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxj6R70hbVC6SnzbhoV8wAAAJE"]
[Sat Jul 18 23:43:05.421125 2026] [security2:error] [pid 943918:tid 944061] [client 223.228.182.224:53131] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxj6R70hbVC6SnzbhoV8wAAAJE"]
[Sat Jul 18 23:43:05.481386 2026] [security2:error] [pid 943918:tid 944000] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/lc.php"] [unique_id "alxj6R70hbVC6SnzbhoV9wAAwVA"]
[Sat Jul 18 23:43:05.481595 2026] [security2:error] [pid 943918:tid 944109] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/lc.php"] [unique_id "alxj6R70hbVC6SnzbhoV9wAAwVA"]
[Sat Jul 18 23:43:05.593724 2026] [security2:error] [pid 943918:tid 944163] [client 45.133.7.61:21525] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/images/images/about.php"] [unique_id "alxj6R70hbVC6SnzbhoV_QAAAPc"]
[Sat Jul 18 23:43:05.651771 2026] [security2:error] [pid 943918:tid 944125] [client 173.239.196.162:52751] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/content.php"] [unique_id "alxj6R70hbVC6SnzbhoWAQAAANE"]
[Sat Jul 18 23:43:05.677343 2026] [security2:error] [pid 943918:tid 943999] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/mo.php"] [unique_id "alxj6R70hbVC6SnzbhoWAgAAqU8"]
[Sat Jul 18 23:43:05.677572 2026] [security2:error] [pid 943918:tid 944085] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/mo.php"] [unique_id "alxj6R70hbVC6SnzbhoWAgAAqU8"]
[Sat Jul 18 23:43:05.880734 2026] [security2:error] [pid 943918:tid 944008] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/nij.php"] [unique_id "alxj6R70hbVC6SnzbhoWDgAA41g"]
[Sat Jul 18 23:43:05.880948 2026] [security2:error] [pid 943918:tid 944143] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/nij.php"] [unique_id "alxj6R70hbVC6SnzbhoWDgAA41g"]
[Sat Jul 18 23:43:06.191920 2026] [security2:error] [pid 943918:tid 944014] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/gfile.php"] [unique_id "alxj6h70hbVC6SnzbhoWGgAA-l4"]
[Sat Jul 18 23:43:06.192157 2026] [security2:error] [pid 943918:tid 944166] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/gfile.php"] [unique_id "alxj6h70hbVC6SnzbhoWGgAA-l4"]
[Sat Jul 18 23:43:06.192946 2026] [security2:error] [pid 943918:tid 944076] [client 14.224.227.113:59367] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxj6h70hbVC6SnzbhoWGQAAAKA"]
[Sat Jul 18 23:43:06.272831 2026] [security2:error] [pid 943918:tid 944089] [client 45.133.7.59:58761] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 59.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/images/class.php"] [unique_id "alxj6h70hbVC6SnzbhoWHwAAAK0"]
[Sat Jul 18 23:43:06.301328 2026] [security2:error] [pid 943918:tid 944075] [client 14.162.195.29:55573] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.marscafe.com"] [uri "/forum/index.php"] [unique_id "alxj6h70hbVC6SnzbhoWHgAAAJ8"]
[Sat Jul 18 23:43:06.382128 2026] [security2:error] [pid 943918:tid 944016] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/xpas2.php"] [unique_id "alxj6h70hbVC6SnzbhoWJQAA6mA"]
[Sat Jul 18 23:43:06.382337 2026] [security2:error] [pid 943918:tid 944150] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/xpas2.php"] [unique_id "alxj6h70hbVC6SnzbhoWJQAA6mA"]
[Sat Jul 18 23:43:06.549173 2026] [security2:error] [pid 938041:tid 938263] [client 173.239.196.161:53869] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/twentytwentyfour/icascreenshots.php"] [unique_id "alxj6iNrzsYMDd5sB1020AAAAFs"]
[Sat Jul 18 23:43:06.573066 2026] [security2:error] [pid 943918:tid 944023] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/asd67.php"] [unique_id "alxj6h70hbVC6SnzbhoWLgAAi2c"]
[Sat Jul 18 23:43:06.573232 2026] [security2:error] [pid 943918:tid 944055] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/asd67.php"] [unique_id "alxj6h70hbVC6SnzbhoWLgAAi2c"]
[Sat Jul 18 23:43:06.764266 2026] [security2:error] [pid 943918:tid 944026] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/alam.php"] [unique_id "alxj6h70hbVC6SnzbhoWMwAAuGo"]
[Sat Jul 18 23:43:06.764459 2026] [security2:error] [pid 943918:tid 944100] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/alam.php"] [unique_id "alxj6h70hbVC6SnzbhoWMwAAuGo"]
[Sat Jul 18 23:43:06.896896 2026] [security2:error] [pid 943918:tid 944027] [remote 103.57.220.209:60436] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.220.57.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxj6h70hbVC6SnzbhoWNwAA8ms"]
[Sat Jul 18 23:43:06.946125 2026] [security2:error] [pid 943918:tid 944106] [client 163.61.1.17:57632] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxj6h70hbVC6SnzbhoWOQAAAL4"]
[Sat Jul 18 23:43:06.946233 2026] [security2:error] [pid 943918:tid 944106] [client 163.61.1.17:57632] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxj6h70hbVC6SnzbhoWOQAAAL4"]
[Sat Jul 18 23:43:06.955492 2026] [security2:error] [pid 943918:tid 944021] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/700.php"] [unique_id "alxj6h70hbVC6SnzbhoWOgAA9WU"]
[Sat Jul 18 23:43:06.955674 2026] [security2:error] [pid 943918:tid 944161] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/700.php"] [unique_id "alxj6h70hbVC6SnzbhoWOgAA9WU"]
[Sat Jul 18 23:43:06.956871 2026] [security2:error] [pid 943918:tid 944051] [client 45.133.7.66:30497] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 66.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/autoload_classmap.php"] [unique_id "alxj6h70hbVC6SnzbhoWOwAAAIc"]
[Sat Jul 18 23:43:07.224489 2026] [security2:error] [pid 938041:tid 938187] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/FAQ.php"] [unique_id "alxj6yNrzsYMDd5sB1026gAAAA8"]
[Sat Jul 18 23:43:07.224588 2026] [security2:error] [pid 938041:tid 938187] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/FAQ.php"] [unique_id "alxj6yNrzsYMDd5sB1026gAAAA8"]
[Sat Jul 18 23:43:07.373014 2026] [security2:error] [pid 943918:tid 944036] [remote 103.57.220.209:60436] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.220.57.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxj6x70hbVC6SnzbhoWRgAAsHQ"], referer: https://mezzacraft.com/wp-login.php
[Sat Jul 18 23:43:07.391296 2026] [security2:error] [pid 943918:tid 944080] [client 34.91.36.231:24576] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "webmail.metodoshanti.com"] [uri "/"] [unique_id "alxj6x70hbVC6SnzbhoWRwAAAKQ"]
[Sat Jul 18 23:43:07.391382 2026] [security2:error] [pid 943918:tid 944080] [client 34.91.36.231:24576] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "webmail.metodoshanti.com"] [uri "/"] [unique_id "alxj6x70hbVC6SnzbhoWRwAAAKQ"]
[Sat Jul 18 23:43:07.401957 2026] [core:error] [pid 943918:tid 944037] [remote 34.122.13.75:4096] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:43:07.401977 2026] [core:error] [pid 943918:tid 944037] [remote 34.122.13.75:4096] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:43:07.438560 2026] [security2:error] [pid 943918:tid 944111] [client 173.239.196.162:33365] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/upgrade/bypass.php"] [unique_id "alxj6x70hbVC6SnzbhoWSgAAAMM"]
[Sat Jul 18 23:43:07.440485 2026] [core:error] [pid 943918:tid 944030] [remote 34.58.52.50:22528] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:43:07.440509 2026] [core:error] [pid 943918:tid 944030] [remote 34.58.52.50:22528] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:43:07.642423 2026] [security2:error] [pid 943918:tid 944160] [client 45.133.7.76:31013] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 76.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/web.php"] [unique_id "alxj6x70hbVC6SnzbhoWagAAAPQ"]
[Sat Jul 18 23:43:07.656092 2026] [security2:error] [pid 943918:tid 944045] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/fifi.php"] [unique_id "alxj6x70hbVC6SnzbhoWawAA3X0"]
[Sat Jul 18 23:43:07.656313 2026] [security2:error] [pid 943918:tid 944137] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/fifi.php"] [unique_id "alxj6x70hbVC6SnzbhoWawAA3X0"]
[Sat Jul 18 23:43:07.923933 2026] [security2:error] [pid 943918:tid 943924] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/wp-signup.php"] [unique_id "alxj6x70hbVC6SnzbhoWdAAArwQ"]
[Sat Jul 18 23:43:07.924101 2026] [security2:error] [pid 943918:tid 944091] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/wp-signup.php"] [unique_id "alxj6x70hbVC6SnzbhoWdAAArwQ"]
[Sat Jul 18 23:43:08.120719 2026] [security2:error] [pid 943918:tid 943952] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/gold.php"] [unique_id "alxj7B70hbVC6SnzbhoWlAAAhyA"]
[Sat Jul 18 23:43:08.120893 2026] [security2:error] [pid 943918:tid 944051] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/gold.php"] [unique_id "alxj7B70hbVC6SnzbhoWlAAAhyA"]
[Sat Jul 18 23:43:08.304662 2026] [security2:error] [pid 943918:tid 944168] [client 173.239.196.161:39637] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/rk2.php"] [unique_id "alxj7B70hbVC6SnzbhoWnAAAAPw"]
[Sat Jul 18 23:43:08.316301 2026] [security2:error] [pid 938041:tid 938193] [client 45.133.7.70:37375] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/ocean/about.php"] [unique_id "alxj7CNrzsYMDd5sB103BAAAABU"]
[Sat Jul 18 23:43:08.319083 2026] [security2:error] [pid 943918:tid 943945] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/blurbs8.php"] [unique_id "alxj7B70hbVC6SnzbhoWngAA9xk"]
[Sat Jul 18 23:43:08.319279 2026] [security2:error] [pid 943918:tid 944163] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/blurbs8.php"] [unique_id "alxj7B70hbVC6SnzbhoWngAA9xk"]
[Sat Jul 18 23:43:08.624721 2026] [security2:error] [pid 943918:tid 943960] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/sid.php"] [unique_id "alxj7B70hbVC6SnzbhoWpgAAuig"]
[Sat Jul 18 23:43:08.624882 2026] [security2:error] [pid 943918:tid 944102] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/sid.php"] [unique_id "alxj7B70hbVC6SnzbhoWpgAAuig"]
[Sat Jul 18 23:43:08.994082 2026] [security2:error] [pid 943918:tid 944151] [client 45.133.7.60:43257] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 60.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/images/index.php"] [unique_id "alxj7B70hbVC6SnzbhoWrwAAAOs"]
[Sat Jul 18 23:43:09.112617 2026] [security2:error] [pid 943918:tid 943971] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/tinyfilemanager.php"] [unique_id "alxj7R70hbVC6SnzbhoWtAAA_jM"]
[Sat Jul 18 23:43:09.112798 2026] [security2:error] [pid 943918:tid 944170] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/tinyfilemanager.php"] [unique_id "alxj7R70hbVC6SnzbhoWtAAA_jM"]
[Sat Jul 18 23:43:09.164069 2026] [security2:error] [pid 943918:tid 944136] [client 173.239.196.165:35723] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "655"] [id "900155"] [msg "WP Brute UA block"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/ocean/alam.php"] [unique_id "alxj7R70hbVC6SnzbhoWtwAAANw"]
[Sat Jul 18 23:43:09.314619 2026] [security2:error] [pid 943918:tid 943973] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/unity.php"] [unique_id "alxj7R70hbVC6SnzbhoWwgAA9TU"]
[Sat Jul 18 23:43:09.314792 2026] [security2:error] [pid 943918:tid 944161] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/unity.php"] [unique_id "alxj7R70hbVC6SnzbhoWwgAA9TU"]
[Sat Jul 18 23:43:09.354637 2026] [security2:error] [pid 938041:tid 938203] [client 74.208.214.194:47046] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxj7SNrzsYMDd5sB103HAAAAB8"]
[Sat Jul 18 23:43:09.426181 2026] [core:error] [pid 943918:tid 943975] [remote 23.251.146.115:2416] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:43:09.426207 2026] [core:error] [pid 943918:tid 943975] [remote 23.251.146.115:2416] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:43:09.517147 2026] [security2:error] [pid 943918:tid 943983] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/cf.php"] [unique_id "alxj7R70hbVC6SnzbhoW0gAA4j8"]
[Sat Jul 18 23:43:09.517312 2026] [security2:error] [pid 943918:tid 944142] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/cf.php"] [unique_id "alxj7R70hbVC6SnzbhoW0gAA4j8"]
[Sat Jul 18 23:43:09.666386 2026] [security2:error] [pid 943918:tid 944166] [client 45.133.7.95:47889] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/bypass.php"] [unique_id "alxj7R70hbVC6SnzbhoW2gAAAPo"]
[Sat Jul 18 23:43:09.725193 2026] [security2:error] [pid 943918:tid 943988] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/get.php"] [unique_id "alxj7R70hbVC6SnzbhoW4AAA3UQ"]
[Sat Jul 18 23:43:09.725326 2026] [security2:error] [pid 943918:tid 944137] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/get.php"] [unique_id "alxj7R70hbVC6SnzbhoW4AAA3UQ"]
[Sat Jul 18 23:43:09.763367 2026] [core:error] [pid 943918:tid 943987] [remote 23.251.146.115:37248] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:43:09.763390 2026] [core:error] [pid 943918:tid 943987] [remote 23.251.146.115:37248] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:43:09.829445 2026] [security2:error] [pid 938041:tid 938286] [client 138.252.89.100:57730] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxj7SNrzsYMDd5sB103JQAAAHI"]
[Sat Jul 18 23:43:09.829540 2026] [security2:error] [pid 938041:tid 938286] [client 138.252.89.100:57730] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxj7SNrzsYMDd5sB103JQAAAHI"]
[Sat Jul 18 23:43:09.878557 2026] [core:error] [pid 943918:tid 943956] [remote 34.44.142.114:50656] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:43:09.878578 2026] [core:error] [pid 943918:tid 943956] [remote 34.44.142.114:50656] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:43:09.930367 2026] [security2:error] [pid 938041:tid 938244] [client 3.79.134.69:19070] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "mtlegnews.gov"] [uri "/index.php"] [unique_id "alxj7SNrzsYMDd5sB103IAAAAEg"], referer: https://mtlegnews.gov/
[Sat Jul 18 23:43:09.933793 2026] [security2:error] [pid 943918:tid 943954] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/v3.php"] [unique_id "alxj7R70hbVC6SnzbhoW8QAAiyI"]
[Sat Jul 18 23:43:09.933966 2026] [security2:error] [pid 943918:tid 944055] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/v3.php"] [unique_id "alxj7R70hbVC6SnzbhoW8QAAiyI"]
[Sat Jul 18 23:43:10.023180 2026] [security2:error] [pid 943918:tid 944153] [client 173.239.196.162:48999] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/b.php"] [unique_id "alxj7h70hbVC6SnzbhoW9AAAAO0"]
[Sat Jul 18 23:43:10.064577 2026] [security2:error] [pid 943918:tid 944084] [client 180.252.198.240:58705] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxj7h70hbVC6SnzbhoW9gAAAKg"]
[Sat Jul 18 23:43:10.065270 2026] [security2:error] [pid 943918:tid 944084] [client 180.252.198.240:58705] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxj7h70hbVC6SnzbhoW9gAAAKg"]
[Sat Jul 18 23:43:10.150023 2026] [security2:error] [pid 943918:tid 943997] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/.well-known/ws.php"] [unique_id "alxj7h70hbVC6SnzbhoW-AAA9k0"]
[Sat Jul 18 23:43:10.150223 2026] [security2:error] [pid 943918:tid 944162] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/.well-known/ws.php"] [unique_id "alxj7h70hbVC6SnzbhoW-AAA9k0"]
[Sat Jul 18 23:43:10.342212 2026] [security2:error] [pid 943918:tid 944002] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/wteed.php"] [unique_id "alxj7h70hbVC6SnzbhoXAwABBFI"]
[Sat Jul 18 23:43:10.342404 2026] [security2:error] [pid 943918:tid 944176] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/wteed.php"] [unique_id "alxj7h70hbVC6SnzbhoXAwABBFI"]
[Sat Jul 18 23:43:10.344014 2026] [security2:error] [pid 938041:tid 938282] [client 45.133.7.100:23533] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "alxj7iNrzsYMDd5sB103NgAAAG4"]
[Sat Jul 18 23:43:10.519409 2026] [security2:error] [pid 943918:tid 944053] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/coffexium.php"] [unique_id "alxj7h70hbVC6SnzbhoXCwAAAIk"]
[Sat Jul 18 23:43:10.519512 2026] [security2:error] [pid 943918:tid 944053] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/coffexium.php"] [unique_id "alxj7h70hbVC6SnzbhoXCwAAAIk"]
[Sat Jul 18 23:43:10.547777 2026] [security2:error] [pid 943918:tid 944005] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/nc4.php"] [unique_id "alxj7h70hbVC6SnzbhoXDgAA0FU"]
[Sat Jul 18 23:43:10.547995 2026] [security2:error] [pid 943918:tid 944124] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/nc4.php"] [unique_id "alxj7h70hbVC6SnzbhoXDgAA0FU"]
[Sat Jul 18 23:43:10.628380 2026] [security2:error] [pid 943918:tid 944086] [client 14.178.254.163:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "taskidsvirginia.com"] [uri "/index.php"] [unique_id "alxj7h70hbVC6SnzbhoW9QAAAKo"]
[Sat Jul 18 23:43:10.757169 2026] [security2:error] [pid 943918:tid 944010] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/ntgn.php"] [unique_id "alxj7h70hbVC6SnzbhoXFgAA4Fo"]
[Sat Jul 18 23:43:10.757350 2026] [security2:error] [pid 943918:tid 944140] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/ntgn.php"] [unique_id "alxj7h70hbVC6SnzbhoXFgAA4Fo"]
[Sat Jul 18 23:43:10.915110 2026] [security2:error] [pid 943918:tid 944062] [client 173.239.196.161:30441] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/certificates/past.php"] [unique_id "alxj7h70hbVC6SnzbhoXHAAAAJI"]
[Sat Jul 18 23:43:10.944591 2026] [security2:error] [pid 943918:tid 944171] [client 139.167.225.146:61574] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxj7h70hbVC6SnzbhoXHQAAAP8"]
[Sat Jul 18 23:43:10.944698 2026] [security2:error] [pid 943918:tid 944171] [client 139.167.225.146:61574] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxj7h70hbVC6SnzbhoXHQAAAP8"]
[Sat Jul 18 23:43:11.018173 2026] [security2:error] [pid 943918:tid 944127] [client 45.133.7.104:62513] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/midnight/install.php"] [unique_id "alxj7x70hbVC6SnzbhoXHwAAANM"]
[Sat Jul 18 23:43:11.041624 2026] [security2:error] [pid 943918:tid 944015] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/ioxi-o.php"] [unique_id "alxj7x70hbVC6SnzbhoXIAAArV8"]
[Sat Jul 18 23:43:11.041823 2026] [security2:error] [pid 943918:tid 944089] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/ioxi-o.php"] [unique_id "alxj7x70hbVC6SnzbhoXIAAArV8"]
[Sat Jul 18 23:43:11.231780 2026] [security2:error] [pid 943918:tid 944020] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/ws.php"] [unique_id "alxj7x70hbVC6SnzbhoXKQAAqGQ"]
[Sat Jul 18 23:43:11.231920 2026] [security2:error] [pid 943918:tid 944084] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/ws.php"] [unique_id "alxj7x70hbVC6SnzbhoXKQAAqGQ"]
[Sat Jul 18 23:43:11.239196 2026] [security2:error] [pid 943918:tid 944116] [client 63.179.105.113:19622] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.105.179.63.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxj7x70hbVC6SnzbhoXKwAAAMg"]
[Sat Jul 18 23:43:11.239456 2026] [security2:error] [pid 943918:tid 944116] [client 63.179.105.113:19622] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxj7x70hbVC6SnzbhoXKwAAAMg"]
[Sat Jul 18 23:43:11.420133 2026] [security2:error] [pid 943918:tid 944160] [client 57.141.18.76:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxj7x70hbVC6SnzbhoXKgAAAPQ"]
[Sat Jul 18 23:43:11.422616 2026] [security2:error] [pid 943918:tid 944018] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/7h.php"] [unique_id "alxj7x70hbVC6SnzbhoXOgABBGI"]
[Sat Jul 18 23:43:11.422848 2026] [security2:error] [pid 943918:tid 944176] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/7h.php"] [unique_id "alxj7x70hbVC6SnzbhoXOgABBGI"]
[Sat Jul 18 23:43:11.614293 2026] [security2:error] [pid 943918:tid 944027] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/gg.php"] [unique_id "alxj7x70hbVC6SnzbhoXPwAArms"]
[Sat Jul 18 23:43:11.614443 2026] [security2:error] [pid 943918:tid 944090] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/gg.php"] [unique_id "alxj7x70hbVC6SnzbhoXPwAArms"]
[Sat Jul 18 23:43:11.695027 2026] [security2:error] [pid 943918:tid 944081] [client 45.133.7.92:29329] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-trackback.php"] [unique_id "alxj7x70hbVC6SnzbhoXRwAAAKU"]
[Sat Jul 18 23:43:11.818794 2026] [security2:error] [pid 943918:tid 944074] [client 173.239.196.162:27455] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/css/as.php"] [unique_id "alxj7x70hbVC6SnzbhoXWAAAAJ4"]
[Sat Jul 18 23:43:11.982405 2026] [security2:error] [pid 943918:tid 944038] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/co.php"] [unique_id "alxj7x70hbVC6SnzbhoXYAAA03Y"]
[Sat Jul 18 23:43:11.982623 2026] [security2:error] [pid 943918:tid 944127] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/co.php"] [unique_id "alxj7x70hbVC6SnzbhoXYAAA03Y"]
[Sat Jul 18 23:43:12.187898 2026] [security2:error] [pid 943918:tid 944032] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/mjq.php"] [unique_id "alxj8B70hbVC6SnzbhoXYwAAuHA"]
[Sat Jul 18 23:43:12.188104 2026] [security2:error] [pid 943918:tid 944100] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/mjq.php"] [unique_id "alxj8B70hbVC6SnzbhoXYwAAuHA"]
[Sat Jul 18 23:43:12.367906 2026] [security2:error] [pid 943918:tid 944057] [client 45.133.7.69:65343] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 69.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "alxj8B70hbVC6SnzbhoXbQAAAI0"]
[Sat Jul 18 23:43:12.599376 2026] [security2:error] [pid 943918:tid 943921] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/rdfe.php"] [unique_id "alxj8B70hbVC6SnzbhoXeQAAmwE"]
[Sat Jul 18 23:43:12.599550 2026] [security2:error] [pid 943918:tid 944071] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/rdfe.php"] [unique_id "alxj8B70hbVC6SnzbhoXeQAAmwE"]
[Sat Jul 18 23:43:12.690484 2026] [security2:error] [pid 938041:tid 938181] [client 173.239.196.162:20349] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/pwnd/sst.php"] [unique_id "alxj8CNrzsYMDd5sB103YQAAAAk"]
[Sat Jul 18 23:43:12.893551 2026] [security2:error] [pid 943918:tid 943935] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/xojryvch.php"] [unique_id "alxj8B70hbVC6SnzbhoXpAAAyQ8"]
[Sat Jul 18 23:43:12.893735 2026] [security2:error] [pid 943918:tid 944117] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/xojryvch.php"] [unique_id "alxj8B70hbVC6SnzbhoXpAAAyQ8"]
[Sat Jul 18 23:43:13.046454 2026] [security2:error] [pid 943918:tid 944131] [client 45.133.7.54:28185] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/radio.php"] [unique_id "alxj8R70hbVC6SnzbhoXswAAANc"]
[Sat Jul 18 23:43:13.089208 2026] [security2:error] [pid 943918:tid 943933] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/reyna.php"] [unique_id "alxj8R70hbVC6SnzbhoXtwAA9A0"]
[Sat Jul 18 23:43:13.089395 2026] [security2:error] [pid 943918:tid 944160] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/reyna.php"] [unique_id "alxj8R70hbVC6SnzbhoXtwAA9A0"]
[Sat Jul 18 23:43:13.112779 2026] [security2:error] [pid 943918:tid 944058] [client 103.160.26.178:51942] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxj8R70hbVC6SnzbhoXuwAAAI4"]
[Sat Jul 18 23:43:13.112853 2026] [security2:error] [pid 943918:tid 944058] [client 103.160.26.178:51942] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxj8R70hbVC6SnzbhoXuwAAAI4"]
[Sat Jul 18 23:43:13.174142 2026] [security2:error] [pid 943918:tid 944105] [client 106.222.249.209:7328] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxj8R70hbVC6SnzbhoXwQAAAL0"]
[Sat Jul 18 23:43:13.174235 2026] [security2:error] [pid 943918:tid 944105] [client 106.222.249.209:7328] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxj8R70hbVC6SnzbhoXwQAAAL0"]
[Sat Jul 18 23:43:13.544069 2026] [security2:error] [pid 943918:tid 944074] [client 173.239.196.161:49465] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/edit-tags.php"] [unique_id "alxj8R70hbVC6SnzbhoX2AAAAJ4"]
[Sat Jul 18 23:43:13.550203 2026] [security2:error] [pid 943918:tid 943936] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/css/index.php"] [unique_id "alxj8R70hbVC6SnzbhoX2QAA6RA"]
[Sat Jul 18 23:43:13.550397 2026] [security2:error] [pid 943918:tid 944149] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/css/index.php"] [unique_id "alxj8R70hbVC6SnzbhoX2QAA6RA"]
[Sat Jul 18 23:43:13.721393 2026] [security2:error] [pid 938041:tid 938245] [client 45.133.7.64:32291] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 64.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/mah.php"] [unique_id "alxj8SNrzsYMDd5sB103eAAAAEk"]
[Sat Jul 18 23:43:13.736430 2026] [security2:error] [pid 938041:tid 938249] [client 36.83.95.75:64100] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxj8SNrzsYMDd5sB103eQAAAE0"]
[Sat Jul 18 23:43:13.736559 2026] [security2:error] [pid 938041:tid 938249] [client 36.83.95.75:64100] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxj8SNrzsYMDd5sB103eQAAAE0"]
[Sat Jul 18 23:43:13.740371 2026] [security2:error] [pid 943918:tid 943947] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/unzip.php"] [unique_id "alxj8R70hbVC6SnzbhoX3AAA0hs"]
[Sat Jul 18 23:43:13.740633 2026] [security2:error] [pid 943918:tid 944126] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/unzip.php"] [unique_id "alxj8R70hbVC6SnzbhoX3AAA0hs"]
[Sat Jul 18 23:43:13.930225 2026] [security2:error] [pid 943918:tid 943952] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/cool.php"] [unique_id "alxj8R70hbVC6SnzbhoX4wABAyA"]
[Sat Jul 18 23:43:13.930373 2026] [security2:error] [pid 943918:tid 944175] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/cool.php"] [unique_id "alxj8R70hbVC6SnzbhoX4wABAyA"]
[Sat Jul 18 23:43:14.123374 2026] [security2:error] [pid 943918:tid 943945] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/.well-known/xin1.php"] [unique_id "alxj8h70hbVC6SnzbhoX5gAAixk"]
[Sat Jul 18 23:43:14.123603 2026] [security2:error] [pid 943918:tid 944055] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/.well-known/xin1.php"] [unique_id "alxj8h70hbVC6SnzbhoX5gAAixk"]
[Sat Jul 18 23:43:14.252054 2026] [security2:error] [pid 938041:tid 938197] [client 84.233.195.160:55320] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxj8iNrzsYMDd5sB103iwAAABk"], referer: http://readartny.com:80
[Sat Jul 18 23:43:14.314768 2026] [security2:error] [pid 943918:tid 943960] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/axx.php"] [unique_id "alxj8h70hbVC6SnzbhoX7QAA7Cg"]
[Sat Jul 18 23:43:14.314996 2026] [security2:error] [pid 943918:tid 944152] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/axx.php"] [unique_id "alxj8h70hbVC6SnzbhoX7QAA7Cg"]
[Sat Jul 18 23:43:14.393651 2026] [security2:error] [pid 943918:tid 944063] [client 45.133.7.69:56705] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 69.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/dummyyummy/wp-signup.php"] [unique_id "alxj8h70hbVC6SnzbhoX7wAAAJM"]
[Sat Jul 18 23:43:14.421043 2026] [security2:error] [pid 943918:tid 944110] [client 173.239.196.167:52669] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wsax.php"] [unique_id "alxj8h70hbVC6SnzbhoX9AAAAMI"]
[Sat Jul 18 23:43:14.522099 2026] [security2:error] [pid 943918:tid 943966] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/w3llstore.php"] [unique_id "alxj8h70hbVC6SnzbhoX_gAAhy4"]
[Sat Jul 18 23:43:14.522243 2026] [security2:error] [pid 943918:tid 944051] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/w3llstore.php"] [unique_id "alxj8h70hbVC6SnzbhoX_gAAhy4"]
[Sat Jul 18 23:43:14.795189 2026] [security2:error] [pid 938041:tid 938240] [client 57.141.18.73:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxj8iNrzsYMDd5sB103kgAAAEQ"]
[Sat Jul 18 23:43:14.836744 2026] [security2:error] [pid 943918:tid 943958] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/aua.php"] [unique_id "alxj8h70hbVC6SnzbhoYDAAAzyY"]
[Sat Jul 18 23:43:14.836935 2026] [security2:error] [pid 943918:tid 944123] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/aua.php"] [unique_id "alxj8h70hbVC6SnzbhoYDAAAzyY"]
[Sat Jul 18 23:43:15.041800 2026] [security2:error] [pid 943918:tid 943975] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/c4.php"] [unique_id "alxj8x70hbVC6SnzbhoYGAAA6Dc"]
[Sat Jul 18 23:43:15.042069 2026] [security2:error] [pid 943918:tid 944148] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/c4.php"] [unique_id "alxj8x70hbVC6SnzbhoYGAAA6Dc"]
[Sat Jul 18 23:43:15.133702 2026] [security2:error] [pid 943918:tid 944126] [client 45.133.7.100:56593] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "alxj8x70hbVC6SnzbhoYHQAAANI"]
[Sat Jul 18 23:43:15.236694 2026] [security2:error] [pid 943918:tid 943981] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/bu5.php"] [unique_id "alxj8x70hbVC6SnzbhoYKAAAzj0"]
[Sat Jul 18 23:43:15.236829 2026] [security2:error] [pid 943918:tid 944122] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/bu5.php"] [unique_id "alxj8x70hbVC6SnzbhoYKAAAzj0"]
[Sat Jul 18 23:43:15.292251 2026] [security2:error] [pid 943918:tid 944113] [client 173.239.196.166:45149] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/bless.php%20"] [unique_id "alxj8x70hbVC6SnzbhoYKQAAAMU"]
[Sat Jul 18 23:43:15.565288 2026] [security2:error] [pid 943918:tid 944118] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/red.php"] [unique_id "alxj8x70hbVC6SnzbhoYNgAAAMo"]
[Sat Jul 18 23:43:15.565398 2026] [security2:error] [pid 943918:tid 944118] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/red.php"] [unique_id "alxj8x70hbVC6SnzbhoYNgAAAMo"]
[Sat Jul 18 23:43:15.604650 2026] [security2:error] [pid 943918:tid 943954] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/lhh2.php"] [unique_id "alxj8x70hbVC6SnzbhoYOgAA2CI"]
[Sat Jul 18 23:43:15.604815 2026] [security2:error] [pid 943918:tid 944132] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/lhh2.php"] [unique_id "alxj8x70hbVC6SnzbhoYOgAA2CI"]
[Sat Jul 18 23:43:15.652567 2026] [security2:error] [pid 943918:tid 944116] [client 84.233.195.152:55486] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxj8x70hbVC6SnzbhoYOwAAAMg"], referer: http://readartny.com:80
[Sat Jul 18 23:43:15.799195 2026] [security2:error] [pid 943918:tid 944000] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/an.php"] [unique_id "alxj8x70hbVC6SnzbhoYQwAAhlA"]
[Sat Jul 18 23:43:15.799396 2026] [security2:error] [pid 943918:tid 944050] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/an.php"] [unique_id "alxj8x70hbVC6SnzbhoYQwAAhlA"]
[Sat Jul 18 23:43:15.815972 2026] [security2:error] [pid 943918:tid 944120] [client 45.133.7.69:25301] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 69.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-conflg.php"] [unique_id "alxj8x70hbVC6SnzbhoYRAAAAMw"]
[Sat Jul 18 23:43:16.146346 2026] [security2:error] [pid 938041:tid 938219] [client 223.228.182.224:51361] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxj9CNrzsYMDd5sB103tAAAAC8"]
[Sat Jul 18 23:43:16.153434 2026] [security2:error] [pid 943918:tid 944054] [client 173.239.196.164:41829] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/uploads/system_cache.php"] [unique_id "alxj9B70hbVC6SnzbhoYUAAAAIo"]
[Sat Jul 18 23:43:16.156309 2026] [security2:error] [pid 938041:tid 938219] [client 223.228.182.224:51361] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxj9CNrzsYMDd5sB103tAAAAC8"]
[Sat Jul 18 23:43:16.345852 2026] [security2:error] [pid 943918:tid 944067] [client 84.233.195.155:51580] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxj9B70hbVC6SnzbhoYWAAAAJc"], referer: http://readartny.com:80
[Sat Jul 18 23:43:16.413152 2026] [security2:error] [pid 943918:tid 944009] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/aw.php"] [unique_id "alxj9B70hbVC6SnzbhoYWwAAklk"]
[Sat Jul 18 23:43:16.413367 2026] [security2:error] [pid 943918:tid 944062] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/aw.php"] [unique_id "alxj9B70hbVC6SnzbhoYWwAAklk"]
[Sat Jul 18 23:43:16.509554 2026] [security2:error] [pid 943918:tid 944114] [client 45.133.7.74:54311] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-setup.php"] [unique_id "alxj9B70hbVC6SnzbhoYZgAAAMY"]
[Sat Jul 18 23:43:16.576373 2026] [security2:error] [pid 943918:tid 944147] [client 67.227.1.12:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxj9B70hbVC6SnzbhoYVgAAAOc"], referer: https://omenanadotcom.files.wordpress.com/sitemap.xml
[Sat Jul 18 23:43:16.719425 2026] [security2:error] [pid 943918:tid 944012] [remote 199.189.225.167:60917] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.225.189.199.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxj9B70hbVC6SnzbhoYcgABA1w"]
[Sat Jul 18 23:43:16.915665 2026] [security2:error] [pid 943918:tid 944017] [remote 103.90.234.13:54516] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.234.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.verdunestate.com"] [uri "/wp-login.php"] [unique_id "alxj9B70hbVC6SnzbhoYeAAAy2E"]
[Sat Jul 18 23:43:16.940541 2026] [security2:error] [pid 943918:tid 944020] [remote 199.189.225.167:60917] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.225.189.199.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxj9B70hbVC6SnzbhoYegAAhmQ"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:43:16.955528 2026] [security2:error] [pid 943918:tid 944022] [remote 20.153.140.50:56756] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxj9B70hbVC6SnzbhoYfgAA7GY"]
[Sat Jul 18 23:43:17.022216 2026] [security2:error] [pid 943918:tid 944157] [client 173.239.196.166:59659] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/files.php"] [unique_id "alxj9R70hbVC6SnzbhoYhgAAAPE"]
[Sat Jul 18 23:43:17.189303 2026] [security2:error] [pid 938041:tid 938193] [client 45.133.7.88:52999] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 88.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/ms-themes.php"] [unique_id "alxj9SNrzsYMDd5sB103xgAAABU"]
[Sat Jul 18 23:43:17.391734 2026] [security2:error] [pid 943918:tid 944035] [remote 20.153.140.50:56756] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxj9R70hbVC6SnzbhoYkgAA33M"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:43:17.452076 2026] [security2:error] [pid 943918:tid 944037] [remote 103.90.234.13:54516] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.234.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.verdunestate.com"] [uri "/wp-login.php"] [unique_id "alxj9R70hbVC6SnzbhoYlAAA5XU"], referer: https://mail.verdunestate.com/wp-login.php
[Sat Jul 18 23:43:17.728249 2026] [security2:error] [pid 943918:tid 944138] [client 163.61.1.17:58116] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxj9R70hbVC6SnzbhoYpAAAAN4"]
[Sat Jul 18 23:43:17.728367 2026] [security2:error] [pid 943918:tid 944138] [client 163.61.1.17:58116] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxj9R70hbVC6SnzbhoYpAAAAN4"]
[Sat Jul 18 23:43:17.864319 2026] [security2:error] [pid 943918:tid 944087] [client 173.239.196.165:57375] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/tflow/admin-footer.php"] [unique_id "alxj9R70hbVC6SnzbhoYpwAAAKs"]
[Sat Jul 18 23:43:17.871645 2026] [security2:error] [pid 938041:tid 938203] [client 45.133.7.59:27591] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 59.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/assets/about.php"] [unique_id "alxj9SNrzsYMDd5sB1031gAAAB8"]
[Sat Jul 18 23:43:18.131265 2026] [security2:error] [pid 943918:tid 944045] [remote 31.42.184.154:45298] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxj9h70hbVC6SnzbhoYswAA7H0"]
[Sat Jul 18 23:43:18.153615 2026] [security2:error] [pid 943918:tid 944072] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.awellpacedlife.com"] [uri "/index.cgi"] [unique_id "alxj9h70hbVC6SnzbhoYsAAAAJw"]
[Sat Jul 18 23:43:18.326455 2026] [security2:error] [pid 943918:tid 944147] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/wp-admin/css/colors/coffee/wp-adochan.php"] [unique_id "alxj9h70hbVC6SnzbhoYwgAAAOc"]
[Sat Jul 18 23:43:18.326543 2026] [security2:error] [pid 943918:tid 944147] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/wp-admin/css/colors/coffee/wp-adochan.php"] [unique_id "alxj9h70hbVC6SnzbhoYwgAAAOc"]
[Sat Jul 18 23:43:18.356958 2026] [security2:error] [pid 943918:tid 943924] [remote 31.42.184.154:45298] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxj9h70hbVC6SnzbhoYxgAArwQ"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:43:18.558733 2026] [security2:error] [pid 938041:tid 938276] [client 45.133.7.94:31999] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 94.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/style.php"] [unique_id "alxj9iNrzsYMDd5sB1033QAAAGg"]
[Sat Jul 18 23:43:18.595845 2026] [security2:error] [pid 943918:tid 943930] [remote 62.210.185.4:36828] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 4.185.210.62.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.talknutritionwithlesley.com"] [uri "/wp-login.php"] [unique_id "alxj9h70hbVC6SnzbhoYzwAA1go"]
[Sat Jul 18 23:43:18.665741 2026] [lsapi:warn] [pid 943918:tid 944033] [remote 149.56.207.25:0] [host ali-alghanim.com] Backend log: PHP Warning:  getimagesize(https://aasgroup.online/wp-content/uploads/2021/09/1291810.jpg): Failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden\r\n in /home2/aasgroup/public_html/alialghanim/wp-content/plugins/litespeed-cache/src/media.cls.php on line 860\n
[Sat Jul 18 23:43:18.670386 2026] [security2:error] [pid 943918:tid 943935] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/as.php"] [unique_id "alxj9h70hbVC6SnzbhoY0wAA2w8"]
[Sat Jul 18 23:43:18.670551 2026] [security2:error] [pid 943918:tid 944135] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/as.php"] [unique_id "alxj9h70hbVC6SnzbhoY0wAA2w8"]
[Sat Jul 18 23:43:18.723206 2026] [security2:error] [pid 938041:tid 938185] [client 173.239.196.162:55145] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "alxj9iNrzsYMDd5sB1034gAAAA0"]
[Sat Jul 18 23:43:18.789781 2026] [security2:error] [pid 943918:tid 943940] [remote 62.210.185.4:36828] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 4.185.210.62.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.talknutritionwithlesley.com"] [uri "/wp-login.php"] [unique_id "alxj9h70hbVC6SnzbhoY1wAA6hQ"], referer: https://mail.talknutritionwithlesley.com/wp-login.php
[Sat Jul 18 23:43:19.091463 2026] [security2:error] [pid 943918:tid 943946] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/new.php"] [unique_id "alxj9x70hbVC6SnzbhoY5gAA_xo"]
[Sat Jul 18 23:43:19.091621 2026] [security2:error] [pid 943918:tid 944171] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/new.php"] [unique_id "alxj9x70hbVC6SnzbhoY5gAA_xo"]
[Sat Jul 18 23:43:19.259068 2026] [security2:error] [pid 943918:tid 944049] [client 45.133.7.63:33895] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/infi.php"] [unique_id "alxj9x70hbVC6SnzbhoY7gAAAIU"]
[Sat Jul 18 23:43:19.292029 2026] [security2:error] [pid 943918:tid 943941] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/Okxob.php"] [unique_id "alxj9x70hbVC6SnzbhoY7wAA6RU"]
[Sat Jul 18 23:43:19.292220 2026] [security2:error] [pid 943918:tid 944149] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/Okxob.php"] [unique_id "alxj9x70hbVC6SnzbhoY7wAA6RU"]
[Sat Jul 18 23:43:19.468466 2026] [security2:error] [pid 938041:tid 938279] [client 152.42.185.27:64884] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.185.42.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "spencersadventures.com"] [uri "/xmlrpc.php"] [unique_id "alxj9yNrzsYMDd5sB1038AAAAGs"]
[Sat Jul 18 23:43:19.587508 2026] [security2:error] [pid 943918:tid 943944] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/ahax.php"] [unique_id "alxj9x70hbVC6SnzbhoY9gAAkhg"]
[Sat Jul 18 23:43:19.587704 2026] [security2:error] [pid 943918:tid 944062] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/ahax.php"] [unique_id "alxj9x70hbVC6SnzbhoY9gAAkhg"]
[Sat Jul 18 23:43:19.624400 2026] [security2:error] [pid 943918:tid 944169] [client 173.239.196.161:38441] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/about.php"] [unique_id "alxj9x70hbVC6SnzbhoY-QAAAP0"]
[Sat Jul 18 23:43:19.785582 2026] [security2:error] [pid 943918:tid 943955] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/cache.php"] [unique_id "alxj9x70hbVC6SnzbhoZBwAA2CM"]
[Sat Jul 18 23:43:19.785762 2026] [security2:error] [pid 943918:tid 944132] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/cache.php"] [unique_id "alxj9x70hbVC6SnzbhoZBwAA2CM"]
[Sat Jul 18 23:43:19.858205 2026] [ssl:error] [pid 943918:tid 944084] [client 3.233.59.216:5170] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname webmail.allergyantidotes.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:43:19.946885 2026] [security2:error] [pid 943918:tid 944134] [client 45.133.7.71:25035] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 71.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/maint/index.php"] [unique_id "alxj9x70hbVC6SnzbhoZDwAAANo"]
[Sat Jul 18 23:43:19.975178 2026] [security2:error] [pid 943918:tid 943959] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/ffile.php"] [unique_id "alxj9x70hbVC6SnzbhoZEQAA3ic"]
[Sat Jul 18 23:43:19.975354 2026] [security2:error] [pid 943918:tid 944138] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/ffile.php"] [unique_id "alxj9x70hbVC6SnzbhoZEQAA3ic"]
[Sat Jul 18 23:43:20.249038 2026] [security2:error] [pid 943918:tid 943966] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/nxac.php"] [unique_id "alxj-B70hbVC6SnzbhoZGgAAsy4"]
[Sat Jul 18 23:43:20.249236 2026] [security2:error] [pid 943918:tid 944095] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/nxac.php"] [unique_id "alxj-B70hbVC6SnzbhoZGgAAsy4"]
[Sat Jul 18 23:43:20.495319 2026] [security2:error] [pid 943918:tid 943970] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/thh.php"] [unique_id "alxj-B70hbVC6SnzbhoZIQAA8TI"]
[Sat Jul 18 23:43:20.495476 2026] [security2:error] [pid 943918:tid 944157] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/thh.php"] [unique_id "alxj-B70hbVC6SnzbhoZIQAA8TI"]
[Sat Jul 18 23:43:20.502497 2026] [security2:error] [pid 943918:tid 944167] [client 173.239.196.161:21545] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "alxj-B70hbVC6SnzbhoZIgAAAPs"]
[Sat Jul 18 23:43:20.519533 2026] [security2:error] [pid 938041:tid 938055] [remote 116.202.224.230:44092] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.224.202.116.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.rvprintfactory.com"] [uri "/wp-login.php"] [unique_id "alxj-CNrzsYMDd5sB104CAAAJQw"]
[Sat Jul 18 23:43:20.635035 2026] [security2:error] [pid 938041:tid 938298] [client 45.133.7.89:63581] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 89.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/x.php"] [unique_id "alxj-CNrzsYMDd5sB104EQAAAH4"]
[Sat Jul 18 23:43:20.696234 2026] [security2:error] [pid 943918:tid 943977] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/wp-includes/buy.php"] [unique_id "alxj-B70hbVC6SnzbhoZKgAA6Tk"]
[Sat Jul 18 23:43:20.696392 2026] [security2:error] [pid 943918:tid 944149] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/wp-includes/buy.php"] [unique_id "alxj-B70hbVC6SnzbhoZKgAA6Tk"]
[Sat Jul 18 23:43:20.708018 2026] [security2:error] [pid 938041:tid 938108] [remote 116.202.224.230:44092] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.224.202.116.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.rvprintfactory.com"] [uri "/wp-login.php"] [unique_id "alxj-CNrzsYMDd5sB104FgAAfUE"], referer: https://www.rvprintfactory.com/wp-login.php
[Sat Jul 18 23:43:21.076219 2026] [security2:error] [pid 938041:tid 938299] [client 180.252.198.240:59188] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxj-SNrzsYMDd5sB104KQAAAH8"]
[Sat Jul 18 23:43:21.076857 2026] [security2:error] [pid 938041:tid 938299] [client 180.252.198.240:59188] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxj-SNrzsYMDd5sB104KQAAAH8"]
[Sat Jul 18 23:43:21.104940 2026] [security2:error] [pid 938041:tid 938239] [client 186.5.207.1:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "taskidsvirginia.com"] [uri "/index.php"] [unique_id "alxj-CNrzsYMDd5sB104FwAAAEM"]
[Sat Jul 18 23:43:21.290441 2026] [security2:error] [pid 943918:tid 943974] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/lo.php"] [unique_id "alxj-R70hbVC6SnzbhoZQAAApTY"]
[Sat Jul 18 23:43:21.290597 2026] [security2:error] [pid 943918:tid 944081] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/lo.php"] [unique_id "alxj-R70hbVC6SnzbhoZQAAApTY"]
[Sat Jul 18 23:43:21.315126 2026] [security2:error] [pid 943918:tid 944114] [client 45.133.7.64:57571] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 64.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/IXR/index.php"] [unique_id "alxj-R70hbVC6SnzbhoZQgAAAMY"]
[Sat Jul 18 23:43:21.362798 2026] [security2:error] [pid 943918:tid 944130] [client 173.239.196.165:46521] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/pwnd/cloud.php"] [unique_id "alxj-R70hbVC6SnzbhoZRQAAANY"]
[Sat Jul 18 23:43:21.366808 2026] [security2:error] [pid 943918:tid 943987] [remote 41.186.86.12:26661] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "elitetax-mi.com"] [uri "/wp-login.php"] [unique_id "alxj-R70hbVC6SnzbhoZRwAAikM"]
[Sat Jul 18 23:43:21.470548 2026] [security2:error] [pid 943918:tid 944140] [client 139.167.225.146:62208] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxj-R70hbVC6SnzbhoZSgAAAOA"]
[Sat Jul 18 23:43:21.470677 2026] [security2:error] [pid 943918:tid 944140] [client 139.167.225.146:62208] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxj-R70hbVC6SnzbhoZSgAAAOA"]
[Sat Jul 18 23:43:21.480496 2026] [security2:error] [pid 943918:tid 943956] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/fb.php"] [unique_id "alxj-R70hbVC6SnzbhoZSwAA8iQ"]
[Sat Jul 18 23:43:21.480660 2026] [security2:error] [pid 943918:tid 944158] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/fb.php"] [unique_id "alxj-R70hbVC6SnzbhoZSwAA8iQ"]
[Sat Jul 18 23:43:21.681173 2026] [security2:error] [pid 943918:tid 943996] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/wp-update.php"] [unique_id "alxj-R70hbVC6SnzbhoZUwAAwUw"]
[Sat Jul 18 23:43:21.681329 2026] [security2:error] [pid 943918:tid 944109] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/wp-update.php"] [unique_id "alxj-R70hbVC6SnzbhoZUwAAwUw"]
[Sat Jul 18 23:43:21.685569 2026] [security2:error] [pid 943918:tid 944133] [client 138.252.89.100:58268] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxj-R70hbVC6SnzbhoZVAAAANk"]
[Sat Jul 18 23:43:21.685645 2026] [security2:error] [pid 943918:tid 944133] [client 138.252.89.100:58268] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxj-R70hbVC6SnzbhoZVAAAANk"]
[Sat Jul 18 23:43:21.779437 2026] [security2:error] [pid 938041:tid 938281] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.awellpacedlife.com"] [uri "/index.cgi"] [unique_id "alxj-SNrzsYMDd5sB104OwAAAG0"]
[Sat Jul 18 23:43:21.866868 2026] [security2:error] [pid 943918:tid 943994] [remote 41.186.86.12:26661] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "elitetax-mi.com"] [uri "/wp-login.php"] [unique_id "alxj-R70hbVC6SnzbhoZWQAAmEo"], referer: https://elitetax-mi.com/wp-login.php
[Sat Jul 18 23:43:21.880485 2026] [security2:error] [pid 943918:tid 943993] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/slo.php"] [unique_id "alxj-R70hbVC6SnzbhoZWwAA8Ek"]
[Sat Jul 18 23:43:21.880650 2026] [security2:error] [pid 943918:tid 944156] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/slo.php"] [unique_id "alxj-R70hbVC6SnzbhoZWwAA8Ek"]
[Sat Jul 18 23:43:21.982502 2026] [security2:error] [pid 938041:tid 938226] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/footer.php"] [unique_id "alxj-SNrzsYMDd5sB104QgAAADY"]
[Sat Jul 18 23:43:21.982598 2026] [security2:error] [pid 938041:tid 938226] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/footer.php"] [unique_id "alxj-SNrzsYMDd5sB104QgAAADY"]
[Sat Jul 18 23:43:21.995070 2026] [security2:error] [pid 943918:tid 944143] [client 45.133.7.76:43233] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 76.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/css/index.php"] [unique_id "alxj-R70hbVC6SnzbhoZYgAAAOM"]
[Sat Jul 18 23:43:22.080613 2026] [security2:error] [pid 943918:tid 944003] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/dropdown.php"] [unique_id "alxj-h70hbVC6SnzbhoZZgAA7FM"]
[Sat Jul 18 23:43:22.080824 2026] [security2:error] [pid 943918:tid 944152] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/dropdown.php"] [unique_id "alxj-h70hbVC6SnzbhoZZgAA7FM"]
[Sat Jul 18 23:43:22.253349 2026] [security2:error] [pid 938041:tid 938270] [client 173.239.196.162:62869] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "alxj-iNrzsYMDd5sB104TwAAAGI"]
[Sat Jul 18 23:43:22.461431 2026] [security2:error] [pid 943918:tid 944009] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/pp.php"] [unique_id "alxj-h70hbVC6SnzbhoZbgAA4lk"]
[Sat Jul 18 23:43:22.461663 2026] [security2:error] [pid 943918:tid 944142] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/pp.php"] [unique_id "alxj-h70hbVC6SnzbhoZbgAA4lk"]
[Sat Jul 18 23:43:22.652012 2026] [security2:error] [pid 943918:tid 944010] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/wp-content/themes/pridmag/db.php"] [unique_id "alxj-h70hbVC6SnzbhoZeAAA0lo"]
[Sat Jul 18 23:43:22.652155 2026] [security2:error] [pid 943918:tid 944126] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/wp-content/themes/pridmag/db.php"] [unique_id "alxj-h70hbVC6SnzbhoZeAAA0lo"]
[Sat Jul 18 23:43:22.676634 2026] [security2:error] [pid 938041:tid 938257] [client 45.133.7.76:60801] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 76.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/images/index22.php"] [unique_id "alxj-iNrzsYMDd5sB104WgAAAFU"]
[Sat Jul 18 23:43:22.850814 2026] [security2:error] [pid 943918:tid 943985] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/bqcheck.php"] [unique_id "alxj-h70hbVC6SnzbhoZfQAAmUE"]
[Sat Jul 18 23:43:22.850980 2026] [security2:error] [pid 943918:tid 944069] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/bqcheck.php"] [unique_id "alxj-h70hbVC6SnzbhoZfQAAmUE"]
[Sat Jul 18 23:43:23.012405 2026] [security2:error] [pid 938041:tid 938160] [remote 31.42.184.154:55148] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxj-yNrzsYMDd5sB104ZgAAXXU"]
[Sat Jul 18 23:43:23.058215 2026] [security2:error] [pid 943918:tid 943984] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/13k.php"] [unique_id "alxj-x70hbVC6SnzbhoZiAAAzUA"]
[Sat Jul 18 23:43:23.058429 2026] [security2:error] [pid 943918:tid 944121] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/13k.php"] [unique_id "alxj-x70hbVC6SnzbhoZiAAAzUA"]
[Sat Jul 18 23:43:23.093767 2026] [security2:error] [pid 938041:tid 938206] [client 52.167.144.146:64710] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "samdothan.org"] [uri "/index.php"] [unique_id "alxj-SNrzsYMDd5sB104OAAAIhA"]
[Sat Jul 18 23:43:23.118737 2026] [security2:error] [pid 943918:tid 944137] [client 173.239.196.164:29233] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/ubh/adminfus.php"] [unique_id "alxj-x70hbVC6SnzbhoZjgAAAN0"]
[Sat Jul 18 23:43:23.118737 2026] [security2:error] [pid 943918:tid 944104] [client 20.226.60.151:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 151.60.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "texasolartrade.com"] [uri "/.well-known/about.php"] [unique_id "alxj-x70hbVC6SnzbhoZjQAAALw"]
[Sat Jul 18 23:43:23.118860 2026] [security2:error] [pid 943918:tid 944104] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "texasolartrade.com"] [uri "/.well-known/about.php"] [unique_id "alxj-x70hbVC6SnzbhoZjQAAALw"]
[Sat Jul 18 23:43:23.233897 2026] [security2:error] [pid 938041:tid 938054] [remote 31.42.184.154:55148] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxj-yNrzsYMDd5sB104agAAVgs"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:43:23.356834 2026] [security2:error] [pid 938041:tid 938243] [client 45.133.7.54:30681] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-user.php"] [unique_id "alxj-yNrzsYMDd5sB104bwAAAEc"]
[Sat Jul 18 23:43:23.461656 2026] [security2:error] [pid 943918:tid 943940] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/ar.php"] [unique_id "alxj-x70hbVC6SnzbhoZxgAAlhQ"]
[Sat Jul 18 23:43:23.461856 2026] [security2:error] [pid 943918:tid 944066] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/ar.php"] [unique_id "alxj-x70hbVC6SnzbhoZxgAAlhQ"]
[Sat Jul 18 23:43:23.601794 2026] [security2:error] [pid 938041:tid 938219] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.awellpacedlife.com"] [uri "/index.cgi"] [unique_id "alxj-yNrzsYMDd5sB104fwAAAC8"]
[Sat Jul 18 23:43:23.650928 2026] [security2:error] [pid 943918:tid 943943] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/bv3.php"] [unique_id "alxj-x70hbVC6SnzbhoZ3gAA6Rc"]
[Sat Jul 18 23:43:23.651099 2026] [security2:error] [pid 943918:tid 944149] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/bv3.php"] [unique_id "alxj-x70hbVC6SnzbhoZ3gAA6Rc"]
[Sat Jul 18 23:43:23.724442 2026] [security2:error] [pid 943918:tid 944087] [client 103.160.26.178:52370] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxj-x70hbVC6SnzbhoZ5AAAAKs"]
[Sat Jul 18 23:43:23.724552 2026] [security2:error] [pid 943918:tid 944087] [client 103.160.26.178:52370] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxj-x70hbVC6SnzbhoZ5AAAAKs"]
[Sat Jul 18 23:43:23.794405 2026] [security2:error] [pid 938041:tid 938209] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/wp-content/index.php"] [unique_id "alxj-yNrzsYMDd5sB104gAAAACU"]
[Sat Jul 18 23:43:23.794545 2026] [security2:error] [pid 938041:tid 938209] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/wp-content/index.php"] [unique_id "alxj-yNrzsYMDd5sB104gAAAACU"]
[Sat Jul 18 23:43:23.843243 2026] [security2:error] [pid 943918:tid 943947] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/racs3.php"] [unique_id "alxj-x70hbVC6SnzbhoZ5gABAxs"]
[Sat Jul 18 23:43:23.843416 2026] [security2:error] [pid 943918:tid 944175] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/racs3.php"] [unique_id "alxj-x70hbVC6SnzbhoZ5gABAxs"]
[Sat Jul 18 23:43:23.871413 2026] [security2:error] [pid 938041:tid 938231] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxj-yNrzsYMDd5sB104fQAAADs"]
[Sat Jul 18 23:43:23.872802 2026] [security2:error] [pid 943918:tid 944106] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxj-x70hbVC6SnzbhoZwAAAAL4"]
[Sat Jul 18 23:43:23.873259 2026] [security2:error] [pid 943918:tid 944103] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxj-x70hbVC6SnzbhoZwwAAALs"]
[Sat Jul 18 23:43:23.887149 2026] [security2:error] [pid 943918:tid 944155] [client 106.222.249.209:26378] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxj-x70hbVC6SnzbhoZ7gAAAO8"]
[Sat Jul 18 23:43:23.887340 2026] [security2:error] [pid 943918:tid 944155] [client 106.222.249.209:26378] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxj-x70hbVC6SnzbhoZ7gAAAO8"]
[Sat Jul 18 23:43:23.893885 2026] [security2:error] [pid 943918:tid 943960] [remote 199.189.225.167:53725] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.225.189.199.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "scarlettshirt.com"] [uri "/wp-login.php"] [unique_id "alxj-x70hbVC6SnzbhoZ7QAA9Sg"]
[Sat Jul 18 23:43:24.009530 2026] [security2:error] [pid 943918:tid 944131] [client 173.239.196.162:23513] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/pki-validation/webdb.php"] [unique_id "alxj_B70hbVC6SnzbhoZ9gAAANc"]
[Sat Jul 18 23:43:24.043711 2026] [security2:error] [pid 938041:tid 938270] [client 45.133.7.58:24701] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/pomo/about.php"] [unique_id "alxj_CNrzsYMDd5sB104hgAAAGI"]
[Sat Jul 18 23:43:24.117969 2026] [security2:error] [pid 943918:tid 943932] [remote 199.189.225.167:53725] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.225.189.199.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "scarlettshirt.com"] [uri "/wp-login.php"] [unique_id "alxj_B70hbVC6SnzbhoZ-AAAuQw"], referer: https://scarlettshirt.com/wp-login.php
[Sat Jul 18 23:43:24.138322 2026] [security2:error] [pid 943918:tid 943948] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/content.php"] [unique_id "alxj_B70hbVC6SnzbhoZ-wAAyBw"]
[Sat Jul 18 23:43:24.138465 2026] [security2:error] [pid 943918:tid 944116] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/content.php"] [unique_id "alxj_B70hbVC6SnzbhoZ-wAAyBw"]
[Sat Jul 18 23:43:24.157491 2026] [security2:error] [pid 943918:tid 944067] [client 36.83.95.75:64780] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxj_B70hbVC6SnzbhoZ_QAAAJc"]
[Sat Jul 18 23:43:24.157602 2026] [security2:error] [pid 943918:tid 944067] [client 36.83.95.75:64780] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxj_B70hbVC6SnzbhoZ_QAAAJc"]
[Sat Jul 18 23:43:24.182714 2026] [security2:error] [pid 943918:tid 944153] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxj-x70hbVC6SnzbhoZvgAAAO0"]
[Sat Jul 18 23:43:24.184221 2026] [security2:error] [pid 943918:tid 944095] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxj-x70hbVC6SnzbhoZwgAAALM"]
[Sat Jul 18 23:43:24.371995 2026] [security2:error] [pid 943918:tid 943974] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/lufix.php"] [unique_id "alxj_B70hbVC6SnzbhoaGAABAjY"]
[Sat Jul 18 23:43:24.372194 2026] [security2:error] [pid 943918:tid 944174] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/lufix.php"] [unique_id "alxj_B70hbVC6SnzbhoaGAABAjY"]
[Sat Jul 18 23:43:24.506039 2026] [security2:error] [pid 943918:tid 944094] [client 103.112.5.7:38174] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "50.116.64.31"] [uri "/"] [unique_id "alxj_B70hbVC6SnzbhoaIgAAALI"]
[Sat Jul 18 23:43:24.561227 2026] [security2:error] [pid 943918:tid 943954] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/bluejackets.php"] [unique_id "alxj_B70hbVC6SnzbhoaKwAA0iI"]
[Sat Jul 18 23:43:24.561382 2026] [security2:error] [pid 943918:tid 944126] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/bluejackets.php"] [unique_id "alxj_B70hbVC6SnzbhoaKwAA0iI"]
[Sat Jul 18 23:43:24.730230 2026] [security2:error] [pid 938041:tid 938198] [client 45.133.7.94:40313] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 94.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/pomo/index.php"] [unique_id "alxj_CNrzsYMDd5sB104mwAAABo"]
[Sat Jul 18 23:43:24.732281 2026] [security2:error] [pid 943918:tid 944141] [client 103.112.5.7:39912] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "50.116.64.31"] [uri "/"] [unique_id "alxj_B70hbVC6SnzbhoaNAAAAOE"]
[Sat Jul 18 23:43:24.840572 2026] [security2:error] [pid 943918:tid 943994] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/zt2.php"] [unique_id "alxj_B70hbVC6SnzbhoaOAAA9Eo"]
[Sat Jul 18 23:43:24.840716 2026] [security2:error] [pid 943918:tid 944160] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/zt2.php"] [unique_id "alxj_B70hbVC6SnzbhoaOAAA9Eo"]
[Sat Jul 18 23:43:24.965118 2026] [security2:error] [pid 943918:tid 944122] [client 173.239.196.167:64671] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "alxj_B70hbVC6SnzbhoaPAAAAM4"]
[Sat Jul 18 23:43:25.045084 2026] [security2:error] [pid 943918:tid 944002] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/f35.php"] [unique_id "alxj_R70hbVC6SnzbhoaRAAA01I"]
[Sat Jul 18 23:43:25.045256 2026] [security2:error] [pid 943918:tid 944127] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/f35.php"] [unique_id "alxj_R70hbVC6SnzbhoaRAAA01I"]
[Sat Jul 18 23:43:25.258351 2026] [security2:error] [pid 943918:tid 944011] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/wp-mn.php"] [unique_id "alxj_R70hbVC6SnzbhoaUQAA3ls"]
[Sat Jul 18 23:43:25.258523 2026] [security2:error] [pid 943918:tid 944138] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/wp-mn.php"] [unique_id "alxj_R70hbVC6SnzbhoaUQAA3ls"]
[Sat Jul 18 23:43:25.293852 2026] [security2:error] [pid 938041:tid 938193] [client 43.173.114.86:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxj_SNrzsYMDd5sB104qgAAFV0"], referer: https://www.aleishapenny.ca/listing/page/1313?paged=1313&view=grid
[Sat Jul 18 23:43:25.352417 2026] [ssl:error] [pid 938041:tid 938189] [client 104.48.69.105:58238] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname blog.danwolfe.us provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:43:25.411139 2026] [security2:error] [pid 943918:tid 944093] [client 45.133.7.83:53033] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/config.php"] [unique_id "alxj_R70hbVC6SnzbhoaWgAAALE"]
[Sat Jul 18 23:43:25.448166 2026] [security2:error] [pid 943918:tid 944001] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/aa8.php"] [unique_id "alxj_R70hbVC6SnzbhoaXQAAm1E"]
[Sat Jul 18 23:43:25.448357 2026] [security2:error] [pid 943918:tid 944071] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/aa8.php"] [unique_id "alxj_R70hbVC6SnzbhoaXQAAm1E"]
[Sat Jul 18 23:43:25.516970 2026] [security2:error] [pid 943918:tid 944051] [client 34.21.157.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "icemarc.org"] [uri "/index.php"] [unique_id "alxj_B70hbVC6SnzbhoaIAAAAIc"]
[Sat Jul 18 23:43:25.782439 2026] [security2:error] [pid 943918:tid 944015] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/xl.php"] [unique_id "alxj_R70hbVC6SnzbhoabAAA3F8"]
[Sat Jul 18 23:43:25.782648 2026] [security2:error] [pid 943918:tid 944136] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/xl.php"] [unique_id "alxj_R70hbVC6SnzbhoabAAA3F8"]
[Sat Jul 18 23:43:25.838278 2026] [security2:error] [pid 938041:tid 938263] [client 173.239.196.163:63369] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/js/admin.php"] [unique_id "alxj_SNrzsYMDd5sB104ugAAAFs"]
[Sat Jul 18 23:43:26.094198 2026] [security2:error] [pid 943918:tid 944140] [client 45.133.7.85:60985] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 85.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/special.php"] [unique_id "alxj_h70hbVC6SnzbhoaeAAAAOA"]
[Sat Jul 18 23:43:26.112697 2026] [security2:error] [pid 943918:tid 944019] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/r4f_1.php"] [unique_id "alxj_h70hbVC6SnzbhoaeQAA22M"]
[Sat Jul 18 23:43:26.112866 2026] [security2:error] [pid 943918:tid 944135] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/r4f_1.php"] [unique_id "alxj_h70hbVC6SnzbhoaeQAA22M"]
[Sat Jul 18 23:43:26.236936 2026] [security2:error] [pid 938041:tid 938270] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/zoro.php"] [unique_id "alxj_iNrzsYMDd5sB104ygAAAGI"]
[Sat Jul 18 23:43:26.237010 2026] [security2:error] [pid 938041:tid 938270] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/zoro.php"] [unique_id "alxj_iNrzsYMDd5sB104ygAAAGI"]
[Sat Jul 18 23:43:26.276370 2026] [security2:error] [pid 938041:tid 938063] [remote 34.21.157.37:45990] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 37.157.21.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "icemarc.org"] [uri "/wp-login.php"] [unique_id "alxj_iNrzsYMDd5sB104yQAAPxQ"], referer: https://icemarc.org/wp-admin/
[Sat Jul 18 23:43:26.276416 2026] [security2:error] [pid 938041:tid 938043] [remote 34.21.157.37:45990] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 37.157.21.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "icemarc.org"] [uri "/wp-login.php"] [unique_id "alxj_iNrzsYMDd5sB104yAAAPwA"], referer: https://icemarc.org/wp-admin/
[Sat Jul 18 23:43:26.448334 2026] [security2:error] [pid 943918:tid 944039] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/sarang.php"] [unique_id "alxj_h70hbVC6SnzbhoahAAAyHc"]
[Sat Jul 18 23:43:26.448454 2026] [security2:error] [pid 943918:tid 944116] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/sarang.php"] [unique_id "alxj_h70hbVC6SnzbhoahAAAyHc"]
[Sat Jul 18 23:43:26.566239 2026] [security2:error] [pid 943918:tid 944028] [remote 98.156.100.191:46682] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 191.100.156.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxj_h70hbVC6SnzbhoaiAAAn2w"]
[Sat Jul 18 23:43:26.650765 2026] [security2:error] [pid 943918:tid 944030] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/6.php"] [unique_id "alxj_h70hbVC6SnzbhoaiwAA424"]
[Sat Jul 18 23:43:26.650930 2026] [security2:error] [pid 943918:tid 944143] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/6.php"] [unique_id "alxj_h70hbVC6SnzbhoaiwAA424"]
[Sat Jul 18 23:43:26.666202 2026] [security2:error] [pid 943918:tid 944066] [client 173.239.196.164:41129] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/js/widgets/item.php"] [unique_id "alxj_h70hbVC6SnzbhoajAAAAJY"]
[Sat Jul 18 23:43:26.773240 2026] [security2:error] [pid 943918:tid 944063] [client 45.133.7.82:64929] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/assets/script.js.php"] [unique_id "alxj_h70hbVC6SnzbhoajwAAAJM"]
[Sat Jul 18 23:43:26.842066 2026] [security2:error] [pid 943918:tid 944044] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/xo.php"] [unique_id "alxj_h70hbVC6SnzbhoalgABAnw"]
[Sat Jul 18 23:43:26.842216 2026] [security2:error] [pid 943918:tid 944174] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/xo.php"] [unique_id "alxj_h70hbVC6SnzbhoalgABAnw"]
[Sat Jul 18 23:43:26.916386 2026] [security2:error] [pid 943918:tid 944101] [client 223.228.182.224:28387] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxj_h70hbVC6SnzbhoamQAAALk"]
[Sat Jul 18 23:43:26.921452 2026] [security2:error] [pid 943918:tid 944101] [client 223.228.182.224:28387] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxj_h70hbVC6SnzbhoamQAAALk"]
[Sat Jul 18 23:43:27.046622 2026] [security2:error] [pid 943918:tid 943924] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/ggs.php"] [unique_id "alxj_x70hbVC6SnzbhoanwAAsgQ"]
[Sat Jul 18 23:43:27.046810 2026] [security2:error] [pid 943918:tid 944094] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/ggs.php"] [unique_id "alxj_x70hbVC6SnzbhoanwAAsgQ"]
[Sat Jul 18 23:43:27.318994 2026] [security2:error] [pid 943918:tid 943929] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/wsr2.php"] [unique_id "alxj_x70hbVC6SnzbhoaqQAA7gk"]
[Sat Jul 18 23:43:27.319130 2026] [security2:error] [pid 943918:tid 944154] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/wsr2.php"] [unique_id "alxj_x70hbVC6SnzbhoaqQAA7gk"]
[Sat Jul 18 23:43:27.453526 2026] [security2:error] [pid 938041:tid 938193] [client 45.133.7.81:63095] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 81.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/twentytwentythree/patterns/index.php"] [unique_id "alxj_yNrzsYMDd5sB1047QAAABU"]
[Sat Jul 18 23:43:27.483381 2026] [security2:error] [pid 938041:tid 938247] [client 173.239.196.166:62573] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/uploads/xsec.php"] [unique_id "alxj_yNrzsYMDd5sB1047gAAAEs"]
[Sat Jul 18 23:43:27.520469 2026] [security2:error] [pid 943918:tid 944047] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/class9.php"] [unique_id "alxj_x70hbVC6SnzbhoargAA_n8"]
[Sat Jul 18 23:43:27.520663 2026] [security2:error] [pid 943918:tid 944170] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/class9.php"] [unique_id "alxj_x70hbVC6SnzbhoargAA_n8"]
[Sat Jul 18 23:43:27.889480 2026] [security2:error] [pid 943918:tid 944033] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/public/wsr2.php"] [unique_id "alxj_x70hbVC6SnzbhoaxQAAp3E"]
[Sat Jul 18 23:43:27.889688 2026] [security2:error] [pid 943918:tid 944083] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/public/wsr2.php"] [unique_id "alxj_x70hbVC6SnzbhoaxQAAp3E"]
[Sat Jul 18 23:43:27.955428 2026] [security2:error] [pid 943918:tid 944057] [client 163.61.1.17:58604] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxj_x70hbVC6SnzbhoaxwAAAI0"]
[Sat Jul 18 23:43:27.955537 2026] [security2:error] [pid 943918:tid 944057] [client 163.61.1.17:58604] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxj_x70hbVC6SnzbhoaxwAAAI0"]
[Sat Jul 18 23:43:27.963512 2026] [security2:error] [pid 943918:tid 944054] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/admin.php"] [unique_id "alxj_x70hbVC6SnzbhoayQAAAIo"]
[Sat Jul 18 23:43:27.963590 2026] [security2:error] [pid 943918:tid 944054] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/admin.php"] [unique_id "alxj_x70hbVC6SnzbhoayQAAAIo"]
[Sat Jul 18 23:43:28.085264 2026] [security2:error] [pid 943918:tid 943941] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/tcp.php"] [unique_id "alxkAB70hbVC6Snzbhoa0AAAnxU"]
[Sat Jul 18 23:43:28.085438 2026] [security2:error] [pid 943918:tid 944075] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/tcp.php"] [unique_id "alxkAB70hbVC6Snzbhoa0AAAnxU"]
[Sat Jul 18 23:43:28.152683 2026] [security2:error] [pid 943918:tid 944176] [client 45.133.7.99:21209] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/sunrise/colors_95.php"] [unique_id "alxkAB70hbVC6Snzbhoa1gAAAQQ"]
[Sat Jul 18 23:43:28.332979 2026] [security2:error] [pid 943918:tid 944172] [client 173.239.196.161:49293] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/images/Marvins.php"] [unique_id "alxkAB70hbVC6Snzbhoa4gAAAQA"]
[Sat Jul 18 23:43:28.403577 2026] [security2:error] [pid 943918:tid 943968] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/witmm.php"] [unique_id "alxkAB70hbVC6Snzbhoa5AAAhTA"]
[Sat Jul 18 23:43:28.403773 2026] [security2:error] [pid 943918:tid 944049] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/witmm.php"] [unique_id "alxkAB70hbVC6Snzbhoa5AAAhTA"]
[Sat Jul 18 23:43:28.679811 2026] [security2:error] [pid 943918:tid 943960] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/jga.php"] [unique_id "alxkAB70hbVC6Snzbhoa9QAA2yg"]
[Sat Jul 18 23:43:28.680052 2026] [security2:error] [pid 943918:tid 944135] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/jga.php"] [unique_id "alxkAB70hbVC6Snzbhoa9QAA2yg"]
[Sat Jul 18 23:43:28.735919 2026] [core:error] [pid 938041:tid 938292] [client 34.10.108.116:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:43:28.735941 2026] [core:error] [pid 938041:tid 938292] [client 34.10.108.116:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:43:28.832845 2026] [security2:error] [pid 943918:tid 944168] [client 45.133.7.72:26513] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 72.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "alxkAB70hbVC6Snzbhoa_gAAAPw"]
[Sat Jul 18 23:43:28.906370 2026] [security2:error] [pid 943918:tid 943990] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/nxx.php"] [unique_id "alxkAB70hbVC6SnzbhobAQAAuEY"]
[Sat Jul 18 23:43:28.906567 2026] [security2:error] [pid 943918:tid 944100] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/nxx.php"] [unique_id "alxkAB70hbVC6SnzbhobAQAAuEY"]
[Sat Jul 18 23:43:28.969391 2026] [security2:error] [pid 943918:tid 943959] [remote 41.76.213.235:49936] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sarahsnyder.net"] [uri "/wp-login.php"] [unique_id "alxkAB70hbVC6SnzbhobAgAAwCc"]
[Sat Jul 18 23:43:29.231906 2026] [security2:error] [pid 943918:tid 944175] [client 173.239.196.164:27309] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/pwnd-1/kurd.php"] [unique_id "alxkAR70hbVC6SnzbhobEQAAAQM"]
[Sat Jul 18 23:43:29.315363 2026] [security2:error] [pid 943918:tid 943958] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/aaaa.php"] [unique_id "alxkAR70hbVC6SnzbhobGAAAkSY"]
[Sat Jul 18 23:43:29.315538 2026] [security2:error] [pid 943918:tid 944061] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/aaaa.php"] [unique_id "alxkAR70hbVC6SnzbhobGAAAkSY"]
[Sat Jul 18 23:43:29.460068 2026] [security2:error] [pid 943918:tid 944086] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/greap.php"] [unique_id "alxkAR70hbVC6SnzbhobHwAAAKo"]
[Sat Jul 18 23:43:29.460188 2026] [security2:error] [pid 943918:tid 944086] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/greap.php"] [unique_id "alxkAR70hbVC6SnzbhobHwAAAKo"]
[Sat Jul 18 23:43:29.478611 2026] [security2:error] [pid 943918:tid 943969] [remote 41.76.213.235:49936] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sarahsnyder.net"] [uri "/wp-login.php"] [unique_id "alxkAR70hbVC6SnzbhobIAAAlTE"], referer: https://sarahsnyder.net/wp-login.php
[Sat Jul 18 23:43:29.521840 2026] [security2:error] [pid 938041:tid 938285] [client 45.133.7.94:64837] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 94.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/uploads/wp.php"] [unique_id "alxkASNrzsYMDd5sB105IQAAAHE"]
[Sat Jul 18 23:43:29.529665 2026] [security2:error] [pid 943918:tid 943963] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/2.php"] [unique_id "alxkAR70hbVC6SnzbhobIgAA-Cs"]
[Sat Jul 18 23:43:29.529869 2026] [security2:error] [pid 943918:tid 944164] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/2.php"] [unique_id "alxkAR70hbVC6SnzbhobIgAA-Cs"]
[Sat Jul 18 23:43:29.895048 2026] [security2:error] [pid 938041:tid 938207] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/177.php"] [unique_id "alxkASNrzsYMDd5sB105NAAAACM"]
[Sat Jul 18 23:43:29.895130 2026] [security2:error] [pid 938041:tid 938207] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/177.php"] [unique_id "alxkASNrzsYMDd5sB105NAAAACM"]
[Sat Jul 18 23:43:30.051525 2026] [security2:error] [pid 938041:tid 938176] [client 14.178.87.149:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "taskidsvirginia.com"] [uri "/index.php"] [unique_id "alxkACNrzsYMDd5sB105BwAAAAQ"]
[Sat Jul 18 23:43:30.062079 2026] [security2:error] [pid 943918:tid 943987] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/ss.php"] [unique_id "alxkAh70hbVC6SnzbhobNAAAikM"]
[Sat Jul 18 23:43:30.062273 2026] [security2:error] [pid 943918:tid 944054] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/ss.php"] [unique_id "alxkAh70hbVC6SnzbhobNAAAikM"]
[Sat Jul 18 23:43:30.110731 2026] [security2:error] [pid 943918:tid 944062] [client 173.239.196.163:40939] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/tflow/install.php"] [unique_id "alxkAh70hbVC6SnzbhobNgAAAJI"]
[Sat Jul 18 23:43:30.205724 2026] [security2:error] [pid 938041:tid 938209] [client 45.133.7.62:53593] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/certificates/about.php"] [unique_id "alxkAiNrzsYMDd5sB105NgAAACU"]
[Sat Jul 18 23:43:30.252495 2026] [security2:error] [pid 943918:tid 943992] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/zc.php"] [unique_id "alxkAh70hbVC6SnzbhobOQAA9Ug"]
[Sat Jul 18 23:43:30.252663 2026] [security2:error] [pid 943918:tid 944161] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/zc.php"] [unique_id "alxkAh70hbVC6SnzbhobOQAA9Ug"]
[Sat Jul 18 23:43:30.288609 2026] [ssl:error] [pid 943918:tid 944109] [client 104.48.69.105:52740] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname www.bandsir.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:43:30.289922 2026] [security2:error] [pid 943918:tid 943991] [remote 98.156.100.191:46682] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 191.100.156.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxkAh70hbVC6SnzbhobPAAA5kc"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:43:30.381327 2026] [security2:error] [pid 943918:tid 944166] [client 74.208.214.194:49914] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxkAh70hbVC6SnzbhobRQAAAPo"]
[Sat Jul 18 23:43:30.444255 2026] [security2:error] [pid 943918:tid 943994] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/dex.php"] [unique_id "alxkAh70hbVC6SnzbhobSQABAEo"]
[Sat Jul 18 23:43:30.444417 2026] [security2:error] [pid 943918:tid 944172] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/dex.php"] [unique_id "alxkAh70hbVC6SnzbhobSQABAEo"]
[Sat Jul 18 23:43:30.601764 2026] [security2:error] [pid 938041:tid 938292] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/199.php"] [unique_id "alxkAiNrzsYMDd5sB105QgAAAHg"]
[Sat Jul 18 23:43:30.601886 2026] [security2:error] [pid 938041:tid 938292] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/199.php"] [unique_id "alxkAiNrzsYMDd5sB105QgAAAHg"]
[Sat Jul 18 23:43:30.633435 2026] [security2:error] [pid 943918:tid 943986] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/sad.php"] [unique_id "alxkAh70hbVC6SnzbhobTgAAo0I"]
[Sat Jul 18 23:43:30.633669 2026] [security2:error] [pid 943918:tid 944079] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/sad.php"] [unique_id "alxkAh70hbVC6SnzbhobTgAAo0I"]
[Sat Jul 18 23:43:30.823900 2026] [security2:error] [pid 943918:tid 944006] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/wp.php"] [unique_id "alxkAh70hbVC6SnzbhobVQAAtVY"]
[Sat Jul 18 23:43:30.824102 2026] [security2:error] [pid 943918:tid 944097] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/wp.php"] [unique_id "alxkAh70hbVC6SnzbhobVQAAtVY"]
[Sat Jul 18 23:43:30.887384 2026] [security2:error] [pid 938041:tid 938272] [client 45.133.7.79:63069] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 79.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/cgi-bin/class.api.php"] [unique_id "alxkAiNrzsYMDd5sB105SQAAAGQ"]
[Sat Jul 18 23:43:30.978268 2026] [security2:error] [pid 938041:tid 938265] [client 173.239.196.163:51845] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/languages/radio.php"] [unique_id "alxkAiNrzsYMDd5sB105TAAAAF0"]
[Sat Jul 18 23:43:31.007053 2026] [security2:error] [pid 943918:tid 944110] [client 34.195.16.23:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "wathenbartlett.co.uk"] [uri "/index.php"] [unique_id "alxkAR70hbVC6SnzbhobIQAAAMI"]
[Sat Jul 18 23:43:31.108579 2026] [security2:error] [pid 943918:tid 944010] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/wp-gr.php"] [unique_id "alxkAx70hbVC6SnzbhobXQAA_1o"]
[Sat Jul 18 23:43:31.108783 2026] [security2:error] [pid 943918:tid 944171] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/wp-gr.php"] [unique_id "alxkAx70hbVC6SnzbhobXQAA_1o"]
[Sat Jul 18 23:43:31.258391 2026] [security2:error] [pid 943918:tid 944139] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/file52.php"] [unique_id "alxkAx70hbVC6SnzbhobYgAAAN8"]
[Sat Jul 18 23:43:31.258499 2026] [security2:error] [pid 943918:tid 944139] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/file52.php"] [unique_id "alxkAx70hbVC6SnzbhobYgAAAN8"]
[Sat Jul 18 23:43:31.365905 2026] [security2:error] [pid 943918:tid 944013] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/cfile.php"] [unique_id "alxkAx70hbVC6SnzbhobZgAAjV0"]
[Sat Jul 18 23:43:31.366065 2026] [security2:error] [pid 943918:tid 944057] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/cfile.php"] [unique_id "alxkAx70hbVC6SnzbhobZgAAjV0"]
[Sat Jul 18 23:43:31.567189 2026] [security2:error] [pid 943918:tid 944016] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/sder52u.php"] [unique_id "alxkAx70hbVC6SnzbhobcgAAw2A"]
[Sat Jul 18 23:43:31.567313 2026] [security2:error] [pid 943918:tid 944111] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/sder52u.php"] [unique_id "alxkAx70hbVC6SnzbhobcgAAw2A"]
[Sat Jul 18 23:43:31.575125 2026] [security2:error] [pid 943918:tid 944095] [client 45.133.7.59:43699] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 59.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/cache/index.php"] [unique_id "alxkAx70hbVC6SnzbhobdAAAALM"]
[Sat Jul 18 23:43:31.775779 2026] [security2:error] [pid 943918:tid 944022] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/asserter.php"] [unique_id "alxkAx70hbVC6SnzbhobegAA5mY"]
[Sat Jul 18 23:43:31.775941 2026] [security2:error] [pid 943918:tid 944146] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/asserter.php"] [unique_id "alxkAx70hbVC6SnzbhobegAA5mY"]
[Sat Jul 18 23:43:31.878724 2026] [security2:error] [pid 943918:tid 944149] [client 173.239.196.163:41157] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/uploads/fileman.php"] [unique_id "alxkAx70hbVC6SnzbhobfgAAAOk"]
[Sat Jul 18 23:43:31.974913 2026] [security2:error] [pid 943918:tid 944027] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/ol.php"] [unique_id "alxkAx70hbVC6SnzbhobhgAAyWs"]
[Sat Jul 18 23:43:31.975106 2026] [security2:error] [pid 943918:tid 944117] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/ol.php"] [unique_id "alxkAx70hbVC6SnzbhobhgAAyWs"]
[Sat Jul 18 23:43:32.083300 2026] [security2:error] [pid 943918:tid 944156] [client 180.252.198.240:59663] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkBB70hbVC6SnzbhobjwAAAPA"]
[Sat Jul 18 23:43:32.083413 2026] [security2:error] [pid 943918:tid 944156] [client 180.252.198.240:59663] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkBB70hbVC6SnzbhobjwAAAPA"]
[Sat Jul 18 23:43:32.180986 2026] [security2:error] [pid 943918:tid 944159] [client 57.141.18.48:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxkAx70hbVC6SnzbhobigAAAPM"]
[Sat Jul 18 23:43:32.196172 2026] [security2:error] [pid 943918:tid 944039] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/pass.php"] [unique_id "alxkBB70hbVC6SnzbhobkwAA73c"]
[Sat Jul 18 23:43:32.196320 2026] [security2:error] [pid 943918:tid 944155] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/pass.php"] [unique_id "alxkBB70hbVC6SnzbhobkwAA73c"]
[Sat Jul 18 23:43:32.264595 2026] [security2:error] [pid 943918:tid 944136] [client 45.133.7.68:20899] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 68.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "alxkBB70hbVC6SnzbhoblwAAANw"]
[Sat Jul 18 23:43:32.386517 2026] [security2:error] [pid 943918:tid 944042] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/l.php"] [unique_id "alxkBB70hbVC6SnzbhoboAAA1Xo"]
[Sat Jul 18 23:43:32.386670 2026] [security2:error] [pid 943918:tid 944129] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/l.php"] [unique_id "alxkBB70hbVC6SnzbhoboAAA1Xo"]
[Sat Jul 18 23:43:32.444684 2026] [security2:error] [pid 943918:tid 944150] [client 139.167.225.146:62842] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkBB70hbVC6SnzbhobogAAAOo"]
[Sat Jul 18 23:43:32.444798 2026] [security2:error] [pid 943918:tid 944150] [client 139.167.225.146:62842] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkBB70hbVC6SnzbhobogAAAOo"]
[Sat Jul 18 23:43:32.593212 2026] [security2:error] [pid 943918:tid 944031] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/ot.php"] [unique_id "alxkBB70hbVC6SnzbhobqgAAt28"]
[Sat Jul 18 23:43:32.593357 2026] [security2:error] [pid 943918:tid 944099] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/ot.php"] [unique_id "alxkBB70hbVC6SnzbhobqgAAt28"]
[Sat Jul 18 23:43:32.758784 2026] [security2:error] [pid 938041:tid 938173] [client 173.239.196.165:21645] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "alxkBCNrzsYMDd5sB105XgAAAAE"]
[Sat Jul 18 23:43:32.788910 2026] [security2:error] [pid 943918:tid 944046] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/wp-rss4.php"] [unique_id "alxkBB70hbVC6SnzbhobrwAAsH4"]
[Sat Jul 18 23:43:32.789061 2026] [security2:error] [pid 943918:tid 944092] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/wp-rss4.php"] [unique_id "alxkBB70hbVC6SnzbhobrwAAsH4"]
[Sat Jul 18 23:43:32.949583 2026] [security2:error] [pid 938041:tid 938298] [client 45.133.7.81:57423] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 81.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/edit.php"] [unique_id "alxkBCNrzsYMDd5sB105YwAAAH4"]
[Sat Jul 18 23:43:32.990837 2026] [security2:error] [pid 943918:tid 943930] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/dev.php"] [unique_id "alxkBB70hbVC6SnzbhobuQAAygo"]
[Sat Jul 18 23:43:32.990984 2026] [security2:error] [pid 943918:tid 944118] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/dev.php"] [unique_id "alxkBB70hbVC6SnzbhobuQAAygo"]
[Sat Jul 18 23:43:33.188436 2026] [security2:error] [pid 943918:tid 944047] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/bin.php"] [unique_id "alxkBR70hbVC6SnzbhobwAAAyX8"]
[Sat Jul 18 23:43:33.188630 2026] [security2:error] [pid 943918:tid 944117] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/bin.php"] [unique_id "alxkBR70hbVC6SnzbhobwAAAyX8"]
[Sat Jul 18 23:43:33.377941 2026] [security2:error] [pid 943918:tid 943940] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/yee.php"] [unique_id "alxkBR70hbVC6SnzbhobywAA8hQ"]
[Sat Jul 18 23:43:33.378112 2026] [security2:error] [pid 943918:tid 944158] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/yee.php"] [unique_id "alxkBR70hbVC6SnzbhobywAA8hQ"]
[Sat Jul 18 23:43:33.545446 2026] [security2:error] [pid 943918:tid 944145] [client 138.252.89.100:58795] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkBR70hbVC6Snzbhob0AAAAOU"]
[Sat Jul 18 23:43:33.545536 2026] [security2:error] [pid 943918:tid 944145] [client 138.252.89.100:58795] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkBR70hbVC6Snzbhob0AAAAOU"]
[Sat Jul 18 23:43:33.557706 2026] [security2:error] [pid 938041:tid 938251] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/122.php"] [unique_id "alxkBSNrzsYMDd5sB105cgAAAE8"]
[Sat Jul 18 23:43:33.557848 2026] [security2:error] [pid 938041:tid 938251] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/122.php"] [unique_id "alxkBSNrzsYMDd5sB105cgAAAE8"]
[Sat Jul 18 23:43:33.589835 2026] [security2:error] [pid 943918:tid 943934] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/epinyins.php"] [unique_id "alxkBR70hbVC6Snzbhob0wAAkQ4"]
[Sat Jul 18 23:43:33.590082 2026] [security2:error] [pid 943918:tid 944061] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/epinyins.php"] [unique_id "alxkBR70hbVC6Snzbhob0wAAkQ4"]
[Sat Jul 18 23:43:33.632025 2026] [security2:error] [pid 943918:tid 944073] [client 173.239.196.162:37745] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "alxkBR70hbVC6Snzbhob1AAAAJ0"]
[Sat Jul 18 23:43:33.642110 2026] [security2:error] [pid 943918:tid 944155] [client 45.133.7.68:45769] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 68.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/webdb.php"] [unique_id "alxkBR70hbVC6Snzbhob1QAAAO8"]
[Sat Jul 18 23:43:33.808339 2026] [security2:error] [pid 938041:tid 938262] [client 18.139.208.24:31034] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.208.139.18.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxkBSNrzsYMDd5sB105eQAAAFo"]
[Sat Jul 18 23:43:33.808456 2026] [security2:error] [pid 938041:tid 938262] [client 18.139.208.24:31034] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxkBSNrzsYMDd5sB105eQAAAFo"]
[Sat Jul 18 23:43:33.847098 2026] [security2:error] [pid 943918:tid 943941] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/aa17.php"] [unique_id "alxkBR70hbVC6Snzbhob2QAAwhU"]
[Sat Jul 18 23:43:33.847260 2026] [security2:error] [pid 943918:tid 944110] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/aa17.php"] [unique_id "alxkBR70hbVC6Snzbhob2QAAwhU"]
[Sat Jul 18 23:43:34.049940 2026] [security2:error] [pid 943918:tid 943938] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/winkel.php"] [unique_id "alxkBh70hbVC6Snzbhob4QAA-xI"]
[Sat Jul 18 23:43:34.050137 2026] [security2:error] [pid 943918:tid 944167] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/winkel.php"] [unique_id "alxkBh70hbVC6Snzbhob4QAA-xI"]
[Sat Jul 18 23:43:34.324801 2026] [security2:error] [pid 943918:tid 944113] [client 45.133.7.90:55565] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 90.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/assets/images/doc.php"] [unique_id "alxkBh70hbVC6Snzbhob8AAAAMU"]
[Sat Jul 18 23:43:34.345692 2026] [core:error] [pid 938041:tid 938250] [client 194.135.133.225:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:43:34.345719 2026] [core:error] [pid 938041:tid 938250] [client 194.135.133.225:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:43:34.357882 2026] [security2:error] [pid 943918:tid 944148] [client 103.160.26.178:52804] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkBh70hbVC6Snzbhob8QAAAOg"]
[Sat Jul 18 23:43:34.357959 2026] [security2:error] [pid 943918:tid 944148] [client 103.160.26.178:52804] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkBh70hbVC6Snzbhob8QAAAOg"]
[Sat Jul 18 23:43:34.456611 2026] [security2:error] [pid 943918:tid 943952] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/ef.php"] [unique_id "alxkBh70hbVC6Snzbhob8wAAuCA"]
[Sat Jul 18 23:43:34.456785 2026] [security2:error] [pid 943918:tid 944100] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/ef.php"] [unique_id "alxkBh70hbVC6Snzbhob8wAAuCA"]
[Sat Jul 18 23:43:34.500654 2026] [security2:error] [pid 943918:tid 944126] [client 173.239.196.162:24839] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/admin.php%20"] [unique_id "alxkBh70hbVC6Snzbhob9gAAANI"]
[Sat Jul 18 23:43:34.626392 2026] [security2:error] [pid 943918:tid 944162] [client 106.222.249.209:3391] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkBh70hbVC6Snzbhob-wAAAPY"]
[Sat Jul 18 23:43:34.626769 2026] [security2:error] [pid 943918:tid 944162] [client 106.222.249.209:3391] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkBh70hbVC6Snzbhob-wAAAPY"]
[Sat Jul 18 23:43:34.758420 2026] [security2:error] [pid 943918:tid 943950] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/gifclass4.php"] [unique_id "alxkBh70hbVC6SnzbhocAwAA8R4"]
[Sat Jul 18 23:43:34.758589 2026] [security2:error] [pid 943918:tid 944157] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/gifclass4.php"] [unique_id "alxkBh70hbVC6SnzbhocAwAA8R4"]
[Sat Jul 18 23:43:34.844845 2026] [security2:error] [pid 938041:tid 938179] [client 36.83.95.75:65234] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkBiNrzsYMDd5sB105lgAAAAc"]
[Sat Jul 18 23:43:34.844941 2026] [security2:error] [pid 938041:tid 938179] [client 36.83.95.75:65234] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkBiNrzsYMDd5sB105lgAAAAc"]
[Sat Jul 18 23:43:34.903930 2026] [security2:error] [pid 938041:tid 938100] [remote 97.74.93.24:48620] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxkBiNrzsYMDd5sB105lwAAOjk"]
[Sat Jul 18 23:43:34.967410 2026] [ssl:error] [pid 938041:tid 938282] [client 104.48.69.105:52754] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname www.icemarc.org provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:43:35.004256 2026] [security2:error] [pid 943918:tid 944154] [client 45.133.7.56:23175] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 56.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/file2.php"] [unique_id "alxkBx70hbVC6SnzbhocFAAAAO4"]
[Sat Jul 18 23:43:35.047530 2026] [security2:error] [pid 943918:tid 943953] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/667.php"] [unique_id "alxkBx70hbVC6SnzbhocGQAA7yE"]
[Sat Jul 18 23:43:35.047678 2026] [security2:error] [pid 943918:tid 944155] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/667.php"] [unique_id "alxkBx70hbVC6SnzbhocGQAA7yE"]
[Sat Jul 18 23:43:35.087893 2026] [core:error] [pid 943918:tid 944164] [client 134.199.88.30:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:43:35.087913 2026] [core:error] [pid 943918:tid 944164] [client 134.199.88.30:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:43:35.152931 2026] [security2:error] [pid 943918:tid 944051] [client 35.227.39.208:44842] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "savilerowtravel.com"] [uri "/"] [unique_id "alxkBx70hbVC6SnzbhocJAAAAIc"]
[Sat Jul 18 23:43:35.284151 2026] [security2:error] [pid 938041:tid 938095] [remote 97.74.93.24:48620] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxkByNrzsYMDd5sB105ogAAWzQ"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:43:35.364933 2026] [proxy:error] [pid 943918:tid 944065] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:43:35.365007 2026] [proxy_http:error] [pid 943918:tid 944065] [client 193.47.62.168:57442] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:43:35.365486 2026] [proxy:error] [pid 943918:tid 944065] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:43:35.365511 2026] [proxy_http:error] [pid 943918:tid 944065] [client 193.47.62.168:57442] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:43:35.389029 2026] [security2:error] [pid 943918:tid 944082] [client 110.249.201.96:63102] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "schuttfarms.com"] [uri "/robots.txt"] [unique_id "alxkBx70hbVC6SnzbhocKQAAAKY"]
[Sat Jul 18 23:43:35.403791 2026] [security2:error] [pid 943918:tid 944067] [client 173.239.196.162:28419] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/hong1.php"] [unique_id "alxkBx70hbVC6SnzbhocKgAAAJc"]
[Sat Jul 18 23:43:35.455517 2026] [security2:error] [pid 943918:tid 943963] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/we.php"] [unique_id "alxkBx70hbVC6SnzbhocLgAAlCs"]
[Sat Jul 18 23:43:35.455650 2026] [security2:error] [pid 943918:tid 944064] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/we.php"] [unique_id "alxkBx70hbVC6SnzbhocLgAAlCs"]
[Sat Jul 18 23:43:35.660939 2026] [security2:error] [pid 943918:tid 943978] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/wp-su.php"] [unique_id "alxkBx70hbVC6SnzbhocPAAA9Do"]
[Sat Jul 18 23:43:35.661076 2026] [security2:error] [pid 943918:tid 944160] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/wp-su.php"] [unique_id "alxkBx70hbVC6SnzbhocPAAA9Do"]
[Sat Jul 18 23:43:35.687721 2026] [security2:error] [pid 938041:tid 938273] [client 45.133.7.88:39581] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 88.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "alxkByNrzsYMDd5sB105pgAAAGU"]
[Sat Jul 18 23:43:35.860722 2026] [security2:error] [pid 943918:tid 943989] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/t3x.php"] [unique_id "alxkBx70hbVC6SnzbhocQgAAhUU"]
[Sat Jul 18 23:43:35.860943 2026] [security2:error] [pid 943918:tid 944049] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/t3x.php"] [unique_id "alxkBx70hbVC6SnzbhocQgAAhUU"]
[Sat Jul 18 23:43:36.256221 2026] [security2:error] [pid 943918:tid 944000] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/13.php"] [unique_id "alxkCB70hbVC6SnzbhocVgAA31A"]
[Sat Jul 18 23:43:36.256395 2026] [security2:error] [pid 943918:tid 944139] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/13.php"] [unique_id "alxkCB70hbVC6SnzbhocVgAA31A"]
[Sat Jul 18 23:43:36.299881 2026] [security2:error] [pid 943918:tid 944114] [client 173.239.196.163:41023] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/maint/byps.php"] [unique_id "alxkCB70hbVC6SnzbhocVwAAAMY"]
[Sat Jul 18 23:43:36.370019 2026] [security2:error] [pid 943918:tid 944069] [client 45.133.7.57:42409] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 57.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/alfa.php"] [unique_id "alxkCB70hbVC6SnzbhocXgAAAJk"]
[Sat Jul 18 23:43:36.455854 2026] [security2:error] [pid 943918:tid 943986] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/yasnu.php"] [unique_id "alxkCB70hbVC6SnzbhocYAAAzkI"]
[Sat Jul 18 23:43:36.456034 2026] [security2:error] [pid 943918:tid 944122] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/yasnu.php"] [unique_id "alxkCB70hbVC6SnzbhocYAAAzkI"]
[Sat Jul 18 23:43:36.774326 2026] [core:error] [pid 943918:tid 944135] [client 34.123.84.55:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:43:36.774351 2026] [core:error] [pid 943918:tid 944135] [client 34.123.84.55:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:43:36.917995 2026] [security2:error] [pid 943918:tid 944002] [remote 31.42.184.154:55052] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxkCB70hbVC6SnzbhoccgAAt1I"]
[Sat Jul 18 23:43:36.986492 2026] [security2:error] [pid 943918:tid 943988] [remote 157.66.47.83:59896] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "solkeetw.com"] [uri "/wp-login.php"] [unique_id "alxkCB70hbVC6SnzbhocdQAApkQ"]
[Sat Jul 18 23:43:37.058354 2026] [security2:error] [pid 943918:tid 944140] [client 45.133.7.66:50279] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 66.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/blue/admin.php"] [unique_id "alxkCR70hbVC6SnzbhoceQAAAOA"]
[Sat Jul 18 23:43:37.070614 2026] [security2:error] [pid 943918:tid 944013] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/trd.php"] [unique_id "alxkCR70hbVC6SnzbhocewAAjF0"]
[Sat Jul 18 23:43:37.070764 2026] [security2:error] [pid 943918:tid 944056] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/trd.php"] [unique_id "alxkCR70hbVC6SnzbhocewAAjF0"]
[Sat Jul 18 23:43:37.081804 2026] [security2:error] [pid 943918:tid 944173] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/green1.php"] [unique_id "alxkCR70hbVC6SnzbhocfAAAAQE"]
[Sat Jul 18 23:43:37.081870 2026] [security2:error] [pid 943918:tid 944173] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/green1.php"] [unique_id "alxkCR70hbVC6SnzbhocfAAAAQE"]
[Sat Jul 18 23:43:37.155941 2026] [security2:error] [pid 943918:tid 944037] [remote 31.42.184.154:55052] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxkCR70hbVC6SnzbhoclgAA7HU"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:43:37.185790 2026] [security2:error] [pid 943918:tid 944153] [client 173.239.196.164:23359] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "alxkCR70hbVC6SnzbhocmQAAAO0"]
[Sat Jul 18 23:43:37.385967 2026] [security2:error] [pid 943918:tid 943922] [remote 157.66.47.83:59896] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "solkeetw.com"] [uri "/wp-login.php"] [unique_id "alxkCR70hbVC6SnzbhocwAAA0AI"], referer: https://solkeetw.com/wp-login.php
[Sat Jul 18 23:43:37.405788 2026] [security2:error] [pid 943918:tid 944018] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/oiepfuav.php"] [unique_id "alxkCR70hbVC6SnzbhocwgAAmWI"]
[Sat Jul 18 23:43:37.405973 2026] [security2:error] [pid 943918:tid 944069] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/oiepfuav.php"] [unique_id "alxkCR70hbVC6SnzbhocwgAAmWI"]
[Sat Jul 18 23:43:37.575862 2026] [security2:error] [pid 943918:tid 944175] [client 34.171.141.44:10846] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "dasmarque.com"] [uri "/wp-json/batch/v1"] [unique_id "alxkCR70hbVC6SnzbhoczAAAAQM"]
[Sat Jul 18 23:43:37.596888 2026] [security2:error] [pid 943918:tid 943939] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/02.php"] [unique_id "alxkCR70hbVC6SnzbhoczgAA5RM"]
[Sat Jul 18 23:43:37.596996 2026] [security2:error] [pid 943918:tid 944145] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/02.php"] [unique_id "alxkCR70hbVC6SnzbhoczgAA5RM"]
[Sat Jul 18 23:43:37.739120 2026] [security2:error] [pid 938041:tid 938212] [client 45.133.7.84:41585] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 84.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/click.php"] [unique_id "alxkCSNrzsYMDd5sB105xgAAACg"]
[Sat Jul 18 23:43:37.752175 2026] [security2:error] [pid 938041:tid 938296] [client 223.228.182.224:58499] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.182.228.223.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxkCSNrzsYMDd5sB105xwAAAHw"]
[Sat Jul 18 23:43:37.752348 2026] [security2:error] [pid 938041:tid 938296] [client 223.228.182.224:58499] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "lmgorman.com"] [uri "/xmlrpc.php"] [unique_id "alxkCSNrzsYMDd5sB105xwAAAHw"]
[Sat Jul 18 23:43:37.954917 2026] [security2:error] [pid 943918:tid 943990] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/file2.php"] [unique_id "alxkCR70hbVC6Snzbhoc5QAA8EY"]
[Sat Jul 18 23:43:37.955049 2026] [security2:error] [pid 943918:tid 944156] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/file2.php"] [unique_id "alxkCR70hbVC6Snzbhoc5QAA8EY"]
[Sat Jul 18 23:43:38.098423 2026] [security2:error] [pid 943918:tid 944110] [client 173.239.196.164:47825] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "alxkCh70hbVC6Snzbhoc7AAAAMI"]
[Sat Jul 18 23:43:38.153784 2026] [security2:error] [pid 943918:tid 943960] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/makeasmtp.php"] [unique_id "alxkCh70hbVC6Snzbhoc8AAAhig"]
[Sat Jul 18 23:43:38.153932 2026] [security2:error] [pid 943918:tid 944050] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/makeasmtp.php"] [unique_id "alxkCh70hbVC6Snzbhoc8AAAhig"]
[Sat Jul 18 23:43:38.157736 2026] [security2:error] [pid 943918:tid 944163] [client 34.171.141.44:10846] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "dasmarque.com"] [uri "/"] [unique_id "alxkCh70hbVC6Snzbhoc8QAAAPc"]
[Sat Jul 18 23:43:38.355885 2026] [security2:error] [pid 943918:tid 943964] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/ant.php"] [unique_id "alxkCh70hbVC6Snzbhoc_gAAyyw"]
[Sat Jul 18 23:43:38.356061 2026] [security2:error] [pid 943918:tid 944119] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/ant.php"] [unique_id "alxkCh70hbVC6Snzbhoc_gAAyyw"]
[Sat Jul 18 23:43:38.419249 2026] [security2:error] [pid 943918:tid 944049] [client 45.133.7.95:46675] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/wp-conflg.php"] [unique_id "alxkCh70hbVC6SnzbhodAAAAAIU"]
[Sat Jul 18 23:43:38.546080 2026] [security2:error] [pid 943918:tid 943970] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/bb5.php"] [unique_id "alxkCh70hbVC6SnzbhodBwAAsDI"]
[Sat Jul 18 23:43:38.546216 2026] [security2:error] [pid 943918:tid 944092] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/bb5.php"] [unique_id "alxkCh70hbVC6SnzbhodBwAAsDI"]
[Sat Jul 18 23:43:38.603094 2026] [security2:error] [pid 943918:tid 944081] [client 163.61.1.17:59080] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkCh70hbVC6SnzbhodCQAAAKU"]
[Sat Jul 18 23:43:38.603180 2026] [security2:error] [pid 943918:tid 944081] [client 163.61.1.17:59080] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkCh70hbVC6SnzbhodCQAAAKU"]
[Sat Jul 18 23:43:38.607890 2026] [security2:error] [pid 943918:tid 944123] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/biufile.php"] [unique_id "alxkCh70hbVC6SnzbhodCgAAAM8"]
[Sat Jul 18 23:43:38.607999 2026] [security2:error] [pid 943918:tid 944123] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/biufile.php"] [unique_id "alxkCh70hbVC6SnzbhodCgAAAM8"]
[Sat Jul 18 23:43:38.716595 2026] [security2:error] [pid 938041:tid 938184] [client 155.117.163.231:19834] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "www.californiaperfumecompany.com"] [uri "/products/product_images/cal_violet_nutri_creame_double_1912.jpg"] [unique_id "alxkCiNrzsYMDd5sB1050QAAAAw"]
[Sat Jul 18 23:43:38.873815 2026] [security2:error] [pid 943918:tid 943963] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/akc.php"] [unique_id "alxkCh70hbVC6SnzbhodEwAA4ys"]
[Sat Jul 18 23:43:38.873966 2026] [security2:error] [pid 943918:tid 944143] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/akc.php"] [unique_id "alxkCh70hbVC6SnzbhodEwAA4ys"]
[Sat Jul 18 23:43:38.905961 2026] [security2:error] [pid 943918:tid 943981] [remote 97.74.93.24:55234] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxkCh70hbVC6SnzbhodFQAA5z0"]
[Sat Jul 18 23:43:38.952678 2026] [security2:error] [pid 943918:tid 944153] [client 173.239.196.166:56129] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/twentytwentyfour/patterns/content-type.php"] [unique_id "alxkCh70hbVC6SnzbhodGQAAAO0"]
[Sat Jul 18 23:43:39.099071 2026] [security2:error] [pid 943918:tid 944097] [client 45.133.7.103:57447] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/blue/atomlib.php"] [unique_id "alxkCx70hbVC6SnzbhodJAAAALU"]
[Sat Jul 18 23:43:39.204375 2026] [security2:error] [pid 943918:tid 943987] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/wefile.php"] [unique_id "alxkCx70hbVC6SnzbhodKgAA70M"]
[Sat Jul 18 23:43:39.204548 2026] [security2:error] [pid 943918:tid 944155] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/wefile.php"] [unique_id "alxkCx70hbVC6SnzbhodKgAA70M"]
[Sat Jul 18 23:43:39.332143 2026] [security2:error] [pid 943918:tid 943983] [remote 97.74.93.24:55234] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxkCx70hbVC6SnzbhodMQAAhz8"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:43:39.478921 2026] [security2:error] [pid 943918:tid 944000] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/s.php"] [unique_id "alxkCx70hbVC6SnzbhodOQAAoVA"]
[Sat Jul 18 23:43:39.479088 2026] [security2:error] [pid 943918:tid 944077] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/s.php"] [unique_id "alxkCx70hbVC6SnzbhodOQAAoVA"]
[Sat Jul 18 23:43:39.691027 2026] [security2:error] [pid 943918:tid 943995] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/yzkvrell.php"] [unique_id "alxkCx70hbVC6SnzbhodRgAApUs"]
[Sat Jul 18 23:43:39.691180 2026] [security2:error] [pid 943918:tid 944081] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/yzkvrell.php"] [unique_id "alxkCx70hbVC6SnzbhodRgAApUs"]
[Sat Jul 18 23:43:39.779631 2026] [security2:error] [pid 943918:tid 944076] [client 45.133.7.60:26221] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 60.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/js/widgets/bypass.php"] [unique_id "alxkCx70hbVC6SnzbhodSgAAAKA"]
[Sat Jul 18 23:43:39.815187 2026] [security2:error] [pid 943918:tid 944099] [client 173.239.196.162:60043] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/network/class.php"] [unique_id "alxkCx70hbVC6SnzbhodTQAAALc"]
[Sat Jul 18 23:43:39.893506 2026] [security2:error] [pid 943918:tid 943998] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/gmo.php"] [unique_id "alxkCx70hbVC6SnzbhodWAAApk4"]
[Sat Jul 18 23:43:39.893711 2026] [security2:error] [pid 943918:tid 944082] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/gmo.php"] [unique_id "alxkCx70hbVC6SnzbhodWAAApk4"]
[Sat Jul 18 23:43:40.145611 2026] [security2:error] [pid 943918:tid 944113] [client 113.160.97.242:62652] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxkDB70hbVC6SnzbhodYwAAAMU"]
[Sat Jul 18 23:43:40.159449 2026] [security2:error] [pid 943918:tid 944164] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/wpconf.php"] [unique_id "alxkDB70hbVC6SnzbhodZQAAAPg"]
[Sat Jul 18 23:43:40.159551 2026] [security2:error] [pid 943918:tid 944164] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/wpconf.php"] [unique_id "alxkDB70hbVC6SnzbhodZQAAAPg"]
[Sat Jul 18 23:43:40.252467 2026] [security2:error] [pid 943918:tid 944013] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/zc-749.php"] [unique_id "alxkDB70hbVC6SnzbhodagAA2F0"]
[Sat Jul 18 23:43:40.252666 2026] [security2:error] [pid 943918:tid 944132] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/zc-749.php"] [unique_id "alxkDB70hbVC6SnzbhodagAA2F0"]
[Sat Jul 18 23:43:40.338640 2026] [security2:error] [pid 943918:tid 944085] [client 35.227.39.208:44842] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "savilerowtravel.com"] [uri "/index.php"] [unique_id "alxkCx70hbVC6SnzbhodNwAAAKk"], referer: http://savilerowtravel.com/wp-json/batch/v1
[Sat Jul 18 23:43:40.461504 2026] [security2:error] [pid 938041:tid 938183] [client 45.133.7.60:60005] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 60.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "alxkDCNrzsYMDd5sB1057gAAAAs"]
[Sat Jul 18 23:43:40.653332 2026] [security2:error] [pid 943918:tid 944017] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/.well-known/fm.php"] [unique_id "alxkDB70hbVC6SnzbhodfwAApWE"]
[Sat Jul 18 23:43:40.653542 2026] [security2:error] [pid 943918:tid 944081] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/.well-known/fm.php"] [unique_id "alxkDB70hbVC6SnzbhodfwAApWE"]
[Sat Jul 18 23:43:40.703185 2026] [security2:error] [pid 943918:tid 944145] [client 173.239.196.162:39699] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "alxkDB70hbVC6SnzbhodgQAAAOU"]
[Sat Jul 18 23:43:40.718338 2026] [security2:error] [pid 943918:tid 944157] [client 91.243.19.150:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.savilerowtravel.com"] [uri "/index.php"] [unique_id "alxkDB70hbVC6SnzbhodcwAAAPE"]
[Sat Jul 18 23:43:40.882037 2026] [security2:error] [pid 943918:tid 943984] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/ava.php"] [unique_id "alxkDB70hbVC6SnzbhodhgAApkA"]
[Sat Jul 18 23:43:40.882163 2026] [security2:error] [pid 943918:tid 944082] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/ava.php"] [unique_id "alxkDB70hbVC6SnzbhodhgAApkA"]
[Sat Jul 18 23:43:41.147171 2026] [security2:error] [pid 943918:tid 944092] [client 45.133.7.72:52887] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 72.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/index.php"] [unique_id "alxkDR70hbVC6SnzbhodnAAAALA"]
[Sat Jul 18 23:43:41.284110 2026] [security2:error] [pid 943918:tid 944037] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/nqsa.php"] [unique_id "alxkDR70hbVC6SnzbhodnwAAynU"]
[Sat Jul 18 23:43:41.284277 2026] [security2:error] [pid 943918:tid 944118] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/nqsa.php"] [unique_id "alxkDR70hbVC6SnzbhodnwAAynU"]
[Sat Jul 18 23:43:41.474296 2026] [security2:error] [pid 943918:tid 944043] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/2020.php"] [unique_id "alxkDR70hbVC6SnzbhodpgAAm3s"]
[Sat Jul 18 23:43:41.474482 2026] [security2:error] [pid 943918:tid 944071] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/2020.php"] [unique_id "alxkDR70hbVC6SnzbhodpgAAm3s"]
[Sat Jul 18 23:43:41.564517 2026] [security2:error] [pid 943918:tid 944172] [client 173.239.196.167:47757] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/ms-file.php"] [unique_id "alxkDR70hbVC6SnzbhodrQAAAQA"]
[Sat Jul 18 23:43:41.663415 2026] [security2:error] [pid 943918:tid 944031] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/rak.php"] [unique_id "alxkDR70hbVC6SnzbhodsgAAu28"]
[Sat Jul 18 23:43:41.663592 2026] [security2:error] [pid 943918:tid 944103] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/rak.php"] [unique_id "alxkDR70hbVC6SnzbhodsgAAu28"]
[Sat Jul 18 23:43:41.837663 2026] [security2:error] [pid 943918:tid 944081] [client 45.133.7.63:29027] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/edit.php"] [unique_id "alxkDR70hbVC6SnzbhoduQAAAKU"]
[Sat Jul 18 23:43:41.852363 2026] [security2:error] [pid 943918:tid 944123] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/mosty.php"] [unique_id "alxkDR70hbVC6SnzbhoduwAAAM8"]
[Sat Jul 18 23:43:41.852471 2026] [security2:error] [pid 943918:tid 944123] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/mosty.php"] [unique_id "alxkDR70hbVC6SnzbhoduwAAAM8"]
[Sat Jul 18 23:43:41.860920 2026] [security2:error] [pid 943918:tid 944129] [client 143.0.205.205:14261] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.guidehunting.com"] [uri "/index.php"] [unique_id "alxkCx70hbVC6SnzbhodXAAAANU"]
[Sat Jul 18 23:43:41.949956 2026] [security2:error] [pid 943918:tid 944100] [client 34.171.141.44:10846] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "dasmarque.com"] [uri "/index.php"] [unique_id "alxkDB70hbVC6SnzbhodgwAAALg"], referer: http://dasmarque.com/wp-json/batch/v1
[Sat Jul 18 23:43:41.965838 2026] [security2:error] [pid 943918:tid 943930] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/bypass.php"] [unique_id "alxkDR70hbVC6SnzbhodxwAAlAo"]
[Sat Jul 18 23:43:41.965977 2026] [security2:error] [pid 943918:tid 944064] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/bypass.php"] [unique_id "alxkDR70hbVC6SnzbhodxwAAlAo"]
[Sat Jul 18 23:43:42.282240 2026] [security2:error] [pid 943918:tid 943923] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/zr.php"] [unique_id "alxkDh70hbVC6Snzbhod2AAA5wM"]
[Sat Jul 18 23:43:42.282391 2026] [security2:error] [pid 943918:tid 944147] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/zr.php"] [unique_id "alxkDh70hbVC6Snzbhod2AAA5wM"]
[Sat Jul 18 23:43:42.474414 2026] [security2:error] [pid 943918:tid 944028] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/wander.php"] [unique_id "alxkDh70hbVC6Snzbhod3QAAymw"]
[Sat Jul 18 23:43:42.474534 2026] [security2:error] [pid 943918:tid 944118] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/wander.php"] [unique_id "alxkDh70hbVC6Snzbhod3QAAymw"]
[Sat Jul 18 23:43:42.507855 2026] [security2:error] [pid 943918:tid 944165] [client 173.239.196.162:59911] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "alxkDh70hbVC6Snzbhod3AAAAPk"]
[Sat Jul 18 23:43:42.517330 2026] [security2:error] [pid 943918:tid 944054] [client 45.133.7.57:64245] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 57.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/WordPressCore/index.php"] [unique_id "alxkDh70hbVC6Snzbhod3wAAAIo"]
[Sat Jul 18 23:43:42.545352 2026] [security2:error] [pid 943918:tid 944077] [client 139.167.225.146:63467] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkDh70hbVC6Snzbhod4gAAAKE"]
[Sat Jul 18 23:43:42.545448 2026] [security2:error] [pid 943918:tid 944077] [client 139.167.225.146:63467] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkDh70hbVC6Snzbhod4gAAAKE"]
[Sat Jul 18 23:43:42.590082 2026] [security2:error] [pid 943918:tid 944160] [client 180.252.198.240:60141] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkDh70hbVC6Snzbhod5gAAAPQ"]
[Sat Jul 18 23:43:42.590176 2026] [security2:error] [pid 943918:tid 944160] [client 180.252.198.240:60141] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkDh70hbVC6Snzbhod5gAAAPQ"]
[Sat Jul 18 23:43:42.662957 2026] [security2:error] [pid 943918:tid 943925] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/lock360.php"] [unique_id "alxkDh70hbVC6Snzbhod6AAAmwU"]
[Sat Jul 18 23:43:42.663143 2026] [security2:error] [pid 943918:tid 944071] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/lock360.php"] [unique_id "alxkDh70hbVC6Snzbhod6AAAmwU"]
[Sat Jul 18 23:43:43.118220 2026] [security2:error] [pid 943918:tid 943941] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/great.php"] [unique_id "alxkDx70hbVC6SnzbhoeAAAAzRU"]
[Sat Jul 18 23:43:43.118432 2026] [security2:error] [pid 943918:tid 944121] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/great.php"] [unique_id "alxkDx70hbVC6SnzbhoeAAAAzRU"]
[Sat Jul 18 23:43:43.191794 2026] [security2:error] [pid 943918:tid 943936] [remote 104.244.79.40:59900] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 40.79.244.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxkDx70hbVC6SnzbhoeAQAAlRA"]
[Sat Jul 18 23:43:43.199197 2026] [security2:error] [pid 943918:tid 944161] [client 45.133.7.69:32145] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 69.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/cgi-bin/autoload_classmap.php"] [unique_id "alxkDx70hbVC6SnzbhoeAwAAAPU"]
[Sat Jul 18 23:43:43.319000 2026] [security2:error] [pid 943918:tid 943931] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/fifii.php"] [unique_id "alxkDx70hbVC6SnzbhoeCAAAzAs"]
[Sat Jul 18 23:43:43.319104 2026] [security2:error] [pid 943918:tid 944120] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/fifii.php"] [unique_id "alxkDx70hbVC6SnzbhoeCAAAzAs"]
[Sat Jul 18 23:43:43.395369 2026] [security2:error] [pid 943918:tid 944076] [client 173.239.196.166:37455] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/widgets/av.php"] [unique_id "alxkDx70hbVC6SnzbhoeDQAAAKA"]
[Sat Jul 18 23:43:43.417345 2026] [security2:error] [pid 943918:tid 943939] [remote 104.244.79.40:59900] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 40.79.244.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxkDx70hbVC6SnzbhoeDgAA6RM"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:43:43.508863 2026] [security2:error] [pid 943918:tid 944039] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/12.php"] [unique_id "alxkDx70hbVC6SnzbhoeEgAAtXc"]
[Sat Jul 18 23:43:43.509025 2026] [security2:error] [pid 943918:tid 944097] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/12.php"] [unique_id "alxkDx70hbVC6SnzbhoeEgAAtXc"]
[Sat Jul 18 23:43:43.864151 2026] [security2:error] [pid 943918:tid 943948] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/efile.php"] [unique_id "alxkDx70hbVC6SnzbhoeJgAA-xw"]
[Sat Jul 18 23:43:43.864376 2026] [security2:error] [pid 943918:tid 944167] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/efile.php"] [unique_id "alxkDx70hbVC6SnzbhoeJgAA-xw"]
[Sat Jul 18 23:43:43.881325 2026] [security2:error] [pid 943918:tid 944160] [client 45.133.7.54:61909] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-links-opml.php"] [unique_id "alxkDx70hbVC6SnzbhoeJwAAAPQ"]
[Sat Jul 18 23:43:44.140684 2026] [security2:error] [pid 943918:tid 943953] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/past1.php"] [unique_id "alxkEB70hbVC6SnzbhoeLgAA-CE"]
[Sat Jul 18 23:43:44.140862 2026] [security2:error] [pid 943918:tid 944164] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/past1.php"] [unique_id "alxkEB70hbVC6SnzbhoeLgAA-CE"]
[Sat Jul 18 23:43:44.223255 2026] [security2:error] [pid 943918:tid 944073] [client 173.239.196.162:49825] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/chosen.php%20"] [unique_id "alxkEB70hbVC6SnzbhoeNgAAAJ0"]
[Sat Jul 18 23:43:44.280081 2026] [security2:error] [pid 943918:tid 944154] [client 4.194.24.143:7203] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/nine2code.php"] [unique_id "alxkEB70hbVC6SnzbhoeOgAAAO4"]
[Sat Jul 18 23:43:44.281066 2026] [security2:error] [pid 943918:tid 944057] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/dejavu.php"] [unique_id "alxkEB70hbVC6SnzbhoeOwAAAI0"]
[Sat Jul 18 23:43:44.281140 2026] [security2:error] [pid 943918:tid 944057] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/dejavu.php"] [unique_id "alxkEB70hbVC6SnzbhoeOwAAAI0"]
[Sat Jul 18 23:43:44.562786 2026] [security2:error] [pid 938041:tid 938192] [client 45.133.7.90:24051] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 90.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/user/network.php"] [unique_id "alxkECNrzsYMDd5sB106KAAAABQ"]
[Sat Jul 18 23:43:44.857908 2026] [security2:error] [pid 943918:tid 943981] [remote 31.42.184.154:59492] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.idf.ldc.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxkEB70hbVC6SnzbhoeUQAAvD0"]
[Sat Jul 18 23:43:44.963853 2026] [security2:error] [pid 943918:tid 944174] [client 4.194.24.143:7178] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/num.php"] [unique_id "alxkEB70hbVC6SnzbhoeUwAAAQI"]
[Sat Jul 18 23:43:45.018851 2026] [security2:error] [pid 938041:tid 938176] [client 103.160.26.178:53252] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkESNrzsYMDd5sB106MAAAAAQ"]
[Sat Jul 18 23:43:45.018956 2026] [security2:error] [pid 938041:tid 938176] [client 103.160.26.178:53252] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkESNrzsYMDd5sB106MAAAAAQ"]
[Sat Jul 18 23:43:45.087955 2026] [security2:error] [pid 943918:tid 944115] [client 173.239.196.160:29657] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/bs1.php"] [unique_id "alxkER70hbVC6SnzbhoeWQAAAMc"]
[Sat Jul 18 23:43:45.094539 2026] [security2:error] [pid 943918:tid 943973] [remote 31.42.184.154:59492] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.idf.ldc.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxkER70hbVC6SnzbhoeWgAAtjU"], referer: https://mail.idf.ldc.mybluehost.me/wp-login.php
[Sat Jul 18 23:43:45.171224 2026] [security2:error] [pid 943918:tid 943980] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/7.php"] [unique_id "alxkER70hbVC6SnzbhoeXgABADw"]
[Sat Jul 18 23:43:45.171397 2026] [security2:error] [pid 943918:tid 944172] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/7.php"] [unique_id "alxkER70hbVC6SnzbhoeXgABADw"]
[Sat Jul 18 23:43:45.241100 2026] [security2:error] [pid 943918:tid 944095] [client 45.133.7.73:43079] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 73.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/atomlib.php"] [unique_id "alxkER70hbVC6SnzbhoeYQAAALM"]
[Sat Jul 18 23:43:45.299020 2026] [security2:error] [pid 943918:tid 944167] [client 138.252.89.100:59320] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkER70hbVC6SnzbhoeYwAAAPs"]
[Sat Jul 18 23:43:45.299123 2026] [security2:error] [pid 943918:tid 944167] [client 138.252.89.100:59320] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkER70hbVC6SnzbhoeYwAAAPs"]
[Sat Jul 18 23:43:45.302826 2026] [security2:error] [pid 943918:tid 944078] [client 13.232.206.133:20730] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.206.232.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxkER70hbVC6SnzbhoeYgAAAKI"]
[Sat Jul 18 23:43:45.302901 2026] [security2:error] [pid 943918:tid 944122] [client 36.83.95.75:49278] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkER70hbVC6SnzbhoeZAAAAM4"]
[Sat Jul 18 23:43:45.302930 2026] [security2:error] [pid 943918:tid 944078] [client 13.232.206.133:20730] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxkER70hbVC6SnzbhoeYgAAAKI"]
[Sat Jul 18 23:43:45.303013 2026] [security2:error] [pid 943918:tid 944122] [client 36.83.95.75:49278] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkER70hbVC6SnzbhoeZAAAAM4"]
[Sat Jul 18 23:43:45.380538 2026] [security2:error] [pid 943918:tid 943991] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/4563.php"] [unique_id "alxkER70hbVC6SnzbhoeagAAy0c"]
[Sat Jul 18 23:43:45.380662 2026] [security2:error] [pid 943918:tid 944119] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/4563.php"] [unique_id "alxkER70hbVC6SnzbhoeagAAy0c"]
[Sat Jul 18 23:43:45.412098 2026] [security2:error] [pid 943918:tid 944118] [client 106.222.249.209:25548] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkER70hbVC6SnzbhoebAAAAMo"]
[Sat Jul 18 23:43:45.412193 2026] [security2:error] [pid 943918:tid 944118] [client 106.222.249.209:25548] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkER70hbVC6SnzbhoebAAAAMo"]
[Sat Jul 18 23:43:45.542647 2026] [security2:error] [pid 943918:tid 944061] [client 4.194.24.143:7229] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/odf7udtspqtpxzyxmw2rccdefault.php"] [unique_id "alxkER70hbVC6SnzbhoedAAAAJE"]
[Sat Jul 18 23:43:45.579234 2026] [security2:error] [pid 943918:tid 944000] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/re.php"] [unique_id "alxkER70hbVC6SnzbhoedQAApFA"]
[Sat Jul 18 23:43:45.579393 2026] [security2:error] [pid 943918:tid 944080] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/re.php"] [unique_id "alxkER70hbVC6SnzbhoedQAApFA"]
[Sat Jul 18 23:43:45.769341 2026] [security2:error] [pid 943918:tid 943993] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/up.php"] [unique_id "alxkER70hbVC6SnzbhoefgAAl0k"]
[Sat Jul 18 23:43:45.769462 2026] [security2:error] [pid 943918:tid 944067] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/up.php"] [unique_id "alxkER70hbVC6SnzbhoefgAAl0k"]
[Sat Jul 18 23:43:45.926503 2026] [security2:error] [pid 938041:tid 938237] [client 45.133.7.59:30465] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 59.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "alxkESNrzsYMDd5sB106SQAAAEE"]
[Sat Jul 18 23:43:45.949145 2026] [security2:error] [pid 938041:tid 938254] [client 173.239.196.160:47583] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "alxkESNrzsYMDd5sB106SgAAAFI"]
[Sat Jul 18 23:43:45.968919 2026] [security2:error] [pid 943918:tid 944003] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/35.php"] [unique_id "alxkER70hbVC6SnzbhoehwAAsFM"]
[Sat Jul 18 23:43:45.969109 2026] [security2:error] [pid 943918:tid 944092] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/35.php"] [unique_id "alxkER70hbVC6SnzbhoehwAAsFM"]
[Sat Jul 18 23:43:46.112513 2026] [security2:error] [pid 943918:tid 944125] [client 4.194.24.143:7506] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/option.php"] [unique_id "alxkEh70hbVC6SnzbhoejQAAANE"]
[Sat Jul 18 23:43:46.216201 2026] [security2:error] [pid 943918:tid 944010] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/witm.php"] [unique_id "alxkEh70hbVC6SnzbhoekgABBFo"]
[Sat Jul 18 23:43:46.216365 2026] [security2:error] [pid 943918:tid 944176] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/witm.php"] [unique_id "alxkEh70hbVC6SnzbhoekgABBFo"]
[Sat Jul 18 23:43:46.406675 2026] [security2:error] [pid 943918:tid 943988] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/atomlib.php"] [unique_id "alxkEh70hbVC6SnzbhoelwAAwEQ"]
[Sat Jul 18 23:43:46.406868 2026] [security2:error] [pid 943918:tid 944108] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/atomlib.php"] [unique_id "alxkEh70hbVC6SnzbhoelwAAwEQ"]
[Sat Jul 18 23:43:46.433286 2026] [security2:error] [pid 943918:tid 944094] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/aaf.php"] [unique_id "alxkEh70hbVC6SnzbhoemQAAALI"]
[Sat Jul 18 23:43:46.433362 2026] [security2:error] [pid 943918:tid 944094] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/aaf.php"] [unique_id "alxkEh70hbVC6SnzbhoemQAAALI"]
[Sat Jul 18 23:43:46.611471 2026] [security2:error] [pid 943918:tid 944103] [client 45.133.7.74:37701] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/xl2023.php"] [unique_id "alxkEh70hbVC6SnzbhoenwAAALs"]
[Sat Jul 18 23:43:46.685885 2026] [security2:error] [pid 943918:tid 943985] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/bless2.php"] [unique_id "alxkEh70hbVC6SnzbhoeqgAA80E"]
[Sat Jul 18 23:43:46.686010 2026] [security2:error] [pid 943918:tid 944159] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/bless2.php"] [unique_id "alxkEh70hbVC6SnzbhoeqgAA80E"]
[Sat Jul 18 23:43:46.827582 2026] [security2:error] [pid 943918:tid 944150] [client 4.194.24.143:58806] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/p.php"] [unique_id "alxkEh70hbVC6SnzbhoetAAAAOo"]
[Sat Jul 18 23:43:46.844799 2026] [security2:error] [pid 943918:tid 944082] [client 173.239.196.162:60431] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/network.php"] [unique_id "alxkEh70hbVC6SnzbhoetQAAAKY"]
[Sat Jul 18 23:43:46.889858 2026] [security2:error] [pid 943918:tid 944016] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/new4.php"] [unique_id "alxkEh70hbVC6SnzbhoetwAA7GA"]
[Sat Jul 18 23:43:46.890036 2026] [security2:error] [pid 943918:tid 944152] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/new4.php"] [unique_id "alxkEh70hbVC6SnzbhoetwAA7GA"]
[Sat Jul 18 23:43:47.080227 2026] [security2:error] [pid 943918:tid 944001] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/wsr2.php"] [unique_id "alxkEx70hbVC6SnzbhoevwAAtFE"]
[Sat Jul 18 23:43:47.080397 2026] [security2:error] [pid 943918:tid 944096] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/wsr2.php"] [unique_id "alxkEx70hbVC6SnzbhoevwAAtFE"]
[Sat Jul 18 23:43:47.270210 2026] [security2:error] [pid 943918:tid 944014] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/shlo.php"] [unique_id "alxkEx70hbVC6SnzbhoeyAAAoV4"]
[Sat Jul 18 23:43:47.270380 2026] [security2:error] [pid 943918:tid 944077] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/shlo.php"] [unique_id "alxkEx70hbVC6SnzbhoeyAAAoV4"]
[Sat Jul 18 23:43:47.289843 2026] [security2:error] [pid 943918:tid 944151] [client 45.133.7.97:56295] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 97.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/certificates/admin.php"] [unique_id "alxkEx70hbVC6SnzbhoeyQAAAOs"]
[Sat Jul 18 23:43:47.627363 2026] [security2:error] [pid 943918:tid 944086] [client 4.194.24.143:7522] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/past.php"] [unique_id "alxkEx70hbVC6Snzbhoe1AAAAKo"]
[Sat Jul 18 23:43:47.747264 2026] [security2:error] [pid 938041:tid 938260] [client 173.239.196.161:52553] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/page.php"] [unique_id "alxkEyNrzsYMDd5sB106aAAAAFg"]
[Sat Jul 18 23:43:47.921938 2026] [security2:error] [pid 943918:tid 944158] [client 57.141.18.110:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxkEx70hbVC6Snzbhoe2AAAAPI"]
[Sat Jul 18 23:43:47.970184 2026] [security2:error] [pid 943918:tid 944057] [client 45.133.7.98:62327] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 98.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/images/media/dog.php"] [unique_id "alxkEx70hbVC6Snzbhoe5QAAAI0"]
[Sat Jul 18 23:43:47.984630 2026] [security2:error] [pid 943918:tid 943930] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/CLA.php"] [unique_id "alxkEx70hbVC6Snzbhoe5gAAlQo"]
[Sat Jul 18 23:43:47.984763 2026] [security2:error] [pid 943918:tid 944065] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/CLA.php"] [unique_id "alxkEx70hbVC6Snzbhoe5gAAlQo"]
[Sat Jul 18 23:43:48.002557 2026] [security2:error] [pid 938041:tid 938108] [remote 31.42.184.154:39270] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxkFCNrzsYMDd5sB106awAAQEE"]
[Sat Jul 18 23:43:48.230260 2026] [security2:error] [pid 938041:tid 938067] [remote 31.42.184.154:39270] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxkFCNrzsYMDd5sB106dAAAJhg"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:43:48.297907 2026] [security2:error] [pid 943918:tid 944107] [client 4.194.24.143:29143] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/php.php"] [unique_id "alxkFB70hbVC6Snzbhoe8wAAAL8"]
[Sat Jul 18 23:43:48.464309 2026] [security2:error] [pid 943918:tid 944149] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/term.php"] [unique_id "alxkFB70hbVC6Snzbhoe-AAAAOk"]
[Sat Jul 18 23:43:48.464436 2026] [security2:error] [pid 943918:tid 944149] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/term.php"] [unique_id "alxkFB70hbVC6Snzbhoe-AAAAOk"]
[Sat Jul 18 23:43:48.587082 2026] [security2:error] [pid 943918:tid 944028] [remote 20.197.192.193:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 193.192.197.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.willockhall.com"] [uri "/kill-9-1.php"] [unique_id "alxkFB70hbVC6Snzbhoe_wAA7Ww"]
[Sat Jul 18 23:43:48.587259 2026] [security2:error] [pid 943918:tid 944153] [client 20.197.192.193:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "webmail.willockhall.com"] [uri "/kill-9-1.php"] [unique_id "alxkFB70hbVC6Snzbhoe_wAA7Ww"]
[Sat Jul 18 23:43:48.651193 2026] [security2:error] [pid 943918:tid 944052] [client 45.133.7.68:49427] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 68.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/xp.php"] [unique_id "alxkFB70hbVC6SnzbhofBAAAAIg"]
[Sat Jul 18 23:43:48.654366 2026] [security2:error] [pid 943918:tid 944176] [client 173.239.196.162:38849] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "655"] [id "900155"] [msg "WP Brute UA block"] [hostname "sixpackminer.org"] [uri "/wp-admin/includes/index.php"] [unique_id "alxkFB70hbVC6SnzbhofBQAAAQQ"]
[Sat Jul 18 23:43:48.893598 2026] [security2:error] [pid 938041:tid 938205] [client 163.61.1.17:59794] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkFCNrzsYMDd5sB106hQAAACE"]
[Sat Jul 18 23:43:48.893715 2026] [security2:error] [pid 938041:tid 938205] [client 163.61.1.17:59794] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkFCNrzsYMDd5sB106hQAAACE"]
[Sat Jul 18 23:43:49.146883 2026] [security2:error] [pid 943918:tid 944098] [client 4.194.24.143:29131] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/php8.php"] [unique_id "alxkFR70hbVC6SnzbhofFwAAALY"]
[Sat Jul 18 23:43:49.332473 2026] [security2:error] [pid 943918:tid 944132] [client 45.133.7.63:54975] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "alxkFR70hbVC6SnzbhofHAAAANg"]
[Sat Jul 18 23:43:49.540093 2026] [security2:error] [pid 938041:tid 938279] [client 173.239.196.164:63551] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/uploads/chosen.php"] [unique_id "alxkFSNrzsYMDd5sB106lAAAAGs"]
[Sat Jul 18 23:43:49.814004 2026] [security2:error] [pid 938041:tid 938219] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/ha.php"] [unique_id "alxkFSNrzsYMDd5sB106mgAAAC8"]
[Sat Jul 18 23:43:49.814140 2026] [security2:error] [pid 938041:tid 938219] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/ha.php"] [unique_id "alxkFSNrzsYMDd5sB106mgAAAC8"]
[Sat Jul 18 23:43:49.851515 2026] [security2:error] [pid 943918:tid 944100] [client 4.194.24.143:63789] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/phpinfo.php"] [unique_id "alxkFR70hbVC6SnzbhofMQAAALg"]
[Sat Jul 18 23:43:50.013051 2026] [security2:error] [pid 938041:tid 938241] [client 45.133.7.90:24919] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 90.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/assets/index.php"] [unique_id "alxkFiNrzsYMDd5sB106pQAAAEU"]
[Sat Jul 18 23:43:50.397338 2026] [security2:error] [pid 943918:tid 944075] [client 173.239.196.161:48259] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/WordPressCore/include.php"] [unique_id "alxkFh70hbVC6SnzbhofQwAAAJ8"]
[Sat Jul 18 23:43:50.623831 2026] [security2:error] [pid 943918:tid 944055] [client 34.172.185.49:3458] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "abilityplus.org"] [uri "/wp-json/batch/v1"] [unique_id "alxkFh70hbVC6SnzbhofTAAAAIs"]
[Sat Jul 18 23:43:50.700409 2026] [security2:error] [pid 943918:tid 944049] [client 45.133.7.54:46205] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-links.php"] [unique_id "alxkFh70hbVC6SnzbhofUwAAAIU"]
[Sat Jul 18 23:43:50.857463 2026] [security2:error] [pid 938041:tid 938192] [client 4.194.24.143:29170] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/post.php"] [unique_id "alxkFiNrzsYMDd5sB106tQAAABQ"]
[Sat Jul 18 23:43:50.882290 2026] [security2:error] [pid 943918:tid 944167] [client 74.7.227.179:34628] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxkFh70hbVC6SnzbhofWAAA-yU"], referer: https://tejasenvironmental.com/p=681585
[Sat Jul 18 23:43:50.966288 2026] [security2:error] [pid 943918:tid 944065] [client 34.172.185.49:3458] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "abilityplus.org"] [uri "/"] [unique_id "alxkFh70hbVC6SnzbhofaAAAAJU"]
[Sat Jul 18 23:43:51.295781 2026] [security2:error] [pid 938041:tid 938233] [client 173.239.196.162:30499] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/admin-footer.php"] [unique_id "alxkFyNrzsYMDd5sB106xAAAAD0"]
[Sat Jul 18 23:43:51.381484 2026] [security2:error] [pid 943918:tid 944052] [client 45.133.7.80:54715] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/as.php"] [unique_id "alxkFx70hbVC6SnzbhoffgAAAIg"]
[Sat Jul 18 23:43:51.617076 2026] [security2:error] [pid 938041:tid 938181] [client 4.194.24.143:58752] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/public/assets/design_1/css/parts/course_cards/grid_card_1.min.php"] [unique_id "alxkFyNrzsYMDd5sB106ywAAAAk"]
[Sat Jul 18 23:43:51.702489 2026] [security2:error] [pid 938041:tid 938113] [remote 97.74.93.24:42366] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ivetstrategies.com"] [uri "/wp-login.php"] [unique_id "alxkFyNrzsYMDd5sB106zQAAIUY"]
[Sat Jul 18 23:43:52.026198 2026] [security2:error] [pid 943918:tid 944063] [client 34.172.185.49:19344] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "abilityplus.org"] [uri "/wp-json/batch/v1"] [unique_id "alxkGB70hbVC6SnzbhofoQAAAJM"]
[Sat Jul 18 23:43:52.061103 2026] [security2:error] [pid 943918:tid 944073] [client 45.133.7.68:38355] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 68.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/css/index.php"] [unique_id "alxkGB70hbVC6SnzbhofowAAAJ0"]
[Sat Jul 18 23:43:52.137860 2026] [security2:error] [pid 938041:tid 938076] [remote 97.74.93.24:42366] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ivetstrategies.com"] [uri "/wp-login.php"] [unique_id "alxkGCNrzsYMDd5sB1061QAAGCE"], referer: https://ivetstrategies.com/wp-login.php
[Sat Jul 18 23:43:52.162420 2026] [security2:error] [pid 943918:tid 944068] [client 4.194.24.143:29148] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/public/css.php"] [unique_id "alxkGB70hbVC6SnzbhofpQAAAJg"]
[Sat Jul 18 23:43:52.175514 2026] [security2:error] [pid 943918:tid 944173] [client 173.239.196.160:40189] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/modules/mod_simplefileuploadv1.3/elements/admin-footer.php"] [unique_id "alxkGB70hbVC6SnzbhofpgAAAQE"]
[Sat Jul 18 23:43:52.276879 2026] [security2:error] [pid 943918:tid 944087] [client 34.172.185.49:19344] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "abilityplus.org"] [uri "/"] [unique_id "alxkGB70hbVC6SnzbhofqAAAAKs"]
[Sat Jul 18 23:43:52.629458 2026] [security2:error] [pid 943918:tid 944137] [client 180.252.198.240:60610] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkGB70hbVC6SnzbhofvgAAAN0"]
[Sat Jul 18 23:43:52.629779 2026] [security2:error] [pid 943918:tid 944137] [client 180.252.198.240:60610] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkGB70hbVC6SnzbhofvgAAAN0"]
[Sat Jul 18 23:43:52.787004 2026] [security2:error] [pid 943918:tid 944060] [client 45.133.7.55:48119] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 55.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/ID3/index.php"] [unique_id "alxkGB70hbVC6SnzbhofwwAAAJA"]
[Sat Jul 18 23:43:53.012420 2026] [security2:error] [pid 943918:tid 944143] [client 173.239.196.164:22053] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/assets/info.php"] [unique_id "alxkGR70hbVC6SnzbhofywAAAOM"]
[Sat Jul 18 23:43:53.023647 2026] [security2:error] [pid 938041:tid 938221] [client 4.194.24.143:44762] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/r.php"] [unique_id "alxkGSNrzsYMDd5sB1066gAAADE"]
[Sat Jul 18 23:43:53.109392 2026] [security2:error] [pid 938041:tid 938215] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/hur.php"] [unique_id "alxkGSNrzsYMDd5sB1067AAAACs"]
[Sat Jul 18 23:43:53.109514 2026] [security2:error] [pid 938041:tid 938215] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/hur.php"] [unique_id "alxkGSNrzsYMDd5sB1067AAAACs"]
[Sat Jul 18 23:43:53.124926 2026] [security2:error] [pid 943918:tid 944075] [client 139.167.225.146:64093] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkGR70hbVC6Snzbhof0QAAAJ8"]
[Sat Jul 18 23:43:53.125059 2026] [security2:error] [pid 943918:tid 944075] [client 139.167.225.146:64093] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkGR70hbVC6Snzbhof0QAAAJ8"]
[Sat Jul 18 23:43:53.164957 2026] [security2:error] [pid 943918:tid 944098] [client 136.243.59.237:41530] ModSecurity: Warning. Matched phrase "DomainStatsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "www.ccsdifference.com"] [uri "/index.php"] [unique_id "alxkGB70hbVC6SnzbhofxAAAAPU"]
[Sat Jul 18 23:43:53.466632 2026] [security2:error] [pid 938041:tid 938200] [client 45.133.7.60:25391] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 60.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/pomo/admin.php"] [unique_id "alxkGSNrzsYMDd5sB1069wAAABw"]
[Sat Jul 18 23:43:53.873377 2026] [security2:error] [pid 943918:tid 944124] [client 173.239.196.167:36069] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "alxkGR70hbVC6Snzbhof8QAAANA"]
[Sat Jul 18 23:43:54.013457 2026] [security2:error] [pid 943918:tid 944091] [client 4.194.24.143:29133] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/radio.php"] [unique_id "alxkGh70hbVC6Snzbhof_AAAAK8"]
[Sat Jul 18 23:43:54.150565 2026] [security2:error] [pid 938041:tid 938174] [client 45.133.7.68:45305] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 68.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/IXR/security.php"] [unique_id "alxkGiNrzsYMDd5sB107CwAAAAI"]
[Sat Jul 18 23:43:54.179408 2026] [security2:error] [pid 943918:tid 944115] [client 24.10.41.53:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aosta.nz"] [uri "/index.php"] [unique_id "alxkGh70hbVC6SnzbhogAQAAAMc"]
[Sat Jul 18 23:43:54.389793 2026] [security2:error] [pid 943918:tid 944042] [remote 62.210.185.4:56182] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 4.185.210.62.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxkGh70hbVC6SnzbhogCQAAm3o"]
[Sat Jul 18 23:43:54.389973 2026] [security2:error] [pid 943918:tid 944071] [client 62.210.185.4:56182] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxkGh70hbVC6SnzbhogCQAAm3o"]
[Sat Jul 18 23:43:54.582300 2026] [security2:error] [pid 938041:tid 938162] [remote 103.255.134.61:50948] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.134.255.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxkGiNrzsYMDd5sB107EQAAXXc"]
[Sat Jul 18 23:43:54.756331 2026] [security2:error] [pid 943918:tid 944093] [client 173.239.196.164:32629] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/pomo/item.php"] [unique_id "alxkGh70hbVC6SnzbhogIAAAALE"]
[Sat Jul 18 23:43:54.838290 2026] [security2:error] [pid 943918:tid 944078] [client 45.133.7.78:52117] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 78.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/phpadmin/as.php"] [unique_id "alxkGh70hbVC6SnzbhogJAAAAKI"]
[Sat Jul 18 23:43:54.854263 2026] [security2:error] [pid 943918:tid 944150] [client 4.194.24.143:7185] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/randkeyword.php7"] [unique_id "alxkGh70hbVC6SnzbhogJgAAAOo"]
[Sat Jul 18 23:43:55.163679 2026] [security2:error] [pid 938041:tid 938043] [remote 103.255.134.61:50948] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.134.255.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxkGyNrzsYMDd5sB107GgAAOAA"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:43:55.521701 2026] [security2:error] [pid 938041:tid 938240] [client 45.133.7.98:22109] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 98.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "alxkGyNrzsYMDd5sB107JgAAAEQ"]
[Sat Jul 18 23:43:55.627966 2026] [security2:error] [pid 943918:tid 944151] [client 173.239.196.160:55091] ModSecurity: Warning. Pattern match "/1\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1543"] [id "900921"] [msg "temporary TUW-72162 logging rule"] [hostname "sixpackminer.org"] [uri "/wp-content/1.php%20"] [unique_id "alxkGx70hbVC6SnzbhogRgAAAOs"]
[Sat Jul 18 23:43:55.628076 2026] [security2:error] [pid 943918:tid 944151] [client 173.239.196.160:55091] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/1.php%20"] [unique_id "alxkGx70hbVC6SnzbhogRgAAAOs"]
[Sat Jul 18 23:43:55.660531 2026] [security2:error] [pid 943918:tid 944115] [client 103.160.26.178:53699] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkGx70hbVC6SnzbhogSAAAAMc"]
[Sat Jul 18 23:43:55.660626 2026] [security2:error] [pid 943918:tid 944115] [client 103.160.26.178:53699] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkGx70hbVC6SnzbhogSAAAAMc"]
[Sat Jul 18 23:43:55.782313 2026] [security2:error] [pid 938041:tid 938296] [client 4.194.24.143:7215] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/readme.php"] [unique_id "alxkGyNrzsYMDd5sB107LgAAAHw"]
[Sat Jul 18 23:43:55.914911 2026] [security2:error] [pid 938041:tid 938149] [remote 154.61.75.100:36940] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxkGyNrzsYMDd5sB107MgAAW2o"]
[Sat Jul 18 23:43:55.973335 2026] [security2:error] [pid 938041:tid 938199] [client 106.222.249.209:7561] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkGyNrzsYMDd5sB107MwAAABs"]
[Sat Jul 18 23:43:55.973425 2026] [security2:error] [pid 938041:tid 938199] [client 106.222.249.209:7561] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkGyNrzsYMDd5sB107MwAAABs"]
[Sat Jul 18 23:43:56.082913 2026] [security2:error] [pid 943918:tid 944071] [client 36.83.95.75:49733] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkHB70hbVC6SnzbhogWQAAAJs"]
[Sat Jul 18 23:43:56.083019 2026] [security2:error] [pid 943918:tid 944071] [client 36.83.95.75:49733] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkHB70hbVC6SnzbhogWQAAAJs"]
[Sat Jul 18 23:43:56.206142 2026] [security2:error] [pid 943918:tid 944064] [client 45.133.7.95:29885] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/hello.php"] [unique_id "alxkHB70hbVC6SnzbhogXQAAAJQ"]
[Sat Jul 18 23:43:56.258264 2026] [autoindex:error] [pid 938041:tid 938102] [remote 74.249.245.134:0] AH01276: Cannot serve directory /home2/aasgroup/public_html/ardhalwafaa/.well-known/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:43:56.258774 2026] [security2:error] [pid 938041:tid 938211] [client 74.249.245.134:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "403"] [hostname "ardhalwafaa.com"] [uri "/.well-known/"] [unique_id "alxkHCNrzsYMDd5sB107OgAAJzs"]
[Sat Jul 18 23:43:56.324688 2026] [security2:error] [pid 938041:tid 938114] [remote 154.61.75.100:36940] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxkHCNrzsYMDd5sB107OwAAUkc"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:43:56.496660 2026] [security2:error] [pid 943918:tid 944176] [client 173.239.196.162:62059] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/blue/wp-atom.php"] [unique_id "alxkHB70hbVC6SnzbhogbgAAAQQ"]
[Sat Jul 18 23:43:56.583722 2026] [security2:error] [pid 938041:tid 938191] [client 4.194.24.143:7187] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/reze.php"] [unique_id "alxkHCNrzsYMDd5sB107QAAAABM"]
[Sat Jul 18 23:43:56.834555 2026] [security2:error] [pid 938041:tid 938222] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/h02ugyh.php"] [unique_id "alxkHCNrzsYMDd5sB107SQAAADI"]
[Sat Jul 18 23:43:56.834647 2026] [security2:error] [pid 938041:tid 938222] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/h02ugyh.php"] [unique_id "alxkHCNrzsYMDd5sB107SQAAADI"]
[Sat Jul 18 23:43:56.885942 2026] [security2:error] [pid 938041:tid 938226] [client 45.133.7.96:59825] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 96.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/seoo/about.php"] [unique_id "alxkHCNrzsYMDd5sB107SgAAADY"]
[Sat Jul 18 23:43:57.286512 2026] [security2:error] [pid 938041:tid 938242] [client 4.194.24.143:7223] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/rh.php"] [unique_id "alxkHSNrzsYMDd5sB107UwAAAEY"]
[Sat Jul 18 23:43:57.296683 2026] [security2:error] [pid 938041:tid 938256] [client 138.252.89.100:59850] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkHSNrzsYMDd5sB107VAAAAFQ"]
[Sat Jul 18 23:43:57.296807 2026] [security2:error] [pid 938041:tid 938256] [client 138.252.89.100:59850] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkHSNrzsYMDd5sB107VAAAAFQ"]
[Sat Jul 18 23:43:57.373200 2026] [security2:error] [pid 938041:tid 938214] [client 173.239.196.165:25271] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "alxkHSNrzsYMDd5sB107VQAAACo"]
[Sat Jul 18 23:43:57.567112 2026] [security2:error] [pid 938041:tid 938228] [client 45.133.7.63:42047] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/fonts/about.php"] [unique_id "alxkHSNrzsYMDd5sB107WAAAADg"]
[Sat Jul 18 23:43:57.858694 2026] [security2:error] [pid 943918:tid 944176] [client 4.194.24.143:44749] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/rip.php"] [unique_id "alxkHR70hbVC6SnzbhogtQAAAQQ"]
[Sat Jul 18 23:43:58.243464 2026] [security2:error] [pid 943918:tid 944071] [client 173.239.196.160:52479] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/assets/install.php"] [unique_id "alxkHh70hbVC6SnzbhogyQAAAJs"]
[Sat Jul 18 23:43:58.250713 2026] [security2:error] [pid 943918:tid 944109] [client 45.133.7.74:25315] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/moon.php"] [unique_id "alxkHh70hbVC6SnzbhogzAAAAME"]
[Sat Jul 18 23:43:58.403707 2026] [security2:error] [pid 943918:tid 944095] [client 4.194.24.143:63754] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/root.php"] [unique_id "alxkHh70hbVC6Snzbhog0AAAALM"]
[Sat Jul 18 23:43:58.960390 2026] [security2:error] [pid 938041:tid 938264] [client 45.133.7.105:64249] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/user/about.php"] [unique_id "alxkHiNrzsYMDd5sB107bwAAAFw"]
[Sat Jul 18 23:43:58.990912 2026] [security2:error] [pid 943918:tid 944110] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/seiso.php"] [unique_id "alxkHh70hbVC6Snzbhog6gAAAMI"]
[Sat Jul 18 23:43:58.991031 2026] [security2:error] [pid 943918:tid 944110] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/seiso.php"] [unique_id "alxkHh70hbVC6Snzbhog6gAAAMI"]
[Sat Jul 18 23:43:59.002217 2026] [security2:error] [pid 943918:tid 944156] [client 4.194.24.143:29169] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/s.php"] [unique_id "alxkHx70hbVC6Snzbhog6wAAAPA"]
[Sat Jul 18 23:43:59.151504 2026] [security2:error] [pid 943918:tid 944104] [client 173.239.196.163:60255] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/acme-challenge/gecko-old.php"] [unique_id "alxkHx70hbVC6Snzbhog8AAAALw"]
[Sat Jul 18 23:43:59.546042 2026] [security2:error] [pid 943918:tid 944167] [client 4.194.24.143:44759] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/sang.php"] [unique_id "alxkHx70hbVC6SnzbhohBQAAAPs"]
[Sat Jul 18 23:43:59.641722 2026] [security2:error] [pid 938041:tid 938275] [client 45.133.7.89:62123] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 89.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/js/widgets/index.php"] [unique_id "alxkHyNrzsYMDd5sB107egAAAGc"]
[Sat Jul 18 23:43:59.914083 2026] [security2:error] [pid 943918:tid 944134] [client 163.61.1.17:60419] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkHx70hbVC6SnzbhohFgAAANo"]
[Sat Jul 18 23:43:59.914173 2026] [security2:error] [pid 943918:tid 944134] [client 163.61.1.17:60419] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkHx70hbVC6SnzbhohFgAAANo"]
[Sat Jul 18 23:43:59.927193 2026] [security2:error] [pid 943918:tid 944147] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/155.php"] [unique_id "alxkHx70hbVC6SnzbhohGAAAAOc"]
[Sat Jul 18 23:43:59.927263 2026] [security2:error] [pid 943918:tid 944147] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/155.php"] [unique_id "alxkHx70hbVC6SnzbhohGAAAAOc"]
[Sat Jul 18 23:44:00.058905 2026] [security2:error] [pid 938041:tid 938194] [client 173.239.196.160:24083] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/wp-login.php"] [unique_id "alxkICNrzsYMDd5sB107hAAAABY"]
[Sat Jul 18 23:44:00.125175 2026] [security2:error] [pid 943918:tid 944149] [client 4.194.24.143:44772] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/scxy.php"] [unique_id "alxkIB70hbVC6SnzbhohHQAAAOk"]
[Sat Jul 18 23:44:00.322511 2026] [security2:error] [pid 938041:tid 938184] [client 45.133.7.69:64821] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 69.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/webadmin.php"] [unique_id "alxkICNrzsYMDd5sB107jwAAAAw"]
[Sat Jul 18 23:44:00.850879 2026] [security2:error] [pid 943918:tid 944066] [client 4.194.24.143:31659] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/sd.php"] [unique_id "alxkIB70hbVC6SnzbhohNgAAAJY"]
[Sat Jul 18 23:44:00.910563 2026] [security2:error] [pid 938041:tid 938277] [client 173.239.196.160:63259] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/images/autoload_classmap.php"] [unique_id "alxkICNrzsYMDd5sB107mgAAAGk"]
[Sat Jul 18 23:44:01.012300 2026] [security2:error] [pid 938041:tid 938240] [client 45.133.7.94:46983] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 94.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "alxkISNrzsYMDd5sB107nQAAAEQ"]
[Sat Jul 18 23:44:01.443541 2026] [security2:error] [pid 943918:tid 944176] [client 4.194.24.143:31616] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/sf.php"] [unique_id "alxkIR70hbVC6SnzbhohSAAAAQQ"]
[Sat Jul 18 23:44:01.514617 2026] [security2:error] [pid 943918:tid 944015] [remote 209.42.21.221:60806] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 221.21.42.209.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "longevityperformanceclinic.com"] [uri "/wp-login.php"] [unique_id "alxkIR70hbVC6SnzbhohSwAAs18"]
[Sat Jul 18 23:44:01.701767 2026] [security2:error] [pid 938041:tid 938263] [client 45.133.7.64:57583] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 64.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/about.php"] [unique_id "alxkISNrzsYMDd5sB107rAAAAFs"]
[Sat Jul 18 23:44:01.750859 2026] [security2:error] [pid 943918:tid 944127] [client 173.239.196.163:64635] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "alxkIR70hbVC6SnzbhohUwAAANM"]
[Sat Jul 18 23:44:01.852852 2026] [security2:error] [pid 943918:tid 944120] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/ppp.php"] [unique_id "alxkIR70hbVC6SnzbhohWgAAAMw"]
[Sat Jul 18 23:44:01.852949 2026] [security2:error] [pid 943918:tid 944120] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/ppp.php"] [unique_id "alxkIR70hbVC6SnzbhohWgAAAMw"]
[Sat Jul 18 23:44:01.864998 2026] [security2:error] [pid 943918:tid 944044] [remote 97.74.93.24:56280] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.gpm.vvo.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxkIR70hbVC6SnzbhohWwAAxHw"]
[Sat Jul 18 23:44:01.873605 2026] [security2:error] [pid 943918:tid 944139] [client 23.160.60.156:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "phillipbloch.com"] [uri "/index.php"] [unique_id "alxkIB70hbVC6SnzbhohLAAAAN8"]
[Sat Jul 18 23:44:01.979153 2026] [security2:error] [pid 943918:tid 944031] [remote 209.42.21.221:60806] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 221.21.42.209.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "longevityperformanceclinic.com"] [uri "/wp-login.php"] [unique_id "alxkIR70hbVC6SnzbhohYAAAum8"], referer: https://longevityperformanceclinic.com/wp-login.php
[Sat Jul 18 23:44:02.004554 2026] [security2:error] [pid 943918:tid 944118] [client 4.194.24.143:31669] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/shell.php"] [unique_id "alxkIh70hbVC6SnzbhohYwAAAMo"]
[Sat Jul 18 23:44:02.251569 2026] [security2:error] [pid 943918:tid 944035] [remote 97.74.93.24:56280] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.gpm.vvo.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxkIh70hbVC6SnzbhohbAAAn3M"], referer: https://mail.gpm.vvo.mybluehost.me/wp-login.php
[Sat Jul 18 23:44:02.259870 2026] [ssl:error] [pid 938041:tid 938288] [client 3.233.59.216:18384] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname cpanel.app.threethirds.co provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:44:02.384581 2026] [security2:error] [pid 938041:tid 938272] [client 45.133.7.66:60089] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 66.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/xl2023.php"] [unique_id "alxkIiNrzsYMDd5sB107wwAAAGQ"]
[Sat Jul 18 23:44:02.488178 2026] [security2:error] [pid 943918:tid 943930] [remote 120.72.98.5:39210] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxkIh70hbVC6SnzbhohdQAApgo"]
[Sat Jul 18 23:44:02.488502 2026] [security2:error] [pid 943918:tid 944082] [client 120.72.98.5:39210] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxkIh70hbVC6SnzbhohdQAApgo"]
[Sat Jul 18 23:44:02.616716 2026] [security2:error] [pid 943918:tid 944168] [client 173.239.196.163:45171] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "alxkIh70hbVC6SnzbhohdgAAAPw"]
[Sat Jul 18 23:44:02.791070 2026] [security2:error] [pid 938041:tid 938185] [client 4.194.24.143:31655] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/sid3.php"] [unique_id "alxkIiNrzsYMDd5sB107zAAAAA0"]
[Sat Jul 18 23:44:02.934354 2026] [security2:error] [pid 938041:tid 938232] [client 180.252.198.240:61093] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkIiNrzsYMDd5sB1070wAAADw"]
[Sat Jul 18 23:44:02.934476 2026] [security2:error] [pid 938041:tid 938232] [client 180.252.198.240:61093] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkIiNrzsYMDd5sB1070wAAADw"]
[Sat Jul 18 23:44:03.080929 2026] [security2:error] [pid 938041:tid 938238] [client 45.133.7.101:49877] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 101.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/go.php"] [unique_id "alxkIyNrzsYMDd5sB1071wAAAEI"]
[Sat Jul 18 23:44:03.367513 2026] [security2:error] [pid 938041:tid 938269] [client 4.194.24.143:37542] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/simple.php"] [unique_id "alxkIyNrzsYMDd5sB1073AAAAGE"]
[Sat Jul 18 23:44:03.505857 2026] [security2:error] [pid 943918:tid 944068] [client 173.239.196.165:60285] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/install.php"] [unique_id "alxkIx70hbVC6SnzbhohogAAAJg"]
[Sat Jul 18 23:44:03.577045 2026] [security2:error] [pid 938041:tid 938095] [remote 97.74.93.24:57182] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "oohlovely.com"] [uri "/wp-login.php"] [unique_id "alxkIyNrzsYMDd5sB1074QAARDQ"]
[Sat Jul 18 23:44:03.763030 2026] [security2:error] [pid 943918:tid 944087] [client 45.133.7.87:53467] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 87.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/xleet.php"] [unique_id "alxkIx70hbVC6SnzbhohqwAAAKs"]
[Sat Jul 18 23:44:03.833406 2026] [security2:error] [pid 938041:tid 938127] [remote 69.163.181.218:33160] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 218.181.163.69.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxkIyNrzsYMDd5sB1074wAAMVQ"]
[Sat Jul 18 23:44:03.905593 2026] [security2:error] [pid 943918:tid 944145] [client 139.167.225.146:64729] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkIx70hbVC6SnzbhohrgAAAOU"]
[Sat Jul 18 23:44:03.905707 2026] [security2:error] [pid 943918:tid 944145] [client 139.167.225.146:64729] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkIx70hbVC6SnzbhohrgAAAOU"]
[Sat Jul 18 23:44:03.907067 2026] [security2:error] [pid 943918:tid 944134] [client 4.194.24.143:31677] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/sitemap.php"] [unique_id "alxkIx70hbVC6SnzbhohrwAAANo"]
[Sat Jul 18 23:44:03.971708 2026] [security2:error] [pid 938041:tid 938144] [remote 97.74.93.24:57182] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "oohlovely.com"] [uri "/wp-login.php"] [unique_id "alxkIyNrzsYMDd5sB1075gAAAWU"], referer: https://oohlovely.com/wp-login.php
[Sat Jul 18 23:44:04.037443 2026] [security2:error] [pid 938041:tid 938133] [remote 69.163.181.218:33160] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 218.181.163.69.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxkJCNrzsYMDd5sB1076QAAVVo"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:44:04.272848 2026] [security2:error] [pid 943918:tid 944033] [remote 47.128.55.205:60190] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "villa-m-medjugorje.com"] [uri "/accommodation-facility/wired-and-wireless-broadband-internet-access/"] [unique_id "alxkJB70hbVC6SnzbhohuwAAsnE"]
[Sat Jul 18 23:44:04.351638 2026] [security2:error] [pid 938041:tid 938255] [client 173.239.196.163:33209] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/install.php"] [unique_id "alxkJCNrzsYMDd5sB1079AAAAFM"]
[Sat Jul 18 23:44:04.444638 2026] [security2:error] [pid 938041:tid 938191] [client 45.133.7.65:50925] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 65.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/templates/beez3/bypass.php"] [unique_id "alxkJCNrzsYMDd5sB107-gAAABM"]
[Sat Jul 18 23:44:04.578536 2026] [security2:error] [pid 938041:tid 938246] [client 57.141.18.74:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxkJCNrzsYMDd5sB1079gAAAEo"]
[Sat Jul 18 23:44:04.641690 2026] [security2:error] [pid 943918:tid 943938] [remote 20.104.137.252:0] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "benbayly.co.nz"] [uri "/.env"] [unique_id "alxkJB70hbVC6SnzbhohywAA4RI"]
[Sat Jul 18 23:44:04.727573 2026] [security2:error] [pid 943918:tid 944146] [client 4.194.24.143:37512] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/size.php"] [unique_id "alxkJB70hbVC6SnzbhohzAAAAOY"]
[Sat Jul 18 23:44:05.054099 2026] [security2:error] [pid 938041:tid 938189] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/201.php"] [unique_id "alxkJSNrzsYMDd5sB108EAAAABE"]
[Sat Jul 18 23:44:05.054235 2026] [security2:error] [pid 938041:tid 938189] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/201.php"] [unique_id "alxkJSNrzsYMDd5sB108EAAAABE"]
[Sat Jul 18 23:44:05.132084 2026] [security2:error] [pid 943918:tid 944168] [client 45.133.7.91:58921] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 91.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/blue/ahax.php"] [unique_id "alxkJR70hbVC6Snzbhoh2wAAAPw"]
[Sat Jul 18 23:44:05.240994 2026] [security2:error] [pid 943918:tid 944105] [client 173.239.196.161:40777] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "alxkJR70hbVC6Snzbhoh3gAAAL0"]
[Sat Jul 18 23:44:05.286130 2026] [security2:error] [pid 943918:tid 944103] [client 4.194.24.143:29154] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/sm.php"] [unique_id "alxkJR70hbVC6Snzbhoh4QAAALs"]
[Sat Jul 18 23:44:05.821796 2026] [security2:error] [pid 938041:tid 938207] [client 45.133.7.60:26651] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 60.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/admin.php"] [unique_id "alxkJSNrzsYMDd5sB108IAAAACM"]
[Sat Jul 18 23:44:05.903811 2026] [security2:error] [pid 938041:tid 938221] [client 4.194.24.143:58754] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/sql.php"] [unique_id "alxkJSNrzsYMDd5sB108IQAAADE"]
[Sat Jul 18 23:44:05.912363 2026] [security2:error] [pid 943918:tid 944133] [client 3.109.49.224:29326] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.49.109.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxkJR70hbVC6Snzbhoh-gAAANk"]
[Sat Jul 18 23:44:05.912507 2026] [security2:error] [pid 943918:tid 944133] [client 3.109.49.224:29326] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxkJR70hbVC6Snzbhoh-gAAANk"]
[Sat Jul 18 23:44:06.154061 2026] [security2:error] [pid 938041:tid 938263] [client 173.239.196.165:28287] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/ws.php"] [unique_id "alxkJiNrzsYMDd5sB108JQAAAFs"]
[Sat Jul 18 23:44:06.297702 2026] [security2:error] [pid 943918:tid 944058] [client 103.160.26.178:54141] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkJh70hbVC6SnzbhoiCwAAAI4"]
[Sat Jul 18 23:44:06.297851 2026] [security2:error] [pid 943918:tid 944058] [client 103.160.26.178:54141] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkJh70hbVC6SnzbhoiCwAAAI4"]
[Sat Jul 18 23:44:06.454939 2026] [security2:error] [pid 938041:tid 938219] [client 36.83.95.75:50170] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkJiNrzsYMDd5sB108JwAAAC8"]
[Sat Jul 18 23:44:06.455081 2026] [security2:error] [pid 938041:tid 938219] [client 36.83.95.75:50170] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkJiNrzsYMDd5sB108JwAAAC8"]
[Sat Jul 18 23:44:06.502241 2026] [security2:error] [pid 938041:tid 938224] [client 45.133.7.88:64539] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 88.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/assets/file.php"] [unique_id "alxkJiNrzsYMDd5sB108KQAAADQ"]
[Sat Jul 18 23:44:06.569800 2026] [security2:error] [pid 943918:tid 944085] [client 4.194.24.143:37537] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/ss.php"] [unique_id "alxkJh70hbVC6SnzbhoiEgAAAKk"]
[Sat Jul 18 23:44:06.581711 2026] [security2:error] [pid 943918:tid 944151] [client 106.222.249.209:24477] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkJh70hbVC6SnzbhoiFAAAAOs"]
[Sat Jul 18 23:44:06.581799 2026] [security2:error] [pid 943918:tid 944151] [client 106.222.249.209:24477] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkJh70hbVC6SnzbhoiFAAAAOs"]
[Sat Jul 18 23:44:07.033847 2026] [security2:error] [pid 943918:tid 944131] [client 173.239.196.163:56031] ModSecurity: Warning. Pattern match "/1\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1543"] [id "900921"] [msg "temporary TUW-72162 logging rule"] [hostname "sixpackminer.org"] [uri "/wp-includes/rest-api/1.php"] [unique_id "alxkJx70hbVC6SnzbhoiIgAAANc"]
[Sat Jul 18 23:44:07.033942 2026] [security2:error] [pid 943918:tid 944131] [client 173.239.196.163:56031] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/rest-api/1.php"] [unique_id "alxkJx70hbVC6SnzbhoiIgAAANc"]
[Sat Jul 18 23:44:07.183544 2026] [security2:error] [pid 943918:tid 944123] [client 45.133.7.63:34857] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/cgi-bin/index.php"] [unique_id "alxkJx70hbVC6SnzbhoiLgAAAM8"]
[Sat Jul 18 23:44:07.287051 2026] [security2:error] [pid 943918:tid 944104] [client 4.194.24.143:44796] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/stats.php"] [unique_id "alxkJx70hbVC6SnzbhoiMAAAALw"]
[Sat Jul 18 23:44:07.382531 2026] [security2:error] [pid 938041:tid 938204] [client 57.141.18.70:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxkJyNrzsYMDd5sB108NgAAACA"]
[Sat Jul 18 23:44:07.392606 2026] [security2:error] [pid 943918:tid 944169] [client 152.42.185.27:51447] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.185.42.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "vfcthomasville-net.vfcthomasville.org"] [uri "/xmlrpc.php"] [unique_id "alxkJx70hbVC6SnzbhoiNAAAAP0"]
[Sat Jul 18 23:44:07.506691 2026] [security2:error] [pid 943918:tid 944100] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/ops.php"] [unique_id "alxkJx70hbVC6SnzbhoiNgAAALg"]
[Sat Jul 18 23:44:07.506793 2026] [security2:error] [pid 943918:tid 944100] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/ops.php"] [unique_id "alxkJx70hbVC6SnzbhoiNgAAALg"]
[Sat Jul 18 23:44:07.872053 2026] [security2:error] [pid 943918:tid 944105] [client 45.133.7.66:63229] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 66.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/uploads/file.php"] [unique_id "alxkJx70hbVC6SnzbhoiTAAAAL0"]
[Sat Jul 18 23:44:07.928709 2026] [security2:error] [pid 938041:tid 938299] [client 173.239.196.162:24877] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "alxkJyNrzsYMDd5sB108QQAAAH8"]
[Sat Jul 18 23:44:08.028153 2026] [security2:error] [pid 943918:tid 944076] [client 4.194.24.143:44747] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/sump1.php"] [unique_id "alxkKB70hbVC6SnzbhoiUQAAAKA"]
[Sat Jul 18 23:44:08.104005 2026] [security2:error] [pid 938041:tid 938184] [client 15.237.217.173:41070] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 173.217.237.15.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxkKCNrzsYMDd5sB108SAAAAAw"]
[Sat Jul 18 23:44:08.438678 2026] [proxy:error] [pid 938041:tid 938274] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:44:08.438764 2026] [proxy_http:error] [pid 938041:tid 938274] [client 193.47.62.168:33710] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:44:08.439297 2026] [proxy:error] [pid 938041:tid 938274] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:44:08.439326 2026] [proxy_http:error] [pid 938041:tid 938274] [client 193.47.62.168:33710] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:44:08.566069 2026] [security2:error] [pid 943918:tid 944169] [client 45.133.7.83:57091] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/view-more/ioxi.php"] [unique_id "alxkKB70hbVC6SnzbhoiZgAAAP0"]
[Sat Jul 18 23:44:08.818238 2026] [security2:error] [pid 943918:tid 944086] [client 4.194.24.143:29176] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/system.php"] [unique_id "alxkKB70hbVC6SnzbhoicQAAAKo"]
[Sat Jul 18 23:44:08.829713 2026] [security2:error] [pid 938041:tid 938224] [client 173.239.196.165:26243] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/shop.php"] [unique_id "alxkKCNrzsYMDd5sB108XAAAADQ"]
[Sat Jul 18 23:44:08.941501 2026] [security2:error] [pid 943918:tid 944000] [remote 103.90.233.75:34932] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.233.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxkKB70hbVC6SnzbhoidQAA2VA"]
[Sat Jul 18 23:44:09.137861 2026] [security2:error] [pid 938041:tid 938273] [client 138.252.89.100:60554] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkKSNrzsYMDd5sB108ZAAAAGU"]
[Sat Jul 18 23:44:09.138009 2026] [security2:error] [pid 938041:tid 938273] [client 138.252.89.100:60554] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkKSNrzsYMDd5sB108ZAAAAGU"]
[Sat Jul 18 23:44:09.247989 2026] [security2:error] [pid 943918:tid 944110] [client 45.133.7.84:31117] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 84.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "alxkKR70hbVC6SnzbhoigwAAAMI"]
[Sat Jul 18 23:44:09.346211 2026] [security2:error] [pid 943918:tid 944011] [remote 103.90.233.75:34932] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.233.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxkKR70hbVC6SnzbhoiigAA_1s"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:44:09.495687 2026] [security2:error] [pid 943918:tid 944172] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/ingfo.php"] [unique_id "alxkKR70hbVC6SnzbhoikwAAAQA"]
[Sat Jul 18 23:44:09.495802 2026] [security2:error] [pid 943918:tid 944172] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/ingfo.php"] [unique_id "alxkKR70hbVC6SnzbhoikwAAAQA"]
[Sat Jul 18 23:44:09.747960 2026] [security2:error] [pid 943918:tid 944124] [client 173.239.196.164:38711] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/pwnd-1/dedi1.php"] [unique_id "alxkKR70hbVC6SnzbhoingAAANA"]
[Sat Jul 18 23:44:09.916733 2026] [security2:error] [pid 943918:tid 944109] [client 4.194.24.143:7198] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/system/03n1hob7p03r2npdefault.php"] [unique_id "alxkKR70hbVC6SnzbhoiqwAAAME"]
[Sat Jul 18 23:44:09.943690 2026] [security2:error] [pid 943918:tid 944128] [client 45.133.7.88:41159] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 88.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "alxkKR70hbVC6SnzbhoirAAAANQ"]
[Sat Jul 18 23:44:09.950706 2026] [security2:error] [pid 943918:tid 944092] [client 163.61.1.17:60909] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkKR70hbVC6SnzbhoirQAAALA"]
[Sat Jul 18 23:44:09.950792 2026] [security2:error] [pid 943918:tid 944092] [client 163.61.1.17:60909] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkKR70hbVC6SnzbhoirQAAALA"]
[Sat Jul 18 23:44:10.633717 2026] [security2:error] [pid 943918:tid 944142] [client 45.133.7.83:60995] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/index.php"] [unique_id "alxkKh70hbVC6SnzbhoiyQAAAOI"]
[Sat Jul 18 23:44:10.636401 2026] [security2:error] [pid 943918:tid 944088] [client 173.239.196.161:48977] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/js/widgets/setting.php"] [unique_id "alxkKh70hbVC6SnzbhoiygAAAKw"]
[Sat Jul 18 23:44:10.674635 2026] [security2:error] [pid 943918:tid 944129] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/error_log.php"] [unique_id "alxkKh70hbVC6SnzbhoizgAAANU"]
[Sat Jul 18 23:44:10.674725 2026] [security2:error] [pid 943918:tid 944129] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/error_log.php"] [unique_id "alxkKh70hbVC6SnzbhoizgAAANU"]
[Sat Jul 18 23:44:11.298133 2026] [security2:error] [pid 938041:tid 938297] [client 4.194.24.143:37554] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/system/cj5ha2rah8lyiqqdefault.php"] [unique_id "alxkKyNrzsYMDd5sB108igAAAH0"]
[Sat Jul 18 23:44:11.493120 2026] [security2:error] [pid 943918:tid 944078] [client 173.239.196.160:64035] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "alxkKx70hbVC6Snzbhoi9wAAAKI"]
[Sat Jul 18 23:44:11.656205 2026] [security2:error] [pid 943918:tid 944135] [client 45.133.7.55:31155] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 55.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/admin.php"] [unique_id "alxkKx70hbVC6Snzbhoi_wAAANs"]
[Sat Jul 18 23:44:11.971924 2026] [security2:error] [pid 943918:tid 944129] [client 4.194.24.143:7201] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/system_log.php"] [unique_id "alxkKx70hbVC6SnzbhojDgAAANU"]
[Sat Jul 18 23:44:12.329436 2026] [security2:error] [pid 943918:tid 944109] [client 173.239.196.163:34467] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/light/as.php"] [unique_id "alxkLB70hbVC6SnzbhojHAAAAME"]
[Sat Jul 18 23:44:12.338671 2026] [security2:error] [pid 938041:tid 938216] [client 45.133.7.99:45939] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "alxkLCNrzsYMDd5sB108lAAAACw"]
[Sat Jul 18 23:44:12.391460 2026] [security2:error] [pid 943918:tid 944033] [remote 120.72.98.5:39204] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "crimargroup.com"] [uri "/wp-login.php"] [unique_id "alxkLB70hbVC6SnzbhojHwAAkXE"]
[Sat Jul 18 23:44:12.571041 2026] [security2:error] [pid 943918:tid 944028] [remote 4.205.168.44:49870] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxkLB70hbVC6SnzbhojJAAA4Gw"]
[Sat Jul 18 23:44:12.571224 2026] [security2:error] [pid 943918:tid 944140] [client 4.205.168.44:49870] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxkLB70hbVC6SnzbhojJAAA4Gw"]
[Sat Jul 18 23:44:12.823404 2026] [security2:error] [pid 943918:tid 944155] [client 4.194.24.143:29175] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/t.php"] [unique_id "alxkLB70hbVC6SnzbhojNgAAAO8"]
[Sat Jul 18 23:44:12.980646 2026] [security2:error] [pid 943918:tid 944108] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/xenon1337.php"] [unique_id "alxkLB70hbVC6SnzbhojQAAAAMA"]
[Sat Jul 18 23:44:12.980746 2026] [security2:error] [pid 943918:tid 944108] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/xenon1337.php"] [unique_id "alxkLB70hbVC6SnzbhojQAAAAMA"]
[Sat Jul 18 23:44:13.086216 2026] [security2:error] [pid 943918:tid 944091] [client 45.133.7.97:26531] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 97.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/images/wp-login.php"] [unique_id "alxkLR70hbVC6SnzbhojQQAAAK8"]
[Sat Jul 18 23:44:13.215688 2026] [security2:error] [pid 943918:tid 944054] [client 173.239.196.162:50781] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/user/header.php"] [unique_id "alxkLR70hbVC6SnzbhojTgAAAIo"]
[Sat Jul 18 23:44:13.272115 2026] [security2:error] [pid 943918:tid 944039] [remote 120.72.98.5:39204] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "crimargroup.com"] [uri "/wp-login.php"] [unique_id "alxkLR70hbVC6SnzbhojUQAA_nc"], referer: https://crimargroup.com/wp-login.php
[Sat Jul 18 23:44:13.453106 2026] [security2:error] [pid 943918:tid 944173] [client 4.194.24.143:37547] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/term.php"] [unique_id "alxkLR70hbVC6SnzbhojXgAAAQE"]
[Sat Jul 18 23:44:13.765858 2026] [security2:error] [pid 943918:tid 944068] [client 45.133.7.87:33713] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 87.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/ioxi/ioxiworm.php"] [unique_id "alxkLR70hbVC6SnzbhojaAAAAJg"]
[Sat Jul 18 23:44:14.009059 2026] [security2:error] [pid 943918:tid 943957] [remote 91.142.222.105:42862] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxkLR70hbVC6SnzbhojdwAAzSU"]
[Sat Jul 18 23:44:14.031723 2026] [security2:error] [pid 938041:tid 938212] [client 57.141.18.25:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxkLSNrzsYMDd5sB108rQAAACg"]
[Sat Jul 18 23:44:14.079953 2026] [security2:error] [pid 938041:tid 938177] [client 173.239.196.166:34737] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/IXR/about.php"] [unique_id "alxkLiNrzsYMDd5sB108uQAAAAU"]
[Sat Jul 18 23:44:14.290899 2026] [security2:error] [pid 943918:tid 944088] [client 4.194.24.143:37523] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/test.php"] [unique_id "alxkLh70hbVC6SnzbhojhQAAAKw"]
[Sat Jul 18 23:44:14.449001 2026] [security2:error] [pid 943918:tid 944071] [client 45.133.7.103:48603] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/blog/wp-content/about.php"] [unique_id "alxkLh70hbVC6SnzbhojigAAAJs"]
[Sat Jul 18 23:44:14.527247 2026] [security2:error] [pid 943918:tid 944120] [client 13.232.206.133:60142] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.206.232.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cryptomeaning.com"] [uri "/xmlrpc.php"] [unique_id "alxkLh70hbVC6SnzbhojjgAAAMw"]
[Sat Jul 18 23:44:14.527338 2026] [security2:error] [pid 943918:tid 944120] [client 13.232.206.133:60142] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cryptomeaning.com"] [uri "/xmlrpc.php"] [unique_id "alxkLh70hbVC6SnzbhojjgAAAMw"]
[Sat Jul 18 23:44:14.697189 2026] [security2:error] [pid 943918:tid 944086] [client 180.252.198.240:61591] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkLh70hbVC6SnzbhojkQAAAKo"]
[Sat Jul 18 23:44:14.697291 2026] [security2:error] [pid 943918:tid 944086] [client 180.252.198.240:61591] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkLh70hbVC6SnzbhojkQAAAKo"]
[Sat Jul 18 23:44:14.919629 2026] [security2:error] [pid 938041:tid 938190] [client 173.239.196.166:22075] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-api.php"] [unique_id "alxkLiNrzsYMDd5sB108xgAAABI"]
[Sat Jul 18 23:44:14.923817 2026] [security2:error] [pid 943918:tid 944175] [client 4.194.24.143:44738] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/test1.php"] [unique_id "alxkLh70hbVC6SnzbhojmQAAAQM"]
[Sat Jul 18 23:44:14.927788 2026] [security2:error] [pid 943918:tid 944147] [client 139.167.225.146:65374] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkLh70hbVC6SnzbhojmAAAAOc"]
[Sat Jul 18 23:44:14.927940 2026] [security2:error] [pid 943918:tid 944147] [client 139.167.225.146:65374] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkLh70hbVC6SnzbhojmAAAAOc"]
[Sat Jul 18 23:44:15.050554 2026] [security2:error] [pid 938041:tid 938297] [client 15.237.217.173:41074] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 173.217.237.15.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxkLyNrzsYMDd5sB108zAAAAH0"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:44:15.129404 2026] [security2:error] [pid 943918:tid 944102] [client 45.133.7.71:65263] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 71.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/hehehehe.php"] [unique_id "alxkLx70hbVC6SnzbhojoQAAALo"]
[Sat Jul 18 23:44:15.518231 2026] [security2:error] [pid 938041:tid 938245] [client 4.194.24.143:44795] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/tfm.php"] [unique_id "alxkLyNrzsYMDd5sB1082gAAAEk"]
[Sat Jul 18 23:44:15.629259 2026] [security2:error] [pid 938041:tid 938153] [remote 31.42.184.154:43058] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxkLyNrzsYMDd5sB1083AAAeG4"]
[Sat Jul 18 23:44:15.758585 2026] [security2:error] [pid 943918:tid 944093] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/test11.php"] [unique_id "alxkLx70hbVC6SnzbhojwgAAALE"]
[Sat Jul 18 23:44:15.758709 2026] [security2:error] [pid 943918:tid 944093] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/test11.php"] [unique_id "alxkLx70hbVC6SnzbhojwgAAALE"]
[Sat Jul 18 23:44:15.781816 2026] [security2:error] [pid 943918:tid 944071] [client 173.239.196.163:20125] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/install.php"] [unique_id "alxkLx70hbVC6SnzbhojxAAAAJs"]
[Sat Jul 18 23:44:15.829489 2026] [security2:error] [pid 943918:tid 944051] [client 45.133.7.66:31989] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 66.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/acme-challenge/install.php"] [unique_id "alxkLx70hbVC6SnzbhojxgAAAIc"]
[Sat Jul 18 23:44:15.857510 2026] [security2:error] [pid 938041:tid 938108] [remote 31.42.184.154:43058] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxkLyNrzsYMDd5sB1083wAAE0E"], referer: https://mezzacraft.com/wp-login.php
[Sat Jul 18 23:44:16.118684 2026] [security2:error] [pid 943918:tid 944066] [client 4.194.24.143:37512] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/thebe.php"] [unique_id "alxkMB70hbVC6Snzbhoj1AAAAJY"]
[Sat Jul 18 23:44:16.510236 2026] [security2:error] [pid 943918:tid 944101] [client 45.133.7.91:54477] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 91.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/acme-challenge/plugins.php"] [unique_id "alxkMB70hbVC6Snzbhoj5gAAALk"]
[Sat Jul 18 23:44:16.655235 2026] [security2:error] [pid 943918:tid 944172] [client 173.239.196.162:57607] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/css.php"] [unique_id "alxkMB70hbVC6Snzbhoj7QAAAQA"]
[Sat Jul 18 23:44:16.719646 2026] [security2:error] [pid 943918:tid 944163] [client 4.194.24.143:44790] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/themes.php"] [unique_id "alxkMB70hbVC6Snzbhoj8wAAAPc"]
[Sat Jul 18 23:44:16.766637 2026] [security2:error] [pid 943918:tid 944108] [client 74.208.214.194:45550] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxkMB70hbVC6Snzbhoj9wAAAMA"]
[Sat Jul 18 23:44:16.860560 2026] [security2:error] [pid 943918:tid 944121] [client 57.141.18.12:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxkMB70hbVC6Snzbhoj7wAAAM0"]
[Sat Jul 18 23:44:16.928545 2026] [security2:error] [pid 943918:tid 944067] [client 103.160.26.178:54605] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkMB70hbVC6Snzbhoj-QAAAJc"]
[Sat Jul 18 23:44:16.928644 2026] [security2:error] [pid 943918:tid 944067] [client 103.160.26.178:54605] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkMB70hbVC6Snzbhoj-QAAAJc"]
[Sat Jul 18 23:44:16.977205 2026] [security2:error] [pid 943918:tid 944004] [remote 91.142.222.105:42862] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxkMB70hbVC6SnzbhokAwAA4lQ"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:44:17.191952 2026] [security2:error] [pid 943918:tid 944138] [client 45.133.7.96:63675] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 96.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/acme-challenge/license.php"] [unique_id "alxkMR70hbVC6SnzbhokDwAAAN4"]
[Sat Jul 18 23:44:17.237128 2026] [security2:error] [pid 943918:tid 944166] [client 106.222.249.209:21507] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkMR70hbVC6SnzbhokEQAAAPo"]
[Sat Jul 18 23:44:17.237253 2026] [security2:error] [pid 943918:tid 944166] [client 106.222.249.209:21507] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkMR70hbVC6SnzbhokEQAAAPo"]
[Sat Jul 18 23:44:17.273723 2026] [security2:error] [pid 938041:tid 938299] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/koala.php"] [unique_id "alxkMSNrzsYMDd5sB1089gAAAH8"]
[Sat Jul 18 23:44:17.273833 2026] [security2:error] [pid 938041:tid 938299] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/koala.php"] [unique_id "alxkMSNrzsYMDd5sB1089gAAAH8"]
[Sat Jul 18 23:44:17.316607 2026] [security2:error] [pid 938041:tid 938196] [client 4.194.24.143:50905] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/tiny.php"] [unique_id "alxkMSNrzsYMDd5sB108-QAAABg"]
[Sat Jul 18 23:44:17.392736 2026] [security2:error] [pid 943918:tid 944097] [client 36.83.95.75:50649] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkMR70hbVC6SnzbhokFAAAALU"]
[Sat Jul 18 23:44:17.392858 2026] [security2:error] [pid 943918:tid 944097] [client 36.83.95.75:50649] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkMR70hbVC6SnzbhokFAAAALU"]
[Sat Jul 18 23:44:17.530000 2026] [security2:error] [pid 938041:tid 938222] [client 173.239.196.166:30943] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/db.php"] [unique_id "alxkMSNrzsYMDd5sB108-wAAADI"]
[Sat Jul 18 23:44:17.867811 2026] [security2:error] [pid 943918:tid 944145] [client 4.194.24.143:37526] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/tmp/byp.php"] [unique_id "alxkMR70hbVC6SnzbhokKAAAAOU"]
[Sat Jul 18 23:44:17.879118 2026] [security2:error] [pid 938041:tid 938199] [client 45.133.7.103:62333] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "alxkMSNrzsYMDd5sB109AwAAABs"]
[Sat Jul 18 23:44:18.429153 2026] [security2:error] [pid 943918:tid 944167] [client 173.239.196.160:21429] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "alxkMh70hbVC6SnzbhokPAAAAPs"]
[Sat Jul 18 23:44:18.567533 2026] [security2:error] [pid 943918:tid 944174] [client 45.133.7.58:27057] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/astra/inc/fm.php"] [unique_id "alxkMh70hbVC6SnzbhokSAAAAQI"]
[Sat Jul 18 23:44:18.969560 2026] [security2:error] [pid 943918:tid 944148] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/mac.php"] [unique_id "alxkMh70hbVC6SnzbhokWwAAAOg"]
[Sat Jul 18 23:44:18.969636 2026] [security2:error] [pid 943918:tid 944148] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/mac.php"] [unique_id "alxkMh70hbVC6SnzbhokWwAAAOg"]
[Sat Jul 18 23:44:19.269798 2026] [security2:error] [pid 938041:tid 938255] [client 173.239.196.160:20671] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/bypass.php"] [unique_id "alxkMyNrzsYMDd5sB109IwAAAFM"]
[Sat Jul 18 23:44:19.291311 2026] [security2:error] [pid 938041:tid 938273] [client 45.133.7.102:43861] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 102.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/ccx/index.php"] [unique_id "alxkMyNrzsYMDd5sB109IgAAAGU"]
[Sat Jul 18 23:44:19.971814 2026] [security2:error] [pid 943918:tid 944176] [client 45.133.7.97:59861] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 97.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/index.php"] [unique_id "alxkMx70hbVC6SnzbhokjwAAAQQ"]
[Sat Jul 18 23:44:20.105684 2026] [security2:error] [pid 943918:tid 944069] [client 173.239.196.164:43115] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/images/fm.php7"] [unique_id "alxkNB70hbVC6SnzbhoklQAAAJk"]
[Sat Jul 18 23:44:20.249252 2026] [security2:error] [pid 938041:tid 938194] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/25d653587fdfd1.php"] [unique_id "alxkNCNrzsYMDd5sB109MAAAABY"]
[Sat Jul 18 23:44:20.249368 2026] [security2:error] [pid 938041:tid 938194] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/25d653587fdfd1.php"] [unique_id "alxkNCNrzsYMDd5sB109MAAAABY"]
[Sat Jul 18 23:44:20.258459 2026] [security2:error] [pid 938041:tid 938241] [client 57.141.18.97:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxkNCNrzsYMDd5sB109LgAAAEU"]
[Sat Jul 18 23:44:20.546906 2026] [security2:error] [pid 938041:tid 938216] [client 156.238.251.148:50180] ModSecurity: Access denied with code 406 (phase 1). RBL lookup of 148.251.238.156.csi.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1548"] [id "900927"] [msg "contact-form RBL block: csi.websitewelcome.com"] [hostname "portkeytravelplanning.com"] [uri "/wp-comments-post.php"] [unique_id "alxkNCNrzsYMDd5sB109NwAAACw"]
[Sat Jul 18 23:44:20.547031 2026] [security2:error] [pid 938041:tid 938216] [client 156.238.251.148:50180] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "406"] [hostname "portkeytravelplanning.com"] [uri "/wp-comments-post.php"] [unique_id "alxkNCNrzsYMDd5sB109NwAAACw"]
[Sat Jul 18 23:44:20.568474 2026] [security2:error] [pid 943918:tid 944132] [client 163.61.1.17:61383] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkNB70hbVC6SnzbhokpwAAANg"]
[Sat Jul 18 23:44:20.568604 2026] [security2:error] [pid 943918:tid 944132] [client 163.61.1.17:61383] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkNB70hbVC6SnzbhokpwAAANg"]
[Sat Jul 18 23:44:20.658818 2026] [security2:error] [pid 943918:tid 944115] [client 45.133.7.62:57909] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/Requests/about.php"] [unique_id "alxkNB70hbVC6SnzbhoksgAAAMc"]
[Sat Jul 18 23:44:21.015610 2026] [security2:error] [pid 943918:tid 944151] [client 173.239.196.165:41737] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/count.php"] [unique_id "alxkNR70hbVC6SnzbhokxQAAAOs"]
[Sat Jul 18 23:44:21.030939 2026] [security2:error] [pid 943918:tid 944101] [client 138.252.89.100:63747] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkNR70hbVC6SnzbhokxgAAALk"]
[Sat Jul 18 23:44:21.031646 2026] [security2:error] [pid 943918:tid 944101] [client 138.252.89.100:63747] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkNR70hbVC6SnzbhokxgAAALk"]
[Sat Jul 18 23:44:21.071584 2026] [security2:error] [pid 943918:tid 943958] [remote 54.37.118.79:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "Mozilla\\\\/5\\\\.0 \\\\(compatible; AhrefsBot\\\\/\\\\d\\\\.\\\\d; \\\\+http:\\\\/\\\\/ahrefs\\\\.com\\\\/robot\\\\/\\\\)" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "578"] [id "900165"] [msg "AhrefsBot BOT Request"] [hostname "premiumoverhead.com"] [uri "/service-area/garage-door-spring-repair-in-tacoma-wa"] [unique_id "alxkNR70hbVC6SnzbhokyQAA8iY"]
[Sat Jul 18 23:44:21.071767 2026] [security2:error] [pid 943918:tid 944158] [client 54.37.118.79:0] ModSecurity: Warning. Matched phrase "AhrefsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "premiumoverhead.com"] [uri "/service-area/garage-door-spring-repair-in-tacoma-wa"] [unique_id "alxkNR70hbVC6SnzbhokyQAA8iY"]
[Sat Jul 18 23:44:21.107411 2026] [security2:error] [pid 943918:tid 944089] [client 66.249.89.66:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "tiokubito.cl"] [uri "/index.php"] [unique_id "alxkMh70hbVC6SnzbhokRgAArXo"], referer: https://tiokubito.cl/producto/%E3%80%90preventa%E3%80%91kawaii-studio-escala-1-6-fern-2/
[Sat Jul 18 23:44:21.125931 2026] [security2:error] [pid 943918:tid 944055] [client 34.210.88.185:59600] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.88.210.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cryptomeaning.com"] [uri "/wp-cron.php"] [unique_id "alxkNR70hbVC6SnzbhokygAAAIs"]
[Sat Jul 18 23:44:21.341366 2026] [security2:error] [pid 938041:tid 938247] [client 45.133.7.74:28659] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "alxkNSNrzsYMDd5sB109RQAAAEs"]
[Sat Jul 18 23:44:21.907036 2026] [security2:error] [pid 943918:tid 944166] [client 173.239.196.160:28277] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-error_log.php"] [unique_id "alxkNR70hbVC6Snzbhok7gAAAPo"]
[Sat Jul 18 23:44:22.028226 2026] [security2:error] [pid 943918:tid 944119] [client 45.133.7.95:32829] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "alxkNh70hbVC6Snzbhok9wAAAMs"]
[Sat Jul 18 23:44:22.511732 2026] [proxy:error] [pid 943918:tid 944145] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:44:22.511833 2026] [proxy_http:error] [pid 943918:tid 944145] [client 193.47.62.168:45598] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:44:22.512526 2026] [proxy:error] [pid 943918:tid 944145] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:44:22.512570 2026] [proxy_http:error] [pid 943918:tid 944145] [client 193.47.62.168:45598] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:44:22.728593 2026] [security2:error] [pid 943918:tid 944154] [client 45.133.7.105:26837] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "alxkNh70hbVC6SnzbholFQAAAO4"]
[Sat Jul 18 23:44:22.766122 2026] [security2:error] [pid 943918:tid 944132] [client 173.239.196.165:63317] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/assets/class_update_plugins.php"] [unique_id "alxkNh70hbVC6SnzbholFwAAANg"]
[Sat Jul 18 23:44:22.976127 2026] [security2:error] [pid 943918:tid 944114] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/wefile.php"] [unique_id "alxkNh70hbVC6SnzbholIQAAAMY"]
[Sat Jul 18 23:44:22.976219 2026] [security2:error] [pid 943918:tid 944114] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/wefile.php"] [unique_id "alxkNh70hbVC6SnzbholIQAAAMY"]
[Sat Jul 18 23:44:23.021628 2026] [security2:error] [pid 938041:tid 938286] [client 180.252.198.240:62102] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkNyNrzsYMDd5sB109ZwAAAHI"]
[Sat Jul 18 23:44:23.021781 2026] [security2:error] [pid 938041:tid 938286] [client 180.252.198.240:62102] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkNyNrzsYMDd5sB109ZwAAAHI"]
[Sat Jul 18 23:44:23.260346 2026] [security2:error] [pid 943918:tid 944049] [client 47.128.117.178:21574] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.keyq8.com"] [uri "/robots.txt"] [unique_id "alxkNx70hbVC6SnzbholLQAAAIU"]
[Sat Jul 18 23:44:23.410046 2026] [security2:error] [pid 943918:tid 944145] [client 45.133.7.99:29781] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "alxkNx70hbVC6SnzbholNwAAAOU"]
[Sat Jul 18 23:44:23.659199 2026] [security2:error] [pid 938041:tid 938285] [client 173.239.196.163:47989] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/network/av.php"] [unique_id "alxkNyNrzsYMDd5sB109bgAAAHE"]
[Sat Jul 18 23:44:23.945635 2026] [security2:error] [pid 943918:tid 943998] [remote 47.86.33.52:30306] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.upf.ztf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxkNx70hbVC6SnzbholTAAA2U4"]
[Sat Jul 18 23:44:23.945807 2026] [security2:error] [pid 943918:tid 944133] [client 47.86.33.52:30306] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "mail.upf.ztf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxkNx70hbVC6SnzbholTAAA2U4"]
[Sat Jul 18 23:44:24.094934 2026] [security2:error] [pid 943918:tid 944134] [client 45.133.7.77:41309] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 77.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "alxkOB70hbVC6SnzbholWAAAANo"]
[Sat Jul 18 23:44:24.522072 2026] [security2:error] [pid 943918:tid 944174] [client 173.239.196.164:46835] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/templates/beez5/error.php"] [unique_id "alxkOB70hbVC6SnzbholZgAAAQI"]
[Sat Jul 18 23:44:24.774051 2026] [security2:error] [pid 938041:tid 938265] [client 45.133.7.65:62587] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 65.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/ocean/index.php"] [unique_id "alxkOCNrzsYMDd5sB109fgAAAF0"]
[Sat Jul 18 23:44:24.906268 2026] [security2:error] [pid 943918:tid 944091] [client 136.243.59.237:47442] ModSecurity: Warning. Matched phrase "DomainStatsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "www.ccsdifference.com"] [uri "/index.php"] [unique_id "alxkOB70hbVC6SnzbholZwAAAK8"]
[Sat Jul 18 23:44:25.355841 2026] [security2:error] [pid 938041:tid 938238] [client 173.239.196.166:62561] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/network/admin-footer.php"] [unique_id "alxkOSNrzsYMDd5sB109iAAAAEI"]
[Sat Jul 18 23:44:25.433864 2026] [security2:error] [pid 943918:tid 944137] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.awellpacedlife.com"] [uri "/index.cgi"] [unique_id "alxkOR70hbVC6SnzbholjQAAAN0"]
[Sat Jul 18 23:44:25.471057 2026] [security2:error] [pid 943918:tid 944122] [client 45.133.7.105:49059] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/images/media/index.php"] [unique_id "alxkOR70hbVC6SnzbhollQAAAM4"]
[Sat Jul 18 23:44:25.603684 2026] [security2:error] [pid 938041:tid 938178] [client 139.167.225.146:49700] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkOSNrzsYMDd5sB109kAAAAAY"]
[Sat Jul 18 23:44:25.603842 2026] [security2:error] [pid 938041:tid 938178] [client 139.167.225.146:49700] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkOSNrzsYMDd5sB109kAAAAAY"]
[Sat Jul 18 23:44:25.605314 2026] [security2:error] [pid 943918:tid 944058] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "404"] [hostname "www.awellpacedlife.com"] [uri "/wp-admin/js/"] [unique_id "alxkOR70hbVC6SnzbholnwAAAI4"]
[Sat Jul 18 23:44:25.805485 2026] [security2:error] [pid 943918:tid 944127] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/wp-admin/css/colour.php"] [unique_id "alxkOR70hbVC6SnzbholpwAAANM"]
[Sat Jul 18 23:44:25.805586 2026] [security2:error] [pid 943918:tid 944127] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/wp-admin/css/colour.php"] [unique_id "alxkOR70hbVC6SnzbholpwAAANM"]
[Sat Jul 18 23:44:26.151848 2026] [security2:error] [pid 938041:tid 938202] [client 45.133.7.76:58735] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 76.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "alxkOiNrzsYMDd5sB109ngAAAB4"]
[Sat Jul 18 23:44:26.192021 2026] [security2:error] [pid 943918:tid 944152] [client 173.239.196.165:49079] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/js/firewall.php7"] [unique_id "alxkOh70hbVC6SnzbholtwAAAOw"]
[Sat Jul 18 23:44:26.268582 2026] [autoindex:error] [pid 943918:tid 943925] [remote 216.73.217.23:18168] AH01276: Cannot serve directory /home2/flhkrvmy/public_html/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:44:26.832128 2026] [security2:error] [pid 943918:tid 944154] [client 45.133.7.73:37847] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 73.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "alxkOh70hbVC6Snzbhol6QAAAO4"]
[Sat Jul 18 23:44:27.073757 2026] [security2:error] [pid 943918:tid 944084] [client 173.239.196.167:28281] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "alxkOx70hbVC6Snzbhol8wAAAKg"]
[Sat Jul 18 23:44:27.564111 2026] [security2:error] [pid 943918:tid 944127] [client 45.133.7.82:36059] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "alxkOx70hbVC6SnzbhomAgAAANM"]
[Sat Jul 18 23:44:27.636781 2026] [security2:error] [pid 938041:tid 938186] [client 103.160.26.178:55055] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkOyNrzsYMDd5sB109uQAAAA4"]
[Sat Jul 18 23:44:27.636874 2026] [security2:error] [pid 938041:tid 938186] [client 103.160.26.178:55055] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkOyNrzsYMDd5sB109uQAAAA4"]
[Sat Jul 18 23:44:27.727509 2026] [security2:error] [pid 943918:tid 944124] [client 36.83.95.75:51087] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkOx70hbVC6SnzbhomDAAAANA"]
[Sat Jul 18 23:44:27.727606 2026] [security2:error] [pid 943918:tid 944124] [client 36.83.95.75:51087] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkOx70hbVC6SnzbhomDAAAANA"]
[Sat Jul 18 23:44:27.793731 2026] [security2:error] [pid 938041:tid 938194] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/2P.php"] [unique_id "alxkOyNrzsYMDd5sB109vQAAABY"]
[Sat Jul 18 23:44:27.793848 2026] [security2:error] [pid 938041:tid 938194] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/2P.php"] [unique_id "alxkOyNrzsYMDd5sB109vQAAABY"]
[Sat Jul 18 23:44:27.930090 2026] [security2:error] [pid 943918:tid 944053] [client 173.239.196.162:64503] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/assets/about.php"] [unique_id "alxkOx70hbVC6SnzbhomGAAAAIk"]
[Sat Jul 18 23:44:27.970948 2026] [security2:error] [pid 938041:tid 938246] [client 106.222.249.209:10065] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkOyNrzsYMDd5sB109vwAAAEo"]
[Sat Jul 18 23:44:27.971219 2026] [security2:error] [pid 938041:tid 938246] [client 106.222.249.209:10065] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkOyNrzsYMDd5sB109vwAAAEo"]
[Sat Jul 18 23:44:28.244599 2026] [security2:error] [pid 943918:tid 944078] [client 45.133.7.60:43009] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 60.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/maint/themes.php"] [unique_id "alxkPB70hbVC6SnzbhomMAAAAKI"]
[Sat Jul 18 23:44:28.758776 2026] [core:error] [pid 943918:tid 944080] [client 159.223.195.105:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:44:28.758797 2026] [core:error] [pid 943918:tid 944080] [client 159.223.195.105:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:44:28.802369 2026] [security2:error] [pid 943918:tid 944104] [client 173.239.196.163:43401] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/js/file/incpb.php"] [unique_id "alxkPB70hbVC6SnzbhomUQAAALw"]
[Sat Jul 18 23:44:28.881845 2026] [proxy:error] [pid 943918:tid 944131] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:44:28.881925 2026] [proxy_http:error] [pid 943918:tid 944131] [client 193.47.62.168:45602] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:44:28.882527 2026] [proxy:error] [pid 943918:tid 944131] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:44:28.882555 2026] [proxy_http:error] [pid 943918:tid 944131] [client 193.47.62.168:45602] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:44:28.928768 2026] [security2:error] [pid 943918:tid 944053] [client 45.133.7.60:21421] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 60.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/seoplugins/index.php"] [unique_id "alxkPB70hbVC6SnzbhomVQAAAIk"]
[Sat Jul 18 23:44:28.964080 2026] [ssl:error] [pid 938041:tid 938254] [client 98.84.1.175:33173] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname cpcontacts.maplerespiteservices.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:44:29.621178 2026] [security2:error] [pid 943918:tid 944074] [client 45.133.7.93:64105] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 93.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/fonts/themes.php"] [unique_id "alxkPR70hbVC6SnzbhomfgAAAJ4"]
[Sat Jul 18 23:44:29.671902 2026] [security2:error] [pid 943918:tid 944051] [client 173.239.196.167:63711] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/images/stories/themes.php"] [unique_id "alxkPR70hbVC6SnzbhomggAAAIc"]
[Sat Jul 18 23:44:29.798131 2026] [security2:error] [pid 943918:tid 944119] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/.well-known/about.php"] [unique_id "alxkPR70hbVC6SnzbhomhQAAAMs"]
[Sat Jul 18 23:44:29.798236 2026] [security2:error] [pid 943918:tid 944119] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/.well-known/about.php"] [unique_id "alxkPR70hbVC6SnzbhomhQAAAMs"]
[Sat Jul 18 23:44:29.915434 2026] [core:error] [pid 943918:tid 944166] [client 159.223.195.105:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace., referer: https://webmail.uritems.net/
[Sat Jul 18 23:44:29.915453 2026] [core:error] [pid 943918:tid 944166] [client 159.223.195.105:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace., referer: https://webmail.uritems.net/
[Sat Jul 18 23:44:30.182613 2026] [security2:error] [pid 943918:tid 944097] [client 3.109.49.224:19078] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.49.109.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxkPh70hbVC6SnzbhomkAAAALU"]
[Sat Jul 18 23:44:30.182690 2026] [security2:error] [pid 943918:tid 944097] [client 3.109.49.224:19078] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxkPh70hbVC6SnzbhomkAAAALU"]
[Sat Jul 18 23:44:30.306791 2026] [security2:error] [pid 943918:tid 944069] [client 45.133.7.86:50741] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 86.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/twentytwentytwo/assets/fonts/index.php"] [unique_id "alxkPh70hbVC6SnzbhomlwAAAJk"]
[Sat Jul 18 23:44:30.524339 2026] [security2:error] [pid 938041:tid 938297] [client 173.239.196.164:46067] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "alxkPiNrzsYMDd5sB1093gAAAH0"]
[Sat Jul 18 23:44:30.918042 2026] [security2:error] [pid 938041:tid 938060] [remote 31.42.184.154:40334] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aandarealtygroup.com"] [uri "/wp-login.php"] [unique_id "alxkPiNrzsYMDd5sB1096QAAdxE"]
[Sat Jul 18 23:44:30.998489 2026] [security2:error] [pid 943918:tid 944106] [client 45.133.7.82:40855] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/certificates/index.php"] [unique_id "alxkPh70hbVC6SnzbhomswAAAL4"]
[Sat Jul 18 23:44:31.150857 2026] [security2:error] [pid 943918:tid 944055] [client 163.61.1.17:61860] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkPx70hbVC6SnzbhomuAAAAIs"]
[Sat Jul 18 23:44:31.150987 2026] [security2:error] [pid 943918:tid 944055] [client 163.61.1.17:61860] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkPx70hbVC6SnzbhomuAAAAIs"]
[Sat Jul 18 23:44:31.238245 2026] [security2:error] [pid 938041:tid 938135] [remote 31.42.184.154:40334] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aandarealtygroup.com"] [uri "/wp-login.php"] [unique_id "alxkPyNrzsYMDd5sB1097gAAaVw"], referer: https://aandarealtygroup.com/wp-login.php
[Sat Jul 18 23:44:31.322423 2026] [security2:error] [pid 938041:tid 938262] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "alxkPyNrzsYMDd5sB1098gAAAFo"]
[Sat Jul 18 23:44:31.322505 2026] [security2:error] [pid 938041:tid 938262] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "alxkPyNrzsYMDd5sB1098gAAAFo"]
[Sat Jul 18 23:44:31.387180 2026] [security2:error] [pid 943918:tid 944053] [client 173.239.196.165:65397] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/firewall.php7"] [unique_id "alxkPx70hbVC6SnzbhomwQAAAIk"]
[Sat Jul 18 23:44:31.665730 2026] [security2:error] [pid 943918:tid 944133] [client 74.208.214.194:53216] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxkPx70hbVC6Snzbhom0wAAANk"]
[Sat Jul 18 23:44:31.676989 2026] [security2:error] [pid 943918:tid 944137] [client 45.133.7.88:59061] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 88.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/byp.php"] [unique_id "alxkPx70hbVC6Snzbhom1wAAAN0"]
[Sat Jul 18 23:44:32.278027 2026] [security2:error] [pid 943918:tid 944151] [client 173.239.196.160:22265] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/home/O-Simple.php"] [unique_id "alxkQB70hbVC6Snzbhom8wAAAOs"]
[Sat Jul 18 23:44:32.356870 2026] [security2:error] [pid 943918:tid 944154] [client 45.133.7.74:45307] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/blog/wp-includes/about.php"] [unique_id "alxkQB70hbVC6Snzbhom-AAAAO4"]
[Sat Jul 18 23:44:32.768101 2026] [security2:error] [pid 938041:tid 938241] [client 138.252.89.100:55262] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkQCNrzsYMDd5sB10-CgAAAEU"]
[Sat Jul 18 23:44:32.768206 2026] [security2:error] [pid 938041:tid 938241] [client 138.252.89.100:55262] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkQCNrzsYMDd5sB10-CgAAAEU"]
[Sat Jul 18 23:44:33.089276 2026] [security2:error] [pid 943918:tid 943929] [remote 31.42.184.154:40350] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxkQR70hbVC6SnzbhonIAAA4Qk"]
[Sat Jul 18 23:44:33.095249 2026] [security2:error] [pid 943918:tid 944121] [client 45.133.7.93:59159] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 93.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "alxkQR70hbVC6SnzbhonHwAAAM0"]
[Sat Jul 18 23:44:33.178641 2026] [security2:error] [pid 938041:tid 938222] [client 173.239.196.161:46297] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "alxkQSNrzsYMDd5sB10-EQAAADI"]
[Sat Jul 18 23:44:33.354185 2026] [security2:error] [pid 943918:tid 944032] [remote 31.42.184.154:40350] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxkQR70hbVC6SnzbhonLQAAkXA"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:44:33.791066 2026] [security2:error] [pid 938041:tid 938200] [client 45.133.7.64:46919] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 64.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/blog/wp-admin/about.php"] [unique_id "alxkQSNrzsYMDd5sB10-GgAAABw"]
[Sat Jul 18 23:44:34.024843 2026] [security2:error] [pid 943918:tid 944146] [client 180.252.198.240:62598] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkQh70hbVC6SnzbhonTwAAAOY"]
[Sat Jul 18 23:44:34.024946 2026] [security2:error] [pid 943918:tid 944146] [client 180.252.198.240:62598] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkQh70hbVC6SnzbhonTwAAAOY"]
[Sat Jul 18 23:44:34.076260 2026] [security2:error] [pid 938041:tid 938205] [client 173.239.196.161:51145] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/vars-soap.php"] [unique_id "alxkQiNrzsYMDd5sB10-IQAAACE"]
[Sat Jul 18 23:44:34.260224 2026] [core:error] [pid 938041:tid 938280] [client 133.167.125.159:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:44:34.260232 2026] [core:error] [pid 938041:tid 938221] [client 133.167.125.159:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:44:34.260246 2026] [core:error] [pid 938041:tid 938280] [client 133.167.125.159:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:44:34.260254 2026] [core:error] [pid 938041:tid 938221] [client 133.167.125.159:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:44:34.451894 2026] [security2:error] [pid 943918:tid 944124] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/bob.php"] [unique_id "alxkQh70hbVC6SnzbhonYQAAANA"]
[Sat Jul 18 23:44:34.452013 2026] [security2:error] [pid 943918:tid 944124] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/bob.php"] [unique_id "alxkQh70hbVC6SnzbhonYQAAANA"]
[Sat Jul 18 23:44:34.469502 2026] [security2:error] [pid 943918:tid 944153] [client 45.133.7.89:25945] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 89.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/twentyfive/include.php"] [unique_id "alxkQh70hbVC6SnzbhonZQAAAO0"]
[Sat Jul 18 23:44:34.972273 2026] [security2:error] [pid 943918:tid 944146] [client 173.239.196.161:44747] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/twentytwentytwo/av.php"] [unique_id "alxkQh70hbVC6SnzbhongwAAAOY"]
[Sat Jul 18 23:44:35.159323 2026] [security2:error] [pid 938041:tid 938248] [client 45.133.7.74:45299] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/css/about.php"] [unique_id "alxkQyNrzsYMDd5sB10-OQAAAEw"]
[Sat Jul 18 23:44:35.837291 2026] [security2:error] [pid 943918:tid 944159] [client 45.133.7.102:55439] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 102.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/cgi-bin/install.php"] [unique_id "alxkQx70hbVC6SnzbhonpgAAAPM"]
[Sat Jul 18 23:44:35.847930 2026] [security2:error] [pid 943918:tid 944167] [client 173.239.196.165:63391] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/style.php%20"] [unique_id "alxkQx70hbVC6SnzbhonqQAAAPs"]
[Sat Jul 18 23:44:36.482181 2026] [security2:error] [pid 943918:tid 943965] [remote 31.42.184.154:40364] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "giftofgiving-usa.org"] [uri "/wp-login.php"] [unique_id "alxkRB70hbVC6Snzbhon0gAAii0"]
[Sat Jul 18 23:44:36.520719 2026] [security2:error] [pid 943918:tid 944091] [client 45.133.7.88:27575] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 88.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/wso.php"] [unique_id "alxkRB70hbVC6Snzbhon1AAAAK8"]
[Sat Jul 18 23:44:36.711918 2026] [security2:error] [pid 943918:tid 943996] [remote 31.42.184.154:40364] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "giftofgiving-usa.org"] [uri "/wp-login.php"] [unique_id "alxkRB70hbVC6Snzbhon3wAA8kw"], referer: https://giftofgiving-usa.org/wp-login.php
[Sat Jul 18 23:44:36.724728 2026] [security2:error] [pid 938041:tid 938202] [client 173.239.196.165:27547] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/files.php"] [unique_id "alxkRCNrzsYMDd5sB10-YQAAAB4"]
[Sat Jul 18 23:44:36.733002 2026] [security2:error] [pid 943918:tid 944128] [client 62.45.36.212:40103] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxkRB70hbVC6Snzbhon2QAAANQ"]
[Sat Jul 18 23:44:36.961614 2026] [ssl:error] [pid 938041:tid 938193] [client 54.86.115.253:64977] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname cpcalendars.alaskabearviewing-net.ninilchik.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:44:37.098935 2026] [security2:error] [pid 943918:tid 944104] [client 139.167.225.146:50388] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkRR70hbVC6Snzbhon7gAAALw"]
[Sat Jul 18 23:44:37.099036 2026] [security2:error] [pid 943918:tid 944104] [client 139.167.225.146:50388] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkRR70hbVC6Snzbhon7gAAALw"]
[Sat Jul 18 23:44:37.201319 2026] [security2:error] [pid 938041:tid 938239] [client 45.133.7.103:30837] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/class.api.php"] [unique_id "alxkRSNrzsYMDd5sB10-bAAAAEM"]
[Sat Jul 18 23:44:37.448347 2026] [security2:error] [pid 943918:tid 944156] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.awellpacedlife.com"] [uri "/index.cgi"] [unique_id "alxkRR70hbVC6Snzbhon_gAAAPA"]
[Sat Jul 18 23:44:37.535331 2026] [security2:error] [pid 943918:tid 944065] [client 34.210.88.185:59060] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.88.210.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxkRR70hbVC6SnzbhooBAAAAJU"]
[Sat Jul 18 23:44:37.537732 2026] [security2:error] [pid 938041:tid 938245] [client 54.149.239.117:37872] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.239.149.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxkRSNrzsYMDd5sB10-cwAAAEk"]
[Sat Jul 18 23:44:37.547793 2026] [security2:error] [pid 938041:tid 938251] [client 54.149.239.117:37878] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.239.149.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxkRSNrzsYMDd5sB10-dAAAAE8"]
[Sat Jul 18 23:44:37.614699 2026] [security2:error] [pid 938041:tid 938292] [client 173.239.196.162:49561] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/av.php"] [unique_id "alxkRSNrzsYMDd5sB10-dQAAAHg"]
[Sat Jul 18 23:44:37.748900 2026] [security2:error] [pid 943918:tid 944054] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.awellpacedlife.com"] [uri "/index.cgi"] [unique_id "alxkRR70hbVC6SnzbhooBwAAAIo"]
[Sat Jul 18 23:44:37.802820 2026] [security2:error] [pid 938041:tid 938228] [client 16.145.89.170:57164] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 170.89.145.16.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxkRSNrzsYMDd5sB10-fgAAADg"]
[Sat Jul 18 23:44:37.938867 2026] [security2:error] [pid 943918:tid 944158] [client 45.133.7.71:27479] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 71.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "alxkRR70hbVC6SnzbhooEQAAAPI"]
[Sat Jul 18 23:44:37.984711 2026] [security2:error] [pid 943918:tid 944159] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/crgio.php"] [unique_id "alxkRR70hbVC6SnzbhooFgAAAPM"]
[Sat Jul 18 23:44:37.984825 2026] [security2:error] [pid 943918:tid 944159] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/crgio.php"] [unique_id "alxkRR70hbVC6SnzbhooFgAAAPM"]
[Sat Jul 18 23:44:38.111022 2026] [security2:error] [pid 943918:tid 944133] [client 185.210.89.142:44189] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 142.89.210.185.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "waterproofgoods.com"] [uri "/xmlrpc.php"] [unique_id "alxkRh70hbVC6SnzbhooGQAAANk"]
[Sat Jul 18 23:44:38.111135 2026] [security2:error] [pid 943918:tid 944133] [client 185.210.89.142:44189] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "waterproofgoods.com"] [uri "/xmlrpc.php"] [unique_id "alxkRh70hbVC6SnzbhooGQAAANk"]
[Sat Jul 18 23:44:38.200845 2026] [security2:error] [pid 943918:tid 944151] [client 103.160.26.178:55516] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkRh70hbVC6SnzbhooIAAAAOs"]
[Sat Jul 18 23:44:38.200943 2026] [security2:error] [pid 943918:tid 944151] [client 103.160.26.178:55516] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkRh70hbVC6SnzbhooIAAAAOs"]
[Sat Jul 18 23:44:38.378719 2026] [security2:error] [pid 943918:tid 944052] [client 36.83.95.75:51563] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkRh70hbVC6SnzbhooJgAAAIg"]
[Sat Jul 18 23:44:38.378890 2026] [security2:error] [pid 943918:tid 944052] [client 36.83.95.75:51563] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkRh70hbVC6SnzbhooJgAAAIg"]
[Sat Jul 18 23:44:38.488353 2026] [security2:error] [pid 938041:tid 938172] [client 173.239.196.164:45737] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/about.php"] [unique_id "alxkRiNrzsYMDd5sB10-hwAAAAA"]
[Sat Jul 18 23:44:38.561657 2026] [security2:error] [pid 943918:tid 944094] [client 106.222.249.209:7931] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkRh70hbVC6SnzbhooLAAAALI"]
[Sat Jul 18 23:44:38.561763 2026] [security2:error] [pid 943918:tid 944094] [client 106.222.249.209:7931] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkRh70hbVC6SnzbhooLAAAALI"]
[Sat Jul 18 23:44:38.618980 2026] [security2:error] [pid 938041:tid 938216] [client 45.133.7.87:61279] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 87.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/radio.php"] [unique_id "alxkRiNrzsYMDd5sB10-igAAACw"]
[Sat Jul 18 23:44:38.722224 2026] [security2:error] [pid 938041:tid 938073] [remote 31.42.184.154:40370] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxkRiNrzsYMDd5sB10-jwAAIB4"]
[Sat Jul 18 23:44:39.096992 2026] [security2:error] [pid 938041:tid 938112] [remote 31.42.184.154:40370] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxkRyNrzsYMDd5sB10-ngAAHkU"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:44:39.299722 2026] [security2:error] [pid 943918:tid 944064] [client 45.133.7.99:23087] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/system_log.php"] [unique_id "alxkRx70hbVC6SnzbhooSwAAAJQ"]
[Sat Jul 18 23:44:39.367198 2026] [security2:error] [pid 943918:tid 944129] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/pucci.php"] [unique_id "alxkRx70hbVC6SnzbhooUAAAANU"]
[Sat Jul 18 23:44:39.367289 2026] [security2:error] [pid 943918:tid 944129] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/pucci.php"] [unique_id "alxkRx70hbVC6SnzbhooUAAAANU"]
[Sat Jul 18 23:44:39.720311 2026] [security2:error] [pid 938041:tid 938142] [remote 31.42.184.154:51388] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "dlu.cjf.mybluehost.me"] [uri "/blog/wp-login.php"] [unique_id "alxkRyNrzsYMDd5sB10-pQAACGM"]
[Sat Jul 18 23:44:39.818581 2026] [security2:error] [pid 943918:tid 944120] [client 173.239.196.163:53707] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "alxkRx70hbVC6SnzbhooZgAAAMw"]
[Sat Jul 18 23:44:39.947288 2026] [security2:error] [pid 938041:tid 938086] [remote 31.42.184.154:51388] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "dlu.cjf.mybluehost.me"] [uri "/blog/wp-login.php"] [unique_id "alxkRyNrzsYMDd5sB10-qwAAaSs"], referer: https://dlu.cjf.mybluehost.me/blog/wp-login.php
[Sat Jul 18 23:44:39.981448 2026] [security2:error] [pid 938041:tid 938264] [client 45.133.7.101:61133] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 101.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.alf.php"] [unique_id "alxkRyNrzsYMDd5sB10-rQAAAFw"]
[Sat Jul 18 23:44:40.666380 2026] [security2:error] [pid 938041:tid 938176] [client 45.133.7.80:34043] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wso.php"] [unique_id "alxkSCNrzsYMDd5sB10-uQAAAAQ"]
[Sat Jul 18 23:44:40.699538 2026] [security2:error] [pid 943918:tid 944137] [client 173.239.196.160:60507] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/WordPressCore/gecko.php"] [unique_id "alxkSB70hbVC6SnzbhooiAAAAN0"]
[Sat Jul 18 23:44:41.159337 2026] [security2:error] [pid 938041:tid 938074] [remote 167.71.240.77:59486] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 77.240.71.167.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxkSSNrzsYMDd5sB10-wgAAKx8"]
[Sat Jul 18 23:44:41.248997 2026] [security2:error] [pid 943918:tid 944061] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.awellpacedlife.com"] [uri "/index.cgi"] [unique_id "alxkSR70hbVC6SnzbhooqAAAAJE"]
[Sat Jul 18 23:44:41.327660 2026] [security2:error] [pid 943918:tid 944092] [client 91.192.181.23:57543] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.adambergeron.com"] [uri "/index.php"] [unique_id "alxkRx70hbVC6SnzbhoobQAAsG4"]
[Sat Jul 18 23:44:41.335757 2026] [security2:error] [pid 938041:tid 938093] [remote 47.128.120.194:19074] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "tomokaoakshistory.com"] [uri "/robots.txt"] [unique_id "alxkSSNrzsYMDd5sB10-yAAAADI"]
[Sat Jul 18 23:44:41.346055 2026] [security2:error] [pid 938041:tid 938241] [client 45.133.7.89:57419] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 89.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/blocks/about.php"] [unique_id "alxkSSNrzsYMDd5sB10-yQAAAEU"]
[Sat Jul 18 23:44:41.366731 2026] [security2:error] [pid 938041:tid 938094] [remote 167.71.240.77:59486] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 77.240.71.167.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxkSSNrzsYMDd5sB10-ygAAVDM"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:44:41.478524 2026] [security2:error] [pid 943918:tid 944085] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.awellpacedlife.com"] [uri "/index.cgi"] [unique_id "alxkSR70hbVC6SnzbhoosAAAAKk"]
[Sat Jul 18 23:44:41.541662 2026] [security2:error] [pid 943918:tid 944164] [client 173.239.196.165:46331] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/baxa1.php7"] [unique_id "alxkSR70hbVC6SnzbhootAAAAPg"]
[Sat Jul 18 23:44:41.606324 2026] [security2:error] [pid 943918:tid 944152] [client 163.61.1.17:62336] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkSR70hbVC6SnzbhootgAAAOw"]
[Sat Jul 18 23:44:41.607717 2026] [security2:error] [pid 943918:tid 944152] [client 163.61.1.17:62336] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkSR70hbVC6SnzbhootgAAAOw"]
[Sat Jul 18 23:44:41.650726 2026] [security2:error] [pid 943918:tid 944098] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/wp-temp.php"] [unique_id "alxkSR70hbVC6SnzbhootwAAALY"]
[Sat Jul 18 23:44:41.650842 2026] [security2:error] [pid 943918:tid 944098] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/wp-temp.php"] [unique_id "alxkSR70hbVC6SnzbhootwAAALY"]
[Sat Jul 18 23:44:42.032891 2026] [security2:error] [pid 943918:tid 944125] [client 45.133.7.66:20961] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 66.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/flower.php"] [unique_id "alxkSh70hbVC6SnzbhoozwAAANE"]
[Sat Jul 18 23:44:42.410418 2026] [security2:error] [pid 938041:tid 938297] [client 173.239.196.167:63071] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "alxkSiNrzsYMDd5sB10-3AAAAH0"]
[Sat Jul 18 23:44:42.713798 2026] [security2:error] [pid 943918:tid 944106] [client 45.133.7.65:50735] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 65.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/wp-class.php"] [unique_id "alxkSh70hbVC6Snzbhoo6gAAAL4"]
[Sat Jul 18 23:44:42.749365 2026] [security2:error] [pid 943918:tid 944042] [remote 31.42.184.154:51392] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "wgs.doq.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxkSh70hbVC6Snzbhoo7gAAkXo"]
[Sat Jul 18 23:44:42.866103 2026] [security2:error] [pid 938041:tid 938298] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.awellpacedlife.com"] [uri "/index.cgi"] [unique_id "alxkSiNrzsYMDd5sB10-6gAAAH4"]
[Sat Jul 18 23:44:42.872895 2026] [security2:error] [pid 938041:tid 938120] [remote 209.42.21.221:47058] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 221.21.42.209.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/wp-login.php"] [unique_id "alxkSiNrzsYMDd5sB10-7AAAd00"]
[Sat Jul 18 23:44:43.033799 2026] [security2:error] [pid 938041:tid 938264] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/wp-admin/js/index.php"] [unique_id "alxkSyNrzsYMDd5sB10-8AAAAFw"]
[Sat Jul 18 23:44:43.033889 2026] [security2:error] [pid 938041:tid 938264] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/wp-admin/js/index.php"] [unique_id "alxkSyNrzsYMDd5sB10-8AAAAFw"]
[Sat Jul 18 23:44:43.110255 2026] [security2:error] [pid 938041:tid 938143] [remote 209.42.21.221:47058] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 221.21.42.209.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/wp-login.php"] [unique_id "alxkSyNrzsYMDd5sB10-9AAAD2Q"], referer: https://youpositive.co/wp-login.php
[Sat Jul 18 23:44:43.215077 2026] [security2:error] [pid 943918:tid 944083] [client 49.228.171.102:50232] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "adambergeron.com"] [uri "/index.php"] [unique_id "alxkSx70hbVC6Snzbhoo_gAApyw"]
[Sat Jul 18 23:44:43.248879 2026] [security2:error] [pid 943918:tid 944079] [client 66.249.74.42:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.marketingonetoone.net"] [uri "/index.php"] [unique_id "alxkSR70hbVC6SnzbhoowgAAAKM"]
[Sat Jul 18 23:44:43.286430 2026] [security2:error] [pid 943918:tid 944158] [client 173.239.196.163:37271] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/pwnd/dedi1.php"] [unique_id "alxkSx70hbVC6SnzbhopCgAAAPI"]
[Sat Jul 18 23:44:43.300304 2026] [security2:error] [pid 943918:tid 943962] [remote 31.42.184.154:51392] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "wgs.doq.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxkSx70hbVC6SnzbhopCwAAiSo"], referer: https://wgs.doq.mybluehost.me/wp-login.php
[Sat Jul 18 23:44:43.396191 2026] [security2:error] [pid 943918:tid 944057] [client 45.133.7.90:29461] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 90.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/js/autoload_classmap.php"] [unique_id "alxkSx70hbVC6SnzbhopEwAAAI0"]
[Sat Jul 18 23:44:43.995035 2026] [security2:error] [pid 943918:tid 944115] [client 180.252.198.240:63065] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkSx70hbVC6SnzbhopMQAAAMc"]
[Sat Jul 18 23:44:43.995135 2026] [security2:error] [pid 943918:tid 944115] [client 180.252.198.240:63065] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkSx70hbVC6SnzbhopMQAAAMc"]
[Sat Jul 18 23:44:44.075684 2026] [security2:error] [pid 943918:tid 944126] [client 45.133.7.79:36151] ModSecurity: Warning. Pattern match "/1\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1543"] [id "900921"] [msg "temporary TUW-72162 logging rule"] [hostname "nikkidesigns.net"] [uri "/wp-content/1.php"] [unique_id "alxkTB70hbVC6SnzbhopNAAAANI"]
[Sat Jul 18 23:44:44.075809 2026] [security2:error] [pid 943918:tid 944126] [client 45.133.7.79:36151] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 79.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/1.php"] [unique_id "alxkTB70hbVC6SnzbhopNAAAANI"]
[Sat Jul 18 23:44:44.174204 2026] [security2:error] [pid 938041:tid 938191] [client 173.239.196.166:46999] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "alxkTCNrzsYMDd5sB10_BAAAABM"]
[Sat Jul 18 23:44:44.601730 2026] [security2:error] [pid 938041:tid 938140] [remote 217.182.128.41:51974] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.128.182.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxkTCNrzsYMDd5sB10_EAAAP2E"]
[Sat Jul 18 23:44:44.645029 2026] [security2:error] [pid 943918:tid 944090] [client 138.252.89.100:55791] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkTB70hbVC6SnzbhopTAAAAK4"]
[Sat Jul 18 23:44:44.645125 2026] [security2:error] [pid 943918:tid 944090] [client 138.252.89.100:55791] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkTB70hbVC6SnzbhopTAAAAK4"]
[Sat Jul 18 23:44:44.756571 2026] [security2:error] [pid 938041:tid 938237] [client 45.133.7.90:47825] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 90.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/ioxi-o.php"] [unique_id "alxkTCNrzsYMDd5sB10_EQAAAEE"]
[Sat Jul 18 23:44:45.056237 2026] [security2:error] [pid 938041:tid 938234] [client 173.239.196.166:59453] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/blog.php"] [unique_id "alxkTSNrzsYMDd5sB10_GAAAAD4"]
[Sat Jul 18 23:44:45.156786 2026] [security2:error] [pid 938041:tid 938085] [remote 217.182.128.41:51974] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.128.182.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxkTSNrzsYMDd5sB10_HQAATio"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:44:45.203061 2026] [security2:error] [pid 943918:tid 944150] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/puc.php"] [unique_id "alxkTR70hbVC6SnzbhopXAAAAOo"]
[Sat Jul 18 23:44:45.203185 2026] [security2:error] [pid 943918:tid 944150] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/puc.php"] [unique_id "alxkTR70hbVC6SnzbhopXAAAAOo"]
[Sat Jul 18 23:44:45.445880 2026] [security2:error] [pid 943918:tid 944101] [client 45.133.7.61:59513] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/info.php"] [unique_id "alxkTR70hbVC6SnzbhopZQAAALk"]
[Sat Jul 18 23:44:45.943982 2026] [security2:error] [pid 938041:tid 938267] [client 173.239.196.167:31875] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/about/install.php"] [unique_id "alxkTSNrzsYMDd5sB10_LQAAAF8"]
[Sat Jul 18 23:44:46.126663 2026] [security2:error] [pid 943918:tid 944052] [client 45.133.7.79:56941] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 79.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/setup.php"] [unique_id "alxkTh70hbVC6SnzbhophgAAAIg"]
[Sat Jul 18 23:44:46.199468 2026] [security2:error] [pid 943918:tid 944155] [client 62.45.36.212:40221] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxkTh70hbVC6SnzbhopggAAAO8"]
[Sat Jul 18 23:44:46.797150 2026] [security2:error] [pid 943918:tid 944134] [client 173.239.196.162:20323] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/pridmag/bypass.php"] [unique_id "alxkTh70hbVC6SnzbhopqQAAANo"]
[Sat Jul 18 23:44:46.810081 2026] [security2:error] [pid 943918:tid 944164] [client 45.133.7.81:63777] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 81.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.bod/.ll/ss.php"] [unique_id "alxkTh70hbVC6SnzbhopqwAAAPg"]
[Sat Jul 18 23:44:47.359480 2026] [security2:error] [pid 943918:tid 944062] [client 139.167.225.146:51056] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkTx70hbVC6SnzbhopwQAAAJI"]
[Sat Jul 18 23:44:47.359567 2026] [security2:error] [pid 943918:tid 944062] [client 139.167.225.146:51056] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkTx70hbVC6SnzbhopwQAAAJI"]
[Sat Jul 18 23:44:47.490392 2026] [security2:error] [pid 943918:tid 944143] [client 45.133.7.60:27675] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 60.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/radio.php"] [unique_id "alxkTx70hbVC6SnzbhopxgAAAOM"]
[Sat Jul 18 23:44:47.674152 2026] [security2:error] [pid 943918:tid 944089] [client 173.239.196.162:62703] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/network/chosen.php"] [unique_id "alxkTx70hbVC6SnzbhopzgAAAK0"]
[Sat Jul 18 23:44:47.860300 2026] [security2:error] [pid 943918:tid 944090] [client 69.79.201.164:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "taskidsvirginia.com"] [uri "/index.php"] [unique_id "alxkTx70hbVC6SnzbhopxQAAAK4"]
[Sat Jul 18 23:44:48.169024 2026] [security2:error] [pid 943918:tid 944168] [client 45.133.7.61:48535] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugin.php"] [unique_id "alxkUB70hbVC6Snzbhop2AAAAPw"]
[Sat Jul 18 23:44:48.424010 2026] [security2:error] [pid 943918:tid 944131] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/themes.php"] [unique_id "alxkUB70hbVC6Snzbhop5wAAANc"]
[Sat Jul 18 23:44:48.424100 2026] [security2:error] [pid 943918:tid 944131] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/themes.php"] [unique_id "alxkUB70hbVC6Snzbhop5wAAANc"]
[Sat Jul 18 23:44:48.494341 2026] [security2:error] [pid 938041:tid 938264] [client 109.105.210.52:12300] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "lifeisbetterlakeside.com"] [uri "/index.php"] [unique_id "alxkTyNrzsYMDd5sB10_XwAAXHo"]
[Sat Jul 18 23:44:48.579236 2026] [security2:error] [pid 943918:tid 944136] [client 173.239.196.167:59413] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/images/av.php"] [unique_id "alxkUB70hbVC6Snzbhop7gAAANw"]
[Sat Jul 18 23:44:48.805507 2026] [security2:error] [pid 943918:tid 944129] [client 103.160.26.178:55970] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkUB70hbVC6Snzbhop-gAAANU"]
[Sat Jul 18 23:44:48.805645 2026] [security2:error] [pid 943918:tid 944129] [client 103.160.26.178:55970] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkUB70hbVC6Snzbhop-gAAANU"]
[Sat Jul 18 23:44:48.855904 2026] [security2:error] [pid 938041:tid 938272] [client 45.133.7.66:20443] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 66.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/ectoplasm/about.php"] [unique_id "alxkUCNrzsYMDd5sB10_dgAAAGQ"]
[Sat Jul 18 23:44:48.993377 2026] [security2:error] [pid 943918:tid 944071] [client 36.83.95.75:52021] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkUB70hbVC6SnzbhoqAQAAAJs"]
[Sat Jul 18 23:44:48.993467 2026] [security2:error] [pid 943918:tid 944071] [client 36.83.95.75:52021] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkUB70hbVC6SnzbhoqAQAAAJs"]
[Sat Jul 18 23:44:49.247697 2026] [security2:error] [pid 943918:tid 944148] [client 106.222.249.209:6787] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkUR70hbVC6SnzbhoqEAAAAOg"]
[Sat Jul 18 23:44:49.248855 2026] [security2:error] [pid 943918:tid 944148] [client 106.222.249.209:6787] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkUR70hbVC6SnzbhoqEAAAAOg"]
[Sat Jul 18 23:44:49.259646 2026] [security2:error] [pid 943918:tid 944152] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/dx.php"] [unique_id "alxkUR70hbVC6SnzbhoqEwAAAOw"]
[Sat Jul 18 23:44:49.259720 2026] [security2:error] [pid 943918:tid 944152] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/dx.php"] [unique_id "alxkUR70hbVC6SnzbhoqEwAAAOw"]
[Sat Jul 18 23:44:49.279459 2026] [security2:error] [pid 938041:tid 938179] [remote 109.105.210.52:12300] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "lifeisbetterlakeside.com"] [uri "/index.php"] [unique_id "alxkUCNrzsYMDd5sB10_cQAABBU"]
[Sat Jul 18 23:44:49.450636 2026] [security2:error] [pid 938041:tid 938191] [client 173.239.196.167:41641] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "alxkUSNrzsYMDd5sB10_gAAAABM"]
[Sat Jul 18 23:44:49.536188 2026] [security2:error] [pid 943918:tid 944055] [client 45.133.7.94:22493] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 94.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/as.php"] [unique_id "alxkUR70hbVC6SnzbhoqHQAAAIs"]
[Sat Jul 18 23:44:49.578593 2026] [security2:error] [pid 943918:tid 943937] [remote 113.160.142.119:35656] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.yok.mqz.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxkUR70hbVC6SnzbhoqIQAAkRE"]
[Sat Jul 18 23:44:49.762299 2026] [security2:error] [pid 938041:tid 938279] [client 109.105.210.54:38976] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "lifeisbetterlakeside.com"] [uri "/index.php"] [unique_id "alxkUSNrzsYMDd5sB10_fwAAAGs"]
[Sat Jul 18 23:44:50.089173 2026] [security2:error] [pid 943918:tid 943961] [remote 113.160.142.119:35656] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.yok.mqz.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxkUh70hbVC6SnzbhoqNQAAlik"], referer: https://mail.yok.mqz.mybluehost.me/wp-login.php
[Sat Jul 18 23:44:50.216498 2026] [security2:error] [pid 943918:tid 944081] [client 45.133.7.99:53991] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/cc.php"] [unique_id "alxkUh70hbVC6SnzbhoqQQAAAKU"]
[Sat Jul 18 23:44:50.350603 2026] [security2:error] [pid 943918:tid 944153] [client 173.239.196.161:49091] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/colour.php"] [unique_id "alxkUh70hbVC6SnzbhoqSAAAAO0"]
[Sat Jul 18 23:44:50.492316 2026] [security2:error] [pid 943918:tid 944042] [remote 31.42.184.154:42104] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/wp-login.php"] [unique_id "alxkUh70hbVC6SnzbhoqUwAA43o"]
[Sat Jul 18 23:44:50.800744 2026] [security2:error] [pid 943918:tid 943946] [remote 31.42.184.154:42104] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "factsandminds.com"] [uri "/wp-login.php"] [unique_id "alxkUh70hbVC6SnzbhoqWwAAhho"], referer: https://factsandminds.com/wp-login.php
[Sat Jul 18 23:44:50.910014 2026] [security2:error] [pid 943918:tid 944113] [client 45.133.7.99:62205] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/index.php"] [unique_id "alxkUh70hbVC6SnzbhoqYAAAAMU"]
[Sat Jul 18 23:44:51.162529 2026] [security2:error] [pid 938041:tid 938275] [client 74.7.227.179:40748] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxkUyNrzsYMDd5sB10_pgAAZ2o"], referer: https://tejasenvironmental.com/p=920403
[Sat Jul 18 23:44:51.217914 2026] [security2:error] [pid 943918:tid 944159] [client 173.239.196.162:39255] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/elp.php"] [unique_id "alxkUx70hbVC6SnzbhoqcAAAAPM"]
[Sat Jul 18 23:44:51.239619 2026] [security2:error] [pid 943918:tid 944096] [client 13.250.107.25:25132] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.107.250.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxkUx70hbVC6SnzbhoqcgAAALQ"]
[Sat Jul 18 23:44:51.239743 2026] [security2:error] [pid 943918:tid 944096] [client 13.250.107.25:25132] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxkUx70hbVC6SnzbhoqcgAAALQ"]
[Sat Jul 18 23:44:51.431008 2026] [security2:error] [pid 943918:tid 944129] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/p.php"] [unique_id "alxkUx70hbVC6SnzbhoqfQAAANU"]
[Sat Jul 18 23:44:51.431122 2026] [security2:error] [pid 943918:tid 944129] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/p.php"] [unique_id "alxkUx70hbVC6SnzbhoqfQAAANU"]
[Sat Jul 18 23:44:51.591162 2026] [security2:error] [pid 938041:tid 938286] [client 45.133.7.78:33285] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 78.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/ab.php"] [unique_id "alxkUyNrzsYMDd5sB10_rgAAAHI"]
[Sat Jul 18 23:44:52.080814 2026] [security2:error] [pid 938041:tid 938206] [client 173.239.196.161:34989] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "alxkVCNrzsYMDd5sB10_ugAAACI"]
[Sat Jul 18 23:44:52.134089 2026] [security2:error] [pid 943918:tid 944071] [client 163.61.1.17:62812] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkVB70hbVC6SnzbhoqogAAAJs"]
[Sat Jul 18 23:44:52.135813 2026] [security2:error] [pid 943918:tid 944071] [client 163.61.1.17:62812] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkVB70hbVC6SnzbhoqogAAAJs"]
[Sat Jul 18 23:44:52.273788 2026] [security2:error] [pid 943918:tid 944100] [client 45.133.7.66:61517] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 66.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/about.php"] [unique_id "alxkVB70hbVC6SnzbhoqqQAAALg"]
[Sat Jul 18 23:44:52.960779 2026] [security2:error] [pid 943918:tid 944093] [client 45.133.7.63:51547] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "alxkVB70hbVC6Snzbhoq1gAAALE"]
[Sat Jul 18 23:44:52.964097 2026] [security2:error] [pid 938041:tid 938281] [client 173.239.196.164:25087] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/images/include.php"] [unique_id "alxkVCNrzsYMDd5sB10_zgAAAG0"]
[Sat Jul 18 23:44:53.197346 2026] [lsapi:warn] [pid 943918:tid 943989] [remote 37.40.225.89:0] [host ali-alghanim.com] Backend log: PHP Warning:  getimagesize(https://aasgroup.online/wp-content/uploads/2021/09/1291810.jpg): Failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden\r\n in /home2/aasgroup/public_html/alialghanim/wp-content/plugins/litespeed-cache/src/media.cls.php on line 860\n, referer: https://www.google.com/
[Sat Jul 18 23:44:53.588615 2026] [security2:error] [pid 938041:tid 938222] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.awellpacedlife.com"] [uri "/index.cgi"] [unique_id "alxkVSNrzsYMDd5sB10_2gAAADI"]
[Sat Jul 18 23:44:53.650988 2026] [security2:error] [pid 943918:tid 944090] [client 45.133.7.91:25031] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 91.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/doc.php"] [unique_id "alxkVR70hbVC6Snzbhoq8gAAAK4"]
[Sat Jul 18 23:44:53.757292 2026] [security2:error] [pid 938041:tid 938268] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/bthil.php"] [unique_id "alxkVSNrzsYMDd5sB10_3AAAAGA"]
[Sat Jul 18 23:44:53.757402 2026] [security2:error] [pid 938041:tid 938268] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/bthil.php"] [unique_id "alxkVSNrzsYMDd5sB10_3AAAAGA"]
[Sat Jul 18 23:44:53.802138 2026] [security2:error] [pid 943918:tid 944097] [client 173.239.196.161:24111] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/av.php.php"] [unique_id "alxkVR70hbVC6Snzbhoq-AAAALU"]
[Sat Jul 18 23:44:53.965981 2026] [security2:error] [pid 943918:tid 944155] [client 125.166.1.102:25269] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 102.1.166.125.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "50.116.64.27"] [uri "/~whatsal4//wp-login.php"] [unique_id "alxkVR70hbVC6SnzbhorAwAAAO8"]
[Sat Jul 18 23:44:54.335717 2026] [security2:error] [pid 943918:tid 944157] [client 45.133.7.96:35617] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 96.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "alxkVh70hbVC6SnzbhorGAAAAPE"]
[Sat Jul 18 23:44:54.429198 2026] [security2:error] [pid 943918:tid 944100] [client 125.166.1.102:15730] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 102.1.166.125.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "50.116.64.27"] [uri "/~whatsal4//wp-login.php"] [unique_id "alxkVh70hbVC6SnzbhorGwAAALg"]
[Sat Jul 18 23:44:54.648545 2026] [security2:error] [pid 938041:tid 938248] [client 173.239.196.162:20591] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/pwnd-1/install.php"] [unique_id "alxkViNrzsYMDd5sB10_8AAAAEw"]
[Sat Jul 18 23:44:55.009464 2026] [security2:error] [pid 938041:tid 938233] [client 57.141.18.84:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxkViNrzsYMDd5sB10_9AAAAD0"]
[Sat Jul 18 23:44:55.027720 2026] [security2:error] [pid 943918:tid 944060] [client 45.133.7.76:43333] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 76.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "alxkVx70hbVC6SnzbhorOAAAAJA"]
[Sat Jul 18 23:44:55.082973 2026] [security2:error] [pid 938041:tid 938199] [client 213.174.1.216:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "healthylifegourmet.org"] [uri "/index.php"] [unique_id "alxkVCNrzsYMDd5sB10_xgAAABs"]
[Sat Jul 18 23:44:55.310630 2026] [security2:error] [pid 943918:tid 944147] [client 113.160.97.242:60178] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxkVx70hbVC6SnzbhorSAAAAOc"]
[Sat Jul 18 23:44:55.396591 2026] [security2:error] [pid 943918:tid 944156] [client 45.134.20.109:38715] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 109.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/bless.php"] [unique_id "alxkVx70hbVC6SnzbhorTQAAAPA"]
[Sat Jul 18 23:44:55.539322 2026] [security2:error] [pid 943918:tid 944128] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/7.php"] [unique_id "alxkVx70hbVC6SnzbhorXAAAANQ"]
[Sat Jul 18 23:44:55.539423 2026] [security2:error] [pid 943918:tid 944128] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/7.php"] [unique_id "alxkVx70hbVC6SnzbhorXAAAANQ"]
[Sat Jul 18 23:44:55.598090 2026] [security2:error] [pid 943918:tid 944098] [client 180.252.198.240:63557] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkVx70hbVC6SnzbhorXgAAALY"]
[Sat Jul 18 23:44:55.598186 2026] [security2:error] [pid 943918:tid 944098] [client 180.252.198.240:63557] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkVx70hbVC6SnzbhorXgAAALY"]
[Sat Jul 18 23:44:55.601009 2026] [security2:error] [pid 943918:tid 944150] [client 173.239.196.167:26271] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "alxkVx70hbVC6SnzbhorXQAAAOo"]
[Sat Jul 18 23:44:55.707608 2026] [security2:error] [pid 938041:tid 938200] [client 45.133.7.70:58963] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/mar.php"] [unique_id "alxkVyNrzsYMDd5sB11ACQAAABw"]
[Sat Jul 18 23:44:56.262299 2026] [security2:error] [pid 943918:tid 944134] [client 45.134.20.117:29351] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/O-Simple.php"] [unique_id "alxkWB70hbVC6SnzbhorfgAAANo"]
[Sat Jul 18 23:44:56.342164 2026] [security2:error] [pid 938041:tid 938244] [client 138.252.89.100:56324] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkWCNrzsYMDd5sB11AEwAAAEg"]
[Sat Jul 18 23:44:56.342249 2026] [security2:error] [pid 938041:tid 938244] [client 138.252.89.100:56324] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkWCNrzsYMDd5sB11AEwAAAEg"]
[Sat Jul 18 23:44:56.409717 2026] [security2:error] [pid 943918:tid 944142] [client 45.133.7.75:57605] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "alxkWB70hbVC6SnzbhorggAAAOI"]
[Sat Jul 18 23:44:56.444010 2026] [security2:error] [pid 943918:tid 944053] [client 173.239.196.163:57745] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/upload/bilder/cong.php"] [unique_id "alxkWB70hbVC6SnzbhoriAAAAIk"]
[Sat Jul 18 23:44:57.090588 2026] [security2:error] [pid 938041:tid 938259] [client 45.133.7.95:54769] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "alxkWSNrzsYMDd5sB11AHgAAAFc"]
[Sat Jul 18 23:44:57.129568 2026] [security2:error] [pid 938041:tid 938188] [client 45.134.20.118:46827] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/lock360.php"] [unique_id "alxkWSNrzsYMDd5sB11AIQAAABA"]
[Sat Jul 18 23:44:57.206975 2026] [security2:error] [pid 938041:tid 938267] [client 139.167.225.146:51690] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkWSNrzsYMDd5sB11AJwAAAF8"]
[Sat Jul 18 23:44:57.207069 2026] [security2:error] [pid 938041:tid 938267] [client 139.167.225.146:51690] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkWSNrzsYMDd5sB11AJwAAAF8"]
[Sat Jul 18 23:44:57.314787 2026] [security2:error] [pid 943918:tid 944100] [client 173.239.196.160:58449] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/blue/pass.php"] [unique_id "alxkWR70hbVC6SnzbhoruwAAALg"]
[Sat Jul 18 23:44:57.388171 2026] [security2:error] [pid 938041:tid 938272] [client 39.63.145.171:38874] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "thierry-henry.fr"] [uri "/index.php"] [unique_id "alxkWSNrzsYMDd5sB11AIwAAAGQ"]
[Sat Jul 18 23:44:57.776354 2026] [security2:error] [pid 943918:tid 944074] [client 45.133.7.69:48405] ModSecurity: Warning. Pattern match "/1\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1543"] [id "900921"] [msg "temporary TUW-72162 logging rule"] [hostname "nikkidesigns.net"] [uri "/1.php"] [unique_id "alxkWR70hbVC6Snzbhor0QAAAJ4"]
[Sat Jul 18 23:44:57.776471 2026] [security2:error] [pid 943918:tid 944074] [client 45.133.7.69:48405] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 69.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/1.php"] [unique_id "alxkWR70hbVC6Snzbhor0QAAAJ4"]
[Sat Jul 18 23:44:58.005294 2026] [security2:error] [pid 943918:tid 944092] [client 45.134.20.135:43263] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/zwso.php"] [unique_id "alxkWR70hbVC6Snzbhor5QAAALA"]
[Sat Jul 18 23:44:58.217138 2026] [security2:error] [pid 938041:tid 938254] [client 173.239.196.160:62031] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "alxkWiNrzsYMDd5sB11APAAAAFI"]
[Sat Jul 18 23:44:58.456197 2026] [security2:error] [pid 938041:tid 938181] [client 45.133.7.85:51223] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 85.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "alxkWiNrzsYMDd5sB11ARwAAAAk"]
[Sat Jul 18 23:44:58.874483 2026] [security2:error] [pid 938041:tid 938275] [client 45.134.20.127:33451] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 127.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/chosen.php"] [unique_id "alxkWiNrzsYMDd5sB11AWQAAAGc"]
[Sat Jul 18 23:44:59.123394 2026] [core:error] [pid 938041:tid 938207] [client 104.168.28.15:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:44:59.123411 2026] [core:error] [pid 938041:tid 938207] [client 104.168.28.15:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:44:59.128476 2026] [security2:error] [pid 938041:tid 938144] [remote 31.42.184.154:37580] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.nvy.ppp.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxkWyNrzsYMDd5sB11AYQAAOGU"]
[Sat Jul 18 23:44:59.128606 2026] [security2:error] [pid 938041:tid 938228] [client 31.42.184.154:37580] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "mail.nvy.ppp.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxkWyNrzsYMDd5sB11AYQAAOGU"]
[Sat Jul 18 23:44:59.131635 2026] [security2:error] [pid 938041:tid 938235] [client 173.239.196.164:30427] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/assets/about5.php"] [unique_id "alxkWyNrzsYMDd5sB11AYgAAAD8"]
[Sat Jul 18 23:44:59.134788 2026] [security2:error] [pid 943918:tid 944104] [client 45.133.7.102:45947] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 102.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/style-engine/index.php"] [unique_id "alxkWx70hbVC6SnzbhosHAAAALw"]
[Sat Jul 18 23:44:59.425929 2026] [security2:error] [pid 938041:tid 938189] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/8.php"] [unique_id "alxkWyNrzsYMDd5sB11AcQAAABE"]
[Sat Jul 18 23:44:59.426057 2026] [security2:error] [pid 938041:tid 938189] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/8.php"] [unique_id "alxkWyNrzsYMDd5sB11AcQAAABE"]
[Sat Jul 18 23:44:59.484470 2026] [security2:error] [pid 938041:tid 938197] [client 103.160.26.178:56430] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkWyNrzsYMDd5sB11AcgAAABk"]
[Sat Jul 18 23:44:59.484559 2026] [security2:error] [pid 938041:tid 938197] [client 103.160.26.178:56430] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkWyNrzsYMDd5sB11AcgAAABk"]
[Sat Jul 18 23:44:59.672504 2026] [security2:error] [pid 938041:tid 938227] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxkWyNrzsYMDd5sB11AdgAAADc"]
[Sat Jul 18 23:44:59.683726 2026] [security2:error] [pid 938041:tid 938287] [client 36.83.95.75:52493] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkWyNrzsYMDd5sB11AewAAAHM"]
[Sat Jul 18 23:44:59.683848 2026] [security2:error] [pid 938041:tid 938287] [client 36.83.95.75:52493] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkWyNrzsYMDd5sB11AewAAAHM"]
[Sat Jul 18 23:44:59.753599 2026] [security2:error] [pid 943918:tid 944134] [client 45.134.20.106:51453] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/about.php"] [unique_id "alxkWx70hbVC6SnzbhosMQAAANo"]
[Sat Jul 18 23:44:59.794859 2026] [security2:error] [pid 938041:tid 938236] [client 106.222.249.209:14261] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkWyNrzsYMDd5sB11AgAAAAEA"]
[Sat Jul 18 23:44:59.794979 2026] [security2:error] [pid 938041:tid 938236] [client 106.222.249.209:14261] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkWyNrzsYMDd5sB11AgAAAAEA"]
[Sat Jul 18 23:44:59.814880 2026] [security2:error] [pid 943918:tid 944052] [client 45.133.7.59:58363] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 59.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/js/fm.php"] [unique_id "alxkWx70hbVC6SnzbhosNAAAAIg"]
[Sat Jul 18 23:44:59.891396 2026] [security2:error] [pid 943918:tid 944144] [client 136.243.222.140:48586] ModSecurity: Warning. Matched phrase "DomainStatsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "www.ccsdifference.com"] [uri "/index.php"] [unique_id "alxkWx70hbVC6SnzbhosJwAAAOQ"]
[Sat Jul 18 23:45:00.048667 2026] [security2:error] [pid 943918:tid 944158] [client 173.239.196.161:32951] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/maint/lint-branch.php"] [unique_id "alxkXB70hbVC6SnzbhosQQAAAPI"]
[Sat Jul 18 23:45:00.144935 2026] [security2:error] [pid 943918:tid 944114] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxkWx70hbVC6SnzbhosOwAAAMY"]
[Sat Jul 18 23:45:00.502886 2026] [security2:error] [pid 938041:tid 938177] [client 45.133.7.103:27373] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/images/index.php"] [unique_id "alxkXCNrzsYMDd5sB11AjgAAAAU"]
[Sat Jul 18 23:45:00.675412 2026] [security2:error] [pid 938041:tid 938297] [client 35.227.39.208:12504] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "sbinframx.com"] [uri "/wp-json/batch/v1"] [unique_id "alxkXCNrzsYMDd5sB11AkwAAAH0"]
[Sat Jul 18 23:45:00.682256 2026] [security2:error] [pid 943918:tid 944133] [client 45.134.20.109:60929] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 109.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/admin.php"] [unique_id "alxkXB70hbVC6SnzbhosVQAAANk"]
[Sat Jul 18 23:45:00.898568 2026] [security2:error] [pid 943918:tid 944134] [client 173.239.196.161:31785] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/cong.php"] [unique_id "alxkXB70hbVC6SnzbhosYAAAANo"]
[Sat Jul 18 23:45:00.954196 2026] [security2:error] [pid 938041:tid 938295] [client 35.227.39.208:12504] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "sbinframx.com"] [uri "/"] [unique_id "alxkXCNrzsYMDd5sB11AnAAAAHs"]
[Sat Jul 18 23:45:01.000335 2026] [security2:error] [pid 943918:tid 944034] [remote 103.75.185.95:32866] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "viennarotaryfoundation.com"] [uri "/wp-login.php"] [unique_id "alxkXB70hbVC6SnzbhosaQAAm3I"]
[Sat Jul 18 23:45:01.193190 2026] [security2:error] [pid 943918:tid 944127] [client 45.133.7.105:41101] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "alxkXR70hbVC6SnzbhoscgAAANM"]
[Sat Jul 18 23:45:01.502800 2026] [security2:error] [pid 943918:tid 943925] [remote 103.75.185.95:32866] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "viennarotaryfoundation.com"] [uri "/wp-login.php"] [unique_id "alxkXR70hbVC6SnzbhosgAAAjwU"], referer: https://viennarotaryfoundation.com/wp-login.php
[Sat Jul 18 23:45:01.541610 2026] [security2:error] [pid 938041:tid 938179] [client 45.134.20.135:44907] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/mah.php"] [unique_id "alxkXSNrzsYMDd5sB11ArgAAAAc"]
[Sat Jul 18 23:45:01.766789 2026] [security2:error] [pid 938041:tid 938269] [client 173.239.196.164:55523] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/js/db.php"] [unique_id "alxkXSNrzsYMDd5sB11AuAAAAGE"]
[Sat Jul 18 23:45:01.782603 2026] [security2:error] [pid 938041:tid 938214] [client 186.128.68.134:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "taskidsvirginia.com"] [uri "/index.php"] [unique_id "alxkXCNrzsYMDd5sB11AngAAACo"]
[Sat Jul 18 23:45:01.866241 2026] [security2:error] [pid 938041:tid 938149] [remote 45.157.54.14:21885] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "website-510b2c1f.uritems.net"] [uri "/xmlrpc.php"] [unique_id "alxkXSNrzsYMDd5sB11AuwAAcmo"]
[Sat Jul 18 23:45:01.866519 2026] [security2:error] [pid 938041:tid 938286] [client 45.157.54.14:21885] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "website-510b2c1f.uritems.net"] [uri "/xmlrpc.php"] [unique_id "alxkXSNrzsYMDd5sB11AuwAAcmo"]
[Sat Jul 18 23:45:01.874324 2026] [security2:error] [pid 943918:tid 944174] [client 45.133.7.89:35975] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 89.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/file.php"] [unique_id "alxkXR70hbVC6SnzbhosigAAAQI"]
[Sat Jul 18 23:45:02.465689 2026] [security2:error] [pid 943918:tid 944077] [client 45.134.20.129:43625] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.wp/wso.php"] [unique_id "alxkXh70hbVC6SnzbhosnQAAAKE"]
[Sat Jul 18 23:45:02.554391 2026] [security2:error] [pid 943918:tid 944088] [client 45.133.7.92:50501] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "alxkXh70hbVC6SnzbhosoQAAAKw"]
[Sat Jul 18 23:45:02.591640 2026] [security2:error] [pid 943918:tid 944142] [client 20.206.105.145:0] ModSecurity: Warning. Pattern match "/1\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1543"] [id "900921"] [msg "temporary TUW-72162 logging rule"] [hostname "www.awellpacedlife.com"] [uri "/1.php"] [unique_id "alxkXh70hbVC6SnzbhosogAAAOI"]
[Sat Jul 18 23:45:02.591727 2026] [security2:error] [pid 943918:tid 944142] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/1.php"] [unique_id "alxkXh70hbVC6SnzbhosogAAAOI"]
[Sat Jul 18 23:45:02.591825 2026] [security2:error] [pid 943918:tid 944142] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/1.php"] [unique_id "alxkXh70hbVC6SnzbhosogAAAOI"]
[Sat Jul 18 23:45:02.669908 2026] [security2:error] [pid 938041:tid 938224] [client 173.239.196.163:30569] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/buy.php"] [unique_id "alxkXiNrzsYMDd5sB11A0gAAADQ"]
[Sat Jul 18 23:45:02.787860 2026] [security2:error] [pid 943918:tid 944143] [client 163.61.1.17:63288] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkXh70hbVC6SnzbhosqAAAAOM"]
[Sat Jul 18 23:45:02.787969 2026] [security2:error] [pid 943918:tid 944143] [client 163.61.1.17:63288] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkXh70hbVC6SnzbhosqAAAAOM"]
[Sat Jul 18 23:45:03.082149 2026] [security2:error] [pid 943918:tid 944023] [remote 31.42.184.154:56972] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "petpawo.com"] [uri "/wp-login.php"] [unique_id "alxkXx70hbVC6SnzbhosrgAA0Wc"]
[Sat Jul 18 23:45:03.236477 2026] [security2:error] [pid 943918:tid 944064] [client 45.133.7.74:33047] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/fm.php"] [unique_id "alxkXx70hbVC6SnzbhosswAAAJQ"]
[Sat Jul 18 23:45:03.336979 2026] [security2:error] [pid 943918:tid 944121] [client 45.134.20.124:39491] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 124.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/core.php"] [unique_id "alxkXx70hbVC6SnzbhosuwAAAM0"]
[Sat Jul 18 23:45:03.538242 2026] [security2:error] [pid 943918:tid 944122] [client 173.239.196.160:24735] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/ID3/db.php"] [unique_id "alxkXx70hbVC6SnzbhosvwAAAM4"]
[Sat Jul 18 23:45:03.804557 2026] [security2:error] [pid 943918:tid 943923] [remote 31.42.184.154:56972] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "petpawo.com"] [uri "/wp-login.php"] [unique_id "alxkXx70hbVC6SnzbhosyQABAQM"], referer: https://petpawo.com/wp-login.php
[Sat Jul 18 23:45:03.923481 2026] [security2:error] [pid 943918:tid 944061] [client 45.133.7.83:55909] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/js/widgets/cloud.php"] [unique_id "alxkXx70hbVC6Snzbhos0gAAAJE"]
[Sat Jul 18 23:45:04.211058 2026] [security2:error] [pid 938041:tid 938199] [client 45.134.20.116:50285] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 116.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/robots.php"] [unique_id "alxkYCNrzsYMDd5sB11BAAAAABs"]
[Sat Jul 18 23:45:04.397839 2026] [security2:error] [pid 943918:tid 944150] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/100.php"] [unique_id "alxkYB70hbVC6Snzbhos7QAAAOo"]
[Sat Jul 18 23:45:04.397969 2026] [security2:error] [pid 943918:tid 944150] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/100.php"] [unique_id "alxkYB70hbVC6Snzbhos7QAAAOo"]
[Sat Jul 18 23:45:04.410125 2026] [security2:error] [pid 943918:tid 944171] [client 173.239.196.160:32817] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/function/install.php"] [unique_id "alxkYB70hbVC6Snzbhos7gAAAP8"]
[Sat Jul 18 23:45:04.604093 2026] [security2:error] [pid 938041:tid 938198] [client 45.133.7.79:36167] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 79.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/adminfuns.php7"] [unique_id "alxkYCNrzsYMDd5sB11BCgAAABo"]
[Sat Jul 18 23:45:05.075572 2026] [security2:error] [pid 943918:tid 944169] [client 45.134.20.111:21717] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/inputs.php"] [unique_id "alxkYR70hbVC6SnzbhotDgAAAP0"]
[Sat Jul 18 23:45:05.293024 2026] [security2:error] [pid 938041:tid 938297] [client 45.133.7.89:56777] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 89.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/images/about.php"] [unique_id "alxkYSNrzsYMDd5sB11BIgAAAH0"]
[Sat Jul 18 23:45:05.298957 2026] [security2:error] [pid 943918:tid 944117] [client 173.239.196.167:40175] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/tflow/av.php"] [unique_id "alxkYR70hbVC6SnzbhotEwAAAMk"]
[Sat Jul 18 23:45:05.385162 2026] [security2:error] [pid 943918:tid 944104] [client 180.252.198.240:64035] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkYR70hbVC6SnzbhotGAAAALw"]
[Sat Jul 18 23:45:05.385264 2026] [security2:error] [pid 943918:tid 944104] [client 180.252.198.240:64035] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkYR70hbVC6SnzbhotGAAAALw"]
[Sat Jul 18 23:45:05.890176 2026] [security2:error] [pid 938041:tid 938144] [remote 131.72.236.158:42356] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 158.236.72.131.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxkYSNrzsYMDd5sB11BQgAADGU"]
[Sat Jul 18 23:45:05.950764 2026] [security2:error] [pid 938041:tid 938211] [client 45.134.20.112:31427] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 112.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/mini.php"] [unique_id "alxkYSNrzsYMDd5sB11BRQAAACc"]
[Sat Jul 18 23:45:05.977262 2026] [security2:error] [pid 943918:tid 944160] [client 45.133.7.62:50699] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/ini.php"] [unique_id "alxkYR70hbVC6SnzbhotJQAAAPQ"]
[Sat Jul 18 23:45:06.196554 2026] [security2:error] [pid 938041:tid 938193] [client 173.239.196.160:54625] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "alxkYiNrzsYMDd5sB11BTQAAABU"]
[Sat Jul 18 23:45:06.337935 2026] [security2:error] [pid 938041:tid 938050] [remote 131.72.236.158:42356] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 158.236.72.131.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxkYiNrzsYMDd5sB11BUgAAMAc"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:45:06.421309 2026] [security2:error] [pid 938041:tid 938181] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/about.php"] [unique_id "alxkYiNrzsYMDd5sB11BVQAAAAk"]
[Sat Jul 18 23:45:06.421402 2026] [security2:error] [pid 938041:tid 938181] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/about.php"] [unique_id "alxkYiNrzsYMDd5sB11BVQAAAAk"]
[Sat Jul 18 23:45:06.656547 2026] [security2:error] [pid 938041:tid 938208] [client 45.133.7.82:60057] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/coffee/cloud.php"] [unique_id "alxkYiNrzsYMDd5sB11BXgAAACQ"]
[Sat Jul 18 23:45:06.808004 2026] [security2:error] [pid 943918:tid 944106] [client 45.134.20.136:39509] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 136.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/goods.php"] [unique_id "alxkYh70hbVC6SnzbhotNgAAAL4"]
[Sat Jul 18 23:45:07.077918 2026] [security2:error] [pid 938041:tid 938256] [client 173.239.196.162:26639] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/testt.php"] [unique_id "alxkYyNrzsYMDd5sB11BeAAAAFQ"]
[Sat Jul 18 23:45:07.354987 2026] [security2:error] [pid 943918:tid 944161] [client 45.133.7.72:39371] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 72.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "alxkYx70hbVC6SnzbhotPwAAAPU"]
[Sat Jul 18 23:45:07.674838 2026] [security2:error] [pid 943918:tid 944157] [client 45.134.20.139:32983] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 139.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/file5.php"] [unique_id "alxkYx70hbVC6SnzbhotSgAAAPE"]
[Sat Jul 18 23:45:07.904245 2026] [security2:error] [pid 938041:tid 938043] [remote 103.255.134.61:43024] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.134.255.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxkYyNrzsYMDd5sB11BkAAAYQA"]
[Sat Jul 18 23:45:07.904413 2026] [security2:error] [pid 938041:tid 938269] [client 103.255.134.61:43024] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxkYyNrzsYMDd5sB11BkAAAYQA"]
[Sat Jul 18 23:45:07.960203 2026] [security2:error] [pid 943918:tid 944056] [client 138.252.89.100:56853] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkYx70hbVC6SnzbhotUwAAAIw"]
[Sat Jul 18 23:45:07.960316 2026] [security2:error] [pid 943918:tid 944056] [client 138.252.89.100:56853] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkYx70hbVC6SnzbhotUwAAAIw"]
[Sat Jul 18 23:45:07.975161 2026] [security2:error] [pid 943918:tid 944055] [client 173.239.196.163:28559] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/uploads/goods.php"] [unique_id "alxkYx70hbVC6SnzbhotVQAAAIs"]
[Sat Jul 18 23:45:08.045143 2026] [security2:error] [pid 943918:tid 944096] [client 45.133.7.60:45467] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 60.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "alxkZB70hbVC6SnzbhotWgAAALQ"]
[Sat Jul 18 23:45:08.102358 2026] [security2:error] [pid 938041:tid 938112] [remote 117.0.21.154:42794] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.narv.co"] [uri "/xmlrpc.php"] [unique_id "alxkZCNrzsYMDd5sB11BmQAAF0U"]
[Sat Jul 18 23:45:08.102512 2026] [security2:error] [pid 938041:tid 938195] [client 117.0.21.154:42794] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.narv.co"] [uri "/xmlrpc.php"] [unique_id "alxkZCNrzsYMDd5sB11BmQAAF0U"]
[Sat Jul 18 23:45:08.152479 2026] [security2:error] [pid 943918:tid 944117] [client 139.167.225.146:52312] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkZB70hbVC6SnzbhotYAAAAMk"]
[Sat Jul 18 23:45:08.152568 2026] [security2:error] [pid 943918:tid 944117] [client 139.167.225.146:52312] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkZB70hbVC6SnzbhotYAAAAMk"]
[Sat Jul 18 23:45:08.236945 2026] [security2:error] [pid 943918:tid 943968] [remote 4.205.168.44:52484] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxkZB70hbVC6SnzbhotYwAA0zA"]
[Sat Jul 18 23:45:08.372100 2026] [security2:error] [pid 943918:tid 944138] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/admin.php"] [unique_id "alxkZB70hbVC6SnzbhotZwAAAN4"]
[Sat Jul 18 23:45:08.372204 2026] [security2:error] [pid 943918:tid 944138] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/admin.php"] [unique_id "alxkZB70hbVC6SnzbhotZwAAAN4"]
[Sat Jul 18 23:45:08.415341 2026] [security2:error] [pid 943918:tid 943950] [remote 4.205.168.44:52484] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxkZB70hbVC6SnzbhotbAAApR4"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:45:08.542665 2026] [security2:error] [pid 943918:tid 944057] [client 45.134.20.131:63095] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/ahax.php"] [unique_id "alxkZB70hbVC6SnzbhotcQAAAI0"]
[Sat Jul 18 23:45:08.618761 2026] [security2:error] [pid 938041:tid 938146] [remote 31.42.184.154:56986] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxkZCNrzsYMDd5sB11BpgAAFGc"]
[Sat Jul 18 23:45:08.725817 2026] [security2:error] [pid 943918:tid 944098] [client 45.133.7.91:21497] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 91.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/acme-challenge/atomlib.php"] [unique_id "alxkZB70hbVC6SnzbhotfQAAALY"]
[Sat Jul 18 23:45:08.858205 2026] [security2:error] [pid 943918:tid 944067] [client 173.239.196.163:27573] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/js/sad.php"] [unique_id "alxkZB70hbVC6SnzbhotfgAAAJc"]
[Sat Jul 18 23:45:09.102905 2026] [security2:error] [pid 938041:tid 938093] [remote 31.42.184.154:56986] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxkZSNrzsYMDd5sB11BugAARTI"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:45:09.225038 2026] [security2:error] [pid 943918:tid 944073] [client 157.55.39.193:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxkZR70hbVC6SnzbhotiQAAAJ0"]
[Sat Jul 18 23:45:09.400822 2026] [security2:error] [pid 938041:tid 938283] [client 45.134.20.129:36097] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/f35.php"] [unique_id "alxkZSNrzsYMDd5sB11BxAAAAG8"]
[Sat Jul 18 23:45:09.408479 2026] [security2:error] [pid 938041:tid 938259] [client 45.133.7.72:46721] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 72.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/js/instaall.php"] [unique_id "alxkZSNrzsYMDd5sB11BxQAAAFc"]
[Sat Jul 18 23:45:09.718270 2026] [security2:error] [pid 943918:tid 944115] [client 173.239.196.163:58065] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "alxkZR70hbVC6SnzbhotngAAAMc"]
[Sat Jul 18 23:45:09.888339 2026] [security2:error] [pid 938041:tid 938120] [remote 113.160.142.119:56762] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "elementconstruction.co.uk"] [uri "/wp-login.php"] [unique_id "alxkZSNrzsYMDd5sB11B0gAAKE0"]
[Sat Jul 18 23:45:10.081764 2026] [security2:error] [pid 943918:tid 944149] [client 103.160.26.178:56883] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkZh70hbVC6SnzbhotrwAAAOk"]
[Sat Jul 18 23:45:10.081848 2026] [security2:error] [pid 943918:tid 944149] [client 103.160.26.178:56883] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkZh70hbVC6SnzbhotrwAAAOk"]
[Sat Jul 18 23:45:10.100629 2026] [security2:error] [pid 943918:tid 944160] [client 45.133.7.84:60683] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 84.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/function.php"] [unique_id "alxkZh70hbVC6SnzbhotswAAAPQ"]
[Sat Jul 18 23:45:10.245120 2026] [security2:error] [pid 943918:tid 944175] [client 36.83.95.75:52968] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkZh70hbVC6SnzbhotuQAAAQM"]
[Sat Jul 18 23:45:10.245239 2026] [security2:error] [pid 943918:tid 944175] [client 36.83.95.75:52968] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkZh70hbVC6SnzbhotuQAAAQM"]
[Sat Jul 18 23:45:10.282313 2026] [security2:error] [pid 943918:tid 944174] [client 45.134.20.108:32715] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/simple.php"] [unique_id "alxkZh70hbVC6SnzbhotugAAAQI"]
[Sat Jul 18 23:45:10.505670 2026] [core:error] [pid 943918:tid 944066] [client 104.168.28.15:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:45:10.505688 2026] [core:error] [pid 943918:tid 944066] [client 104.168.28.15:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:45:10.612579 2026] [security2:error] [pid 943918:tid 944121] [client 106.222.249.209:22140] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkZh70hbVC6SnzbhotxwAAAM0"]
[Sat Jul 18 23:45:10.612706 2026] [security2:error] [pid 943918:tid 944121] [client 106.222.249.209:22140] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkZh70hbVC6SnzbhotxwAAAM0"]
[Sat Jul 18 23:45:10.624510 2026] [security2:error] [pid 943918:tid 944140] [client 173.239.196.167:60551] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "alxkZh70hbVC6SnzbhotyAAAAOA"]
[Sat Jul 18 23:45:10.782692 2026] [security2:error] [pid 943918:tid 944136] [client 45.133.7.58:38255] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/plugins.php"] [unique_id "alxkZh70hbVC6Snzbhot1AAAANw"]
[Sat Jul 18 23:45:10.799254 2026] [security2:error] [pid 943918:tid 943962] [remote 41.186.86.12:20331] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxkZh70hbVC6Snzbhot1QAAsio"]
[Sat Jul 18 23:45:11.106355 2026] [security2:error] [pid 943918:tid 943970] [remote 188.138.102.156:45382] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "hammadownenterprises.com"] [uri "/wp-login.php"] [unique_id "alxkZx70hbVC6Snzbhot3gAAvDI"]
[Sat Jul 18 23:45:11.154163 2026] [security2:error] [pid 938041:tid 938295] [client 45.134.20.130:27273] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 130.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/amax.php"] [unique_id "alxkZyNrzsYMDd5sB11B_QAAAHs"]
[Sat Jul 18 23:45:11.305573 2026] [security2:error] [pid 943918:tid 943944] [remote 41.186.86.12:20331] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxkZx70hbVC6Snzbhot4wAAkhg"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:45:11.312465 2026] [security2:error] [pid 943918:tid 943967] [remote 188.138.102.156:45382] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "hammadownenterprises.com"] [uri "/wp-login.php"] [unique_id "alxkZx70hbVC6Snzbhot5AAAmy8"], referer: https://hammadownenterprises.com/wp-login.php
[Sat Jul 18 23:45:11.443412 2026] [security2:error] [pid 943918:tid 944131] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/edit.php"] [unique_id "alxkZx70hbVC6Snzbhot6wAAANc"]
[Sat Jul 18 23:45:11.443483 2026] [security2:error] [pid 943918:tid 944131] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/edit.php"] [unique_id "alxkZx70hbVC6Snzbhot6wAAANc"]
[Sat Jul 18 23:45:11.462876 2026] [security2:error] [pid 943918:tid 944118] [client 45.133.7.105:41827] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/atomlib.php"] [unique_id "alxkZx70hbVC6Snzbhot7gAAAMo"]
[Sat Jul 18 23:45:11.541222 2026] [security2:error] [pid 943918:tid 944113] [client 173.239.196.166:56693] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "alxkZx70hbVC6Snzbhot8QAAAMU"]
[Sat Jul 18 23:45:12.007255 2026] [security2:error] [pid 938041:tid 938260] [client 45.134.20.108:46863] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/update/f35.php"] [unique_id "alxkaCNrzsYMDd5sB11CGwAAAFg"]
[Sat Jul 18 23:45:12.150010 2026] [security2:error] [pid 938041:tid 938216] [client 45.133.7.56:30811] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 56.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content.php"] [unique_id "alxkaCNrzsYMDd5sB11CHwAAACw"]
[Sat Jul 18 23:45:12.445563 2026] [security2:error] [pid 943918:tid 944084] [client 173.239.196.162:52245] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/network.php"] [unique_id "alxkaB70hbVC6SnzbhouCQAAAKg"]
[Sat Jul 18 23:45:12.841091 2026] [security2:error] [pid 943918:tid 944070] [client 45.133.7.71:41727] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 71.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/css/chosen.php"] [unique_id "alxkaB70hbVC6SnzbhouDQAAAJo"]
[Sat Jul 18 23:45:12.878240 2026] [security2:error] [pid 938041:tid 938208] [client 45.134.20.126:54705] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 126.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/hello.php"] [unique_id "alxkaCNrzsYMDd5sB11CRQAAACQ"]
[Sat Jul 18 23:45:13.318954 2026] [security2:error] [pid 943918:tid 944099] [client 173.239.196.160:50119] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/blue/alfa.php"] [unique_id "alxkaR70hbVC6SnzbhouEwAAALc"]
[Sat Jul 18 23:45:13.508009 2026] [security2:error] [pid 938041:tid 938284] [client 163.61.1.17:63772] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkaSNrzsYMDd5sB11CZgAAAHA"]
[Sat Jul 18 23:45:13.508379 2026] [security2:error] [pid 938041:tid 938284] [client 163.61.1.17:63772] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkaSNrzsYMDd5sB11CZgAAAHA"]
[Sat Jul 18 23:45:13.517298 2026] [security2:error] [pid 943918:tid 944075] [client 57.141.18.110:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxkaR70hbVC6SnzbhouFAAAAJ8"]
[Sat Jul 18 23:45:13.522179 2026] [security2:error] [pid 943918:tid 944147] [client 45.133.7.56:56421] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 56.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "alxkaR70hbVC6SnzbhouGQAAAOc"]
[Sat Jul 18 23:45:13.744997 2026] [security2:error] [pid 943918:tid 944158] [client 45.134.20.130:27299] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 130.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/maint/bootstrap.php"] [unique_id "alxkaR70hbVC6SnzbhouHgAAAPI"]
[Sat Jul 18 23:45:14.203155 2026] [security2:error] [pid 943918:tid 944176] [client 173.239.196.165:49513] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "alxkah70hbVC6SnzbhouLQAAAQQ"]
[Sat Jul 18 23:45:14.203954 2026] [security2:error] [pid 943918:tid 944139] [client 45.133.7.56:61563] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 56.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/network/index.php"] [unique_id "alxkah70hbVC6SnzbhouLgAAAN8"]
[Sat Jul 18 23:45:14.603127 2026] [security2:error] [pid 938041:tid 938289] [client 45.134.20.135:27597] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/themes/zMousse/otuz1.php"] [unique_id "alxkaiNrzsYMDd5sB11ChgAAAHU"]
[Sat Jul 18 23:45:14.886986 2026] [security2:error] [pid 938041:tid 938269] [client 45.133.7.86:22287] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 86.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/light/about.php"] [unique_id "alxkaiNrzsYMDd5sB11CkwAAAGE"]
[Sat Jul 18 23:45:15.053053 2026] [security2:error] [pid 943918:tid 944114] [client 173.239.196.160:65269] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wikindex.php"] [unique_id "alxkax70hbVC6SnzbhouTgAAAMY"]
[Sat Jul 18 23:45:15.176595 2026] [security2:error] [pid 943918:tid 944131] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/wp-content/admin.php"] [unique_id "alxkax70hbVC6SnzbhouUAAAANc"]
[Sat Jul 18 23:45:15.176704 2026] [security2:error] [pid 943918:tid 944131] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/wp-content/admin.php"] [unique_id "alxkax70hbVC6SnzbhouUAAAANc"]
[Sat Jul 18 23:45:15.468558 2026] [security2:error] [pid 943918:tid 944095] [client 45.134.20.135:27111] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/edit-wolf.php"] [unique_id "alxkax70hbVC6SnzbhouXgAAALM"]
[Sat Jul 18 23:45:15.557967 2026] [security2:error] [pid 943918:tid 944168] [client 180.252.198.240:64518] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkax70hbVC6SnzbhouYQAAAPw"]
[Sat Jul 18 23:45:15.558098 2026] [security2:error] [pid 943918:tid 944168] [client 180.252.198.240:64518] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkax70hbVC6SnzbhouYQAAAPw"]
[Sat Jul 18 23:45:15.567081 2026] [security2:error] [pid 938041:tid 938179] [client 45.133.7.98:63997] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 98.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/customize.php"] [unique_id "alxkayNrzsYMDd5sB11CrQAAAAc"]
[Sat Jul 18 23:45:15.905715 2026] [security2:error] [pid 938041:tid 938195] [client 173.239.196.166:62261] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/seoo/alfa.php"] [unique_id "alxkayNrzsYMDd5sB11CvwAAABc"]
[Sat Jul 18 23:45:16.246993 2026] [security2:error] [pid 938041:tid 938280] [client 45.133.7.94:37027] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 94.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/license.php"] [unique_id "alxkbCNrzsYMDd5sB11CyQAAAGw"]
[Sat Jul 18 23:45:16.333009 2026] [security2:error] [pid 938041:tid 938190] [client 45.134.20.135:29761] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/ubh/up.php"] [unique_id "alxkbCNrzsYMDd5sB11CzQAAABI"]
[Sat Jul 18 23:45:16.779816 2026] [security2:error] [pid 943918:tid 944134] [client 173.239.196.160:24045] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "alxkbB70hbVC6SnzbhoufwAAANo"]
[Sat Jul 18 23:45:16.928855 2026] [security2:error] [pid 938041:tid 938290] [client 45.133.7.59:60307] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 59.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/languages/autoload_classmap.php"] [unique_id "alxkbCNrzsYMDd5sB11C5QAAAHY"]
[Sat Jul 18 23:45:17.194380 2026] [security2:error] [pid 943918:tid 944137] [client 45.134.20.126:43699] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 126.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/images/bootstrap.php"] [unique_id "alxkbR70hbVC6SnzbhoujwAAAN0"]
[Sat Jul 18 23:45:17.337660 2026] [security2:error] [pid 938041:tid 938046] [remote 47.86.33.52:24402] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxkbSNrzsYMDd5sB11C9gAAZgM"]
[Sat Jul 18 23:45:17.622996 2026] [security2:error] [pid 943918:tid 944157] [client 45.133.7.82:36615] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/lock.php"] [unique_id "alxkbR70hbVC6SnzbhouogAAAPE"]
[Sat Jul 18 23:45:17.640505 2026] [security2:error] [pid 943918:tid 944069] [client 173.239.196.162:37815] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/css/dist/about.php"] [unique_id "alxkbR70hbVC6SnzbhoupAAAAJk"]
[Sat Jul 18 23:45:18.061641 2026] [security2:error] [pid 943918:tid 944113] [client 45.134.20.110:38137] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/images/upload.php"] [unique_id "alxkbh70hbVC6SnzbhoutwAAAMU"]
[Sat Jul 18 23:45:18.309243 2026] [security2:error] [pid 938041:tid 938239] [client 45.133.7.84:37431] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 84.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/blue/gold.php"] [unique_id "alxkbiNrzsYMDd5sB11DGwAAAEM"]
[Sat Jul 18 23:45:18.490247 2026] [security2:error] [pid 938041:tid 938264] [client 173.239.196.160:28991] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/as.php"] [unique_id "alxkbiNrzsYMDd5sB11DJAAAAFw"]
[Sat Jul 18 23:45:18.534954 2026] [security2:error] [pid 943918:tid 944092] [client 139.167.225.146:52924] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkbh70hbVC6SnzbhouvgAAALA"]
[Sat Jul 18 23:45:18.535054 2026] [security2:error] [pid 943918:tid 944092] [client 139.167.225.146:52924] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkbh70hbVC6SnzbhouvgAAALA"]
[Sat Jul 18 23:45:18.578955 2026] [security2:error] [pid 938041:tid 938273] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/f6.php"] [unique_id "alxkbiNrzsYMDd5sB11DKwAAAGU"]
[Sat Jul 18 23:45:18.579051 2026] [security2:error] [pid 938041:tid 938273] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/f6.php"] [unique_id "alxkbiNrzsYMDd5sB11DKwAAAGU"]
[Sat Jul 18 23:45:18.639743 2026] [security2:error] [pid 943918:tid 944088] [client 195.2.84.198:51834] ModSecurity: Access denied with code 406 (phase 1). IPmatchFromFile: "195.2.84.198" matched at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1090"] [id "999022"] [msg "Blacklisted IP Address for POST data StopForumSpam List"] [hostname "www.guidehunting.com"] [uri "/wp-comments-post.php"] [unique_id "alxkbh70hbVC6SnzbhouwQAAAKw"], referer: https://www.guidehunting.com/contact/
[Sat Jul 18 23:45:18.639848 2026] [security2:error] [pid 943918:tid 944088] [client 195.2.84.198:51834] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "406"] [hostname "www.guidehunting.com"] [uri "/wp-comments-post.php"] [unique_id "alxkbh70hbVC6SnzbhouwQAAAKw"], referer: https://www.guidehunting.com/contact/
[Sat Jul 18 23:45:18.878296 2026] [security2:error] [pid 938041:tid 938057] [remote 47.86.33.52:24402] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxkbiNrzsYMDd5sB11DNwAAUg4"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:45:18.932469 2026] [security2:error] [pid 938041:tid 938274] [client 74.208.214.194:45724] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxkbiNrzsYMDd5sB11DOgAAAGY"]
[Sat Jul 18 23:45:18.934859 2026] [security2:error] [pid 938041:tid 938182] [client 45.134.20.113:62055] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/seoplugins/db.php"] [unique_id "alxkbiNrzsYMDd5sB11DOQAAAAo"]
[Sat Jul 18 23:45:18.998812 2026] [security2:error] [pid 938041:tid 938176] [client 45.133.7.70:46213] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/atomlib.php"] [unique_id "alxkbiNrzsYMDd5sB11DPQAAAAQ"]
[Sat Jul 18 23:45:19.339224 2026] [security2:error] [pid 938041:tid 938252] [client 173.239.196.166:64783] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/customize/about.php"] [unique_id "alxkbyNrzsYMDd5sB11DVAAAAFA"]
[Sat Jul 18 23:45:19.692756 2026] [security2:error] [pid 943918:tid 944055] [client 45.133.7.68:29407] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 68.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/rest-api/index.php"] [unique_id "alxkbx70hbVC6Snzbhou1QAAAIs"]
[Sat Jul 18 23:45:19.762095 2026] [security2:error] [pid 943918:tid 944122] [client 45.153.4.154:52208] ModSecurity: Access denied with code 406 (phase 1). RBL lookup of 154.4.153.45.csi.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1548"] [id "900927"] [msg "contact-form RBL block: csi.websitewelcome.com"] [hostname "www.guidehunting.com"] [uri "/wp-comments-post.php"] [unique_id "alxkbx70hbVC6Snzbhou1gAAAM4"], referer: https://www.guidehunting.com/contact/
[Sat Jul 18 23:45:19.762221 2026] [security2:error] [pid 943918:tid 944122] [client 45.153.4.154:52208] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "406"] [hostname "www.guidehunting.com"] [uri "/wp-comments-post.php"] [unique_id "alxkbx70hbVC6Snzbhou1gAAAM4"], referer: https://www.guidehunting.com/contact/
[Sat Jul 18 23:45:19.788163 2026] [security2:error] [pid 938041:tid 938273] [client 45.134.20.110:55357] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/pridmag/db.php"] [unique_id "alxkbyNrzsYMDd5sB11DaAAAAGU"]
[Sat Jul 18 23:45:19.802531 2026] [security2:error] [pid 938041:tid 938295] [client 138.252.89.100:57391] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkbyNrzsYMDd5sB11DaQAAAHs"]
[Sat Jul 18 23:45:19.802631 2026] [security2:error] [pid 938041:tid 938295] [client 138.252.89.100:57391] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkbyNrzsYMDd5sB11DaQAAAHs"]
[Sat Jul 18 23:45:20.205143 2026] [security2:error] [pid 938041:tid 938203] [client 173.239.196.163:22433] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/js/simi.php"] [unique_id "alxkcCNrzsYMDd5sB11DeAAAAB8"]
[Sat Jul 18 23:45:20.326379 2026] [proxy:error] [pid 943918:tid 944140] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:45:20.326462 2026] [proxy_http:error] [pid 943918:tid 944140] [client 193.47.62.168:37024] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:45:20.327095 2026] [proxy:error] [pid 943918:tid 944140] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:45:20.327128 2026] [proxy_http:error] [pid 943918:tid 944140] [client 193.47.62.168:37024] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:45:20.377499 2026] [security2:error] [pid 943918:tid 944142] [client 45.133.7.66:48261] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 66.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/about.php"] [unique_id "alxkcB70hbVC6Snzbhou6gAAAOI"]
[Sat Jul 18 23:45:20.603101 2026] [security2:error] [pid 943918:tid 944128] [client 114.119.149.222:42233] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "healthylifegourmet.org"] [uri "/"] [unique_id "alxkcB70hbVC6Snzbhou8AAAANQ"], referer: https://healthylifegourmet.org/
[Sat Jul 18 23:45:20.658818 2026] [security2:error] [pid 943918:tid 944118] [client 45.134.20.118:30863] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/linkpreview/db.php"] [unique_id "alxkcB70hbVC6Snzbhou9QAAAMo"]
[Sat Jul 18 23:45:20.797885 2026] [security2:error] [pid 943918:tid 944125] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/inputs.php"] [unique_id "alxkcB70hbVC6Snzbhou-wAAANE"]
[Sat Jul 18 23:45:20.797986 2026] [security2:error] [pid 943918:tid 944125] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/inputs.php"] [unique_id "alxkcB70hbVC6Snzbhou-wAAANE"]
[Sat Jul 18 23:45:20.802153 2026] [security2:error] [pid 938041:tid 938248] [client 103.160.26.178:57352] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkcCNrzsYMDd5sB11DjAAAAEw"]
[Sat Jul 18 23:45:20.802245 2026] [security2:error] [pid 938041:tid 938248] [client 103.160.26.178:57352] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkcCNrzsYMDd5sB11DjAAAAEw"]
[Sat Jul 18 23:45:20.887017 2026] [security2:error] [pid 943918:tid 944144] [client 36.83.95.75:53437] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkcB70hbVC6SnzbhovAQAAAOQ"]
[Sat Jul 18 23:45:20.887828 2026] [security2:error] [pid 943918:tid 944144] [client 36.83.95.75:53437] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkcB70hbVC6SnzbhovAQAAAOQ"]
[Sat Jul 18 23:45:21.019141 2026] [security2:error] [pid 938041:tid 938195] [client 216.244.66.228:46130] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.fansarogroup.com"] [uri "/"] [unique_id "alxkcSNrzsYMDd5sB11DkgAAABc"]
[Sat Jul 18 23:45:21.019233 2026] [security2:error] [pid 938041:tid 938195] [client 216.244.66.228:46130] ModSecurity: Warning. Matched phrase "Dotbot" at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "www.fansarogroup.com"] [uri "/"] [unique_id "alxkcSNrzsYMDd5sB11DkgAAABc"]
[Sat Jul 18 23:45:21.058949 2026] [security2:error] [pid 938041:tid 938196] [client 45.133.7.101:49779] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 101.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/wincust.php"] [unique_id "alxkcSNrzsYMDd5sB11DkwAAABg"]
[Sat Jul 18 23:45:21.118357 2026] [security2:error] [pid 938041:tid 938209] [client 173.239.196.166:34871] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/images/chosen.php"] [unique_id "alxkcSNrzsYMDd5sB11DlwAAACU"]
[Sat Jul 18 23:45:21.233972 2026] [security2:error] [pid 938041:tid 938093] [remote 131.72.236.158:46856] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 158.236.72.131.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "worbals.com"] [uri "/wp-login.php"] [unique_id "alxkcSNrzsYMDd5sB11DogAAMjI"]
[Sat Jul 18 23:45:21.278931 2026] [lsapi:warn] [pid 943918:tid 944024] [remote 104.28.163.36:0] [host ali-alghanim.com] Backend log: PHP Warning:  getimagesize(https://aasgroup.online/wp-content/uploads/2021/09/1291810.jpg): Failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden\r\n in /home2/aasgroup/public_html/alialghanim/wp-content/plugins/litespeed-cache/src/media.cls.php on line 860\n, referer: https://ali-alghanim.net
[Sat Jul 18 23:45:21.744094 2026] [security2:error] [pid 943918:tid 944165] [client 45.133.7.79:62587] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 79.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/light/alfa-rex.php"] [unique_id "alxkcR70hbVC6SnzbhovGwAAAPk"]
[Sat Jul 18 23:45:21.840643 2026] [security2:error] [pid 943918:tid 944084] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/av.php"] [unique_id "alxkcR70hbVC6SnzbhovHwAAAKg"]
[Sat Jul 18 23:45:21.840775 2026] [security2:error] [pid 943918:tid 944084] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/av.php"] [unique_id "alxkcR70hbVC6SnzbhovHwAAAKg"]
[Sat Jul 18 23:45:21.857117 2026] [security2:error] [pid 938041:tid 938077] [remote 103.90.233.75:39202] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.233.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "idigress.studio"] [uri "/wp-login.php"] [unique_id "alxkcSNrzsYMDd5sB11DtgAAPyI"]
[Sat Jul 18 23:45:21.957403 2026] [security2:error] [pid 943918:tid 944153] [client 45.134.20.121:37933] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 121.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/udd.php"] [unique_id "alxkcR70hbVC6SnzbhovIgAAAO0"]
[Sat Jul 18 23:45:21.969977 2026] [security2:error] [pid 943918:tid 944143] [client 173.239.196.164:42699] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/gold.php"] [unique_id "alxkcR70hbVC6SnzbhovIwAAAOM"]
[Sat Jul 18 23:45:22.330492 2026] [security2:error] [pid 938041:tid 938120] [remote 103.90.233.75:39202] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.233.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "idigress.studio"] [uri "/wp-login.php"] [unique_id "alxkciNrzsYMDd5sB11DxQAAWE0"], referer: https://idigress.studio/wp-login.php
[Sat Jul 18 23:45:22.424781 2026] [security2:error] [pid 943918:tid 944137] [client 45.133.7.84:22779] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 84.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-good.php"] [unique_id "alxkch70hbVC6SnzbhovNAAAAN0"]
[Sat Jul 18 23:45:22.617643 2026] [security2:error] [pid 943918:tid 944062] [client 43.153.74.75:48394] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.74.153.43.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.aviationsynergy.aero"] [uri "/"] [unique_id "alxkch70hbVC6SnzbhovOAAAAJI"]
[Sat Jul 18 23:45:22.623472 2026] [security2:error] [pid 938041:tid 938122] [remote 131.72.236.158:46856] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 158.236.72.131.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "worbals.com"] [uri "/wp-login.php"] [unique_id "alxkciNrzsYMDd5sB11DywAAWk8"], referer: https://worbals.com/wp-login.php
[Sat Jul 18 23:45:22.663622 2026] [security2:error] [pid 943918:tid 944085] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/classwithtostring.php"] [unique_id "alxkch70hbVC6SnzbhovQAAAAKk"]
[Sat Jul 18 23:45:22.663716 2026] [security2:error] [pid 943918:tid 944085] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/classwithtostring.php"] [unique_id "alxkch70hbVC6SnzbhovQAAAAKk"]
[Sat Jul 18 23:45:22.833118 2026] [security2:error] [pid 943918:tid 944173] [client 173.239.196.167:55005] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "alxkch70hbVC6SnzbhovRgAAAQE"]
[Sat Jul 18 23:45:22.852269 2026] [security2:error] [pid 943918:tid 944161] [client 45.134.20.132:25785] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "alxkch70hbVC6SnzbhovRQAAAPU"]
[Sat Jul 18 23:45:22.863319 2026] [security2:error] [pid 943918:tid 944129] [client 106.222.249.209:23824] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkch70hbVC6SnzbhovSAAAANU"]
[Sat Jul 18 23:45:22.863437 2026] [security2:error] [pid 943918:tid 944129] [client 106.222.249.209:23824] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkch70hbVC6SnzbhovSAAAANU"]
[Sat Jul 18 23:45:23.109818 2026] [security2:error] [pid 938041:tid 938237] [client 45.133.7.62:51169] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/index.php"] [unique_id "alxkcyNrzsYMDd5sB11D1wAAAEE"]
[Sat Jul 18 23:45:23.291262 2026] [security2:error] [pid 943918:tid 944008] [remote 41.76.213.235:55010] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "headachescarpaltunnelfibromyalgia.com"] [uri "/wp-login.php"] [unique_id "alxkcx70hbVC6SnzbhovXQAA51g"]
[Sat Jul 18 23:45:23.709416 2026] [security2:error] [pid 943918:tid 944071] [client 45.134.20.109:46149] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 109.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/pwnd-1/pwnd.php"] [unique_id "alxkcx70hbVC6SnzbhovawAAAJs"]
[Sat Jul 18 23:45:23.747365 2026] [security2:error] [pid 943918:tid 944135] [client 173.239.196.163:50961] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/mu-plugins/index.php"] [unique_id "alxkcx70hbVC6SnzbhovbAAAANs"]
[Sat Jul 18 23:45:23.748789 2026] [security2:error] [pid 943918:tid 944156] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/wp-content/themes/index.php"] [unique_id "alxkcx70hbVC6SnzbhovbQAAAPA"]
[Sat Jul 18 23:45:23.748871 2026] [security2:error] [pid 943918:tid 944156] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/wp-content/themes/index.php"] [unique_id "alxkcx70hbVC6SnzbhovbQAAAPA"]
[Sat Jul 18 23:45:23.806441 2026] [security2:error] [pid 943918:tid 944162] [client 45.133.7.59:38183] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 59.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "alxkcx70hbVC6SnzbhovbwAAAPY"]
[Sat Jul 18 23:45:23.863989 2026] [security2:error] [pid 943918:tid 944034] [remote 41.76.213.235:55010] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "headachescarpaltunnelfibromyalgia.com"] [uri "/wp-login.php"] [unique_id "alxkcx70hbVC6SnzbhovcQAAknI"], referer: https://headachescarpaltunnelfibromyalgia.com/wp-login.php
[Sat Jul 18 23:45:23.882146 2026] [security2:error] [pid 938041:tid 938213] [client 163.61.1.17:64252] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkcyNrzsYMDd5sB11D_AAAACk"]
[Sat Jul 18 23:45:23.887297 2026] [security2:error] [pid 938041:tid 938213] [client 163.61.1.17:64252] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkcyNrzsYMDd5sB11D_AAAACk"]
[Sat Jul 18 23:45:24.492414 2026] [security2:error] [pid 943918:tid 944054] [client 45.133.7.80:26489] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "alxkdB70hbVC6SnzbhovhgAAAIo"]
[Sat Jul 18 23:45:24.568550 2026] [security2:error] [pid 943918:tid 944057] [client 45.134.20.137:59451] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 137.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/midnight/admin.php"] [unique_id "alxkdB70hbVC6SnzbhoviAAAAI0"]
[Sat Jul 18 23:45:24.599993 2026] [security2:error] [pid 943918:tid 944172] [client 173.239.196.164:60103] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "alxkdB70hbVC6SnzbhovigAAAQA"]
[Sat Jul 18 23:45:25.174039 2026] [security2:error] [pid 943918:tid 944070] [client 45.133.7.84:45267] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 84.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/twentytwentyfour/about.php"] [unique_id "alxkdR70hbVC6SnzbhovpAAAAJo"]
[Sat Jul 18 23:45:25.434194 2026] [security2:error] [pid 943918:tid 944081] [client 173.239.196.160:29529] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "alxkdR70hbVC6SnzbhovsQAAAKU"]
[Sat Jul 18 23:45:25.444764 2026] [security2:error] [pid 943918:tid 944069] [client 45.134.20.138:51627] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 138.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/kill.php"] [unique_id "alxkdR70hbVC6SnzbhovsAAAAJk"]
[Sat Jul 18 23:45:25.447694 2026] [security2:error] [pid 943918:tid 944136] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/wp-blog.php"] [unique_id "alxkdR70hbVC6SnzbhovswAAANw"]
[Sat Jul 18 23:45:25.447791 2026] [security2:error] [pid 943918:tid 944136] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/wp-blog.php"] [unique_id "alxkdR70hbVC6SnzbhovswAAANw"]
[Sat Jul 18 23:45:25.635513 2026] [security2:error] [pid 943918:tid 943935] [remote 116.179.32.103:30714] ModSecurity: Access denied with code 406 (phase 2). Match of "beginsWith %{request_headers.host}" against "TX:1" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "504"] [id "340162"] [rev "302"] [msg "Atomicorp.com WAF Rules: Remote File Injection Attack detected (Unauthorized URL detected as argument)"] [data ",TX:1"] [severity "CRITICAL"] [hostname "mollycahill.com"] [uri "/podcast"] [unique_id "alxkdR70hbVC6SnzbhovtgAA4A8"]
[Sat Jul 18 23:45:26.145249 2026] [security2:error] [pid 943918:tid 944120] [client 180.252.198.240:65005] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkdh70hbVC6SnzbhovzAAAAMw"]
[Sat Jul 18 23:45:26.145364 2026] [security2:error] [pid 943918:tid 944120] [client 180.252.198.240:65005] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkdh70hbVC6SnzbhovzAAAAMw"]
[Sat Jul 18 23:45:26.196321 2026] [security2:error] [pid 943918:tid 944059] [client 45.133.7.79:56869] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 79.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/js/widgets/about.php"] [unique_id "alxkdh70hbVC6Snzbhov0AAAAI8"]
[Sat Jul 18 23:45:26.302836 2026] [security2:error] [pid 943918:tid 944175] [client 45.134.20.129:56773] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "alxkdh70hbVC6Snzbhov1AAAAQM"]
[Sat Jul 18 23:45:26.304266 2026] [security2:error] [pid 943918:tid 944083] [client 173.239.196.166:60497] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "alxkdh70hbVC6Snzbhov1QAAAKc"]
[Sat Jul 18 23:45:26.434234 2026] [security2:error] [pid 938041:tid 938210] [client 119.156.157.170:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "elementconstruction.co.uk"] [uri "/index.php"] [unique_id "alxkdiNrzsYMDd5sB11ERAAAACY"]
[Sat Jul 18 23:45:26.673370 2026] [security2:error] [pid 943918:tid 943923] [remote 111.225.214.138:41003] ModSecurity: Access denied with code 406 (phase 2). Match of "beginsWith %{request_headers.host}" against "TX:1" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "504"] [id "340162"] [rev "302"] [msg "Atomicorp.com WAF Rules: Remote File Injection Attack detected (Unauthorized URL detected as argument)"] [data ",TX:1"] [severity "CRITICAL"] [hostname "mollycahill.com"] [uri "/podcast"] [unique_id "alxkdh70hbVC6Snzbhov6gAAiwM"]
[Sat Jul 18 23:45:26.698294 2026] [security2:error] [pid 943918:tid 944140] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.awellpacedlife.com"] [uri "/index.cgi"] [unique_id "alxkdh70hbVC6Snzbhov6QAAAOA"]
[Sat Jul 18 23:45:26.889524 2026] [security2:error] [pid 943918:tid 944078] [client 45.133.7.72:65417] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 72.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/fonts/database.php"] [unique_id "alxkdh70hbVC6Snzbhov7wAAAKI"]
[Sat Jul 18 23:45:26.901359 2026] [security2:error] [pid 943918:tid 944128] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/wp-content/admin.php"] [unique_id "alxkdh70hbVC6Snzbhov8AAAANQ"]
[Sat Jul 18 23:45:26.901450 2026] [security2:error] [pid 943918:tid 944128] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/wp-content/admin.php"] [unique_id "alxkdh70hbVC6Snzbhov8AAAANQ"]
[Sat Jul 18 23:45:27.157001 2026] [security2:error] [pid 943918:tid 944059] [client 45.134.20.121:51159] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 121.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "alxkdx70hbVC6SnzbhowAgAAAI8"]
[Sat Jul 18 23:45:27.179291 2026] [security2:error] [pid 943918:tid 944075] [client 173.239.196.167:29653] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/chosen.php"] [unique_id "alxkdx70hbVC6SnzbhowAwAAAJ8"]
[Sat Jul 18 23:45:27.570884 2026] [security2:error] [pid 943918:tid 944097] [client 45.133.7.62:64071] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/ff2.php"] [unique_id "alxkdx70hbVC6SnzbhowHgAAALU"]
[Sat Jul 18 23:45:27.712521 2026] [security2:error] [pid 943918:tid 943938] [remote 111.225.214.219:13761] ModSecurity: Access denied with code 406 (phase 2). Match of "beginsWith %{request_headers.host}" against "TX:1" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "504"] [id "340162"] [rev "302"] [msg "Atomicorp.com WAF Rules: Remote File Injection Attack detected (Unauthorized URL detected as argument)"] [data ",TX:1"] [severity "CRITICAL"] [hostname "mollycahill.com"] [uri "/podcast"] [unique_id "alxkdx70hbVC6SnzbhowIAAA9BI"]
[Sat Jul 18 23:45:28.010879 2026] [security2:error] [pid 943918:tid 944085] [client 45.134.20.112:57543] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 112.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/core-plugin/include.php"] [unique_id "alxkeB70hbVC6SnzbhowMQAAAKk"]
[Sat Jul 18 23:45:28.064470 2026] [security2:error] [pid 943918:tid 944133] [client 173.239.196.166:59187] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/pwnd/autoload_classmap.php"] [unique_id "alxkeB70hbVC6SnzbhowNgAAANk"]
[Sat Jul 18 23:45:28.252644 2026] [security2:error] [pid 943918:tid 944136] [client 45.133.7.60:62677] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 60.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "alxkeB70hbVC6SnzbhowOwAAANw"]
[Sat Jul 18 23:45:28.690850 2026] [security2:error] [pid 943918:tid 943927] [remote 157.66.47.83:57604] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "slutilities.com"] [uri "/wp-login.php"] [unique_id "alxkeB70hbVC6SnzbhowSQAAlgc"]
[Sat Jul 18 23:45:28.867341 2026] [security2:error] [pid 943918:tid 944152] [client 45.134.20.129:61455] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/envato-css.php"] [unique_id "alxkeB70hbVC6SnzbhowUQAAAOw"]
[Sat Jul 18 23:45:28.902243 2026] [security2:error] [pid 943918:tid 944054] [client 173.239.196.163:31779] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "alxkeB70hbVC6SnzbhowVAAAAIo"]
[Sat Jul 18 23:45:28.934615 2026] [security2:error] [pid 943918:tid 944145] [client 45.133.7.98:33585] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 98.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/plugin.php"] [unique_id "alxkeB70hbVC6SnzbhowWQAAAOU"]
[Sat Jul 18 23:45:28.980335 2026] [proxy:error] [pid 943918:tid 944142] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:45:28.980411 2026] [proxy_http:error] [pid 943918:tid 944142] [client 193.47.62.168:60694] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:45:28.980919 2026] [proxy:error] [pid 943918:tid 944142] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:45:28.980959 2026] [proxy_http:error] [pid 943918:tid 944142] [client 193.47.62.168:60694] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:45:29.087193 2026] [security2:error] [pid 943918:tid 944140] [client 139.167.225.146:53478] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkeR70hbVC6SnzbhowYAAAAOA"]
[Sat Jul 18 23:45:29.087285 2026] [security2:error] [pid 943918:tid 944140] [client 139.167.225.146:53478] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkeR70hbVC6SnzbhowYAAAAOA"]
[Sat Jul 18 23:45:29.089496 2026] [security2:error] [pid 943918:tid 943950] [remote 157.66.47.83:57604] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "slutilities.com"] [uri "/wp-login.php"] [unique_id "alxkeR70hbVC6SnzbhowXwAArR4"], referer: https://slutilities.com/wp-login.php
[Sat Jul 18 23:45:29.223964 2026] [security2:error] [pid 943918:tid 944138] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/adminfuns.php"] [unique_id "alxkeR70hbVC6SnzbhowZgAAAN4"]
[Sat Jul 18 23:45:29.224059 2026] [security2:error] [pid 943918:tid 944138] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/adminfuns.php"] [unique_id "alxkeR70hbVC6SnzbhowZgAAAN4"]
[Sat Jul 18 23:45:29.624253 2026] [security2:error] [pid 943918:tid 944146] [client 45.133.7.77:51999] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 77.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "alxkeR70hbVC6SnzbhowcAAAAOY"]
[Sat Jul 18 23:45:29.719438 2026] [security2:error] [pid 943918:tid 944075] [client 45.134.20.132:65269] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/classwithtostring.php"] [unique_id "alxkeR70hbVC6SnzbhowdQAAAJ8"]
[Sat Jul 18 23:45:29.762649 2026] [security2:error] [pid 943918:tid 944055] [client 173.239.196.166:61347] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/alam.php"] [unique_id "alxkeR70hbVC6SnzbhowdgAAAIs"]
[Sat Jul 18 23:45:30.309072 2026] [security2:error] [pid 943918:tid 944054] [client 45.133.7.95:22203] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/jp.php"] [unique_id "alxkeh70hbVC6SnzbhowiQAAAIo"]
[Sat Jul 18 23:45:30.611245 2026] [security2:error] [pid 938041:tid 938266] [client 173.239.196.166:64143] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/css/adminfusm.php"] [unique_id "alxkeiNrzsYMDd5sB11EygAAAF4"]
[Sat Jul 18 23:45:30.879208 2026] [security2:error] [pid 943918:tid 944160] [client 40.160.21.14:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "onpoint-evsolutions.com"] [uri "/index.php"] [unique_id "alxkeB70hbVC6SnzbhowTgAA9AA"]
[Sat Jul 18 23:45:30.942820 2026] [security2:error] [pid 943918:tid 944061] [client 116.179.33.73:63444] ModSecurity: Access denied with code 406 (phase 2). Match of "beginsWith %{request_headers.host}" against "TX:1" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "504"] [id "340162"] [rev "302"] [msg "Atomicorp.com WAF Rules: Remote File Injection Attack detected (Unauthorized URL detected as argument)"] [data ",TX:1"] [severity "CRITICAL"] [hostname "mollycahill.com"] [uri "/podcast"] [unique_id "alxkeh70hbVC6SnzbhowpwAAAJE"]
[Sat Jul 18 23:45:31.018001 2026] [security2:error] [pid 938041:tid 938225] [client 45.133.7.95:65135] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-atom.php"] [unique_id "alxkeyNrzsYMDd5sB11E2AAAADU"]
[Sat Jul 18 23:45:31.022984 2026] [security2:error] [pid 938041:tid 938228] [client 45.134.20.129:20363] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/index/function.php"] [unique_id "alxkeyNrzsYMDd5sB11E2QAAADg"]
[Sat Jul 18 23:45:31.430274 2026] [security2:error] [pid 943918:tid 944049] [client 103.160.26.178:57817] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkex70hbVC6SnzbhowvwAAAIU"]
[Sat Jul 18 23:45:31.430364 2026] [security2:error] [pid 943918:tid 944049] [client 103.160.26.178:57817] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkex70hbVC6SnzbhowvwAAAIU"]
[Sat Jul 18 23:45:31.468083 2026] [security2:error] [pid 943918:tid 944099] [client 173.239.196.165:26175] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "alxkex70hbVC6SnzbhowxQAAALc"]
[Sat Jul 18 23:45:31.491375 2026] [security2:error] [pid 943918:tid 944042] [remote 31.42.184.154:37218] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "elementconstruction.co.uk"] [uri "/wp-login.php"] [unique_id "alxkex70hbVC6SnzbhowyQAAtHo"]
[Sat Jul 18 23:45:31.498176 2026] [security2:error] [pid 943918:tid 944069] [client 36.83.95.75:53913] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkex70hbVC6SnzbhowyAAAAJk"]
[Sat Jul 18 23:45:31.498255 2026] [security2:error] [pid 943918:tid 944069] [client 36.83.95.75:53913] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkex70hbVC6SnzbhowyAAAAJk"]
[Sat Jul 18 23:45:31.538336 2026] [security2:error] [pid 943918:tid 944168] [client 138.252.89.100:57908] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkex70hbVC6SnzbhowywAAAPw"]
[Sat Jul 18 23:45:31.538408 2026] [security2:error] [pid 943918:tid 944168] [client 138.252.89.100:57908] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkex70hbVC6SnzbhowywAAAPw"]
[Sat Jul 18 23:45:31.603070 2026] [security2:error] [pid 943918:tid 944083] [client 40.160.21.14:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "onpoint-evsolutions.com"] [uri "/index.php"] [unique_id "alxkex70hbVC6SnzbhowvQAApxs"], referer: https://onpoint-evsolutions.com/app
[Sat Jul 18 23:45:31.697601 2026] [security2:error] [pid 943918:tid 944065] [client 45.133.7.70:21741] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/index.php"] [unique_id "alxkex70hbVC6Snzbhow0QAAAJU"]
[Sat Jul 18 23:45:31.889959 2026] [security2:error] [pid 938041:tid 938209] [client 45.134.20.134:61015] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 134.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/tinyfilemanager.php"] [unique_id "alxkeyNrzsYMDd5sB11E-wAAACU"]
[Sat Jul 18 23:45:32.338653 2026] [security2:error] [pid 943918:tid 944105] [client 173.239.196.163:52927] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/raw.php"] [unique_id "alxkfB70hbVC6Snzbhow8QAAAL0"]
[Sat Jul 18 23:45:32.377258 2026] [security2:error] [pid 943918:tid 944104] [client 45.133.7.56:41985] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 56.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/up.php"] [unique_id "alxkfB70hbVC6Snzbhow9AAAALw"]
[Sat Jul 18 23:45:32.649070 2026] [security2:error] [pid 938041:tid 938161] [remote 97.74.93.24:59556] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "elevator-data.com"] [uri "/wp-login.php"] [unique_id "alxkfCNrzsYMDd5sB11FFgAAH3Y"]
[Sat Jul 18 23:45:32.658581 2026] [security2:error] [pid 943918:tid 944103] [client 35.162.140.124:8999] ModSecurity: Warning. Matched phrase "Sucuri" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxkfB70hbVC6Snzbhow-AAAALs"]
[Sat Jul 18 23:45:32.742227 2026] [security2:error] [pid 938041:tid 938182] [client 45.134.20.106:45245] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/js/bas.php"] [unique_id "alxkfCNrzsYMDd5sB11FGAAAAAo"]
[Sat Jul 18 23:45:33.059794 2026] [security2:error] [pid 943918:tid 944078] [client 45.133.7.94:48249] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 94.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/uploads/bypass.php"] [unique_id "alxkfR70hbVC6SnzbhoxDAAAAKI"]
[Sat Jul 18 23:45:33.061978 2026] [security2:error] [pid 938041:tid 938159] [remote 97.74.93.24:59556] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.93.74.97.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "elevator-data.com"] [uri "/wp-login.php"] [unique_id "alxkfSNrzsYMDd5sB11FIwAAcnQ"], referer: https://elevator-data.com/wp-login.php
[Sat Jul 18 23:45:33.189314 2026] [security2:error] [pid 938041:tid 938192] [client 173.239.196.160:23161] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "alxkfSNrzsYMDd5sB11FJwAAABQ"]
[Sat Jul 18 23:45:33.232819 2026] [security2:error] [pid 943918:tid 944106] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/goods.php"] [unique_id "alxkfR70hbVC6SnzbhoxFAAAAL4"]
[Sat Jul 18 23:45:33.232919 2026] [security2:error] [pid 943918:tid 944106] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/goods.php"] [unique_id "alxkfR70hbVC6SnzbhoxFAAAAL4"]
[Sat Jul 18 23:45:33.599105 2026] [security2:error] [pid 943918:tid 944109] [client 45.134.20.116:54487] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 116.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/pki-validation/moon.php"] [unique_id "alxkfR70hbVC6SnzbhoxIwAAAME"]
[Sat Jul 18 23:45:33.756704 2026] [security2:error] [pid 943918:tid 944079] [client 45.133.7.77:38347] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 77.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/assets/images/admin.php"] [unique_id "alxkfR70hbVC6SnzbhoxJQAAAKM"]
[Sat Jul 18 23:45:33.788390 2026] [security2:error] [pid 943918:tid 943987] [remote 31.42.184.154:37218] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "elementconstruction.co.uk"] [uri "/wp-login.php"] [unique_id "alxkfR70hbVC6SnzbhoxKQAA5UM"], referer: https://elementconstruction.co.uk/wp-login.php
[Sat Jul 18 23:45:34.042229 2026] [security2:error] [pid 943918:tid 944162] [client 173.239.196.167:34345] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/includes/admin.php"] [unique_id "alxkfh70hbVC6SnzbhoxLgAAAPY"]
[Sat Jul 18 23:45:34.043375 2026] [security2:error] [pid 943918:tid 944173] [client 106.222.249.209:21524] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkfh70hbVC6SnzbhoxLwAAAQE"]
[Sat Jul 18 23:45:34.045838 2026] [security2:error] [pid 943918:tid 944173] [client 106.222.249.209:21524] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkfh70hbVC6SnzbhoxLwAAAQE"]
[Sat Jul 18 23:45:34.257998 2026] [core:error] [pid 943918:tid 944127] [client 5.61.209.43:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:45:34.258020 2026] [core:error] [pid 943918:tid 944127] [client 5.61.209.43:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:45:34.302466 2026] [proxy:error] [pid 938041:tid 938172] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:45:34.302524 2026] [proxy_http:error] [pid 938041:tid 938172] [client 193.47.62.168:41690] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:45:34.302958 2026] [proxy:error] [pid 938041:tid 938172] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:45:34.302984 2026] [proxy_http:error] [pid 938041:tid 938172] [client 193.47.62.168:41690] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:45:34.439678 2026] [security2:error] [pid 943918:tid 944074] [client 45.133.7.70:54275] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/index.php"] [unique_id "alxkfh70hbVC6SnzbhoxPgAAAJ4"]
[Sat Jul 18 23:45:34.452953 2026] [security2:error] [pid 938041:tid 938238] [client 45.134.20.127:45751] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 127.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/file.php"] [unique_id "alxkfiNrzsYMDd5sB11FXgAAAEI"]
[Sat Jul 18 23:45:34.529795 2026] [security2:error] [pid 943918:tid 944049] [client 163.61.1.17:64731] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkfh70hbVC6SnzbhoxPwAAAIU"]
[Sat Jul 18 23:45:34.529902 2026] [security2:error] [pid 943918:tid 944049] [client 163.61.1.17:64731] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkfh70hbVC6SnzbhoxPwAAAIU"]
[Sat Jul 18 23:45:34.891311 2026] [security2:error] [pid 943918:tid 944122] [client 173.239.196.164:24145] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/customize/chosen.php"] [unique_id "alxkfh70hbVC6SnzbhoxTgAAAM4"]
[Sat Jul 18 23:45:35.171577 2026] [security2:error] [pid 943918:tid 944056] [client 45.133.7.59:32201] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 59.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/js/wp-login.php"] [unique_id "alxkfx70hbVC6SnzbhoxUwAAAIw"]
[Sat Jul 18 23:45:35.320014 2026] [security2:error] [pid 938041:tid 938204] [client 45.134.20.124:61939] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 124.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/js/index.php"] [unique_id "alxkfyNrzsYMDd5sB11FfQAAACA"]
[Sat Jul 18 23:45:35.751459 2026] [security2:error] [pid 938041:tid 938278] [client 173.239.196.165:32021] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/uploads/2021/wp-works.php"] [unique_id "alxkfyNrzsYMDd5sB11FkgAAAGo"]
[Sat Jul 18 23:45:35.773950 2026] [security2:error] [pid 943918:tid 943973] [remote 152.228.213.32:49586] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxkfx70hbVC6SnzbhoxagAA5DU"]
[Sat Jul 18 23:45:35.856650 2026] [security2:error] [pid 943918:tid 944113] [client 45.133.7.61:43977] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/simple/function.php"] [unique_id "alxkfx70hbVC6SnzbhoxbwAAAMU"]
[Sat Jul 18 23:45:35.905960 2026] [security2:error] [pid 943918:tid 944171] [client 207.46.13.127:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "maxenengineering.com"] [uri "/maxenengineering/index.php"] [unique_id "alxkfh70hbVC6SnzbhoxOwAAAP8"]
[Sat Jul 18 23:45:35.971401 2026] [security2:error] [pid 943918:tid 943994] [remote 152.228.213.32:49586] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxkfx70hbVC6SnzbhoxdwABBEo"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:45:36.035632 2026] [proxy:error] [pid 943918:tid 944175] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:45:36.035700 2026] [proxy_http:error] [pid 943918:tid 944175] [client 193.47.62.168:41700] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:45:36.036196 2026] [proxy:error] [pid 943918:tid 944175] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:45:36.036222 2026] [proxy_http:error] [pid 943918:tid 944175] [client 193.47.62.168:41700] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:45:36.164915 2026] [security2:error] [pid 938041:tid 938072] [remote 31.42.184.154:57746] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "wathenbartlett.co.uk"] [uri "/wp-login.php"] [unique_id "alxkgCNrzsYMDd5sB11FnAAABB0"]
[Sat Jul 18 23:45:36.177355 2026] [security2:error] [pid 943918:tid 944139] [client 45.134.20.131:57339] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/upgrade/item.php"] [unique_id "alxkgB70hbVC6SnzbhoxfgAAAN8"]
[Sat Jul 18 23:45:36.235849 2026] [security2:error] [pid 943918:tid 944160] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/ms-edit.php"] [unique_id "alxkgB70hbVC6SnzbhoxgwAAAPQ"]
[Sat Jul 18 23:45:36.235932 2026] [security2:error] [pid 943918:tid 944160] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/ms-edit.php"] [unique_id "alxkgB70hbVC6SnzbhoxgwAAAPQ"]
[Sat Jul 18 23:45:36.322775 2026] [security2:error] [pid 938041:tid 938152] [remote 98.156.100.191:35350] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 191.100.156.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "boz.rnn.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxkgCNrzsYMDd5sB11FogAAE20"]
[Sat Jul 18 23:45:36.322964 2026] [security2:error] [pid 938041:tid 938191] [client 98.156.100.191:35350] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "boz.rnn.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxkgCNrzsYMDd5sB11FogAAE20"]
[Sat Jul 18 23:45:36.615620 2026] [security2:error] [pid 943918:tid 944112] [client 173.239.196.166:56905] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/media-new.php"] [unique_id "alxkgB70hbVC6SnzbhoxlgAAAMQ"]
[Sat Jul 18 23:45:36.720865 2026] [security2:error] [pid 943918:tid 944011] [remote 20.153.140.50:38032] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thslogistics.net"] [uri "/xmlrpc.php"] [unique_id "alxkgB70hbVC6SnzbhoxnAAA11s"]
[Sat Jul 18 23:45:36.721026 2026] [security2:error] [pid 943918:tid 944131] [client 20.153.140.50:38032] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "thslogistics.net"] [uri "/xmlrpc.php"] [unique_id "alxkgB70hbVC6SnzbhoxnAAA11s"]
[Sat Jul 18 23:45:36.728126 2026] [security2:error] [pid 943918:tid 944052] [client 180.252.198.240:65488] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkgB70hbVC6SnzbhoxnQAAAIg"]
[Sat Jul 18 23:45:36.728218 2026] [security2:error] [pid 943918:tid 944052] [client 180.252.198.240:65488] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkgB70hbVC6SnzbhoxnQAAAIg"]
[Sat Jul 18 23:45:36.891657 2026] [security2:error] [pid 943918:tid 944129] [client 45.133.7.93:46043] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 93.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/ext.php"] [unique_id "alxkgB70hbVC6SnzbhoxpQAAANU"]
[Sat Jul 18 23:45:37.041524 2026] [security2:error] [pid 943918:tid 944049] [client 45.134.20.129:58739] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/buy.php"] [unique_id "alxkgR70hbVC6SnzbhoxrwAAAIU"]
[Sat Jul 18 23:45:37.300157 2026] [security2:error] [pid 938041:tid 938050] [remote 31.42.184.154:57746] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "wathenbartlett.co.uk"] [uri "/wp-login.php"] [unique_id "alxkgSNrzsYMDd5sB11FuwAAGgc"], referer: https://wathenbartlett.co.uk/wp-login.php
[Sat Jul 18 23:45:37.501953 2026] [security2:error] [pid 943918:tid 944122] [client 173.239.196.165:23411] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/media-new.php"] [unique_id "alxkgR70hbVC6SnzbhoxwgAAAM4"]
[Sat Jul 18 23:45:37.569521 2026] [security2:error] [pid 943918:tid 944118] [client 45.133.7.76:58371] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 76.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/delpaths.php"] [unique_id "alxkgR70hbVC6SnzbhoxxgAAAMo"]
[Sat Jul 18 23:45:37.695615 2026] [security2:error] [pid 943918:tid 943992] [remote 154.61.75.100:51554] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "intelligentengineeringsolutions.com"] [uri "/wp-login.php"] [unique_id "alxkgR70hbVC6SnzbhoxzwAAukg"]
[Sat Jul 18 23:45:37.740718 2026] [security2:error] [pid 938041:tid 938264] [client 50.116.65.227:53806] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "obc.enu.mybluehost.me"] [uri "/website_43ccd705/wp-cron.php"] [unique_id "alxkgSNrzsYMDd5sB11FxgAAAFw"]
[Sat Jul 18 23:45:37.915763 2026] [security2:error] [pid 938041:tid 938279] [client 45.134.20.120:28663] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 120.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/languages/wp-conflg.php"] [unique_id "alxkgSNrzsYMDd5sB11FywAAAGs"]
[Sat Jul 18 23:45:38.235450 2026] [security2:error] [pid 943918:tid 944148] [client 113.173.135.216:35931] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "collectingrealestate.com"] [uri "/index.php"] [unique_id "alxkgh70hbVC6Snzbhox5QAAAOg"]
[Sat Jul 18 23:45:38.248018 2026] [security2:error] [pid 943918:tid 944100] [client 45.133.7.60:28755] ModSecurity: Warning. Pattern match "/1\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1543"] [id "900921"] [msg "temporary TUW-72162 logging rule"] [hostname "nikkidesigns.net"] [uri "/.well-known/pki-validation/1.php"] [unique_id "alxkgh70hbVC6Snzbhox5wAAALg"]
[Sat Jul 18 23:45:38.248137 2026] [security2:error] [pid 943918:tid 944100] [client 45.133.7.60:28755] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 60.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/pki-validation/1.php"] [unique_id "alxkgh70hbVC6Snzbhox5wAAALg"]
[Sat Jul 18 23:45:38.249026 2026] [security2:error] [pid 943918:tid 943974] [remote 154.61.75.100:51554] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "intelligentengineeringsolutions.com"] [uri "/wp-login.php"] [unique_id "alxkgh70hbVC6Snzbhox5gABAjY"], referer: https://intelligentengineeringsolutions.com/wp-login.php
[Sat Jul 18 23:45:38.373763 2026] [security2:error] [pid 943918:tid 944125] [client 173.239.196.164:62087] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/js/class_api.php"] [unique_id "alxkgh70hbVC6Snzbhox8AAAANE"]
[Sat Jul 18 23:45:38.428436 2026] [security2:error] [pid 943918:tid 944041] [remote 163.227.186.27:44754] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxkgh70hbVC6Snzbhox8QAAvXk"]
[Sat Jul 18 23:45:38.428566 2026] [security2:error] [pid 943918:tid 944105] [client 163.227.186.27:44754] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxkgh70hbVC6Snzbhox8QAAvXk"]
[Sat Jul 18 23:45:38.779481 2026] [security2:error] [pid 938041:tid 938238] [client 45.134.20.108:27793] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/classwithtostring.php"] [unique_id "alxkgiNrzsYMDd5sB11F6gAAAEI"]
[Sat Jul 18 23:45:38.840406 2026] [security2:error] [pid 943918:tid 943985] [remote 31.42.184.154:50694] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxkgh70hbVC6SnzbhoyBwAAn0E"]
[Sat Jul 18 23:45:38.977465 2026] [security2:error] [pid 938041:tid 938233] [client 45.133.7.87:49967] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 87.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "alxkgiNrzsYMDd5sB11F8AAAAD0"]
[Sat Jul 18 23:45:39.075772 2026] [security2:error] [pid 943918:tid 944036] [remote 31.42.184.154:50694] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxkgx70hbVC6SnzbhoyCgAAsnQ"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:45:39.232443 2026] [security2:error] [pid 943918:tid 944158] [client 173.239.196.163:23185] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/uploads/2021/themes.php"] [unique_id "alxkgx70hbVC6SnzbhoyFgAAAPI"]
[Sat Jul 18 23:45:39.635794 2026] [security2:error] [pid 943918:tid 944122] [client 45.134.20.138:21095] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 138.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/elementor/wp-wjvngrh.php"] [unique_id "alxkgx70hbVC6SnzbhoyHgAAAM4"]
[Sat Jul 18 23:45:39.660448 2026] [security2:error] [pid 943918:tid 944081] [client 45.133.7.96:39557] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 96.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/pki-validation/install.php"] [unique_id "alxkgx70hbVC6SnzbhoyIAAAAKU"]
[Sat Jul 18 23:45:39.818114 2026] [security2:error] [pid 943918:tid 944161] [client 3.109.49.224:43582] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.49.109.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxkgx70hbVC6SnzbhoyJAAAAPU"]
[Sat Jul 18 23:45:39.818187 2026] [security2:error] [pid 943918:tid 944161] [client 3.109.49.224:43582] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxkgx70hbVC6SnzbhoyJAAAAPU"]
[Sat Jul 18 23:45:40.085361 2026] [security2:error] [pid 943918:tid 944052] [client 173.239.196.166:26053] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/admin/install.php"] [unique_id "alxkhB70hbVC6SnzbhoyMgAAAIg"]
[Sat Jul 18 23:45:40.126908 2026] [security2:error] [pid 943918:tid 944152] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/222.php"] [unique_id "alxkhB70hbVC6SnzbhoyNQAAAOw"]
[Sat Jul 18 23:45:40.127016 2026] [security2:error] [pid 943918:tid 944152] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/222.php"] [unique_id "alxkhB70hbVC6SnzbhoyNQAAAOw"]
[Sat Jul 18 23:45:40.202299 2026] [security2:error] [pid 938041:tid 938291] [client 139.167.225.146:53968] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkhCNrzsYMDd5sB11GGwAAAHc"]
[Sat Jul 18 23:45:40.202419 2026] [security2:error] [pid 938041:tid 938291] [client 139.167.225.146:53968] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkhCNrzsYMDd5sB11GGwAAAHc"]
[Sat Jul 18 23:45:40.341529 2026] [security2:error] [pid 943918:tid 944089] [client 45.133.7.64:60809] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 64.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/sunrise/admin.php"] [unique_id "alxkhB70hbVC6SnzbhoyQAAAAK0"]
[Sat Jul 18 23:45:40.396145 2026] [proxy:error] [pid 943918:tid 944094] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:45:40.396216 2026] [proxy_http:error] [pid 943918:tid 944094] [client 193.47.62.168:41712] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:45:40.396744 2026] [proxy:error] [pid 943918:tid 944094] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:45:40.396781 2026] [proxy_http:error] [pid 943918:tid 944094] [client 193.47.62.168:41712] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:45:40.492855 2026] [security2:error] [pid 943918:tid 944173] [client 45.134.20.105:61353] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/IXR/fix.php7"] [unique_id "alxkhB70hbVC6SnzbhoySAAAAQE"]
[Sat Jul 18 23:45:40.719033 2026] [security2:error] [pid 943918:tid 944155] [client 18.195.15.81:60756] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 81.15.195.18.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxkhB70hbVC6SnzbhoyVAAAAO8"]
[Sat Jul 18 23:45:40.719149 2026] [security2:error] [pid 943918:tid 944155] [client 18.195.15.81:60756] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxkhB70hbVC6SnzbhoyVAAAAO8"]
[Sat Jul 18 23:45:40.885923 2026] [security2:error] [pid 938041:tid 938199] [client 57.141.18.45:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxkhCNrzsYMDd5sB11GKAAAABs"]
[Sat Jul 18 23:45:40.949264 2026] [security2:error] [pid 943918:tid 944108] [client 173.239.196.162:48413] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/plugin.php"] [unique_id "alxkhB70hbVC6SnzbhoyXAAAAMA"]
[Sat Jul 18 23:45:41.019928 2026] [security2:error] [pid 943918:tid 944161] [client 45.133.7.82:39177] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/gifclass.php"] [unique_id "alxkhR70hbVC6SnzbhoyXQAAAPU"]
[Sat Jul 18 23:45:41.205894 2026] [security2:error] [pid 943918:tid 944046] [remote 31.42.184.154:54398] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxkhR70hbVC6SnzbhoyZQAAyn4"]
[Sat Jul 18 23:45:41.371392 2026] [security2:error] [pid 938041:tid 938248] [client 45.134.20.123:53305] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 123.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "alxkhSNrzsYMDd5sB11GOAAAAEw"]
[Sat Jul 18 23:45:41.643557 2026] [security2:error] [pid 943918:tid 944026] [remote 103.90.234.13:38764] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.234.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxkhR70hbVC6SnzbhoydgAA5Go"]
[Sat Jul 18 23:45:41.643709 2026] [security2:error] [pid 943918:tid 944144] [client 103.90.234.13:38764] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxkhR70hbVC6SnzbhoydgAA5Go"]
[Sat Jul 18 23:45:41.699171 2026] [security2:error] [pid 943918:tid 944072] [client 45.133.7.85:37667] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 85.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/plugin.php"] [unique_id "alxkhR70hbVC6SnzbhoyeAAAAJw"]
[Sat Jul 18 23:45:41.811734 2026] [security2:error] [pid 943918:tid 944087] [client 173.239.196.160:51021] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "alxkhR70hbVC6SnzbhoyhAAAAKs"]
[Sat Jul 18 23:45:41.899391 2026] [security2:error] [pid 943918:tid 944073] [client 103.160.26.178:58277] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkhR70hbVC6SnzbhoyhgAAAJ0"]
[Sat Jul 18 23:45:41.899519 2026] [security2:error] [pid 943918:tid 944073] [client 103.160.26.178:58277] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkhR70hbVC6SnzbhoyhgAAAJ0"]
[Sat Jul 18 23:45:42.017847 2026] [security2:error] [pid 943918:tid 944130] [client 36.83.95.75:54395] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkhh70hbVC6SnzbhoyhwAAANY"]
[Sat Jul 18 23:45:42.017975 2026] [security2:error] [pid 943918:tid 944130] [client 36.83.95.75:54395] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkhh70hbVC6SnzbhoyhwAAANY"]
[Sat Jul 18 23:45:42.251518 2026] [security2:error] [pid 943918:tid 944079] [client 45.134.20.122:36829] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/admin/function.php"] [unique_id "alxkhh70hbVC6SnzbhoyjAAAAKM"]
[Sat Jul 18 23:45:42.351315 2026] [security2:error] [pid 943918:tid 944109] [client 47.128.17.12:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.thescarystory.com"] [uri "/%27/2015/5"] [unique_id "alxkhh70hbVC6SnzbhoyjQAAAME"]
[Sat Jul 18 23:45:42.378846 2026] [security2:error] [pid 943918:tid 944059] [client 45.133.7.104:55747] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/twentytwentyfour/bypass.php"] [unique_id "alxkhh70hbVC6SnzbhoyjgAAAI8"]
[Sat Jul 18 23:45:42.507680 2026] [security2:error] [pid 943918:tid 944031] [remote 31.42.184.154:54398] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxkhh70hbVC6SnzbhoykwAA5m8"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:45:42.690114 2026] [security2:error] [pid 938041:tid 938269] [client 173.239.196.161:29245] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/js/item.php"] [unique_id "alxkhiNrzsYMDd5sB11GZwAAAGE"]
[Sat Jul 18 23:45:43.070863 2026] [security2:error] [pid 943918:tid 944050] [client 45.133.7.64:35631] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 64.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/update-core.php"] [unique_id "alxkhx70hbVC6SnzbhoypQAAAIY"]
[Sat Jul 18 23:45:43.107019 2026] [security2:error] [pid 938041:tid 938219] [client 45.134.20.119:31869] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "alxkhyNrzsYMDd5sB11GcgAAAC8"]
[Sat Jul 18 23:45:43.361603 2026] [security2:error] [pid 943918:tid 944117] [client 138.252.89.100:58428] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkhx70hbVC6SnzbhoysQAAAMk"]
[Sat Jul 18 23:45:43.362463 2026] [security2:error] [pid 943918:tid 944117] [client 138.252.89.100:58428] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkhx70hbVC6SnzbhoysQAAAMk"]
[Sat Jul 18 23:45:43.531850 2026] [security2:error] [pid 938041:tid 938273] [client 173.239.196.161:55077] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/pages.php"] [unique_id "alxkhyNrzsYMDd5sB11GfQAAAGU"]
[Sat Jul 18 23:45:43.753715 2026] [security2:error] [pid 943918:tid 944175] [client 45.133.7.55:55119] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 55.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/blue/about.php"] [unique_id "alxkhx70hbVC6SnzbhoytAAAAQM"]
[Sat Jul 18 23:45:43.969645 2026] [security2:error] [pid 943918:tid 944108] [client 45.134.20.117:53247] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "alxkhx70hbVC6SnzbhoywQAAAMA"]
[Sat Jul 18 23:45:44.180300 2026] [security2:error] [pid 943918:tid 943940] [remote 113.160.142.119:58688] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "elementconstruction.co.uk"] [uri "/wp-login.php"] [unique_id "alxkiB70hbVC6SnzbhoywwAAmhQ"], referer: https://elementconstruction.co.uk/wp-login.php
[Sat Jul 18 23:45:44.306196 2026] [security2:error] [pid 943918:tid 944164] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/cgi-bin/index.php"] [unique_id "alxkiB70hbVC6SnzbhoyxAAAAPg"]
[Sat Jul 18 23:45:44.306284 2026] [security2:error] [pid 943918:tid 944164] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/cgi-bin/index.php"] [unique_id "alxkiB70hbVC6SnzbhoyxAAAAPg"]
[Sat Jul 18 23:45:44.378559 2026] [security2:error] [pid 943918:tid 944086] [client 173.239.196.160:49901] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "alxkiB70hbVC6SnzbhoyyAAAAKo"]
[Sat Jul 18 23:45:44.442347 2026] [security2:error] [pid 943918:tid 944056] [client 45.133.7.59:63453] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 59.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-mail.php"] [unique_id "alxkiB70hbVC6SnzbhoyzgAAAIw"]
[Sat Jul 18 23:45:44.825290 2026] [security2:error] [pid 943918:tid 944169] [client 45.134.20.137:50583] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 137.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "alxkiB70hbVC6Snzbhoy2QAAAP0"]
[Sat Jul 18 23:45:45.066290 2026] [proxy:error] [pid 943918:tid 944143] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:45:45.066345 2026] [proxy_http:error] [pid 943918:tid 944143] [client 193.47.62.168:39004] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:45:45.066811 2026] [proxy:error] [pid 943918:tid 944143] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:45:45.066835 2026] [proxy_http:error] [pid 943918:tid 944143] [client 193.47.62.168:39004] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:45:45.122638 2026] [security2:error] [pid 938041:tid 938236] [client 45.133.7.92:32881] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/admin.php"] [unique_id "alxkiSNrzsYMDd5sB11GoAAAAEA"]
[Sat Jul 18 23:45:45.125138 2026] [security2:error] [pid 943918:tid 944149] [client 106.222.249.209:10202] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkiR70hbVC6Snzbhoy7gAAAOk"]
[Sat Jul 18 23:45:45.125394 2026] [security2:error] [pid 943918:tid 944149] [client 106.222.249.209:10202] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkiR70hbVC6Snzbhoy7gAAAOk"]
[Sat Jul 18 23:45:45.197977 2026] [security2:error] [pid 943918:tid 944136] [client 163.61.1.17:65216] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkiR70hbVC6Snzbhoy8AAAANw"]
[Sat Jul 18 23:45:45.198158 2026] [security2:error] [pid 943918:tid 944136] [client 163.61.1.17:65216] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkiR70hbVC6Snzbhoy8AAAANw"]
[Sat Jul 18 23:45:45.211546 2026] [security2:error] [pid 938041:tid 938225] [client 173.239.196.162:50953] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/classwithtostring.php%20"] [unique_id "alxkiSNrzsYMDd5sB11GogAAADU"]
[Sat Jul 18 23:45:45.682166 2026] [security2:error] [pid 938041:tid 938204] [client 45.134.20.122:24561] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "alxkiSNrzsYMDd5sB11GswAAACA"]
[Sat Jul 18 23:45:45.802648 2026] [security2:error] [pid 943918:tid 944151] [client 45.133.7.75:48715] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/defaults.php"] [unique_id "alxkiR70hbVC6SnzbhozAAAAAOs"]
[Sat Jul 18 23:45:46.098613 2026] [security2:error] [pid 938041:tid 938247] [client 173.239.196.166:53991] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/uploads/function.php"] [unique_id "alxkiiNrzsYMDd5sB11GwQAAAEs"]
[Sat Jul 18 23:45:46.370949 2026] [security2:error] [pid 938041:tid 938283] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.awellpacedlife.com"] [uri "/index.cgi"] [unique_id "alxkiiNrzsYMDd5sB11GyQAAAG8"]
[Sat Jul 18 23:45:46.482985 2026] [security2:error] [pid 943918:tid 944145] [client 45.133.7.95:60885] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/acme-challenge/content.php"] [unique_id "alxkih70hbVC6SnzbhozGQAAAOU"]
[Sat Jul 18 23:45:46.603449 2026] [security2:error] [pid 943918:tid 944129] [client 45.134.20.110:57443] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "655"] [id "900155"] [msg "WP Brute UA block"] [hostname "swafforddetailing.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "alxkih70hbVC6SnzbhozHQAAANU"]
[Sat Jul 18 23:45:46.757328 2026] [security2:error] [pid 938041:tid 938287] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/BDKR28WP.php"] [unique_id "alxkiiNrzsYMDd5sB11G3wAAAHM"]
[Sat Jul 18 23:45:46.757490 2026] [security2:error] [pid 938041:tid 938287] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/BDKR28WP.php"] [unique_id "alxkiiNrzsYMDd5sB11G3wAAAHM"]
[Sat Jul 18 23:45:46.840443 2026] [security2:error] [pid 943918:tid 944110] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxkih70hbVC6SnzbhozNwAAAMI"]
[Sat Jul 18 23:45:46.989918 2026] [security2:error] [pid 943918:tid 944144] [client 173.239.196.161:35465] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/assets/js/doc.php"] [unique_id "alxkih70hbVC6SnzbhozSQAAAOQ"]
[Sat Jul 18 23:45:47.129044 2026] [security2:error] [pid 943918:tid 944155] [client 180.252.198.240:49573] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkix70hbVC6SnzbhozUQAAAO8"]
[Sat Jul 18 23:45:47.129877 2026] [security2:error] [pid 943918:tid 944155] [client 180.252.198.240:49573] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkix70hbVC6SnzbhozUQAAAO8"]
[Sat Jul 18 23:45:47.164949 2026] [security2:error] [pid 943918:tid 944158] [client 45.133.7.95:47699] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/ALFA_DATA/alfacgiapi/bypass.php"] [unique_id "alxkix70hbVC6SnzbhozVQAAAPI"]
[Sat Jul 18 23:45:47.350686 2026] [security2:error] [pid 943918:tid 944169] [client 34.162.230.222:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxkix70hbVC6SnzbhozTwAAAP0"]
[Sat Jul 18 23:45:47.529468 2026] [security2:error] [pid 943918:tid 944078] [client 45.134.20.104:57865] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/files/index.php"] [unique_id "alxkix70hbVC6SnzbhozXwAAAKI"]
[Sat Jul 18 23:45:47.850688 2026] [security2:error] [pid 938041:tid 938225] [client 45.133.7.98:48751] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 98.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/maint/about.php"] [unique_id "alxkiyNrzsYMDd5sB11G-AAAADU"]
[Sat Jul 18 23:45:47.851584 2026] [security2:error] [pid 943918:tid 944144] [client 173.239.196.164:54175] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/assets/comfunctions.php"] [unique_id "alxkix70hbVC6SnzbhozbwAAAOQ"]
[Sat Jul 18 23:45:47.974313 2026] [security2:error] [pid 943918:tid 944123] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.awellpacedlife.com"] [uri "/index.cgi"] [unique_id "alxkix70hbVC6SnzbhozewAAAM8"]
[Sat Jul 18 23:45:48.238519 2026] [security2:error] [pid 943918:tid 944136] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.awellpacedlife.com"] [uri "/index.cgi"] [unique_id "alxkjB70hbVC6SnzbhozhQAAANw"]
[Sat Jul 18 23:45:48.382034 2026] [security2:error] [pid 943918:tid 944063] [client 45.134.20.124:52883] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 124.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "alxkjB70hbVC6SnzbhozjQAAAJM"]
[Sat Jul 18 23:45:48.408475 2026] [security2:error] [pid 943918:tid 944162] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/wp.php"] [unique_id "alxkjB70hbVC6SnzbhozjgAAAPY"]
[Sat Jul 18 23:45:48.408552 2026] [security2:error] [pid 943918:tid 944162] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/wp.php"] [unique_id "alxkjB70hbVC6SnzbhozjgAAAPY"]
[Sat Jul 18 23:45:48.537108 2026] [security2:error] [pid 938041:tid 938264] [client 45.133.7.86:38183] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 86.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/js/about.php"] [unique_id "alxkjCNrzsYMDd5sB11HCAAAAFw"]
[Sat Jul 18 23:45:48.577161 2026] [security2:error] [pid 943918:tid 944092] [client 66.249.68.39:50569] ModSecurity: Access denied with code 429 (phase 2). Pattern match "Googlebot[\\\\/-]" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/google.conf"] [line "3"] [id "901003"] [msg "Googlebot Crawler 429 ADDED BY MONITORING DO NOT WHITELIST"] [hostname "box5023.bluehost.com"] [uri "/robots.txt"] [unique_id "alxkjB70hbVC6SnzbhozkQAAALA"]
[Sat Jul 18 23:45:48.612817 2026] [security2:error] [pid 943918:tid 944110] [client 66.249.68.38:58419] ModSecurity: Access denied with code 429 (phase 2). Pattern match "Googlebot[\\\\/-]" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/google.conf"] [line "3"] [id "901003"] [msg "Googlebot Crawler 429 ADDED BY MONITORING DO NOT WHITELIST"] [hostname "box5023.bluehost.com"] [uri "/robots.txt"] [unique_id "alxkjB70hbVC6SnzbhozkwAAAMI"]
[Sat Jul 18 23:45:48.636861 2026] [security2:error] [pid 938041:tid 938216] [client 74.208.214.194:55066] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxkjCNrzsYMDd5sB11HDwAAACw"]
[Sat Jul 18 23:45:48.673290 2026] [security2:error] [pid 943918:tid 944057] [client 66.249.68.128:36399] ModSecurity: Access denied with code 429 (phase 2). Pattern match "Googlebot[\\\\/-]" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/google.conf"] [line "3"] [id "901003"] [msg "Googlebot Crawler 429 ADDED BY MONITORING DO NOT WHITELIST"] [hostname "tsctanks.com"] [uri "/robots.txt"] [unique_id "alxkjB70hbVC6SnzbhozmAAAAI0"]
[Sat Jul 18 23:45:48.675944 2026] [security2:error] [pid 938041:tid 938243] [client 66.249.68.131:61835] ModSecurity: Access denied with code 429 (phase 2). Pattern match "Googlebot[\\\\/-]" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/google.conf"] [line "3"] [id "901003"] [msg "Googlebot Crawler 429 ADDED BY MONITORING DO NOT WHITELIST"] [hostname "tsctanks.com"] [uri "/robots.txt"] [unique_id "alxkjCNrzsYMDd5sB11HEQAAAEc"]
[Sat Jul 18 23:45:48.693510 2026] [security2:error] [pid 943918:tid 944144] [client 173.239.196.165:44039] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "alxkjB70hbVC6SnzbhozmgAAAOQ"]
[Sat Jul 18 23:45:48.704365 2026] [security2:error] [pid 943918:tid 943950] [remote 4.205.168.44:39598] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxkjB70hbVC6SnzbhozmQAA6h4"]
[Sat Jul 18 23:45:48.904921 2026] [security2:error] [pid 943918:tid 943968] [remote 4.205.168.44:39598] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxkjB70hbVC6SnzbhoznAAAkjA"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:45:48.914288 2026] [security2:error] [pid 938041:tid 938219] [client 113.160.97.242:64446] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxkjCNrzsYMDd5sB11HHAAAAC8"]
[Sat Jul 18 23:45:49.146852 2026] [security2:error] [pid 938041:tid 938185] [client 62.150.67.110:62348] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "ali-alghanim.net"] [uri "/index.php"] [unique_id "alxkjCNrzsYMDd5sB11HGgAAAA0"]
[Sat Jul 18 23:45:49.220172 2026] [security2:error] [pid 943918:tid 944082] [client 45.133.7.61:22827] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/uploads/2023/05/404.php"] [unique_id "alxkjR70hbVC6SnzbhozpgAAAKY"]
[Sat Jul 18 23:45:49.241323 2026] [security2:error] [pid 938041:tid 938195] [client 45.134.20.129:52629] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/inc.php"] [unique_id "alxkjSNrzsYMDd5sB11HLQAAABc"]
[Sat Jul 18 23:45:49.556053 2026] [security2:error] [pid 938041:tid 938177] [client 173.239.196.166:42685] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/css/adminfus.php"] [unique_id "alxkjSNrzsYMDd5sB11HQAAAAAU"]
[Sat Jul 18 23:45:49.910385 2026] [security2:error] [pid 943918:tid 944160] [client 45.133.7.88:65517] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 88.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/maint/maint.php"] [unique_id "alxkjR70hbVC6SnzbhozrgAAAPQ"]
[Sat Jul 18 23:45:50.113848 2026] [security2:error] [pid 938041:tid 938216] [client 45.134.20.125:22695] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 125.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/index.php"] [unique_id "alxkjiNrzsYMDd5sB11HUgAAACw"]
[Sat Jul 18 23:45:50.414699 2026] [security2:error] [pid 943918:tid 944169] [client 173.239.196.166:49361] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/adminfus.php"] [unique_id "alxkjh70hbVC6SnzbhozvwAAAP0"]
[Sat Jul 18 23:45:50.455984 2026] [security2:error] [pid 943918:tid 944162] [client 139.167.225.146:54414] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkjh70hbVC6SnzbhozwAAAAPY"]
[Sat Jul 18 23:45:50.456085 2026] [security2:error] [pid 943918:tid 944162] [client 139.167.225.146:54414] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkjh70hbVC6SnzbhozwAAAAPY"]
[Sat Jul 18 23:45:50.597799 2026] [security2:error] [pid 943918:tid 944067] [client 45.133.7.93:41481] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 93.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/assets/bypass.php"] [unique_id "alxkjh70hbVC6SnzbhozwQAAAJc"]
[Sat Jul 18 23:45:50.968610 2026] [security2:error] [pid 938041:tid 938199] [client 45.134.20.139:29981] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 139.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/filemanager.php"] [unique_id "alxkjiNrzsYMDd5sB11HaQAAABs"]
[Sat Jul 18 23:45:51.235237 2026] [security2:error] [pid 938041:tid 938287] [client 173.239.196.165:51065] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/css/litespeed.php"] [unique_id "alxkjyNrzsYMDd5sB11HdgAAAHM"]
[Sat Jul 18 23:45:51.279640 2026] [security2:error] [pid 938041:tid 938205] [client 45.133.7.94:31867] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 94.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/aa.php"] [unique_id "alxkjyNrzsYMDd5sB11HeAAAACE"]
[Sat Jul 18 23:45:51.359783 2026] [security2:error] [pid 943918:tid 944052] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/abcd.php"] [unique_id "alxkjx70hbVC6Snzbhoz1gAAAIg"]
[Sat Jul 18 23:45:51.359863 2026] [security2:error] [pid 943918:tid 944052] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/abcd.php"] [unique_id "alxkjx70hbVC6Snzbhoz1gAAAIg"]
[Sat Jul 18 23:45:51.828012 2026] [security2:error] [pid 943918:tid 944098] [client 45.134.20.116:20625] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 116.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/cgi-bin/bypass.php"] [unique_id "alxkjx70hbVC6Snzbhoz5gAAALY"]
[Sat Jul 18 23:45:51.959779 2026] [security2:error] [pid 938041:tid 938189] [client 45.133.7.80:55705] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/index2.php"] [unique_id "alxkjyNrzsYMDd5sB11HjgAAABE"]
[Sat Jul 18 23:45:52.060922 2026] [security2:error] [pid 938041:tid 938243] [client 173.239.196.162:28771] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/images/as.php"] [unique_id "alxkkCNrzsYMDd5sB11HkQAAAEc"]
[Sat Jul 18 23:45:52.367474 2026] [security2:error] [pid 943918:tid 944161] [client 114.119.143.68:45307] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "colinkeyphotography.com"] [uri "/product/4-look-4-retouch-theatrical"] [unique_id "alxkkB70hbVC6Snzbhoz8QAAAPU"], referer: https://colinkeyphotography.com/product/4-look-4-retouch-theatrical
[Sat Jul 18 23:45:52.549608 2026] [security2:error] [pid 943918:tid 944103] [client 36.83.95.75:54862] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkkB70hbVC6Snzbhoz8wAAALs"]
[Sat Jul 18 23:45:52.549833 2026] [security2:error] [pid 943918:tid 944103] [client 36.83.95.75:54862] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkkB70hbVC6Snzbhoz8wAAALs"]
[Sat Jul 18 23:45:52.579818 2026] [security2:error] [pid 943918:tid 944114] [client 103.160.26.178:58748] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkkB70hbVC6Snzbhoz9AAAAMY"]
[Sat Jul 18 23:45:52.579937 2026] [security2:error] [pid 943918:tid 944114] [client 103.160.26.178:58748] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkkB70hbVC6Snzbhoz9AAAAMY"]
[Sat Jul 18 23:45:52.641592 2026] [security2:error] [pid 943918:tid 944075] [client 45.133.7.58:20411] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/hello-element/footer.php"] [unique_id "alxkkB70hbVC6Snzbhoz-AAAAJ8"]
[Sat Jul 18 23:45:52.673045 2026] [security2:error] [pid 938041:tid 938096] [remote 157.66.47.83:39744] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/wp-login.php"] [unique_id "alxkkCNrzsYMDd5sB11HpAAAJTU"]
[Sat Jul 18 23:45:52.686040 2026] [security2:error] [pid 943918:tid 944166] [client 45.134.20.136:33137] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 136.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/pki-validation/admin.php"] [unique_id "alxkkB70hbVC6Snzbhoz_AAAAPo"]
[Sat Jul 18 23:45:52.920036 2026] [security2:error] [pid 943918:tid 944062] [client 173.239.196.162:41517] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/setup-config.php"] [unique_id "alxkkB70hbVC6Snzbho0BAAAAJI"]
[Sat Jul 18 23:45:53.070814 2026] [security2:error] [pid 938041:tid 938129] [remote 157.66.47.83:39744] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/wp-login.php"] [unique_id "alxkkSNrzsYMDd5sB11HtAAABFY"], referer: https://muafaces.org/wp-login.php
[Sat Jul 18 23:45:53.328630 2026] [security2:error] [pid 938041:tid 938226] [client 45.133.7.72:52513] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 72.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/network/admin.php"] [unique_id "alxkkSNrzsYMDd5sB11HuQAAADY"]
[Sat Jul 18 23:45:53.530884 2026] [security2:error] [pid 938041:tid 938205] [client 74.7.227.179:44932] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxkkSNrzsYMDd5sB11HvAAAIS0"], referer: https://tejasenvironmental.com/p=274723
[Sat Jul 18 23:45:53.541257 2026] [security2:error] [pid 938041:tid 938244] [client 45.134.20.113:49719] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "alxkkSNrzsYMDd5sB11HwAAAAEg"]
[Sat Jul 18 23:45:53.552814 2026] [security2:error] [pid 943918:tid 944080] [client 207.46.13.51:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.maxenengineering.com"] [uri "/maxenengineering/index.php"] [unique_id "alxkkR70hbVC6Snzbho0EgAAAKQ"]
[Sat Jul 18 23:45:53.824207 2026] [security2:error] [pid 943918:tid 944081] [client 173.239.196.166:46847] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "alxkkR70hbVC6Snzbho0JQAAAKU"]
[Sat Jul 18 23:45:54.019020 2026] [security2:error] [pid 938041:tid 938281] [client 45.133.7.57:50219] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 57.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/pki-validation/2index.php"] [unique_id "alxkkiNrzsYMDd5sB11HzAAAAG0"]
[Sat Jul 18 23:45:54.406714 2026] [security2:error] [pid 943918:tid 944074] [client 45.134.20.115:37361] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/js/index.php"] [unique_id "alxkkh70hbVC6Snzbho0RgAAAJ4"]
[Sat Jul 18 23:45:54.426822 2026] [security2:error] [pid 938041:tid 938151] [remote 49.13.1.223:36214] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.1.13.49.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-login.php"] [unique_id "alxkkiNrzsYMDd5sB11H1QAAX2w"]
[Sat Jul 18 23:45:54.443052 2026] [security2:error] [pid 943918:tid 944157] [client 136.243.59.237:33404] ModSecurity: Warning. Matched phrase "DomainStatsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "www.ccsdifference.com"] [uri "/index.php"] [unique_id "alxkkh70hbVC6Snzbho0MwAAAPE"]
[Sat Jul 18 23:45:54.570364 2026] [security2:error] [pid 943918:tid 943973] [remote 217.182.128.41:45428] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.128.182.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "solkeetw.com"] [uri "/xmlrpc.php"] [unique_id "alxkkh70hbVC6Snzbho0TwABAzU"]
[Sat Jul 18 23:45:54.570504 2026] [security2:error] [pid 943918:tid 944175] [client 217.182.128.41:45428] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "solkeetw.com"] [uri "/xmlrpc.php"] [unique_id "alxkkh70hbVC6Snzbho0TwABAzU"]
[Sat Jul 18 23:45:54.622083 2026] [security2:error] [pid 938041:tid 938097] [remote 49.13.1.223:36214] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.1.13.49.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-login.php"] [unique_id "alxkkiNrzsYMDd5sB11H3QAASTY"], referer: https://maxenengineering.com/wp-login.php
[Sat Jul 18 23:45:54.701419 2026] [security2:error] [pid 943918:tid 944112] [client 45.133.7.80:35751] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/languages/plugins.php"] [unique_id "alxkkh70hbVC6Snzbho0UgAAAMQ"]
[Sat Jul 18 23:45:54.710182 2026] [security2:error] [pid 938041:tid 938179] [client 173.239.196.167:59539] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/cong.php"] [unique_id "alxkkiNrzsYMDd5sB11H3wAAAAc"]
[Sat Jul 18 23:45:54.837707 2026] [security2:error] [pid 938041:tid 938219] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/a1.php"] [unique_id "alxkkiNrzsYMDd5sB11H5AAAAC8"]
[Sat Jul 18 23:45:54.837823 2026] [security2:error] [pid 938041:tid 938219] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/a1.php"] [unique_id "alxkkiNrzsYMDd5sB11H5AAAAC8"]
[Sat Jul 18 23:45:55.223152 2026] [security2:error] [pid 943918:tid 944117] [client 138.252.89.100:58949] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkkx70hbVC6Snzbho0XwAAAMk"]
[Sat Jul 18 23:45:55.223855 2026] [security2:error] [pid 943918:tid 944117] [client 138.252.89.100:58949] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkkx70hbVC6Snzbho0XwAAAMk"]
[Sat Jul 18 23:45:55.269272 2026] [security2:error] [pid 943918:tid 944052] [client 45.134.20.135:44547] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "alxkkx70hbVC6Snzbho0YQAAAIg"]
[Sat Jul 18 23:45:55.383328 2026] [security2:error] [pid 943918:tid 944150] [client 45.133.7.101:22839] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 101.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/shell.php"] [unique_id "alxkkx70hbVC6Snzbho0aAAAAOo"]
[Sat Jul 18 23:45:55.625489 2026] [security2:error] [pid 938041:tid 938266] [client 173.239.196.160:20833] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "alxkkyNrzsYMDd5sB11IAwAAAF4"]
[Sat Jul 18 23:45:55.651127 2026] [security2:error] [pid 938041:tid 938235] [client 163.61.1.17:49310] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkkyNrzsYMDd5sB11IBQAAAD8"]
[Sat Jul 18 23:45:55.651252 2026] [security2:error] [pid 938041:tid 938235] [client 163.61.1.17:49310] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkkyNrzsYMDd5sB11IBQAAAD8"]
[Sat Jul 18 23:45:55.723887 2026] [security2:error] [pid 943918:tid 944055] [client 106.222.249.209:21418] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkkx70hbVC6Snzbho0iwAAAIs"]
[Sat Jul 18 23:45:55.724152 2026] [security2:error] [pid 943918:tid 944055] [client 106.222.249.209:21418] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkkx70hbVC6Snzbho0iwAAAIs"]
[Sat Jul 18 23:45:56.071111 2026] [security2:error] [pid 938041:tid 938297] [client 45.133.7.64:26931] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 64.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/content.php"] [unique_id "alxklCNrzsYMDd5sB11INwAAAH0"]
[Sat Jul 18 23:45:56.076689 2026] [security2:error] [pid 943918:tid 944126] [client 35.227.39.208:37258] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "scarlettshirt.com"] [uri "/wp-json/batch/v1"] [unique_id "alxklB70hbVC6Snzbho05QAAANI"]
[Sat Jul 18 23:45:56.167146 2026] [security2:error] [pid 943918:tid 944094] [client 35.227.39.208:37258] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "scarlettshirt.com"] [uri "/"] [unique_id "alxklB70hbVC6Snzbho06AAAALI"]
[Sat Jul 18 23:45:56.331551 2026] [security2:error] [pid 938041:tid 938271] [client 45.134.20.133:31117] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/function.php"] [unique_id "alxklCNrzsYMDd5sB11IQwAAAGM"]
[Sat Jul 18 23:45:56.520044 2026] [security2:error] [pid 943918:tid 944163] [client 173.239.196.163:39585] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/pwnd/adminfus.php"] [unique_id "alxklB70hbVC6Snzbho0_QAAAPc"]
[Sat Jul 18 23:45:56.585873 2026] [security2:error] [pid 938041:tid 938289] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "alxklCNrzsYMDd5sB11ITAAAAHU"]
[Sat Jul 18 23:45:56.585972 2026] [security2:error] [pid 938041:tid 938289] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "alxklCNrzsYMDd5sB11ITAAAAHU"]
[Sat Jul 18 23:45:56.756699 2026] [security2:error] [pid 943918:tid 944146] [client 45.133.7.54:22613] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/Text/about.php"] [unique_id "alxklB70hbVC6Snzbho1BQAAAOY"]
[Sat Jul 18 23:45:57.145617 2026] [security2:error] [pid 938041:tid 938101] [remote 167.71.132.111:43074] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.132.71.167.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "careysheatingandcooling.com"] [uri "/wp-login.php"] [unique_id "alxklSNrzsYMDd5sB11IXQAAMTo"]
[Sat Jul 18 23:45:57.184557 2026] [security2:error] [pid 943918:tid 944120] [client 45.134.20.125:48109] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 125.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "alxklR70hbVC6Snzbho1FAAAAMw"]
[Sat Jul 18 23:45:57.299316 2026] [security2:error] [pid 938041:tid 938218] [client 180.252.198.240:50055] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxklSNrzsYMDd5sB11IYwAAAC4"]
[Sat Jul 18 23:45:57.299432 2026] [security2:error] [pid 938041:tid 938218] [client 180.252.198.240:50055] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxklSNrzsYMDd5sB11IYwAAAC4"]
[Sat Jul 18 23:45:57.383251 2026] [security2:error] [pid 938041:tid 938217] [client 173.239.196.163:59545] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "alxklSNrzsYMDd5sB11IZQAAAC0"]
[Sat Jul 18 23:45:57.436623 2026] [security2:error] [pid 943918:tid 944160] [client 45.133.7.91:52969] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 91.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/network/atomlib.php"] [unique_id "alxklR70hbVC6Snzbho1HQAAAPQ"]
[Sat Jul 18 23:45:57.447075 2026] [security2:error] [pid 943918:tid 944094] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "www.awellpacedlife.com"] [uri "/index.cgi"] [unique_id "alxklR70hbVC6Snzbho1GgAAALI"]
[Sat Jul 18 23:45:57.457379 2026] [security2:error] [pid 943918:tid 944053] [client 185.8.106.147:39324] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "cira.org"] [uri "/index.php"] [unique_id "alxkkx70hbVC6Snzbho0dwAAiVI"]
[Sat Jul 18 23:45:57.463025 2026] [security2:error] [pid 938041:tid 938123] [remote 167.71.132.111:43074] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.132.71.167.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "careysheatingandcooling.com"] [uri "/wp-login.php"] [unique_id "alxklSNrzsYMDd5sB11IagAAGVA"], referer: https://careysheatingandcooling.com/wp-login.php
[Sat Jul 18 23:45:58.045759 2026] [security2:error] [pid 943918:tid 944105] [client 45.134.20.105:46203] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-signup.php"] [unique_id "alxklh70hbVC6Snzbho1NgAAAL0"]
[Sat Jul 18 23:45:58.117123 2026] [security2:error] [pid 938041:tid 938299] [client 45.133.7.100:33463] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/install.php"] [unique_id "alxkliNrzsYMDd5sB11IegAAAH8"]
[Sat Jul 18 23:45:58.287371 2026] [security2:error] [pid 943918:tid 944099] [client 173.239.196.165:57007] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/css/install.php"] [unique_id "alxklh70hbVC6Snzbho1PQAAALc"]
[Sat Jul 18 23:45:58.421529 2026] [security2:error] [pid 943918:tid 944115] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "www.awellpacedlife.com"] [uri "/index.cgi"] [unique_id "alxklh70hbVC6Snzbho1QgAAAMc"]
[Sat Jul 18 23:45:58.534944 2026] [security2:error] [pid 943918:tid 943986] [remote 31.42.184.154:35894] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxklh70hbVC6Snzbho1SQAA-0I"]
[Sat Jul 18 23:45:58.622012 2026] [security2:error] [pid 943918:tid 943985] [remote 31.42.184.154:40352] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxklh70hbVC6Snzbho1TgAAqkE"]
[Sat Jul 18 23:45:58.760640 2026] [security2:error] [pid 943918:tid 944004] [remote 31.42.184.154:35894] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxklh70hbVC6Snzbho1UQAAm1Q"], referer: https://mezzacraft.com/wp-login.php
[Sat Jul 18 23:45:58.797772 2026] [security2:error] [pid 943918:tid 944130] [client 45.133.7.105:37469] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/hehe.php"] [unique_id "alxklh70hbVC6Snzbho1UgAAANY"]
[Sat Jul 18 23:45:58.903564 2026] [security2:error] [pid 943918:tid 944082] [client 45.134.20.114:30975] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/network/network.php"] [unique_id "alxklh70hbVC6Snzbho1VQAAAKY"]
[Sat Jul 18 23:45:58.937813 2026] [security2:error] [pid 943918:tid 944024] [remote 31.42.184.154:40352] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxklh70hbVC6Snzbho1VgAAlWg"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:45:59.174346 2026] [security2:error] [pid 943918:tid 944165] [client 173.239.196.166:24973] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/assets/av.php"] [unique_id "alxklx70hbVC6Snzbho1XwAAAPk"]
[Sat Jul 18 23:45:59.478912 2026] [security2:error] [pid 943918:tid 944075] [client 45.133.7.89:63471] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 89.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "alxklx70hbVC6Snzbho1bgAAAJ8"]
[Sat Jul 18 23:45:59.759711 2026] [security2:error] [pid 943918:tid 944141] [client 45.134.20.120:31219] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 120.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/admin/upload/css.php"] [unique_id "alxklx70hbVC6Snzbho1cwAAAOE"]
[Sat Jul 18 23:46:00.058094 2026] [security2:error] [pid 943918:tid 944175] [client 173.239.196.167:46741] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/autoload_classmap/about.php"] [unique_id "alxkmB70hbVC6Snzbho1fQAAAQM"]
[Sat Jul 18 23:46:00.158744 2026] [security2:error] [pid 943918:tid 944063] [client 45.133.7.86:57335] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 86.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/css/slider.php"] [unique_id "alxkmB70hbVC6Snzbho1fwAAAJM"]
[Sat Jul 18 23:46:00.415524 2026] [security2:error] [pid 943918:tid 944101] [client 69.165.67.172:61913] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 172.67.165.69.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "weiserfootball-org.qqx.crt.mybluehost.me"] [uri "/index.php"] [unique_id "alxkmB70hbVC6Snzbho1kQAAALk"], referer: https://weiserfootball-org.qqx.crt.mybluehost.me
[Sat Jul 18 23:46:00.598315 2026] [security2:error] [pid 943918:tid 944086] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkmB70hbVC6Snzbho1fgAAql4"]
[Sat Jul 18 23:46:00.618514 2026] [security2:error] [pid 943918:tid 944136] [client 104.210.56.224:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "tiokubito.cl"] [uri "/index.php"] [unique_id "alxkmB70hbVC6Snzbho1kAAA3BY"]
[Sat Jul 18 23:46:00.622590 2026] [security2:error] [pid 938041:tid 938260] [client 45.134.20.136:48583] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 136.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-blog.php"] [unique_id "alxkmCNrzsYMDd5sB11IwwAAAFg"]
[Sat Jul 18 23:46:00.624708 2026] [security2:error] [pid 943918:tid 944107] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "www.awellpacedlife.com"] [uri "/index.cgi"] [unique_id "alxkmB70hbVC6Snzbho1nAAAAL8"]
[Sat Jul 18 23:46:00.849482 2026] [security2:error] [pid 943918:tid 944067] [client 45.133.7.98:61381] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 98.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/dir.php"] [unique_id "alxkmB70hbVC6Snzbho1qAAAAJc"]
[Sat Jul 18 23:46:00.911821 2026] [security2:error] [pid 938041:tid 938177] [client 173.239.196.166:24199] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-configs.php"] [unique_id "alxkmCNrzsYMDd5sB11IzwAAAAU"]
[Sat Jul 18 23:46:01.231106 2026] [security2:error] [pid 938041:tid 938209] [client 139.167.225.146:54850] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkmSNrzsYMDd5sB11I2AAAACU"]
[Sat Jul 18 23:46:01.231203 2026] [security2:error] [pid 938041:tid 938209] [client 139.167.225.146:54850] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkmSNrzsYMDd5sB11I2AAAACU"]
[Sat Jul 18 23:46:01.271255 2026] [security2:error] [pid 938041:tid 938073] [remote 102.134.101.35:37312] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 35.101.134.102.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "grecaalma.com"] [uri "/wp-login.php"] [unique_id "alxkmSNrzsYMDd5sB11I2QAAOx4"]
[Sat Jul 18 23:46:01.507420 2026] [security2:error] [pid 943918:tid 944163] [client 45.134.20.108:46959] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/file.php"] [unique_id "alxkmR70hbVC6Snzbho1uQAAAPc"]
[Sat Jul 18 23:46:01.528793 2026] [security2:error] [pid 943918:tid 944146] [client 45.133.7.73:25513] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 73.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/css/atomlib.php"] [unique_id "alxkmR70hbVC6Snzbho1vAAAAOY"]
[Sat Jul 18 23:46:01.724621 2026] [security2:error] [pid 938041:tid 938065] [remote 102.134.101.35:37312] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 35.101.134.102.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "grecaalma.com"] [uri "/wp-login.php"] [unique_id "alxkmSNrzsYMDd5sB11I6AAANRY"], referer: https://grecaalma.com/wp-login.php
[Sat Jul 18 23:46:01.776554 2026] [security2:error] [pid 943918:tid 943939] [remote 15.235.27.182:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "Mozilla\\\\/5\\\\.0 \\\\(compatible; AhrefsBot\\\\/\\\\d\\\\.\\\\d; \\\\+http:\\\\/\\\\/ahrefs\\\\.com\\\\/robot\\\\/\\\\)" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "578"] [id "900165"] [msg "AhrefsBot BOT Request"] [hostname "fairwaysonmainteetimes.com"] [uri "/post-sitemap.xml"] [unique_id "alxkmR70hbVC6Snzbho10QAAlxM"]
[Sat Jul 18 23:46:01.776756 2026] [security2:error] [pid 943918:tid 944067] [client 15.235.27.182:0] ModSecurity: Warning. Matched phrase "AhrefsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "fairwaysonmainteetimes.com"] [uri "/post-sitemap.xml"] [unique_id "alxkmR70hbVC6Snzbho10QAAlxM"]
[Sat Jul 18 23:46:01.785886 2026] [security2:error] [pid 943918:tid 944077] [client 173.239.196.162:43921] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "alxkmR70hbVC6Snzbho10gAAAKE"]
[Sat Jul 18 23:46:02.106528 2026] [security2:error] [pid 943918:tid 943946] [remote 103.75.185.95:59092] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "insolario.com"] [uri "/wp-login.php"] [unique_id "alxkmh70hbVC6Snzbho16AAAkBo"]
[Sat Jul 18 23:46:02.224347 2026] [security2:error] [pid 943918:tid 944106] [client 45.133.7.55:47383] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 55.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/style.php"] [unique_id "alxkmh70hbVC6Snzbho18AAAAL4"]
[Sat Jul 18 23:46:02.334026 2026] [security2:error] [pid 938041:tid 938216] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkmSNrzsYMDd5sB11I7QAALAA"]
[Sat Jul 18 23:46:02.363021 2026] [security2:error] [pid 943918:tid 944114] [client 45.134.20.113:60563] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "alxkmh70hbVC6Snzbho19wAAAMY"]
[Sat Jul 18 23:46:02.606532 2026] [security2:error] [pid 943918:tid 944097] [client 50.116.65.227:58398] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "recruitinginsight.us"] [uri "/wp-cron.php"] [unique_id "alxkmh70hbVC6Snzbho1_gAAALU"]
[Sat Jul 18 23:46:02.611024 2026] [security2:error] [pid 943918:tid 943945] [remote 103.75.185.95:59092] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "insolario.com"] [uri "/wp-login.php"] [unique_id "alxkmh70hbVC6Snzbho1_wAArhk"], referer: https://insolario.com/wp-login.php
[Sat Jul 18 23:46:02.664315 2026] [security2:error] [pid 943918:tid 944076] [client 173.239.196.165:56897] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/js/widgets/bless2.php"] [unique_id "alxkmh70hbVC6Snzbho2BgAAAKA"]
[Sat Jul 18 23:46:02.698661 2026] [security2:error] [pid 943918:tid 944160] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/cgi-bin/admin.php"] [unique_id "alxkmh70hbVC6Snzbho2CAAAAPQ"]
[Sat Jul 18 23:46:02.698816 2026] [security2:error] [pid 943918:tid 944160] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/cgi-bin/admin.php"] [unique_id "alxkmh70hbVC6Snzbho2CAAAAPQ"]
[Sat Jul 18 23:46:02.903409 2026] [security2:error] [pid 943918:tid 944129] [client 45.133.7.94:29245] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 94.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/libraries/phpmailer/updates.php"] [unique_id "alxkmh70hbVC6Snzbho2EgAAANU"]
[Sat Jul 18 23:46:03.079663 2026] [security2:error] [pid 943918:tid 943962] [remote 102.134.101.35:37324] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 35.101.134.102.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "zbj.ahr.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxkmx70hbVC6Snzbho2HAAA6So"]
[Sat Jul 18 23:46:03.118232 2026] [security2:error] [pid 943918:tid 944096] [client 36.83.95.75:55348] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkmx70hbVC6Snzbho2HgAAALQ"]
[Sat Jul 18 23:46:03.118380 2026] [security2:error] [pid 943918:tid 944096] [client 36.83.95.75:55348] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkmx70hbVC6Snzbho2HgAAALQ"]
[Sat Jul 18 23:46:03.133416 2026] [security2:error] [pid 943918:tid 943930] [remote 51.222.168.139:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "Mozilla\\\\/5\\\\.0 \\\\(compatible; AhrefsBot\\\\/\\\\d\\\\.\\\\d; \\\\+http:\\\\/\\\\/ahrefs\\\\.com\\\\/robot\\\\/\\\\)" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "578"] [id "900165"] [msg "AhrefsBot BOT Request"] [hostname "fairwaysonmainteetimes.com"] [uri "/page-sitemap.xml"] [unique_id "alxkmx70hbVC6Snzbho2IgAAxAo"]
[Sat Jul 18 23:46:03.133555 2026] [security2:error] [pid 943918:tid 944112] [client 51.222.168.139:0] ModSecurity: Warning. Matched phrase "AhrefsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "fairwaysonmainteetimes.com"] [uri "/page-sitemap.xml"] [unique_id "alxkmx70hbVC6Snzbho2IgAAxAo"]
[Sat Jul 18 23:46:03.217400 2026] [security2:error] [pid 943918:tid 944162] [client 45.134.20.116:46425] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 116.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "alxkmx70hbVC6Snzbho2JwAAAPY"]
[Sat Jul 18 23:46:03.274501 2026] [security2:error] [pid 943918:tid 944153] [client 103.160.26.178:59217] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkmx70hbVC6Snzbho2KQAAAO0"]
[Sat Jul 18 23:46:03.274671 2026] [security2:error] [pid 943918:tid 944153] [client 103.160.26.178:59217] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkmx70hbVC6Snzbho2KQAAAO0"]
[Sat Jul 18 23:46:03.280409 2026] [security2:error] [pid 943918:tid 944146] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/gettest.php"] [unique_id "alxkmx70hbVC6Snzbho2KwAAAOY"]
[Sat Jul 18 23:46:03.280454 2026] [security2:error] [pid 943918:tid 944126] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkmh70hbVC6Snzbho2EQAA0i8"]
[Sat Jul 18 23:46:03.280483 2026] [security2:error] [pid 943918:tid 944146] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/gettest.php"] [unique_id "alxkmx70hbVC6Snzbho2KwAAAOY"]
[Sat Jul 18 23:46:03.521459 2026] [security2:error] [pid 943918:tid 944101] [client 173.239.196.162:22137] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/network/about.php"] [unique_id "alxkmx70hbVC6Snzbho2NQAAALk"]
[Sat Jul 18 23:46:03.532469 2026] [security2:error] [pid 943918:tid 944000] [remote 102.134.101.35:37324] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 35.101.134.102.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "zbj.ahr.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxkmx70hbVC6Snzbho2NAAAklA"], referer: https://zbj.ahr.mybluehost.me/wp-login.php
[Sat Jul 18 23:46:03.586032 2026] [security2:error] [pid 943918:tid 944120] [client 45.133.7.92:21625] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/nf_tracking.php"] [unique_id "alxkmx70hbVC6Snzbho2OgAAAMw"]
[Sat Jul 18 23:46:03.826234 2026] [security2:error] [pid 938041:tid 938287] [client 34.136.134.112:6622] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "elevatewithemma.com"] [uri "/wp-json/batch/v1"] [unique_id "alxkmyNrzsYMDd5sB11JEwAAAHM"]
[Sat Jul 18 23:46:03.876778 2026] [security2:error] [pid 943918:tid 944067] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkmx70hbVC6Snzbho2MwAAlzs"]
[Sat Jul 18 23:46:03.877267 2026] [security2:error] [pid 943918:tid 944081] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.awellpacedlife.com"] [uri "/index.cgi"] [unique_id "alxkmx70hbVC6Snzbho2QQAAAKU"]
[Sat Jul 18 23:46:04.000384 2026] [security2:error] [pid 938041:tid 938224] [client 34.136.134.112:6622] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "elevatewithemma.com"] [uri "/"] [unique_id "alxkmyNrzsYMDd5sB11JGgAAADQ"]
[Sat Jul 18 23:46:04.049853 2026] [security2:error] [pid 943918:tid 944116] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/simple.php"] [unique_id "alxknB70hbVC6Snzbho2SgAAAMg"]
[Sat Jul 18 23:46:04.049943 2026] [security2:error] [pid 943918:tid 944116] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/simple.php"] [unique_id "alxknB70hbVC6Snzbho2SgAAAMg"]
[Sat Jul 18 23:46:04.069859 2026] [security2:error] [pid 938041:tid 938220] [client 45.134.20.117:31371] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-l0gin.php"] [unique_id "alxknCNrzsYMDd5sB11JHAAAADA"]
[Sat Jul 18 23:46:04.266632 2026] [security2:error] [pid 938041:tid 938208] [client 45.133.7.78:24249] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 78.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/about.php7"] [unique_id "alxknCNrzsYMDd5sB11JIQAAACQ"]
[Sat Jul 18 23:46:04.424793 2026] [security2:error] [pid 938041:tid 938187] [client 173.239.196.166:43293] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/item.php"] [unique_id "alxknCNrzsYMDd5sB11JJQAAAA8"]
[Sat Jul 18 23:46:04.448499 2026] [security2:error] [pid 938041:tid 938198] [client 34.136.134.112:6630] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "elevator-data.com"] [uri "/wp-json/batch/v1"] [unique_id "alxknCNrzsYMDd5sB11JJwAAABo"]
[Sat Jul 18 23:46:04.456355 2026] [security2:error] [pid 943918:tid 944142] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxknB70hbVC6Snzbho2TAAA4jg"]
[Sat Jul 18 23:46:04.596715 2026] [security2:error] [pid 938041:tid 938189] [client 34.136.134.112:6630] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "elevator-data.com"] [uri "/"] [unique_id "alxknCNrzsYMDd5sB11JLwAAABE"]
[Sat Jul 18 23:46:04.742603 2026] [security2:error] [pid 938041:tid 938217] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/xxx.php"] [unique_id "alxknCNrzsYMDd5sB11JNwAAAC0"]
[Sat Jul 18 23:46:04.742698 2026] [security2:error] [pid 938041:tid 938217] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/xxx.php"] [unique_id "alxknCNrzsYMDd5sB11JNwAAAC0"]
[Sat Jul 18 23:46:04.930525 2026] [security2:error] [pid 943918:tid 944152] [client 45.134.20.123:47885] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 123.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "alxknB70hbVC6Snzbho2YwAAAOw"]
[Sat Jul 18 23:46:04.947954 2026] [security2:error] [pid 938041:tid 938228] [client 45.133.7.103:51187] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/filefuns.php"] [unique_id "alxknCNrzsYMDd5sB11JQgAAADg"]
[Sat Jul 18 23:46:05.004184 2026] [security2:error] [pid 943918:tid 944049] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxknB70hbVC6Snzbho2XAAAhU4"]
[Sat Jul 18 23:46:05.322461 2026] [security2:error] [pid 943918:tid 944136] [client 173.239.196.167:44227] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "alxknR70hbVC6Snzbho2cAAAANw"]
[Sat Jul 18 23:46:05.405635 2026] [security2:error] [pid 943918:tid 943984] [remote 217.113.60.80:43718] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.60.113.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "omrobuildingcenter.com"] [uri "/wp-login.php"] [unique_id "alxknR70hbVC6Snzbho2dQAA80A"]
[Sat Jul 18 23:46:05.441645 2026] [security2:error] [pid 943918:tid 944131] [client 85.204.70.112:46594] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "momheadquarters.com"] [uri "/wp-admin/css/"] [unique_id "alxknR70hbVC6Snzbho2dgAAANc"]
[Sat Jul 18 23:46:05.482032 2026] [security2:error] [pid 938041:tid 938266] [client 34.136.134.112:26602] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "elevator-data.com"] [uri "/wp-json/batch/v1"] [unique_id "alxknSNrzsYMDd5sB11JUAAAAF4"]
[Sat Jul 18 23:46:05.628839 2026] [security2:error] [pid 943918:tid 944054] [client 45.133.7.103:58591] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/pki-validation/class_api.php"] [unique_id "alxknR70hbVC6Snzbho2egAAAIo"]
[Sat Jul 18 23:46:05.722012 2026] [security2:error] [pid 938041:tid 938271] [client 34.136.134.112:26602] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "elevator-data.com"] [uri "/"] [unique_id "alxknSNrzsYMDd5sB11JWAAAAGM"]
[Sat Jul 18 23:46:05.794898 2026] [security2:error] [pid 943918:tid 944057] [client 45.134.20.110:63463] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/new.php"] [unique_id "alxknR70hbVC6Snzbho2hAAAAI0"]
[Sat Jul 18 23:46:05.799160 2026] [security2:error] [pid 943918:tid 944008] [remote 217.113.60.80:43718] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.60.113.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "omrobuildingcenter.com"] [uri "/wp-login.php"] [unique_id "alxknR70hbVC6Snzbho2gwAA0lg"], referer: https://omrobuildingcenter.com/wp-login.php
[Sat Jul 18 23:46:05.936218 2026] [security2:error] [pid 943918:tid 944053] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxknR70hbVC6Snzbho2eQAAiU0"]
[Sat Jul 18 23:46:06.106810 2026] [security2:error] [pid 938041:tid 938244] [client 163.61.1.17:49803] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkniNrzsYMDd5sB11JYwAAAEg"]
[Sat Jul 18 23:46:06.106946 2026] [security2:error] [pid 938041:tid 938244] [client 163.61.1.17:49803] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkniNrzsYMDd5sB11JYwAAAEg"]
[Sat Jul 18 23:46:06.180509 2026] [security2:error] [pid 943918:tid 943924] [remote 158.180.33.171:34700] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 171.33.180.158.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxknh70hbVC6Snzbho2lgAA8QQ"]
[Sat Jul 18 23:46:06.191079 2026] [security2:error] [pid 938041:tid 938234] [client 173.239.196.163:24179] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/.well-known/acme-challenge/mah.php"] [unique_id "alxkniNrzsYMDd5sB11JZAAAAD4"]
[Sat Jul 18 23:46:06.307691 2026] [security2:error] [pid 938041:tid 938264] [client 45.133.7.84:62213] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 84.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/l.php"] [unique_id "alxkniNrzsYMDd5sB11JbAAAAFw"]
[Sat Jul 18 23:46:06.355642 2026] [security2:error] [pid 943918:tid 944104] [client 106.222.249.209:24637] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxknh70hbVC6Snzbho2ngAAALw"]
[Sat Jul 18 23:46:06.355875 2026] [security2:error] [pid 943918:tid 944104] [client 106.222.249.209:24637] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxknh70hbVC6Snzbho2ngAAALw"]
[Sat Jul 18 23:46:06.366994 2026] [security2:error] [pid 943918:tid 943942] [remote 158.180.33.171:34700] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 171.33.180.158.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxknh70hbVC6Snzbho2nwAAzBY"], referer: https://sesamegreenbeans.com/wp-login.php
[Sat Jul 18 23:46:06.421341 2026] [security2:error] [pid 938041:tid 938186] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/hypo.php"] [unique_id "alxkniNrzsYMDd5sB11JcgAAAA4"]
[Sat Jul 18 23:46:06.421458 2026] [security2:error] [pid 938041:tid 938186] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/hypo.php"] [unique_id "alxkniNrzsYMDd5sB11JcgAAAA4"]
[Sat Jul 18 23:46:06.524086 2026] [security2:error] [pid 943918:tid 944080] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxknh70hbVC6Snzbho2lQAApBQ"]
[Sat Jul 18 23:46:06.651184 2026] [security2:error] [pid 938041:tid 938263] [client 45.134.20.137:52877] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 137.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/pwnd-1/admin.php"] [unique_id "alxkniNrzsYMDd5sB11JdgAAAFs"]
[Sat Jul 18 23:46:06.667698 2026] [security2:error] [pid 938041:tid 938176] [client 216.244.66.237:44678] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "jenfarley.com"] [uri "/robots.txt"] [unique_id "alxkniNrzsYMDd5sB11JdwAAAAQ"]
[Sat Jul 18 23:46:06.667791 2026] [security2:error] [pid 938041:tid 938176] [client 216.244.66.237:44678] ModSecurity: Warning. Matched phrase "Dotbot" at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "jenfarley.com"] [uri "/robots.txt"] [unique_id "alxkniNrzsYMDd5sB11JdwAAAAQ"]
[Sat Jul 18 23:46:06.679383 2026] [security2:error] [pid 938041:tid 938122] [remote 20.153.140.50:45626] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nwcarvingacademy.com"] [uri "/wp-login.php"] [unique_id "alxkniNrzsYMDd5sB11JeAAAN08"]
[Sat Jul 18 23:46:06.983043 2026] [security2:error] [pid 938041:tid 938178] [client 138.252.89.100:59465] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkniNrzsYMDd5sB11JhwAAAAY"]
[Sat Jul 18 23:46:06.983158 2026] [security2:error] [pid 938041:tid 938178] [client 138.252.89.100:59465] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkniNrzsYMDd5sB11JhwAAAAY"]
[Sat Jul 18 23:46:06.994951 2026] [security2:error] [pid 938041:tid 938172] [client 45.133.7.85:49349] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 85.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/repeater.php"] [unique_id "alxkniNrzsYMDd5sB11JiAAAAAA"]
[Sat Jul 18 23:46:07.069129 2026] [security2:error] [pid 938041:tid 938215] [client 173.239.196.167:29575] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/ID3/shell.php"] [unique_id "alxknyNrzsYMDd5sB11JigAAACs"]
[Sat Jul 18 23:46:07.098342 2026] [security2:error] [pid 938041:tid 938134] [remote 20.153.140.50:45626] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nwcarvingacademy.com"] [uri "/wp-login.php"] [unique_id "alxknyNrzsYMDd5sB11JiwAAe1s"], referer: https://nwcarvingacademy.com/wp-login.php
[Sat Jul 18 23:46:07.381936 2026] [security2:error] [pid 938041:tid 938205] [client 13.232.206.133:51386] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.206.232.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxknyNrzsYMDd5sB11JlwAAACE"]
[Sat Jul 18 23:46:07.482308 2026] [security2:error] [pid 943918:tid 944146] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxknx70hbVC6Snzbho2swAA5mU"]
[Sat Jul 18 23:46:07.523515 2026] [security2:error] [pid 938041:tid 938234] [client 45.134.20.123:20823] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 123.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/defaults.php"] [unique_id "alxknyNrzsYMDd5sB11JmgAAAD4"]
[Sat Jul 18 23:46:07.668458 2026] [security2:error] [pid 938041:tid 938192] [client 216.73.217.24:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.thebestreps.net"] [uri "/index.php"] [unique_id "alxkniNrzsYMDd5sB11JYAAAFBs"]
[Sat Jul 18 23:46:07.674135 2026] [security2:error] [pid 943918:tid 944079] [client 45.133.7.54:58075] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/wso.php"] [unique_id "alxknx70hbVC6Snzbho2xgAAAKM"]
[Sat Jul 18 23:46:07.946222 2026] [security2:error] [pid 943918:tid 944122] [client 173.239.196.165:53331] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "alxknx70hbVC6Snzbho20gAAAM4"]
[Sat Jul 18 23:46:07.982698 2026] [security2:error] [pid 943918:tid 944056] [client 180.252.198.240:50522] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxknx70hbVC6Snzbho20wAAAIw"]
[Sat Jul 18 23:46:07.982861 2026] [security2:error] [pid 943918:tid 944056] [client 180.252.198.240:50522] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxknx70hbVC6Snzbho20wAAAIw"]
[Sat Jul 18 23:46:07.994794 2026] [security2:error] [pid 938041:tid 938294] [client 85.254.40.219:51030] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.sesamegreenbeans.com"] [uri "/index.php"] [unique_id "alxknSNrzsYMDd5sB11JXgAAemw"]
[Sat Jul 18 23:46:08.044880 2026] [security2:error] [pid 938041:tid 938237] [client 36.68.125.232:54828] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 232.125.68.36.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.tsb.jiv.mybluehost.me"] [uri "/phpinfo.php"] [unique_id "alxkoCNrzsYMDd5sB11JogAAAEE"]
[Sat Jul 18 23:46:08.093001 2026] [security2:error] [pid 943918:tid 944175] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxknx70hbVC6Snzbho2yAABAxE"]
[Sat Jul 18 23:46:08.134286 2026] [security2:error] [pid 938041:tid 938219] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.awellpacedlife.com"] [uri "/index.cgi"] [unique_id "alxkoCNrzsYMDd5sB11JowAAAC8"]
[Sat Jul 18 23:46:08.197096 2026] [security2:error] [pid 938041:tid 938181] [client 216.73.217.24:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.thebestreps.net"] [uri "/index.php"] [unique_id "alxkoCNrzsYMDd5sB11JqQAACTE"]
[Sat Jul 18 23:46:08.303196 2026] [security2:error] [pid 938041:tid 938188] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/chosen.php"] [unique_id "alxkoCNrzsYMDd5sB11JrAAAABA"]
[Sat Jul 18 23:46:08.303301 2026] [security2:error] [pid 938041:tid 938188] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/chosen.php"] [unique_id "alxkoCNrzsYMDd5sB11JrAAAABA"]
[Sat Jul 18 23:46:08.352903 2026] [security2:error] [pid 938041:tid 938298] [client 45.133.7.105:27849] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "alxkoCNrzsYMDd5sB11JrwAAAH4"]
[Sat Jul 18 23:46:08.395977 2026] [security2:error] [pid 943918:tid 944112] [client 45.134.20.110:32395] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/images/DJP9.php"] [unique_id "alxkoB70hbVC6Snzbho26QAAAMQ"]
[Sat Jul 18 23:46:08.411505 2026] [security2:error] [pid 943918:tid 944068] [client 3.109.49.224:37698] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.49.109.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxkoB70hbVC6Snzbho26gAAAJg"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:46:08.464606 2026] [security2:error] [pid 938041:tid 938226] [client 36.68.125.232:55100] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 232.125.68.36.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.tsb.jiv.mybluehost.me"] [uri "/test.php"] [unique_id "alxkoCNrzsYMDd5sB11JtgAAADY"]
[Sat Jul 18 23:46:08.671025 2026] [security2:error] [pid 943918:tid 944170] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkoB70hbVC6Snzbho24gAA_iA"]
[Sat Jul 18 23:46:08.782077 2026] [security2:error] [pid 943918:tid 944152] [client 173.239.196.163:63981] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/ms-users.php"] [unique_id "alxkoB70hbVC6Snzbho2_wAAAOw"]
[Sat Jul 18 23:46:09.040720 2026] [security2:error] [pid 943918:tid 944060] [client 45.133.7.95:55173] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/contacts.php"] [unique_id "alxkoR70hbVC6Snzbho3DgAAAJA"]
[Sat Jul 18 23:46:09.159693 2026] [security2:error] [pid 943918:tid 943962] [remote 212.129.77.58:23188] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "hedgerow-crafts.com"] [uri "/index.php"] [unique_id "alxkoB70hbVC6Snzbho3AAAAhyo"]
[Sat Jul 18 23:46:09.202802 2026] [security2:error] [pid 938041:tid 938214] [client 50.116.65.227:58450] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "learnthissecret.com"] [uri "/index.php"] [unique_id "alxkoCNrzsYMDd5sB11JuQAAACo"]
[Sat Jul 18 23:46:09.234190 2026] [security2:error] [pid 943918:tid 944132] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkoB70hbVC6Snzbho3BAAA2E8"]
[Sat Jul 18 23:46:09.254823 2026] [security2:error] [pid 943918:tid 944106] [client 45.134.20.118:28303] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/customize/index.php"] [unique_id "alxkoR70hbVC6Snzbho3GwAAAL4"]
[Sat Jul 18 23:46:09.351424 2026] [security2:error] [pid 943918:tid 944089] [client 36.68.125.232:55678] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\.bak|\\\\.bak\\\\.php)$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1260"] [id "390582"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that nclude .bak)"] [severity "CRITICAL"] [hostname "webmail.tsb.jiv.mybluehost.me"] [uri "/___proxy_subdomain_webmail/.env/.env.bak"] [unique_id "alxkoR70hbVC6Snzbho3HgAAAK0"]
[Sat Jul 18 23:46:09.527087 2026] [security2:error] [pid 943918:tid 944092] [client 50.116.65.227:30768] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "learnthissecret.com"] [uri "/index.php"] [unique_id "alxkoR70hbVC6Snzbho3GgAAALA"]
[Sat Jul 18 23:46:09.631868 2026] [security2:error] [pid 938041:tid 938243] [client 173.239.196.164:32979] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/js/cc.php"] [unique_id "alxkoSNrzsYMDd5sB11JywAAAEc"]
[Sat Jul 18 23:46:09.721440 2026] [security2:error] [pid 943918:tid 944166] [client 45.133.7.89:47171] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 89.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wsa.php"] [unique_id "alxkoR70hbVC6Snzbho3LwAAAPo"]
[Sat Jul 18 23:46:09.749762 2026] [security2:error] [pid 943918:tid 944114] [client 89.124.113.107:52366] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 107.113.124.89.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "learnthissecret.com"] [uri "/wp-comments-post.php"] [unique_id "alxkoR70hbVC6Snzbho3MgAAAMY"], referer: https://learnthissecret.com/product/the-complete-man-membership-programme/
[Sat Jul 18 23:46:09.749952 2026] [security2:error] [pid 943918:tid 944114] [client 89.124.113.107:52366] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "409"] [hostname "learnthissecret.com"] [uri "/wp-comments-post.php"] [unique_id "alxkoR70hbVC6Snzbho3MgAAAMY"], referer: https://learnthissecret.com/product/the-complete-man-membership-programme/
[Sat Jul 18 23:46:09.798564 2026] [security2:error] [pid 943918:tid 944171] [client 57.141.18.42:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxkoR70hbVC6Snzbho3JgAAAP8"]
[Sat Jul 18 23:46:09.832360 2026] [security2:error] [pid 943918:tid 944085] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkoR70hbVC6Snzbho3IAAAqVM"]
[Sat Jul 18 23:46:10.111553 2026] [security2:error] [pid 943918:tid 944144] [client 45.134.20.136:56397] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 136.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/shell20211028.php"] [unique_id "alxkoh70hbVC6Snzbho3PgAAAOQ"]
[Sat Jul 18 23:46:10.126639 2026] [security2:error] [pid 938041:tid 938057] [remote 20.87.239.85:15073] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 85.239.87.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "recruitinginsight.us"] [uri "/wp-login.php"] [unique_id "alxkoiNrzsYMDd5sB11J1QAAKQ4"]
[Sat Jul 18 23:46:10.229649 2026] [security2:error] [pid 943918:tid 944122] [client 36.68.125.232:56203] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 232.125.68.36.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.tsb.jiv.mybluehost.me"] [uri "/index.php"] [unique_id "alxkoh70hbVC6Snzbho3QwAAAM4"]
[Sat Jul 18 23:46:10.301556 2026] [security2:error] [pid 938041:tid 938229] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.awellpacedlife.com"] [uri "/index.cgi"] [unique_id "alxkoiNrzsYMDd5sB11J2gAAADk"]
[Sat Jul 18 23:46:10.401383 2026] [security2:error] [pid 938041:tid 938221] [client 45.133.7.65:54951] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 65.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "alxkoiNrzsYMDd5sB11J3QAAADE"]
[Sat Jul 18 23:46:10.451634 2026] [security2:error] [pid 943918:tid 944083] [client 18.141.144.104:50178] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.144.141.18.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxkoh70hbVC6Snzbho3UAAAAKc"]
[Sat Jul 18 23:46:10.451910 2026] [security2:error] [pid 943918:tid 944083] [client 18.141.144.104:50178] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxkoh70hbVC6Snzbho3UAAAAKc"]
[Sat Jul 18 23:46:10.470220 2026] [security2:error] [pid 938041:tid 938181] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/als.php"] [unique_id "alxkoiNrzsYMDd5sB11J3wAAAAk"]
[Sat Jul 18 23:46:10.470347 2026] [security2:error] [pid 938041:tid 938181] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/als.php"] [unique_id "alxkoiNrzsYMDd5sB11J3wAAAAk"]
[Sat Jul 18 23:46:10.527141 2026] [security2:error] [pid 943918:tid 944134] [client 173.239.196.166:24877] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "alxkoh70hbVC6Snzbho3UQAAANo"]
[Sat Jul 18 23:46:10.577352 2026] [security2:error] [pid 938041:tid 938237] [client 57.141.18.41:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxkoiNrzsYMDd5sB11J3AAAAEE"]
[Sat Jul 18 23:46:10.619861 2026] [security2:error] [pid 938041:tid 938115] [remote 20.87.239.85:15073] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 85.239.87.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "recruitinginsight.us"] [uri "/wp-login.php"] [unique_id "alxkoiNrzsYMDd5sB11J5AAAF0g"], referer: https://recruitinginsight.us/wp-login.php
[Sat Jul 18 23:46:10.796799 2026] [security2:error] [pid 943918:tid 944099] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkoh70hbVC6Snzbho3TwAAtzY"]
[Sat Jul 18 23:46:10.983390 2026] [security2:error] [pid 943918:tid 944075] [client 45.134.20.123:59601] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 123.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/natural.php"] [unique_id "alxkoh70hbVC6Snzbho3ZwAAAJ8"]
[Sat Jul 18 23:46:11.087836 2026] [security2:error] [pid 938041:tid 938287] [client 45.133.7.100:52001] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/firewall.php7"] [unique_id "alxkoyNrzsYMDd5sB11J7AAAAHM"]
[Sat Jul 18 23:46:11.251217 2026] [security2:error] [pid 943918:tid 944127] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/pol.php"] [unique_id "alxkox70hbVC6Snzbho3cQAAANM"]
[Sat Jul 18 23:46:11.251347 2026] [security2:error] [pid 943918:tid 944127] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/pol.php"] [unique_id "alxkox70hbVC6Snzbho3cQAAANM"]
[Sat Jul 18 23:46:11.382591 2026] [security2:error] [pid 943918:tid 944136] [client 34.73.232.127:60078] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "juniper3medical.com"] [uri "/wp-json/batch/v1"] [unique_id "alxkox70hbVC6Snzbho3dwAAANw"]
[Sat Jul 18 23:46:11.404286 2026] [security2:error] [pid 943918:tid 944115] [client 173.239.196.163:44827] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "alxkox70hbVC6Snzbho3eAAAAMc"]
[Sat Jul 18 23:46:11.650642 2026] [security2:error] [pid 943918:tid 944083] [client 34.73.232.127:60078] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "juniper3medical.com"] [uri "/"] [unique_id "alxkox70hbVC6Snzbho3ggAAAKc"]
[Sat Jul 18 23:46:11.769827 2026] [security2:error] [pid 943918:tid 944138] [client 45.133.7.103:62037] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "alxkox70hbVC6Snzbho3iQAAAN4"]
[Sat Jul 18 23:46:11.846512 2026] [security2:error] [pid 943918:tid 944068] [client 45.134.20.137:60761] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 137.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/item.php"] [unique_id "alxkox70hbVC6Snzbho3jAAAAJg"]
[Sat Jul 18 23:46:11.999606 2026] [security2:error] [pid 943918:tid 944006] [remote 117.0.21.154:55550] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxkox70hbVC6Snzbho3lgAA_1Y"]
[Sat Jul 18 23:46:11.999846 2026] [security2:error] [pid 943918:tid 944171] [client 117.0.21.154:55550] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxkox70hbVC6Snzbho3lgAA_1Y"]
[Sat Jul 18 23:46:12.106812 2026] [security2:error] [pid 943918:tid 944132] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkox70hbVC6Snzbho3hwAA2EQ"]
[Sat Jul 18 23:46:12.293094 2026] [security2:error] [pid 938041:tid 938201] [client 173.239.196.163:39145] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/css/file.php"] [unique_id "alxkpCNrzsYMDd5sB11KAgAAAB0"]
[Sat Jul 18 23:46:12.459637 2026] [security2:error] [pid 938041:tid 938271] [client 45.133.7.74:39361] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/uploads/content.php"] [unique_id "alxkpCNrzsYMDd5sB11KAwAAAGM"]
[Sat Jul 18 23:46:12.594819 2026] [security2:error] [pid 943918:tid 944088] [client 34.73.232.127:17850] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "juniper3medical.com"] [uri "/wp-json/batch/v1"] [unique_id "alxkpB70hbVC6Snzbho3qQAAAKw"]
[Sat Jul 18 23:46:12.627205 2026] [security2:error] [pid 943918:tid 944075] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkpB70hbVC6Snzbho3oAAAn1k"]
[Sat Jul 18 23:46:12.706632 2026] [security2:error] [pid 943918:tid 944091] [client 45.134.20.115:48263] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/function/function.php"] [unique_id "alxkpB70hbVC6Snzbho3sAAAAK8"]
[Sat Jul 18 23:46:12.751080 2026] [security2:error] [pid 938041:tid 938259] [client 50.116.65.227:38826] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxkpCNrzsYMDd5sB11KDAAAAFc"]
[Sat Jul 18 23:46:12.767272 2026] [security2:error] [pid 943918:tid 944122] [client 50.116.65.227:30792] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxkpB70hbVC6Snzbho3sQAAAM4"]
[Sat Jul 18 23:46:12.815016 2026] [security2:error] [pid 938041:tid 938281] [client 139.167.225.146:55417] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkpCNrzsYMDd5sB11KDQAAAG0"]
[Sat Jul 18 23:46:12.815166 2026] [security2:error] [pid 938041:tid 938281] [client 139.167.225.146:55417] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkpCNrzsYMDd5sB11KDQAAAG0"]
[Sat Jul 18 23:46:12.924402 2026] [security2:error] [pid 943918:tid 944059] [client 34.73.232.127:17850] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "juniper3medical.com"] [uri "/"] [unique_id "alxkpB70hbVC6Snzbho3uQAAAI8"]
[Sat Jul 18 23:46:13.140287 2026] [security2:error] [pid 943918:tid 944058] [client 45.133.7.58:57603] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/lv.php"] [unique_id "alxkpR70hbVC6Snzbho3wgAAAI4"]
[Sat Jul 18 23:46:13.168792 2026] [security2:error] [pid 943918:tid 944102] [client 173.239.196.162:20541] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/classic-editor/alam.php"] [unique_id "alxkpR70hbVC6Snzbho3xAAAALo"]
[Sat Jul 18 23:46:13.180290 2026] [security2:error] [pid 943918:tid 944157] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkpB70hbVC6Snzbho3swAA8RI"]
[Sat Jul 18 23:46:13.488608 2026] [security2:error] [pid 943918:tid 944052] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/file5.php"] [unique_id "alxkpR70hbVC6Snzbho31AAAAIg"]
[Sat Jul 18 23:46:13.488710 2026] [security2:error] [pid 943918:tid 944052] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/file5.php"] [unique_id "alxkpR70hbVC6Snzbho31AAAAIg"]
[Sat Jul 18 23:46:13.562061 2026] [security2:error] [pid 938041:tid 938292] [client 45.134.20.120:29747] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 120.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "alxkpSNrzsYMDd5sB11KGAAAAHg"]
[Sat Jul 18 23:46:13.737642 2026] [security2:error] [pid 943918:tid 944126] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkpR70hbVC6Snzbho30gAA0g0"]
[Sat Jul 18 23:46:13.821008 2026] [security2:error] [pid 943918:tid 944163] [client 45.133.7.89:44017] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 89.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/images/js1.php"] [unique_id "alxkpR70hbVC6Snzbho34gAAAPc"]
[Sat Jul 18 23:46:13.891019 2026] [security2:error] [pid 943918:tid 944073] [client 36.83.95.75:55831] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkpR70hbVC6Snzbho35gAAAJ0"]
[Sat Jul 18 23:46:13.891089 2026] [security2:error] [pid 943918:tid 944073] [client 36.83.95.75:55831] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkpR70hbVC6Snzbho35gAAAJ0"]
[Sat Jul 18 23:46:13.997907 2026] [security2:error] [pid 938041:tid 938282] [client 103.160.26.178:59682] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkpSNrzsYMDd5sB11KHQAAAG4"]
[Sat Jul 18 23:46:13.998005 2026] [security2:error] [pid 938041:tid 938282] [client 103.160.26.178:59682] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkpSNrzsYMDd5sB11KHQAAAG4"]
[Sat Jul 18 23:46:14.050570 2026] [security2:error] [pid 943918:tid 944140] [client 173.239.196.167:39987] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wordpress/wp-admin/includes/admin-filters.php"] [unique_id "alxkph70hbVC6Snzbho36gAAAOA"]
[Sat Jul 18 23:46:14.416136 2026] [security2:error] [pid 943918:tid 944132] [client 45.134.20.121:20613] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 121.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/images/admin.php"] [unique_id "alxkph70hbVC6Snzbho4AAAAANg"]
[Sat Jul 18 23:46:14.503809 2026] [security2:error] [pid 938041:tid 938178] [client 45.133.7.76:38115] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 76.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/maint/file.php"] [unique_id "alxkpiNrzsYMDd5sB11KKwAAAAY"]
[Sat Jul 18 23:46:14.922635 2026] [security2:error] [pid 943918:tid 944169] [client 173.239.196.163:21879] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/assets/content.php"] [unique_id "alxkph70hbVC6Snzbho4FAAAAP0"]
[Sat Jul 18 23:46:14.976774 2026] [security2:error] [pid 943918:tid 944064] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkph70hbVC6Snzbho4BAAAlCc"]
[Sat Jul 18 23:46:15.182603 2026] [security2:error] [pid 943918:tid 944144] [client 45.133.7.91:26663] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 91.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/acme-challenge/file.php"] [unique_id "alxkpx70hbVC6Snzbho4HQAAAOQ"]
[Sat Jul 18 23:46:15.278991 2026] [security2:error] [pid 943918:tid 944128] [client 45.134.20.134:63243] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 134.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "alxkpx70hbVC6Snzbho4IQAAANQ"]
[Sat Jul 18 23:46:15.325855 2026] [security2:error] [pid 943918:tid 943943] [remote 152.53.111.131:39550] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.111.53.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/wp-login.php"] [unique_id "alxkpx70hbVC6Snzbho4IwAA9Rc"]
[Sat Jul 18 23:46:15.548383 2026] [security2:error] [pid 943918:tid 944123] [client 51.68.236.95:29679] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "sustaintheart.com"] [uri "/robots.txt"] [unique_id "alxkpx70hbVC6Snzbho4MQAAAM8"]
[Sat Jul 18 23:46:15.548494 2026] [security2:error] [pid 943918:tid 944123] [client 51.68.236.95:29679] ModSecurity: Warning. Matched phrase "MJ12bot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "sustaintheart.com"] [uri "/robots.txt"] [unique_id "alxkpx70hbVC6Snzbho4MQAAAM8"]
[Sat Jul 18 23:46:15.575247 2026] [security2:error] [pid 943918:tid 943977] [remote 152.53.111.131:39550] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.111.53.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/wp-login.php"] [unique_id "alxkpx70hbVC6Snzbho4MgAAhzk"], referer: https://youpositive.co/wp-login.php
[Sat Jul 18 23:46:15.613411 2026] [security2:error] [pid 943918:tid 944069] [client 74.208.214.194:45234] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxkpx70hbVC6Snzbho4NAAAAJk"]
[Sat Jul 18 23:46:15.705970 2026] [security2:error] [pid 943918:tid 944090] [client 3.109.49.224:42252] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.49.109.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxkpx70hbVC6Snzbho4OAAAAK4"]
[Sat Jul 18 23:46:15.706079 2026] [security2:error] [pid 943918:tid 944090] [client 3.109.49.224:42252] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxkpx70hbVC6Snzbho4OAAAAK4"]
[Sat Jul 18 23:46:15.712515 2026] [security2:error] [pid 943918:tid 944065] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkpx70hbVC6Snzbho4KAAAlUw"]
[Sat Jul 18 23:46:15.749782 2026] [security2:error] [pid 943918:tid 944176] [client 173.239.196.161:52211] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/fm.php%20"] [unique_id "alxkpx70hbVC6Snzbho4OQAAAQQ"]
[Sat Jul 18 23:46:15.870783 2026] [security2:error] [pid 943918:tid 944084] [client 45.133.7.95:61769] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "alxkpx70hbVC6Snzbho4QAAAAKg"]
[Sat Jul 18 23:46:16.012212 2026] [security2:error] [pid 943918:tid 943973] [remote 31.42.184.154:34682] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxkqB70hbVC6Snzbho4SAAA8jU"]
[Sat Jul 18 23:46:16.135172 2026] [security2:error] [pid 938041:tid 938197] [client 45.134.20.115:63905] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/about/function.php"] [unique_id "alxkqCNrzsYMDd5sB11KSgAAABk"]
[Sat Jul 18 23:46:16.239451 2026] [security2:error] [pid 943918:tid 943954] [remote 31.42.184.154:34682] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxkqB70hbVC6Snzbho4UgAA4CI"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:46:16.265778 2026] [security2:error] [pid 943918:tid 944087] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkpx70hbVC6Snzbho4QwAAqyE"]
[Sat Jul 18 23:46:16.421573 2026] [security2:error] [pid 943918:tid 944105] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/4PJcpMFsD8B.php"] [unique_id "alxkqB70hbVC6Snzbho4XgAAAL0"]
[Sat Jul 18 23:46:16.421680 2026] [security2:error] [pid 943918:tid 944105] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/4PJcpMFsD8B.php"] [unique_id "alxkqB70hbVC6Snzbho4XgAAAL0"]
[Sat Jul 18 23:46:16.550555 2026] [security2:error] [pid 943918:tid 944101] [client 45.133.7.88:55985] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 88.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "alxkqB70hbVC6Snzbho4agAAALk"]
[Sat Jul 18 23:46:16.611286 2026] [security2:error] [pid 938041:tid 938245] [client 173.239.196.166:54287] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/goods.php"] [unique_id "alxkqCNrzsYMDd5sB11KUAAAAEk"]
[Sat Jul 18 23:46:16.727859 2026] [security2:error] [pid 938041:tid 938259] [client 163.61.1.17:50294] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkqCNrzsYMDd5sB11KVwAAAFc"]
[Sat Jul 18 23:46:16.733628 2026] [security2:error] [pid 938041:tid 938259] [client 163.61.1.17:50294] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkqCNrzsYMDd5sB11KVwAAAFc"]
[Sat Jul 18 23:46:16.771357 2026] [proxy:error] [pid 943918:tid 944080] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:46:16.771427 2026] [proxy_http:error] [pid 943918:tid 944080] [client 193.47.62.168:57504] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:46:16.771893 2026] [proxy:error] [pid 943918:tid 944080] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:46:16.771924 2026] [proxy_http:error] [pid 943918:tid 944080] [client 193.47.62.168:57504] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:46:16.793047 2026] [security2:error] [pid 943918:tid 943986] [remote 45.157.54.14:48651] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/xmlrpc.php"] [unique_id "alxkqB70hbVC6Snzbho4cwAAu0I"]
[Sat Jul 18 23:46:16.793265 2026] [security2:error] [pid 943918:tid 944103] [client 45.157.54.14:48651] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/xmlrpc.php"] [unique_id "alxkqB70hbVC6Snzbho4cwAAu0I"]
[Sat Jul 18 23:46:16.828447 2026] [security2:error] [pid 943918:tid 944095] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkqB70hbVC6Snzbho4ZAAAs1w"]
[Sat Jul 18 23:46:16.991615 2026] [security2:error] [pid 943918:tid 944158] [client 45.134.20.127:40185] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 127.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "alxkqB70hbVC6Snzbho4fQAAAPI"]
[Sat Jul 18 23:46:16.995622 2026] [security2:error] [pid 943918:tid 944099] [client 106.222.249.209:22923] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkqB70hbVC6Snzbho4fgAAALc"]
[Sat Jul 18 23:46:16.995721 2026] [security2:error] [pid 943918:tid 944099] [client 106.222.249.209:22923] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkqB70hbVC6Snzbho4fgAAALc"]
[Sat Jul 18 23:46:17.232815 2026] [security2:error] [pid 938041:tid 938239] [client 45.133.7.70:32969] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "alxkqSNrzsYMDd5sB11KXwAAAEM"]
[Sat Jul 18 23:46:17.452701 2026] [security2:error] [pid 938041:tid 938118] [remote 77.75.76.168:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "theablesea.com"] [uri "/robots.txt"] [unique_id "alxkqSNrzsYMDd5sB11KYgAATEs"]
[Sat Jul 18 23:46:17.452961 2026] [security2:error] [pid 938041:tid 938248] [client 77.75.76.168:0] ModSecurity: Warning. Matched phrase "Seznam" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "theablesea.com"] [uri "/robots.txt"] [unique_id "alxkqSNrzsYMDd5sB11KYgAATEs"]
[Sat Jul 18 23:46:17.471796 2026] [security2:error] [pid 943918:tid 944174] [client 173.239.196.167:62789] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/wp-2019.php"] [unique_id "alxkqR70hbVC6Snzbho4kAAAAQI"]
[Sat Jul 18 23:46:17.602532 2026] [security2:error] [pid 943918:tid 944166] [client 216.244.66.228:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.commonsensesf.com"] [uri "/member/165939/"] [unique_id "alxkqR70hbVC6Snzbho4lAAAAPo"]
[Sat Jul 18 23:46:17.602630 2026] [security2:error] [pid 943918:tid 944166] [client 216.244.66.228:0] ModSecurity: Warning. Matched phrase "Dotbot" at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "www.commonsensesf.com"] [uri "/member/165939/"] [unique_id "alxkqR70hbVC6Snzbho4lAAAAPo"]
[Sat Jul 18 23:46:17.650058 2026] [security2:error] [pid 943918:tid 944105] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkqR70hbVC6Snzbho4jAAAvTE"]
[Sat Jul 18 23:46:17.684779 2026] [security2:error] [pid 938041:tid 938077] [remote 77.75.76.168:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "theablesea.com"] [uri "/"] [unique_id "alxkqSNrzsYMDd5sB11KaAAACCI"]
[Sat Jul 18 23:46:17.684987 2026] [security2:error] [pid 938041:tid 938180] [client 77.75.76.168:0] ModSecurity: Warning. Matched phrase "Seznam" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "theablesea.com"] [uri "/"] [unique_id "alxkqSNrzsYMDd5sB11KaAAACCI"]
[Sat Jul 18 23:46:17.849772 2026] [security2:error] [pid 943918:tid 944049] [client 45.134.20.125:58913] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 125.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "alxkqR70hbVC6Snzbho4oQAAAIU"]
[Sat Jul 18 23:46:17.914806 2026] [security2:error] [pid 938041:tid 938296] [client 45.133.7.67:26415] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/theme-editor.php"] [unique_id "alxkqSNrzsYMDd5sB11KcQAAAHw"]
[Sat Jul 18 23:46:17.955770 2026] [security2:error] [pid 943918:tid 944106] [client 40.77.167.2:40278] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.thewelloiledlife.com"] [uri "/index.php"] [unique_id "alxkqB70hbVC6Snzbho4bQAAvkE"]
[Sat Jul 18 23:46:17.970112 2026] [security2:error] [pid 943918:tid 944026] [remote 45.157.54.14:49994] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "jhavoctattoos.com"] [uri "/xmlrpc.php"] [unique_id "alxkqR70hbVC6Snzbho4pwAAh2o"]
[Sat Jul 18 23:46:17.970330 2026] [security2:error] [pid 943918:tid 944051] [client 45.157.54.14:49994] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "jhavoctattoos.com"] [uri "/xmlrpc.php"] [unique_id "alxkqR70hbVC6Snzbho4pwAAh2o"]
[Sat Jul 18 23:46:18.179293 2026] [security2:error] [pid 943918:tid 944075] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/file.php"] [unique_id "alxkqh70hbVC6Snzbho4sAAAAJ8"]
[Sat Jul 18 23:46:18.179397 2026] [security2:error] [pid 943918:tid 944075] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/file.php"] [unique_id "alxkqh70hbVC6Snzbho4sAAAAJ8"]
[Sat Jul 18 23:46:18.220535 2026] [security2:error] [pid 943918:tid 944053] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkqR70hbVC6Snzbho4pAAAiXM"]
[Sat Jul 18 23:46:18.297517 2026] [security2:error] [pid 938041:tid 938250] [client 180.252.198.240:51012] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkqiNrzsYMDd5sB11KdAAAAE4"]
[Sat Jul 18 23:46:18.297616 2026] [security2:error] [pid 938041:tid 938250] [client 180.252.198.240:51012] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkqiNrzsYMDd5sB11KdAAAAE4"]
[Sat Jul 18 23:46:18.366464 2026] [security2:error] [pid 943918:tid 944073] [client 173.239.196.161:61853] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "alxkqh70hbVC6Snzbho4uQAAAJ0"]
[Sat Jul 18 23:46:18.598631 2026] [security2:error] [pid 943918:tid 944102] [client 45.133.7.71:62335] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 71.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/blue/abc.php"] [unique_id "alxkqh70hbVC6Snzbho4wQAAALo"]
[Sat Jul 18 23:46:18.702744 2026] [security2:error] [pid 943918:tid 944056] [client 45.134.20.139:33473] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 139.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "alxkqh70hbVC6Snzbho4xAAAAIw"]
[Sat Jul 18 23:46:18.734334 2026] [security2:error] [pid 943918:tid 944133] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkqh70hbVC6Snzbho4vAAA2W8"]
[Sat Jul 18 23:46:18.740077 2026] [security2:error] [pid 943918:tid 944140] [client 138.252.89.100:59976] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkqh70hbVC6Snzbho4xwAAAOA"]
[Sat Jul 18 23:46:18.740163 2026] [security2:error] [pid 943918:tid 944140] [client 138.252.89.100:59976] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkqh70hbVC6Snzbho4xwAAAOA"]
[Sat Jul 18 23:46:18.755754 2026] [security2:error] [pid 943918:tid 944071] [client 216.73.163.134:58347] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 134.163.73.216.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.scoophouse.com"] [uri "/wp-login.php"] [unique_id "alxkqh70hbVC6Snzbho4xgAAAJs"]
[Sat Jul 18 23:46:19.092653 2026] [security2:error] [pid 943918:tid 944023] [remote 103.90.234.13:36034] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.234.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxkqx70hbVC6Snzbho41QAArGc"]
[Sat Jul 18 23:46:19.277616 2026] [security2:error] [pid 943918:tid 944049] [client 45.133.7.60:49673] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 60.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/maint/wonder.php"] [unique_id "alxkqx70hbVC6Snzbho42QAAAIU"]
[Sat Jul 18 23:46:19.292578 2026] [security2:error] [pid 938041:tid 938198] [client 173.239.196.166:33651] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/assets/images/cloud.php"] [unique_id "alxkqyNrzsYMDd5sB11KggAAABo"]
[Sat Jul 18 23:46:19.298246 2026] [core:error] [pid 943918:tid 944109] [client 66.249.73.160:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:46:19.298262 2026] [core:error] [pid 943918:tid 944109] [client 66.249.73.160:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:46:19.298554 2026] [security2:error] [pid 943918:tid 944123] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkqh70hbVC6Snzbho40QAAzyU"]
[Sat Jul 18 23:46:19.336593 2026] [core:error] [pid 938041:tid 938199] [client 66.249.73.171:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:46:19.336615 2026] [core:error] [pid 938041:tid 938199] [client 66.249.73.171:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:46:19.556863 2026] [security2:error] [pid 938041:tid 938264] [client 45.134.20.111:63787] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/languages/404.php"] [unique_id "alxkqyNrzsYMDd5sB11KiwAAAFw"]
[Sat Jul 18 23:46:19.750922 2026] [security2:error] [pid 943918:tid 944094] [client 158.173.166.68:23235] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/index.php"] [unique_id "alxkqx70hbVC6Snzbho46QAAsh0"]
[Sat Jul 18 23:46:19.943987 2026] [security2:error] [pid 943918:tid 944154] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkqx70hbVC6Snzbho46gAA7gE"]
[Sat Jul 18 23:46:19.958366 2026] [security2:error] [pid 943918:tid 944064] [client 45.133.7.85:59289] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 85.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/twentytwentyfour/wonder.php"] [unique_id "alxkqx70hbVC6Snzbho47wAAAJQ"]
[Sat Jul 18 23:46:19.968221 2026] [security2:error] [pid 943918:tid 944030] [remote 45.157.54.14:52121] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/xmlrpc.php"] [unique_id "alxkqx70hbVC6Snzbho48AAAiW4"]
[Sat Jul 18 23:46:19.968357 2026] [security2:error] [pid 943918:tid 944053] [client 45.157.54.14:52121] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "jhavoctattoos-com.grndl.com"] [uri "/xmlrpc.php"] [unique_id "alxkqx70hbVC6Snzbho48AAAiW4"]
[Sat Jul 18 23:46:20.164049 2026] [security2:error] [pid 943918:tid 944138] [client 173.239.196.164:31909] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/log.php"] [unique_id "alxkrB70hbVC6Snzbho4-QAAAN4"]
[Sat Jul 18 23:46:20.259263 2026] [security2:error] [pid 943918:tid 944033] [remote 103.90.234.13:36034] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.234.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxkrB70hbVC6Snzbho4_AAAunE"], referer: https://sesamegreenbeans.com/wp-login.php
[Sat Jul 18 23:46:20.412047 2026] [security2:error] [pid 943918:tid 944127] [client 45.134.20.104:26269] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/update/403.php"] [unique_id "alxkrB70hbVC6Snzbho5CAAAANM"]
[Sat Jul 18 23:46:20.511119 2026] [security2:error] [pid 943918:tid 944057] [client 50.116.65.227:15872] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxkrB70hbVC6Snzbho5CwAAAI0"]
[Sat Jul 18 23:46:20.513000 2026] [security2:error] [pid 943918:tid 944060] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkrB70hbVC6Snzbho49wAAkHg"]
[Sat Jul 18 23:46:20.527047 2026] [security2:error] [pid 943918:tid 944110] [client 50.116.65.227:20350] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxkrB70hbVC6Snzbho5DAAAAMI"]
[Sat Jul 18 23:46:20.638800 2026] [security2:error] [pid 943918:tid 944083] [client 45.133.7.93:30101] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 93.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/fix/as.php"] [unique_id "alxkrB70hbVC6Snzbho5DQAAAKc"]
[Sat Jul 18 23:46:20.795806 2026] [security2:error] [pid 943918:tid 944114] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/cfile.php"] [unique_id "alxkrB70hbVC6Snzbho5GwAAAMY"]
[Sat Jul 18 23:46:20.795904 2026] [security2:error] [pid 943918:tid 944114] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/cfile.php"] [unique_id "alxkrB70hbVC6Snzbho5GwAAAMY"]
[Sat Jul 18 23:46:20.853404 2026] [security2:error] [pid 943918:tid 943922] [remote 45.157.54.14:53013] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "jhavoctattoos.com"] [uri "/xmlrpc.php"] [unique_id "alxkrB70hbVC6Snzbho5IQAAjgI"]
[Sat Jul 18 23:46:20.853581 2026] [security2:error] [pid 943918:tid 944058] [client 45.157.54.14:53013] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "jhavoctattoos.com"] [uri "/xmlrpc.php"] [unique_id "alxkrB70hbVC6Snzbho5IQAAjgI"]
[Sat Jul 18 23:46:20.896931 2026] [security2:error] [pid 943918:tid 943971] [remote 74.235.96.117:47222] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.235.74.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "boz.rnn.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxkrB70hbVC6Snzbho5JAAAoDM"]
[Sat Jul 18 23:46:20.897119 2026] [security2:error] [pid 943918:tid 944076] [client 74.235.96.117:47222] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "boz.rnn.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxkrB70hbVC6Snzbho5JAAAoDM"]
[Sat Jul 18 23:46:21.022566 2026] [security2:error] [pid 938041:tid 938180] [client 173.239.196.162:45533] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "alxkrSNrzsYMDd5sB11KpQAAAAg"]
[Sat Jul 18 23:46:21.051271 2026] [security2:error] [pid 943918:tid 944049] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkrB70hbVC6Snzbho5DgAAhRM"]
[Sat Jul 18 23:46:21.264247 2026] [security2:error] [pid 938041:tid 938286] [client 45.134.20.134:30949] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 134.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/default.php"] [unique_id "alxkrSNrzsYMDd5sB11KrQAAAHI"]
[Sat Jul 18 23:46:21.278417 2026] [security2:error] [pid 938041:tid 938253] [client 50.116.65.227:15876] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxkrSNrzsYMDd5sB11KrgAAAFE"]
[Sat Jul 18 23:46:21.293388 2026] [security2:error] [pid 938041:tid 938288] [client 50.116.65.227:20354] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxkrSNrzsYMDd5sB11KrwAAAHQ"]
[Sat Jul 18 23:46:21.320702 2026] [security2:error] [pid 938041:tid 938209] [client 45.133.7.99:41163] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/tox.php"] [unique_id "alxkrSNrzsYMDd5sB11KsQAAACU"]
[Sat Jul 18 23:46:21.618569 2026] [security2:error] [pid 943918:tid 944104] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkrR70hbVC6Snzbho5MgAAvCA"]
[Sat Jul 18 23:46:21.900156 2026] [security2:error] [pid 938041:tid 938246] [client 173.239.196.167:23121] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "alxkrSNrzsYMDd5sB11KyAAAAEo"]
[Sat Jul 18 23:46:22.009371 2026] [security2:error] [pid 938041:tid 938218] [client 45.133.7.76:49183] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 76.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/languages/index.php"] [unique_id "alxkriNrzsYMDd5sB11KyQAAAC4"]
[Sat Jul 18 23:46:22.123026 2026] [security2:error] [pid 943918:tid 944159] [client 45.134.20.129:55555] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/assets/info.php"] [unique_id "alxkrh70hbVC6Snzbho5QQAAAPM"]
[Sat Jul 18 23:46:22.169333 2026] [security2:error] [pid 943918:tid 944087] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkrR70hbVC6Snzbho5OwAAqxc"]
[Sat Jul 18 23:46:22.461591 2026] [security2:error] [pid 938041:tid 938147] [remote 163.227.186.27:34162] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/wp-login.php"] [unique_id "alxkriNrzsYMDd5sB11K0gAASWg"]
[Sat Jul 18 23:46:22.688484 2026] [security2:error] [pid 943918:tid 944079] [client 45.133.7.92:44389] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/js/dist/default.php"] [unique_id "alxkrh70hbVC6Snzbho5YQAAAKM"]
[Sat Jul 18 23:46:22.742965 2026] [security2:error] [pid 943918:tid 944148] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkrh70hbVC6Snzbho5TwAA6Dc"]
[Sat Jul 18 23:46:22.772631 2026] [security2:error] [pid 943918:tid 944081] [client 173.239.196.165:42573] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/aw.php"] [unique_id "alxkrh70hbVC6Snzbho5ZQAAAKU"]
[Sat Jul 18 23:46:22.921367 2026] [security2:error] [pid 943918:tid 944069] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/class-wp.php"] [unique_id "alxkrh70hbVC6Snzbho5awAAAJk"]
[Sat Jul 18 23:46:22.921464 2026] [security2:error] [pid 943918:tid 944069] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/class-wp.php"] [unique_id "alxkrh70hbVC6Snzbho5awAAAJk"]
[Sat Jul 18 23:46:22.928874 2026] [security2:error] [pid 938041:tid 938049] [remote 163.227.186.27:34162] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/wp-login.php"] [unique_id "alxkriNrzsYMDd5sB11K1wAAHwY"], referer: https://nevelow.com/wp-login.php
[Sat Jul 18 23:46:22.981080 2026] [security2:error] [pid 943918:tid 944074] [client 45.134.20.124:48105] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 124.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/class.api.php"] [unique_id "alxkrh70hbVC6Snzbho5bgAAAJ4"]
[Sat Jul 18 23:46:23.057142 2026] [security2:error] [pid 943918:tid 944153] [client 4.194.24.143:22397] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/nine2code.php"] [unique_id "alxkrx70hbVC6Snzbho5dAAAAO0"]
[Sat Jul 18 23:46:23.171112 2026] [security2:error] [pid 943918:tid 944121] [client 4.194.24.143:23612] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/nine2code.php"] [unique_id "alxkrx70hbVC6Snzbho5eAAAAM0"]
[Sat Jul 18 23:46:23.311055 2026] [security2:error] [pid 943918:tid 944122] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkrh70hbVC6Snzbho5bQAAzkg"]
[Sat Jul 18 23:46:23.369832 2026] [security2:error] [pid 943918:tid 944156] [client 45.133.7.62:35095] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/tfileman.php"] [unique_id "alxkrx70hbVC6Snzbho5hAAAAPA"]
[Sat Jul 18 23:46:23.597666 2026] [security2:error] [pid 943918:tid 944095] [client 4.194.24.143:30356] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/num.php"] [unique_id "alxkrx70hbVC6Snzbho5iwAAALM"]
[Sat Jul 18 23:46:23.640187 2026] [security2:error] [pid 943918:tid 944170] [client 173.239.196.162:24519] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/update/gely.php"] [unique_id "alxkrx70hbVC6Snzbho5jQAAAP4"]
[Sat Jul 18 23:46:23.763974 2026] [security2:error] [pid 943918:tid 944112] [client 4.194.24.143:23579] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/num.php"] [unique_id "alxkrx70hbVC6Snzbho5lQAAAMQ"]
[Sat Jul 18 23:46:23.837629 2026] [security2:error] [pid 938041:tid 938250] [client 45.134.20.126:58841] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 126.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "alxkryNrzsYMDd5sB11K5wAAAE4"]
[Sat Jul 18 23:46:23.923287 2026] [security2:error] [pid 943918:tid 944081] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/admin.php"] [unique_id "alxkrx70hbVC6Snzbho5mgAAAKU"]
[Sat Jul 18 23:46:23.923422 2026] [security2:error] [pid 943918:tid 944081] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/admin.php"] [unique_id "alxkrx70hbVC6Snzbho5mgAAAKU"]
[Sat Jul 18 23:46:24.050416 2026] [security2:error] [pid 943918:tid 944142] [client 45.133.7.68:34293] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 68.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/tiny.php"] [unique_id "alxksB70hbVC6Snzbho5oQAAAOI"]
[Sat Jul 18 23:46:24.160275 2026] [security2:error] [pid 943918:tid 944076] [client 4.194.24.143:17316] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/odf7udtspqtpxzyxmw2rccdefault.php"] [unique_id "alxksB70hbVC6Snzbho5pAAAAKA"]
[Sat Jul 18 23:46:24.208686 2026] [security2:error] [pid 943918:tid 944165] [client 36.83.95.75:56290] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxksB70hbVC6Snzbho5pQAAAPk"]
[Sat Jul 18 23:46:24.208817 2026] [security2:error] [pid 943918:tid 944165] [client 36.83.95.75:56290] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxksB70hbVC6Snzbho5pQAAAPk"]
[Sat Jul 18 23:46:24.317561 2026] [security2:error] [pid 938041:tid 938273] [client 4.194.24.143:30390] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/odf7udtspqtpxzyxmw2rccdefault.php"] [unique_id "alxksCNrzsYMDd5sB11K9wAAAGU"]
[Sat Jul 18 23:46:24.352963 2026] [security2:error] [pid 943918:tid 944131] [client 139.167.225.146:56024] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxksB70hbVC6Snzbho5qQAAANc"]
[Sat Jul 18 23:46:24.356767 2026] [security2:error] [pid 943918:tid 944131] [client 139.167.225.146:56024] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxksB70hbVC6Snzbho5qQAAANc"]
[Sat Jul 18 23:46:24.466326 2026] [security2:error] [pid 943918:tid 944132] [client 173.239.196.160:28857] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/uploads/c99shell.php"] [unique_id "alxksB70hbVC6Snzbho5rgAAANg"]
[Sat Jul 18 23:46:24.632524 2026] [security2:error] [pid 943918:tid 944110] [client 103.160.26.178:60141] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxksB70hbVC6Snzbho5sgAAAMI"]
[Sat Jul 18 23:46:24.632625 2026] [security2:error] [pid 943918:tid 944110] [client 103.160.26.178:60141] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxksB70hbVC6Snzbho5sgAAAMI"]
[Sat Jul 18 23:46:24.694866 2026] [security2:error] [pid 938041:tid 938177] [client 45.134.20.118:41501] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/chosen.php"] [unique_id "alxksCNrzsYMDd5sB11K-wAAAAU"]
[Sat Jul 18 23:46:24.704130 2026] [security2:error] [pid 943918:tid 944087] [client 4.194.24.143:22337] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/option.php"] [unique_id "alxksB70hbVC6Snzbho5twAAAKs"]
[Sat Jul 18 23:46:24.732219 2026] [security2:error] [pid 943918:tid 944058] [client 45.133.7.101:25875] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 101.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/js/widgets/autoload_classmap.php"] [unique_id "alxksB70hbVC6Snzbho5uwAAAI4"]
[Sat Jul 18 23:46:24.935383 2026] [security2:error] [pid 943918:tid 944156] [client 4.194.24.143:35732] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/option.php"] [unique_id "alxksB70hbVC6Snzbho5xwAAAPA"]
[Sat Jul 18 23:46:25.044737 2026] [security2:error] [pid 943918:tid 944106] [client 3.85.217.58:37436] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.217.85.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxksR70hbVC6Snzbho5ywAAAL4"]
[Sat Jul 18 23:46:25.244604 2026] [security2:error] [pid 943918:tid 944125] [client 4.194.24.143:28462] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/p.php"] [unique_id "alxksR70hbVC6Snzbho50QAAANE"]
[Sat Jul 18 23:46:25.333462 2026] [security2:error] [pid 943918:tid 944072] [client 173.239.196.162:40289] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/pridmag/admin-footer.php"] [unique_id "alxksR70hbVC6Snzbho50wAAAJw"]
[Sat Jul 18 23:46:25.403899 2026] [security2:error] [pid 938041:tid 938225] [client 32.198.12.77:15058] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 77.12.198.32.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxksSNrzsYMDd5sB11LCgAAADU"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:46:25.414328 2026] [security2:error] [pid 938041:tid 938228] [client 45.133.7.74:26349] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/themes.php"] [unique_id "alxksSNrzsYMDd5sB11LDQAAADg"]
[Sat Jul 18 23:46:25.503561 2026] [security2:error] [pid 943918:tid 944149] [client 4.194.24.143:22364] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/p.php"] [unique_id "alxksR70hbVC6Snzbho52wAAAOk"]
[Sat Jul 18 23:46:25.550382 2026] [security2:error] [pid 943918:tid 944105] [client 45.134.20.112:60609] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 112.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/autoload_classmap/bypass.php"] [unique_id "alxksR70hbVC6Snzbho53QAAAL0"]
[Sat Jul 18 23:46:25.670229 2026] [security2:error] [pid 943918:tid 944073] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/aa2.php"] [unique_id "alxksR70hbVC6Snzbho56gAAAJ0"]
[Sat Jul 18 23:46:25.670343 2026] [security2:error] [pid 943918:tid 944073] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/aa2.php"] [unique_id "alxksR70hbVC6Snzbho56gAAAJ0"]
[Sat Jul 18 23:46:25.817064 2026] [security2:error] [pid 943918:tid 944132] [client 4.194.24.143:35712] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/past.php"] [unique_id "alxksR70hbVC6Snzbho58AAAANg"]
[Sat Jul 18 23:46:26.044572 2026] [security2:error] [pid 938041:tid 938203] [client 4.194.24.143:30389] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/past.php"] [unique_id "alxksiNrzsYMDd5sB11LHQAAAB8"]
[Sat Jul 18 23:46:26.093729 2026] [security2:error] [pid 943918:tid 944151] [client 50.116.65.227:20426] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "oldracelimited.com"] [uri "/index.php"] [unique_id "alxksR70hbVC6Snzbho53AAAAOs"]
[Sat Jul 18 23:46:26.101595 2026] [security2:error] [pid 943918:tid 944090] [client 45.133.7.83:31017] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-themes.php"] [unique_id "alxksh70hbVC6Snzbho5-gAAAK4"]
[Sat Jul 18 23:46:26.223457 2026] [security2:error] [pid 943918:tid 944128] [client 173.239.196.166:26379] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/uploads/lala.php"] [unique_id "alxksh70hbVC6Snzbho5_gAAANQ"]
[Sat Jul 18 23:46:26.372944 2026] [security2:error] [pid 938041:tid 938297] [client 4.194.24.143:17289] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/php.php"] [unique_id "alxksiNrzsYMDd5sB11LKQAAAH0"]
[Sat Jul 18 23:46:26.420415 2026] [security2:error] [pid 943918:tid 944148] [client 45.134.20.134:39833] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 134.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/dropdown.php"] [unique_id "alxksh70hbVC6Snzbho6CgAAAOg"]
[Sat Jul 18 23:46:26.525268 2026] [security2:error] [pid 943918:tid 944160] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxksh70hbVC6Snzbho5_AAA9CU"]
[Sat Jul 18 23:46:26.586896 2026] [security2:error] [pid 938041:tid 938209] [client 4.194.24.143:17333] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/php.php"] [unique_id "alxksiNrzsYMDd5sB11LLAAAACU"]
[Sat Jul 18 23:46:26.697779 2026] [security2:error] [pid 938041:tid 938235] [client 50.116.65.227:20434] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "oldracelimited.com"] [uri "/index.php"] [unique_id "alxksiNrzsYMDd5sB11LIQAAAD8"]
[Sat Jul 18 23:46:26.780804 2026] [security2:error] [pid 943918:tid 944136] [client 45.133.7.71:32017] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 71.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "alxksh70hbVC6Snzbho6JgAAANw"]
[Sat Jul 18 23:46:26.900333 2026] [security2:error] [pid 943918:tid 944078] [client 108.59.114.128:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mtlegnews.gov"] [uri "/index.php"] [unique_id "alxksh70hbVC6Snzbho6GAAAAKI"]
[Sat Jul 18 23:46:26.913607 2026] [security2:error] [pid 938041:tid 938256] [client 4.194.24.143:30383] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/php8.php"] [unique_id "alxksiNrzsYMDd5sB11LMAAAAFQ"]
[Sat Jul 18 23:46:27.093986 2026] [security2:error] [pid 943918:tid 944149] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxksh70hbVC6Snzbho6IAAA6Ro"]
[Sat Jul 18 23:46:27.100837 2026] [security2:error] [pid 938041:tid 938271] [client 173.239.196.166:39123] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/IXR/db.php"] [unique_id "alxksyNrzsYMDd5sB11LNAAAAGM"]
[Sat Jul 18 23:46:27.173451 2026] [security2:error] [pid 943918:tid 944169] [client 4.194.24.143:30348] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/php8.php"] [unique_id "alxksx70hbVC6Snzbho6OAAAAP0"]
[Sat Jul 18 23:46:27.279260 2026] [security2:error] [pid 943918:tid 944150] [client 45.134.20.113:34183] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/images/admin.php"] [unique_id "alxksx70hbVC6Snzbho6QQAAAOo"]
[Sat Jul 18 23:46:27.390920 2026] [security2:error] [pid 943918:tid 944094] [client 163.61.1.17:50773] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxksx70hbVC6Snzbho6SQAAALI"]
[Sat Jul 18 23:46:27.391059 2026] [security2:error] [pid 943918:tid 944094] [client 163.61.1.17:50773] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxksx70hbVC6Snzbho6SQAAALI"]
[Sat Jul 18 23:46:27.455650 2026] [security2:error] [pid 943918:tid 944138] [client 4.194.24.143:17296] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/phpinfo.php"] [unique_id "alxksx70hbVC6Snzbho6TQAAAN4"]
[Sat Jul 18 23:46:27.466623 2026] [security2:error] [pid 943918:tid 944105] [client 45.133.7.85:58149] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 85.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/erinyani/asasx.php"] [unique_id "alxksx70hbVC6Snzbho6TgAAAL0"]
[Sat Jul 18 23:46:27.588202 2026] [security2:error] [pid 943918:tid 944095] [client 106.222.249.209:25186] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxksx70hbVC6Snzbho6VAAAALM"]
[Sat Jul 18 23:46:27.588311 2026] [security2:error] [pid 943918:tid 944095] [client 106.222.249.209:25186] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxksx70hbVC6Snzbho6VAAAALM"]
[Sat Jul 18 23:46:27.715041 2026] [security2:error] [pid 943918:tid 944084] [client 4.194.24.143:23582] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/phpinfo.php"] [unique_id "alxksx70hbVC6Snzbho6XAAAAKg"]
[Sat Jul 18 23:46:27.750979 2026] [security2:error] [pid 943918:tid 944171] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxksx70hbVC6Snzbho6SAAA_xs"]
[Sat Jul 18 23:46:27.957009 2026] [security2:error] [pid 943918:tid 944156] [client 173.239.196.161:48023] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/css/install.php"] [unique_id "alxksx70hbVC6Snzbho6ZwAAAPA"]
[Sat Jul 18 23:46:28.135676 2026] [security2:error] [pid 938041:tid 938237] [client 45.134.20.120:50935] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 120.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/db.php"] [unique_id "alxktCNrzsYMDd5sB11LRwAAAEE"]
[Sat Jul 18 23:46:28.151148 2026] [security2:error] [pid 943918:tid 944153] [client 45.133.7.63:52649] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/mariju.php"] [unique_id "alxktB70hbVC6Snzbho6cgAAAO0"]
[Sat Jul 18 23:46:28.315516 2026] [security2:error] [pid 943918:tid 944116] [client 57.141.18.22:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "alexsandbergmusic.com"] [uri "/index.php"] [unique_id "alxksR70hbVC6Snzbho55gAAAMg"]
[Sat Jul 18 23:46:28.334994 2026] [security2:error] [pid 943918:tid 944075] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxksx70hbVC6Snzbho6aAAAnyA"]
[Sat Jul 18 23:46:28.341509 2026] [security2:error] [pid 943918:tid 943962] [remote 148.113.130.241:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "Mozilla\\\\/5\\\\.0 \\\\(compatible; AhrefsBot\\\\/\\\\d\\\\.\\\\d; \\\\+http:\\\\/\\\\/ahrefs\\\\.com\\\\/robot\\\\/\\\\)" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "578"] [id "900165"] [msg "AhrefsBot BOT Request"] [hostname "fairwaysonmainteetimes.com"] [uri "/category-sitemap.xml"] [unique_id "alxktB70hbVC6Snzbho6egAA4Co"]
[Sat Jul 18 23:46:28.341673 2026] [security2:error] [pid 943918:tid 944140] [client 148.113.130.241:0] ModSecurity: Warning. Matched phrase "AhrefsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "fairwaysonmainteetimes.com"] [uri "/category-sitemap.xml"] [unique_id "alxktB70hbVC6Snzbho6egAA4Co"]
[Sat Jul 18 23:46:28.730197 2026] [security2:error] [pid 938041:tid 938223] [client 180.252.198.240:51618] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxktCNrzsYMDd5sB11LVQAAADM"]
[Sat Jul 18 23:46:28.730318 2026] [security2:error] [pid 938041:tid 938223] [client 180.252.198.240:51618] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxktCNrzsYMDd5sB11LVQAAADM"]
[Sat Jul 18 23:46:28.733945 2026] [security2:error] [pid 943918:tid 944070] [client 57.141.18.12:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "falconarrowshop.com"] [uri "/index.php"] [unique_id "alxksh70hbVC6Snzbho6DgAAAJo"]
[Sat Jul 18 23:46:28.778459 2026] [security2:error] [pid 943918:tid 944114] [client 173.239.196.162:27163] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/plugins/wp-theme-editor/include.php%20"] [unique_id "alxktB70hbVC6Snzbho6kQAAAMY"]
[Sat Jul 18 23:46:28.831644 2026] [security2:error] [pid 943918:tid 944144] [client 45.133.7.72:25657] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 72.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/waf_defender.php"] [unique_id "alxktB70hbVC6Snzbho6lAAAAOQ"]
[Sat Jul 18 23:46:28.992183 2026] [security2:error] [pid 943918:tid 944097] [client 45.134.20.135:59217] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/pki-validation/mariju.php"] [unique_id "alxktB70hbVC6Snzbho6mwAAALU"]
[Sat Jul 18 23:46:29.180964 2026] [security2:error] [pid 943918:tid 944079] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/ccou.php"] [unique_id "alxktR70hbVC6Snzbho6sQAAAKM"]
[Sat Jul 18 23:46:29.181086 2026] [security2:error] [pid 943918:tid 944079] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/ccou.php"] [unique_id "alxktR70hbVC6Snzbho6sQAAAKM"]
[Sat Jul 18 23:46:29.267684 2026] [security2:error] [pid 938041:tid 938219] [client 4.194.24.143:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "lutheranphilosopher.com"] [uri "/index.php"] [unique_id "alxktCNrzsYMDd5sB11LRQAAAC8"]
[Sat Jul 18 23:46:29.501524 2026] [security2:error] [pid 943918:tid 944075] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxktR70hbVC6Snzbho6sAAAn1I"]
[Sat Jul 18 23:46:29.511127 2026] [security2:error] [pid 943918:tid 944070] [client 45.133.7.89:65155] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 89.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/maint/cong.php"] [unique_id "alxktR70hbVC6Snzbho6uwAAAJo"]
[Sat Jul 18 23:46:29.617350 2026] [security2:error] [pid 943918:tid 944110] [client 173.239.196.165:42833] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/top.php"] [unique_id "alxktR70hbVC6Snzbho6wgAAAMI"]
[Sat Jul 18 23:46:29.692490 2026] [security2:error] [pid 943918:tid 944091] [client 4.194.24.143:28428] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/post.php"] [unique_id "alxktR70hbVC6Snzbho6xgAAAK8"]
[Sat Jul 18 23:46:29.843685 2026] [security2:error] [pid 943918:tid 944077] [client 45.134.20.108:28659] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/mah/function.php"] [unique_id "alxktR70hbVC6Snzbho6zwAAAKE"]
[Sat Jul 18 23:46:29.981620 2026] [security2:error] [pid 938041:tid 938210] [client 4.194.24.143:23087] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "nurturemarple.co.uk"] [uri "/index.php"] [unique_id "alxktCNrzsYMDd5sB11LSwAAACY"]
[Sat Jul 18 23:46:30.069315 2026] [security2:error] [pid 943918:tid 944098] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxktR70hbVC6Snzbho6yQAAtk4"]
[Sat Jul 18 23:46:30.160595 2026] [security2:error] [pid 938041:tid 938252] [client 4.194.24.143:23087] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/post.php"] [unique_id "alxktiNrzsYMDd5sB11LcAAAAFA"]
[Sat Jul 18 23:46:30.171307 2026] [security2:error] [pid 938041:tid 938207] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/dr.php"] [unique_id "alxktiNrzsYMDd5sB11LcQAAACM"]
[Sat Jul 18 23:46:30.171391 2026] [security2:error] [pid 938041:tid 938207] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/dr.php"] [unique_id "alxktiNrzsYMDd5sB11LcQAAACM"]
[Sat Jul 18 23:46:30.190955 2026] [security2:error] [pid 938041:tid 938189] [client 45.133.7.65:58215] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 65.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/av.php"] [unique_id "alxktiNrzsYMDd5sB11LcgAAABE"]
[Sat Jul 18 23:46:30.243371 2026] [security2:error] [pid 938041:tid 938215] [client 4.194.24.143:23063] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/public/assets/design_1/css/parts/course_cards/grid_card_1.min.php"] [unique_id "alxktiNrzsYMDd5sB11LcwAAACs"]
[Sat Jul 18 23:46:30.437709 2026] [security2:error] [pid 943918:tid 944050] [client 50.116.65.227:15474] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.nurturemarple.co.uk"] [uri "/index.php"] [unique_id "alxkth70hbVC6Snzbho63QAAAIY"]
[Sat Jul 18 23:46:30.446925 2026] [security2:error] [pid 938041:tid 938209] [client 138.252.89.100:60659] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxktiNrzsYMDd5sB11LfgAAACU"]
[Sat Jul 18 23:46:30.447055 2026] [security2:error] [pid 938041:tid 938209] [client 138.252.89.100:60659] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxktiNrzsYMDd5sB11LfgAAACU"]
[Sat Jul 18 23:46:30.499379 2026] [security2:error] [pid 938041:tid 938246] [client 173.239.196.160:20199] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/css/dist/install.php"] [unique_id "alxktiNrzsYMDd5sB11LgQAAAEo"]
[Sat Jul 18 23:46:30.547328 2026] [security2:error] [pid 938041:tid 938255] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/xamp.php"] [unique_id "alxktiNrzsYMDd5sB11LggAAAFM"]
[Sat Jul 18 23:46:30.547427 2026] [security2:error] [pid 938041:tid 938255] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/xamp.php"] [unique_id "alxktiNrzsYMDd5sB11LggAAAFM"]
[Sat Jul 18 23:46:30.574065 2026] [security2:error] [pid 943918:tid 944152] [client 3.109.49.224:62562] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.49.109.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxkth70hbVC6Snzbho66gAAAOw"]
[Sat Jul 18 23:46:30.628700 2026] [security2:error] [pid 943918:tid 944059] [client 50.116.65.227:15476] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.nurturemarple.co.uk"] [uri "/index.php"] [unique_id "alxkth70hbVC6Snzbho66AAAAI8"]
[Sat Jul 18 23:46:30.702020 2026] [security2:error] [pid 938041:tid 938276] [client 4.194.24.143:34968] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/public/assets/design_1/css/parts/course_cards/grid_card_1.min.php"] [unique_id "alxktiNrzsYMDd5sB11LiQAAAGg"]
[Sat Jul 18 23:46:30.712529 2026] [security2:error] [pid 938041:tid 938283] [client 45.134.20.123:21405] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 123.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/bypass.php"] [unique_id "alxktiNrzsYMDd5sB11LigAAAG8"]
[Sat Jul 18 23:46:30.730050 2026] [security2:error] [pid 943918:tid 944012] [remote 117.0.21.154:44210] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "narv.co"] [uri "/wp-login.php"] [unique_id "alxkth70hbVC6Snzbho67gAAlVw"]
[Sat Jul 18 23:46:30.799290 2026] [security2:error] [pid 938041:tid 938270] [client 4.194.24.143:30369] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/public/css.php"] [unique_id "alxktiNrzsYMDd5sB11LjAAAAGI"]
[Sat Jul 18 23:46:30.800181 2026] [security2:error] [pid 943918:tid 944120] [client 50.116.65.227:27800] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxkth70hbVC6Snzbho68gAAAMw"]
[Sat Jul 18 23:46:30.813359 2026] [security2:error] [pid 943918:tid 944057] [client 50.116.65.227:15492] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxkth70hbVC6Snzbho68wAAAI0"]
[Sat Jul 18 23:46:30.885872 2026] [security2:error] [pid 943918:tid 944051] [client 45.133.7.69:59377] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 69.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/glex.php"] [unique_id "alxkth70hbVC6Snzbho69QAAAIc"]
[Sat Jul 18 23:46:31.155439 2026] [security2:error] [pid 943918:tid 944162] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/bless.php"] [unique_id "alxktx70hbVC6Snzbho7CQAAAPY"]
[Sat Jul 18 23:46:31.155523 2026] [security2:error] [pid 943918:tid 944162] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/bless.php"] [unique_id "alxktx70hbVC6Snzbho7CQAAAPY"]
[Sat Jul 18 23:46:31.204320 2026] [security2:error] [pid 943918:tid 944026] [remote 117.0.21.154:44210] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "narv.co"] [uri "/wp-login.php"] [unique_id "alxktx70hbVC6Snzbho7DgAAy2o"], referer: https://narv.co/wp-login.php
[Sat Jul 18 23:46:31.271279 2026] [security2:error] [pid 938041:tid 938196] [client 4.194.24.143:28426] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/public/css.php"] [unique_id "alxktyNrzsYMDd5sB11LmgAAABg"]
[Sat Jul 18 23:46:31.273488 2026] [security2:error] [pid 943918:tid 944103] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkth70hbVC6Snzbho6-gAAu20"]
[Sat Jul 18 23:46:31.341983 2026] [security2:error] [pid 943918:tid 944077] [client 4.194.24.143:34946] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/r.php"] [unique_id "alxktx70hbVC6Snzbho7GAAAAKE"]
[Sat Jul 18 23:46:31.409273 2026] [security2:error] [pid 943918:tid 944104] [client 173.239.196.163:64465] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "alxktx70hbVC6Snzbho7GgAAALw"]
[Sat Jul 18 23:46:31.564978 2026] [security2:error] [pid 943918:tid 944060] [client 45.133.7.91:31593] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 91.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/autoload_classmap.php"] [unique_id "alxktx70hbVC6Snzbho7HgAAAJA"]
[Sat Jul 18 23:46:31.566415 2026] [security2:error] [pid 943918:tid 944049] [client 45.134.20.115:24535] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/admin.php"] [unique_id "alxktx70hbVC6Snzbho7HwAAAIU"]
[Sat Jul 18 23:46:31.597888 2026] [security2:error] [pid 943918:tid 944117] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/file46.php"] [unique_id "alxktx70hbVC6Snzbho7IQAAAMk"]
[Sat Jul 18 23:46:31.598040 2026] [security2:error] [pid 943918:tid 944117] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/file46.php"] [unique_id "alxktx70hbVC6Snzbho7IQAAAMk"]
[Sat Jul 18 23:46:31.822460 2026] [security2:error] [pid 938041:tid 938295] [client 4.194.24.143:34960] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/r.php"] [unique_id "alxktyNrzsYMDd5sB11LowAAAHs"]
[Sat Jul 18 23:46:31.859553 2026] [security2:error] [pid 938041:tid 938210] [client 13.232.206.133:15366] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.206.232.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxktyNrzsYMDd5sB11LpgAAACY"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:46:31.883836 2026] [security2:error] [pid 943918:tid 944059] [client 4.194.24.143:28463] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/radio.php"] [unique_id "alxktx70hbVC6Snzbho7MwAAAI8"]
[Sat Jul 18 23:46:31.890517 2026] [security2:error] [pid 943918:tid 944159] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxktx70hbVC6Snzbho7HQAA80E"]
[Sat Jul 18 23:46:32.245729 2026] [security2:error] [pid 938041:tid 938220] [client 45.133.7.90:29807] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 90.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "alxkuCNrzsYMDd5sB11LrgAAADA"]
[Sat Jul 18 23:46:32.304477 2026] [security2:error] [pid 943918:tid 944153] [client 173.239.196.166:48983] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/adminfusm.php"] [unique_id "alxkuB70hbVC6Snzbho7TQAAAO0"]
[Sat Jul 18 23:46:32.368585 2026] [security2:error] [pid 943918:tid 944088] [client 4.194.24.143:28466] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/radio.php"] [unique_id "alxkuB70hbVC6Snzbho7UwAAAKw"]
[Sat Jul 18 23:46:32.422402 2026] [security2:error] [pid 943918:tid 944165] [client 45.134.20.110:42997] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/tflow/up.php"] [unique_id "alxkuB70hbVC6Snzbho7VwAAAPk"]
[Sat Jul 18 23:46:32.443959 2026] [security2:error] [pid 943918:tid 944122] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkuB70hbVC6Snzbho7QQAAzns"]
[Sat Jul 18 23:46:32.471675 2026] [security2:error] [pid 943918:tid 944138] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/eee.php"] [unique_id "alxkuB70hbVC6Snzbho7XAAAAN4"]
[Sat Jul 18 23:46:32.471802 2026] [security2:error] [pid 943918:tid 944138] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/eee.php"] [unique_id "alxkuB70hbVC6Snzbho7XAAAAN4"]
[Sat Jul 18 23:46:32.479967 2026] [security2:error] [pid 943918:tid 944143] [client 4.194.24.143:30361] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/randkeyword.php7"] [unique_id "alxkuB70hbVC6Snzbho7XQAAAOM"]
[Sat Jul 18 23:46:32.756556 2026] [security2:error] [pid 938041:tid 938077] [remote 113.160.142.119:46160] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tbd.jxc.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxkuCNrzsYMDd5sB11LswAAfSI"]
[Sat Jul 18 23:46:32.756759 2026] [security2:error] [pid 938041:tid 938297] [client 113.160.142.119:46160] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "tbd.jxc.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxkuCNrzsYMDd5sB11LswAAfSI"]
[Sat Jul 18 23:46:32.920425 2026] [security2:error] [pid 938041:tid 938202] [client 4.194.24.143:20646] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/randkeyword.php7"] [unique_id "alxkuCNrzsYMDd5sB11LtgAAAB4"]
[Sat Jul 18 23:46:32.925735 2026] [security2:error] [pid 943918:tid 944173] [client 45.133.7.104:31909] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/acme-challenge/about.php"] [unique_id "alxkuB70hbVC6Snzbho7bwAAAQE"]
[Sat Jul 18 23:46:32.966037 2026] [security2:error] [pid 943918:tid 944133] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkuB70hbVC6Snzbho7YgAA2SM"]
[Sat Jul 18 23:46:33.061366 2026] [security2:error] [pid 938041:tid 938208] [client 4.194.24.143:34944] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/readme.php"] [unique_id "alxkuSNrzsYMDd5sB11LuQAAACQ"]
[Sat Jul 18 23:46:33.188653 2026] [security2:error] [pid 943918:tid 944169] [client 173.239.196.165:46301] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/click.php"] [unique_id "alxkuR70hbVC6Snzbho7fgAAAP0"]
[Sat Jul 18 23:46:33.278692 2026] [security2:error] [pid 938041:tid 938244] [client 45.134.20.138:47969] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 138.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/function.php"] [unique_id "alxkuSNrzsYMDd5sB11LvQAAAEg"]
[Sat Jul 18 23:46:33.318734 2026] [security2:error] [pid 938041:tid 938240] [client 57.141.18.14:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "laceycaraccident.com"] [uri "/index.php"] [unique_id "alxktiNrzsYMDd5sB11LiwAAAEQ"]
[Sat Jul 18 23:46:33.407454 2026] [security2:error] [pid 943918:tid 944060] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/file25.php"] [unique_id "alxkuR70hbVC6Snzbho7iQAAAJA"]
[Sat Jul 18 23:46:33.407583 2026] [security2:error] [pid 943918:tid 944060] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/file25.php"] [unique_id "alxkuR70hbVC6Snzbho7iQAAAJA"]
[Sat Jul 18 23:46:33.469844 2026] [security2:error] [pid 943918:tid 944103] [client 138.226.99.32:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "mollycahill.com"] [uri "/index.php"] [unique_id "alxkuR70hbVC6Snzbho7ewAAALs"]
[Sat Jul 18 23:46:33.481501 2026] [security2:error] [pid 943918:tid 944126] [client 4.194.24.143:34979] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/readme.php"] [unique_id "alxkuR70hbVC6Snzbho7iwAAANI"]
[Sat Jul 18 23:46:33.499967 2026] [security2:error] [pid 943918:tid 944068] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkuR70hbVC6Snzbho7fAAAmA4"]
[Sat Jul 18 23:46:33.604987 2026] [security2:error] [pid 943918:tid 944072] [client 4.194.24.143:20651] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/reze.php"] [unique_id "alxkuR70hbVC6Snzbho7kgAAAJw"]
[Sat Jul 18 23:46:33.606991 2026] [security2:error] [pid 943918:tid 944127] [client 45.133.7.77:61095] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 77.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/twentytwentyfour/system_cache.php"] [unique_id "alxkuR70hbVC6Snzbho7kwAAANM"]
[Sat Jul 18 23:46:34.024108 2026] [security2:error] [pid 943918:tid 944164] [client 4.194.24.143:28439] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/reze.php"] [unique_id "alxkuh70hbVC6Snzbho7qwAAAPg"]
[Sat Jul 18 23:46:34.028052 2026] [security2:error] [pid 943918:tid 943963] [remote 4.205.168.44:38996] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.nvy.ppp.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxkuh70hbVC6Snzbho7rAAAxis"]
[Sat Jul 18 23:46:34.056003 2026] [security2:error] [pid 943918:tid 944073] [client 173.239.196.162:29753] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/template-less.php"] [unique_id "alxkuh70hbVC6Snzbho7sAAAAJ0"]
[Sat Jul 18 23:46:34.142072 2026] [security2:error] [pid 943918:tid 944176] [client 45.134.20.136:31383] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 136.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/templates/beez3/index.php"] [unique_id "alxkuh70hbVC6Snzbho7tAAAAQQ"]
[Sat Jul 18 23:46:34.165897 2026] [security2:error] [pid 943918:tid 944067] [client 4.194.24.143:16821] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/rh.php"] [unique_id "alxkuh70hbVC6Snzbho7tQAAAJc"]
[Sat Jul 18 23:46:34.170972 2026] [security2:error] [pid 943918:tid 944058] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkuR70hbVC6Snzbho7mwAAjhk"]
[Sat Jul 18 23:46:34.208304 2026] [security2:error] [pid 943918:tid 943959] [remote 4.205.168.44:38996] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.nvy.ppp.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxkuh70hbVC6Snzbho7twABACc"], referer: https://mail.nvy.ppp.mybluehost.me/wp-login.php
[Sat Jul 18 23:46:34.287527 2026] [security2:error] [pid 943918:tid 944084] [client 45.133.7.81:51759] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 81.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/sky-pro/js.php"] [unique_id "alxkuh70hbVC6Snzbho7uwAAAKg"]
[Sat Jul 18 23:46:34.619524 2026] [security2:error] [pid 938041:tid 938203] [client 4.194.24.143:16795] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/rh.php"] [unique_id "alxkuiNrzsYMDd5sB11L1QAAAB8"]
[Sat Jul 18 23:46:34.740033 2026] [security2:error] [pid 943918:tid 944109] [client 4.194.24.143:28436] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/rip.php"] [unique_id "alxkuh70hbVC6Snzbho71QAAAME"]
[Sat Jul 18 23:46:34.772873 2026] [security2:error] [pid 943918:tid 944075] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/file48.php"] [unique_id "alxkuh70hbVC6Snzbho71gAAAJ8"]
[Sat Jul 18 23:46:34.773014 2026] [security2:error] [pid 943918:tid 944075] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/file48.php"] [unique_id "alxkuh70hbVC6Snzbho71gAAAJ8"]
[Sat Jul 18 23:46:34.853755 2026] [security2:error] [pid 943918:tid 944134] [client 36.83.95.75:56759] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkuh70hbVC6Snzbho73AAAANo"]
[Sat Jul 18 23:46:34.853863 2026] [security2:error] [pid 943918:tid 944134] [client 36.83.95.75:56759] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkuh70hbVC6Snzbho73AAAANo"]
[Sat Jul 18 23:46:34.955382 2026] [security2:error] [pid 943918:tid 944073] [client 173.239.196.164:54659] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "alxkuh70hbVC6Snzbho75AAAAJ0"]
[Sat Jul 18 23:46:34.965283 2026] [security2:error] [pid 943918:tid 944097] [client 45.133.7.91:24715] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 91.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "alxkuh70hbVC6Snzbho75gAAALU"]
[Sat Jul 18 23:46:35.058167 2026] [security2:error] [pid 943918:tid 944081] [client 45.134.20.122:24635] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "alxkux70hbVC6Snzbho75wAAAKU"]
[Sat Jul 18 23:46:35.075921 2026] [security2:error] [pid 943918:tid 944149] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkuh70hbVC6Snzbho71AAA6SA"]
[Sat Jul 18 23:46:35.206608 2026] [security2:error] [pid 943918:tid 944116] [client 4.194.24.143:23099] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/rip.php"] [unique_id "alxkux70hbVC6Snzbho7-QAAAMg"]
[Sat Jul 18 23:46:35.268265 2026] [security2:error] [pid 943918:tid 944176] [client 103.160.26.178:60618] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkux70hbVC6Snzbho8AAAAAQQ"]
[Sat Jul 18 23:46:35.268394 2026] [security2:error] [pid 943918:tid 944176] [client 103.160.26.178:60618] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkux70hbVC6Snzbho8AAAAAQQ"]
[Sat Jul 18 23:46:35.282593 2026] [security2:error] [pid 938041:tid 938274] [client 4.194.24.143:23088] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/root.php"] [unique_id "alxkuyNrzsYMDd5sB11L3gAAAGY"]
[Sat Jul 18 23:46:35.284184 2026] [security2:error] [pid 938041:tid 938197] [client 74.208.214.194:48476] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxkuyNrzsYMDd5sB11L3wAAABk"]
[Sat Jul 18 23:46:35.321668 2026] [security2:error] [pid 943918:tid 943965] [remote 31.42.184.154:47832] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxkux70hbVC6Snzbho8AgAAhy0"]
[Sat Jul 18 23:46:35.441368 2026] [security2:error] [pid 943918:tid 944168] [client 164.92.212.216:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "falconarrowshop.com"] [uri "/index.php"] [unique_id "alxkux70hbVC6Snzbho7_wAAAPw"]
[Sat Jul 18 23:46:35.450006 2026] [security2:error] [pid 943918:tid 944090] [client 164.92.212.216:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "falconarrowshop.com"] [uri "/index.php"] [unique_id "alxkux70hbVC6Snzbho7_gAAAK4"]
[Sat Jul 18 23:46:35.561176 2026] [security2:error] [pid 943918:tid 944115] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/file6.php"] [unique_id "alxkux70hbVC6Snzbho8CwAAAMc"]
[Sat Jul 18 23:46:35.561278 2026] [security2:error] [pid 943918:tid 944115] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/file6.php"] [unique_id "alxkux70hbVC6Snzbho8CwAAAMc"]
[Sat Jul 18 23:46:35.633663 2026] [security2:error] [pid 943918:tid 943953] [remote 31.42.184.154:47832] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxkux70hbVC6Snzbho8FwAAqyE"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:46:35.646700 2026] [security2:error] [pid 943918:tid 944123] [client 45.133.7.102:28079] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 102.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/pridmag/waf_defender.php"] [unique_id "alxkux70hbVC6Snzbho8GQAAAM8"]
[Sat Jul 18 23:46:35.749170 2026] [security2:error] [pid 943918:tid 944003] [remote 103.90.234.13:47494] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.234.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxkux70hbVC6Snzbho8HwAA9lM"]
[Sat Jul 18 23:46:35.749786 2026] [security2:error] [pid 943918:tid 944075] [client 4.194.24.143:20643] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/root.php"] [unique_id "alxkux70hbVC6Snzbho8IQAAAJ8"]
[Sat Jul 18 23:46:35.803487 2026] [security2:error] [pid 938041:tid 938235] [client 57.141.18.26:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxkuyNrzsYMDd5sB11L4wAAAD8"]
[Sat Jul 18 23:46:35.825456 2026] [security2:error] [pid 943918:tid 944163] [client 4.194.24.143:20665] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/s.php"] [unique_id "alxkux70hbVC6Snzbho8JQAAAPc"]
[Sat Jul 18 23:46:35.849961 2026] [security2:error] [pid 943918:tid 944134] [client 164.92.212.216:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "falconarrowshop.com"] [uri "/index.php"] [unique_id "alxkux70hbVC6Snzbho8FgAAANo"]
[Sat Jul 18 23:46:35.878038 2026] [security2:error] [pid 943918:tid 944084] [client 173.239.196.165:25455] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/abcd.php"] [unique_id "alxkux70hbVC6Snzbho8KQAAAKg"]
[Sat Jul 18 23:46:35.913789 2026] [security2:error] [pid 938041:tid 938175] [client 45.134.20.117:53467] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/install.php"] [unique_id "alxkuyNrzsYMDd5sB11L6gAAAAM"]
[Sat Jul 18 23:46:35.949054 2026] [security2:error] [pid 943918:tid 944176] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/a2.php"] [unique_id "alxkux70hbVC6Snzbho8MQAAAQQ"]
[Sat Jul 18 23:46:35.949148 2026] [security2:error] [pid 943918:tid 944176] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/a2.php"] [unique_id "alxkux70hbVC6Snzbho8MQAAAQQ"]
[Sat Jul 18 23:46:36.290147 2026] [security2:error] [pid 943918:tid 944070] [client 4.194.24.143:34996] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/s.php"] [unique_id "alxkvB70hbVC6Snzbho8QwAAAJo"]
[Sat Jul 18 23:46:36.326553 2026] [security2:error] [pid 938041:tid 938297] [client 107.161.92.6:43688] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "intelligentengineeringsolutions.com"] [uri "/.env"] [unique_id "alxkvCNrzsYMDd5sB11L9gAAAH0"]
[Sat Jul 18 23:46:36.334446 2026] [security2:error] [pid 938041:tid 938199] [client 45.133.7.71:23783] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 71.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/theme.php"] [unique_id "alxkvCNrzsYMDd5sB11L9wAAABs"]
[Sat Jul 18 23:46:36.402903 2026] [security2:error] [pid 943918:tid 944081] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkvB70hbVC6Snzbho8OAAApVo"]
[Sat Jul 18 23:46:36.407908 2026] [security2:error] [pid 943918:tid 944059] [client 4.194.24.143:28416] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/sang.php"] [unique_id "alxkvB70hbVC6Snzbho8RwAAAI8"]
[Sat Jul 18 23:46:36.418832 2026] [security2:error] [pid 938041:tid 938202] [client 107.161.92.6:43688] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "intelligentengineeringsolutions.com"] [uri "/.env.local"] [unique_id "alxkvCNrzsYMDd5sB11L-QAAAB4"]
[Sat Jul 18 23:46:36.469931 2026] [security2:error] [pid 938041:tid 938276] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/file15.php"] [unique_id "alxkvCNrzsYMDd5sB11L_QAAAGg"]
[Sat Jul 18 23:46:36.470014 2026] [security2:error] [pid 938041:tid 938276] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/file15.php"] [unique_id "alxkvCNrzsYMDd5sB11L_QAAAGg"]
[Sat Jul 18 23:46:36.709241 2026] [security2:error] [pid 938041:tid 938237] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvCNrzsYMDd5sB11L_wAAAEE"]
[Sat Jul 18 23:46:36.748587 2026] [security2:error] [pid 943918:tid 944129] [client 173.239.196.165:40719] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/blue/admin-footer.php"] [unique_id "alxkvB70hbVC6Snzbho8WwAAANU"]
[Sat Jul 18 23:46:36.754678 2026] [security2:error] [pid 943918:tid 944063] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvB70hbVC6Snzbho8VwAAAJM"]
[Sat Jul 18 23:46:36.769051 2026] [security2:error] [pid 938041:tid 938294] [client 107.161.92.6:43706] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\.bak|\\\\.bak\\\\.php)$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1260"] [id "390582"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that nclude .bak)"] [severity "CRITICAL"] [hostname "intelligentengineeringsolutions.com"] [uri "/.env.bak"] [unique_id "alxkvCNrzsYMDd5sB11MBQAAAHo"]
[Sat Jul 18 23:46:36.770419 2026] [security2:error] [pid 943918:tid 944160] [client 45.134.20.105:35503] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/blue/rk2.php"] [unique_id "alxkvB70hbVC6Snzbho8XAAAAPQ"]
[Sat Jul 18 23:46:36.848043 2026] [security2:error] [pid 943918:tid 944121] [client 4.194.24.143:23084] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/sang.php"] [unique_id "alxkvB70hbVC6Snzbho8XgAAAM0"]
[Sat Jul 18 23:46:36.866992 2026] [security2:error] [pid 938041:tid 938187] [client 107.161.92.6:43706] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.backup$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1279"] [id "390588"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .backup)"] [severity "CRITICAL"] [hostname "intelligentengineeringsolutions.com"] [uri "/.env.backup"] [unique_id "alxkvCNrzsYMDd5sB11MBgAAAA8"]
[Sat Jul 18 23:46:36.895155 2026] [security2:error] [pid 943918:tid 944092] [client 139.167.225.146:56625] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkvB70hbVC6Snzbho8YgAAALA"]
[Sat Jul 18 23:46:36.895233 2026] [security2:error] [pid 943918:tid 944092] [client 139.167.225.146:56625] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxkvB70hbVC6Snzbho8YgAAALA"]
[Sat Jul 18 23:46:36.964962 2026] [security2:error] [pid 943918:tid 944104] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/jp.php"] [unique_id "alxkvB70hbVC6Snzbho8ZgAAALw"]
[Sat Jul 18 23:46:36.965094 2026] [security2:error] [pid 943918:tid 944104] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/jp.php"] [unique_id "alxkvB70hbVC6Snzbho8ZgAAALw"]
[Sat Jul 18 23:46:36.965368 2026] [security2:error] [pid 943918:tid 944124] [client 4.194.24.143:23070] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/scxy.php"] [unique_id "alxkvB70hbVC6Snzbho8ZwAAANA"]
[Sat Jul 18 23:46:37.015213 2026] [security2:error] [pid 943918:tid 944148] [client 45.133.7.68:41753] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 68.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/twentytwentytwo/waf_defender.php"] [unique_id "alxkvR70hbVC6Snzbho8awAAAOg"]
[Sat Jul 18 23:46:37.118364 2026] [security2:error] [pid 938041:tid 938278] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvSNrzsYMDd5sB11MCwAAAGo"]
[Sat Jul 18 23:46:37.218694 2026] [security2:error] [pid 938041:tid 938264] [client 107.161.92.6:43706] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "intelligentengineeringsolutions.com"] [uri "/.s3cfg"] [unique_id "alxkvSNrzsYMDd5sB11MDgAAAFw"]
[Sat Jul 18 23:46:37.219633 2026] [security2:error] [pid 943918:tid 944127] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvR70hbVC6Snzbho8cgAAANM"]
[Sat Jul 18 23:46:37.343206 2026] [security2:error] [pid 943918:tid 944089] [client 107.161.92.6:43736] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "intelligentengineeringsolutions.com"] [uri "/.boto"] [unique_id "alxkvR70hbVC6Snzbho8fQAAAK0"]
[Sat Jul 18 23:46:37.343305 2026] [security2:error] [pid 943918:tid 944089] [client 107.161.92.6:43736] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "intelligentengineeringsolutions.com"] [uri "/.boto"] [unique_id "alxkvR70hbVC6Snzbho8fQAAAK0"]
[Sat Jul 18 23:46:37.386100 2026] [security2:error] [pid 943918:tid 944065] [client 4.194.24.143:22350] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/scxy.php"] [unique_id "alxkvR70hbVC6Snzbho8fgAAAJU"]
[Sat Jul 18 23:46:37.490225 2026] [security2:error] [pid 938041:tid 938254] [client 107.161.92.6:43754] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "intelligentengineeringsolutions.com"] [uri "/.ssh/id_rsa"] [unique_id "alxkvSNrzsYMDd5sB11MGgAAAFI"]
[Sat Jul 18 23:46:37.515682 2026] [security2:error] [pid 943918:tid 944142] [client 4.194.24.143:23095] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/sd.php"] [unique_id "alxkvR70hbVC6Snzbho8gwAAAOI"]
[Sat Jul 18 23:46:37.535669 2026] [security2:error] [pid 938041:tid 938239] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvSNrzsYMDd5sB11MGAAAAEM"]
[Sat Jul 18 23:46:37.546494 2026] [security2:error] [pid 938041:tid 938274] [client 107.161.92.6:43754] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "intelligentengineeringsolutions.com"] [uri "/.ssh/id_dsa"] [unique_id "alxkvSNrzsYMDd5sB11MHQAAAGY"]
[Sat Jul 18 23:46:37.573157 2026] [security2:error] [pid 943918:tid 944061] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkvR70hbVC6Snzbho8dgAAkWE"]
[Sat Jul 18 23:46:37.576694 2026] [security2:error] [pid 943918:tid 944027] [remote 103.90.234.13:47494] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.234.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxkvR70hbVC6Snzbho8hwAAvWs"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:46:37.597156 2026] [security2:error] [pid 938041:tid 938222] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/f35.php"] [unique_id "alxkvSNrzsYMDd5sB11MIAAAADI"]
[Sat Jul 18 23:46:37.597226 2026] [security2:error] [pid 938041:tid 938222] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/f35.php"] [unique_id "alxkvSNrzsYMDd5sB11MIAAAADI"]
[Sat Jul 18 23:46:37.638868 2026] [security2:error] [pid 938041:tid 938243] [client 45.134.20.136:31729] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 136.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/images/class-config.php"] [unique_id "alxkvSNrzsYMDd5sB11MIgAAAEc"]
[Sat Jul 18 23:46:37.686843 2026] [security2:error] [pid 938041:tid 938247] [client 163.61.1.17:51259] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkvSNrzsYMDd5sB11MIwAAAEs"]
[Sat Jul 18 23:46:37.686951 2026] [security2:error] [pid 938041:tid 938247] [client 163.61.1.17:51259] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkvSNrzsYMDd5sB11MIwAAAEs"]
[Sat Jul 18 23:46:37.704135 2026] [security2:error] [pid 943918:tid 944083] [client 45.133.7.102:49771] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 102.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/coffee/index.php"] [unique_id "alxkvR70hbVC6Snzbho8jQAAAKc"]
[Sat Jul 18 23:46:37.731326 2026] [security2:error] [pid 943918:tid 944114] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvR70hbVC6Snzbho8jAAAAMY"]
[Sat Jul 18 23:46:37.804613 2026] [security2:error] [pid 943918:tid 944108] [client 107.161.92.6:43756] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvR70hbVC6Snzbho8kAAAAMA"]
[Sat Jul 18 23:46:37.849459 2026] [security2:error] [pid 938041:tid 938292] [client 107.161.92.6:43754] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvSNrzsYMDd5sB11MJQAAAHg"]
[Sat Jul 18 23:46:37.928881 2026] [security2:error] [pid 943918:tid 944162] [client 4.194.24.143:34985] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/sd.php"] [unique_id "alxkvR70hbVC6Snzbho8mAAAAPY"]
[Sat Jul 18 23:46:37.932965 2026] [security2:error] [pid 943918:tid 944163] [client 107.161.92.6:43758] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "intelligentengineeringsolutions.com"] [uri "/.github/workflows/deploy.yml"] [unique_id "alxkvR70hbVC6Snzbho8mgAAAPc"]
[Sat Jul 18 23:46:37.977718 2026] [security2:error] [pid 943918:tid 944123] [client 34.172.185.49:4014] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "acaiandcitystreets.com"] [uri "/wp-json/batch/v1"] [unique_id "alxkvR70hbVC6Snzbho8nAAAAM8"]
[Sat Jul 18 23:46:38.045499 2026] [security2:error] [pid 943918:tid 944050] [client 173.239.196.164:30569] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/twentytwentytwo/bypass.php"] [unique_id "alxkvh70hbVC6Snzbho8oQAAAIY"]
[Sat Jul 18 23:46:38.056964 2026] [security2:error] [pid 943918:tid 944156] [client 4.194.24.143:20660] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/sf.php"] [unique_id "alxkvh70hbVC6Snzbho8owAAAPA"]
[Sat Jul 18 23:46:38.120056 2026] [security2:error] [pid 943918:tid 944131] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvh70hbVC6Snzbho8ogAAANc"]
[Sat Jul 18 23:46:38.128389 2026] [security2:error] [pid 943918:tid 944170] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkvR70hbVC6Snzbho8lAAA_nM"]
[Sat Jul 18 23:46:38.146243 2026] [security2:error] [pid 943918:tid 944049] [client 107.161.92.6:43760] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "web.config"] [severity "CRITICAL"] [hostname "intelligentengineeringsolutions.com"] [uri "/web.config"] [unique_id "alxkvh70hbVC6Snzbho8qgAAAIU"]
[Sat Jul 18 23:46:38.160194 2026] [security2:error] [pid 943918:tid 944051] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvh70hbVC6Snzbho8pwAAAIc"]
[Sat Jul 18 23:46:38.211884 2026] [security2:error] [pid 943918:tid 944103] [client 106.222.249.209:26711] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkvh70hbVC6Snzbho8rQAAALs"]
[Sat Jul 18 23:46:38.212099 2026] [security2:error] [pid 943918:tid 944103] [client 106.222.249.209:26711] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkvh70hbVC6Snzbho8rQAAALs"]
[Sat Jul 18 23:46:38.249078 2026] [security2:error] [pid 943918:tid 944060] [client 34.172.185.49:4014] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "acaiandcitystreets.com"] [uri "/"] [unique_id "alxkvh70hbVC6Snzbho8sAAAAJA"]
[Sat Jul 18 23:46:38.327087 2026] [security2:error] [pid 943918:tid 944157] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvh70hbVC6Snzbho8tAAAAPE"]
[Sat Jul 18 23:46:38.340230 2026] [security2:error] [pid 943918:tid 944134] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/wp-load.php"] [unique_id "alxkvh70hbVC6Snzbho8tgAAANo"]
[Sat Jul 18 23:46:38.340339 2026] [security2:error] [pid 943918:tid 944134] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/wp-load.php"] [unique_id "alxkvh70hbVC6Snzbho8tgAAANo"]
[Sat Jul 18 23:46:38.382219 2026] [security2:error] [pid 938041:tid 938265] [client 45.133.7.55:25343] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 55.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/Simple.php"] [unique_id "alxkviNrzsYMDd5sB11MKwAAAF0"]
[Sat Jul 18 23:46:38.422925 2026] [security2:error] [pid 943918:tid 944096] [client 107.161.92.6:43776] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvh70hbVC6Snzbho8uAAAALQ"]
[Sat Jul 18 23:46:38.492026 2026] [security2:error] [pid 938041:tid 938267] [client 45.134.20.104:58255] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/components/com_jea/views/form/tmpl/size.php"] [unique_id "alxkviNrzsYMDd5sB11MMgAAAF8"]
[Sat Jul 18 23:46:38.506075 2026] [security2:error] [pid 943918:tid 944057] [client 107.161.92.6:43780] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 6.92.161.107.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "intelligentengineeringsolutions.com"] [uri "/phpinfo.php"] [unique_id "alxkvh70hbVC6Snzbho8wQAAAI0"]
[Sat Jul 18 23:46:38.519248 2026] [security2:error] [pid 938041:tid 938238] [remote 40.77.167.2:40260] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.thewelloiledlife.com"] [uri "/index.php"] [unique_id "alxkvSNrzsYMDd5sB11MKAAAJmg"]
[Sat Jul 18 23:46:38.526250 2026] [security2:error] [pid 943918:tid 944127] [client 4.194.24.143:34962] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/sf.php"] [unique_id "alxkvh70hbVC6Snzbho8xQAAANM"]
[Sat Jul 18 23:46:38.537091 2026] [security2:error] [pid 938041:tid 938220] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkviNrzsYMDd5sB11MMQAAADA"]
[Sat Jul 18 23:46:38.561036 2026] [security2:error] [pid 943918:tid 944083] [client 107.161.92.6:43788] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 6.92.161.107.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "intelligentengineeringsolutions.com"] [uri "/info.php"] [unique_id "alxkvh70hbVC6Snzbho8zQAAAKc"]
[Sat Jul 18 23:46:38.601326 2026] [security2:error] [pid 943918:tid 944150] [client 107.161.92.6:43760] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "intelligentengineeringsolutions.com"] [uri "/test.php"] [unique_id "alxkvh70hbVC6Snzbho8zgAAAOo"]
[Sat Jul 18 23:46:38.618406 2026] [security2:error] [pid 943918:tid 944090] [client 4.194.24.143:20619] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/shell.php"] [unique_id "alxkvh70hbVC6Snzbho80AAAAK4"]
[Sat Jul 18 23:46:38.698544 2026] [security2:error] [pid 943918:tid 944116] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkvh70hbVC6Snzbho8tQAAyFk"]
[Sat Jul 18 23:46:38.780438 2026] [security2:error] [pid 943918:tid 944123] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvh70hbVC6Snzbho82QAAAM8"]
[Sat Jul 18 23:46:38.829162 2026] [security2:error] [pid 943918:tid 944145] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvh70hbVC6Snzbho83QAAAOU"]
[Sat Jul 18 23:46:38.903187 2026] [security2:error] [pid 943918:tid 944170] [client 107.161.92.6:43810] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvh70hbVC6Snzbho84wAAAP4"]
[Sat Jul 18 23:46:38.909062 2026] [security2:error] [pid 943918:tid 944092] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvh70hbVC6Snzbho84gAAALA"]
[Sat Jul 18 23:46:38.918132 2026] [security2:error] [pid 943918:tid 944068] [client 173.239.196.162:48645] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/elementskit.php"] [unique_id "alxkvh70hbVC6Snzbho85QAAAJg"]
[Sat Jul 18 23:46:38.934220 2026] [security2:error] [pid 938041:tid 938169] [remote 51.195.44.250:55908] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 250.44.195.51.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "christiancountytrumpet.com"] [uri "/wp-login.php"] [unique_id "alxkviNrzsYMDd5sB11MOwAAGn4"]
[Sat Jul 18 23:46:38.948728 2026] [security2:error] [pid 938041:tid 938298] [client 107.161.92.6:43826] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkviNrzsYMDd5sB11MOgAAAH4"]
[Sat Jul 18 23:46:39.006290 2026] [security2:error] [pid 943918:tid 944117] [client 107.161.92.6:43814] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvh70hbVC6Snzbho85wAAAMk"]
[Sat Jul 18 23:46:39.027741 2026] [security2:error] [pid 943918:tid 943926] [remote 20.153.140.50:34184] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxkvx70hbVC6Snzbho87wABAAY"]
[Sat Jul 18 23:46:39.027998 2026] [security2:error] [pid 943918:tid 944172] [client 20.153.140.50:34184] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxkvx70hbVC6Snzbho87wABAAY"]
[Sat Jul 18 23:46:39.062986 2026] [security2:error] [pid 943918:tid 944120] [client 45.133.7.62:36485] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "alxkvx70hbVC6Snzbho88QAAAMw"]
[Sat Jul 18 23:46:39.069132 2026] [security2:error] [pid 938041:tid 938191] [client 4.194.24.143:28438] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/shell.php"] [unique_id "alxkvyNrzsYMDd5sB11MQwAAABM"]
[Sat Jul 18 23:46:39.078487 2026] [security2:error] [pid 938041:tid 938244] [client 107.161.92.6:43840] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvyNrzsYMDd5sB11MPwAAAEg"]
[Sat Jul 18 23:46:39.123589 2026] [security2:error] [pid 943918:tid 944110] [client 107.161.92.6:43850] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvx70hbVC6Snzbho88AAAAMI"]
[Sat Jul 18 23:46:39.143100 2026] [security2:error] [pid 938041:tid 938113] [remote 51.195.44.250:55908] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 250.44.195.51.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "christiancountytrumpet.com"] [uri "/wp-login.php"] [unique_id "alxkvyNrzsYMDd5sB11MRQAAOEY"], referer: https://christiancountytrumpet.com/wp-login.php
[Sat Jul 18 23:46:39.175933 2026] [security2:error] [pid 938041:tid 938275] [client 107.161.92.6:43864] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvyNrzsYMDd5sB11MRAAAAGc"]
[Sat Jul 18 23:46:39.185569 2026] [security2:error] [pid 938041:tid 938188] [client 107.161.92.6:43886] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "intelligentengineeringsolutions.com"] [uri "/config.json"] [unique_id "alxkvyNrzsYMDd5sB11MSAAAABA"]
[Sat Jul 18 23:46:39.185659 2026] [security2:error] [pid 938041:tid 938188] [client 107.161.92.6:43886] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "intelligentengineeringsolutions.com"] [uri "/config.json"] [unique_id "alxkvyNrzsYMDd5sB11MSAAAABA"]
[Sat Jul 18 23:46:39.208969 2026] [security2:error] [pid 938041:tid 938283] [client 107.161.92.6:43870] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvyNrzsYMDd5sB11MRgAAAG8"]
[Sat Jul 18 23:46:39.225453 2026] [security2:error] [pid 938041:tid 938212] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/xwpg.php"] [unique_id "alxkvyNrzsYMDd5sB11MTAAAACg"]
[Sat Jul 18 23:46:39.225590 2026] [security2:error] [pid 938041:tid 938212] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/xwpg.php"] [unique_id "alxkvyNrzsYMDd5sB11MTAAAACg"]
[Sat Jul 18 23:46:39.266823 2026] [security2:error] [pid 943918:tid 944127] [client 107.161.92.6:43900] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "intelligentengineeringsolutions.com"] [uri "/secrets.json"] [unique_id "alxkvx70hbVC6Snzbho8-wAAANM"]
[Sat Jul 18 23:46:39.266897 2026] [security2:error] [pid 943918:tid 944127] [client 107.161.92.6:43900] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "intelligentengineeringsolutions.com"] [uri "/secrets.json"] [unique_id "alxkvx70hbVC6Snzbho8-wAAANM"]
[Sat Jul 18 23:46:39.302490 2026] [security2:error] [pid 943918:tid 944159] [client 107.161.92.6:43894] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvx70hbVC6Snzbho8-AAAAPM"]
[Sat Jul 18 23:46:39.323694 2026] [security2:error] [pid 943918:tid 944101] [client 107.161.92.6:43906] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "intelligentengineeringsolutions.com"] [uri "/actuator/env"] [unique_id "alxkvx70hbVC6Snzbho8_gAAALk"]
[Sat Jul 18 23:46:39.349661 2026] [security2:error] [pid 938041:tid 938187] [client 4.194.24.143:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "lutheranphilosopher.com"] [uri "/index.php"] [unique_id "alxkvyNrzsYMDd5sB11MSgAAAA8"]
[Sat Jul 18 23:46:39.366715 2026] [security2:error] [pid 943918:tid 944169] [client 45.134.20.128:36885] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/templates/beez/index.php"] [unique_id "alxkvx70hbVC6Snzbho9AQAAAP0"]
[Sat Jul 18 23:46:39.385847 2026] [security2:error] [pid 943918:tid 944064] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkvh70hbVC6Snzbho85gAAlFc"]
[Sat Jul 18 23:46:39.414711 2026] [security2:error] [pid 943918:tid 944098] [client 185.92.25.82:21451] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/ms-themes.php"] [unique_id "alxkvx70hbVC6Snzbho9CgAAALY"]
[Sat Jul 18 23:46:39.436898 2026] [security2:error] [pid 943918:tid 944077] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvx70hbVC6Snzbho9BQAAAKE"]
[Sat Jul 18 23:46:39.439929 2026] [security2:error] [pid 943918:tid 944174] [client 185.192.71.224:53011] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/ms-themes.php"] [unique_id "alxkvx70hbVC6Snzbho9EAAAAQI"]
[Sat Jul 18 23:46:39.443656 2026] [security2:error] [pid 943918:tid 944072] [client 91.230.225.152:49935] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/ms-themes.php"] [unique_id "alxkvx70hbVC6Snzbho9EgAAAJw"]
[Sat Jul 18 23:46:39.444114 2026] [security2:error] [pid 943918:tid 944099] [client 91.230.225.164:20003] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/ms-themes.php"] [unique_id "alxkvx70hbVC6Snzbho9EwAAALc"]
[Sat Jul 18 23:46:39.444389 2026] [security2:error] [pid 938041:tid 938269] [client 91.230.225.152:53787] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/ms-themes.php"] [unique_id "alxkvyNrzsYMDd5sB11MUgAAAGE"]
[Sat Jul 18 23:46:39.446575 2026] [security2:error] [pid 938041:tid 938219] [client 91.230.225.157:35569] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/ms-themes.php"] [unique_id "alxkvyNrzsYMDd5sB11MUwAAAC8"]
[Sat Jul 18 23:46:39.446655 2026] [security2:error] [pid 938041:tid 938224] [client 91.230.225.151:29923] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/ms-themes.php"] [unique_id "alxkvyNrzsYMDd5sB11MVAAAADQ"]
[Sat Jul 18 23:46:39.447342 2026] [security2:error] [pid 943918:tid 944133] [client 91.230.225.156:65347] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/ms-themes.php"] [unique_id "alxkvx70hbVC6Snzbho9FAAAANk"]
[Sat Jul 18 23:46:39.470271 2026] [security2:error] [pid 943918:tid 944091] [client 16.145.89.170:34806] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 170.89.145.16.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxkvx70hbVC6Snzbho9GAAAAK8"]
[Sat Jul 18 23:46:39.472881 2026] [security2:error] [pid 943918:tid 944148] [client 107.161.92.6:43938] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "intelligentengineeringsolutions.com"] [uri "/health"] [unique_id "alxkvx70hbVC6Snzbho9GQAAAOg"]
[Sat Jul 18 23:46:39.472945 2026] [security2:error] [pid 943918:tid 944148] [client 107.161.92.6:43938] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "intelligentengineeringsolutions.com"] [uri "/health"] [unique_id "alxkvx70hbVC6Snzbho9GQAAAOg"]
[Sat Jul 18 23:46:39.532398 2026] [security2:error] [pid 943918:tid 944143] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvx70hbVC6Snzbho9FgAAAOM"]
[Sat Jul 18 23:46:39.533140 2026] [security2:error] [pid 943918:tid 944049] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvx70hbVC6Snzbho9FQAAAIU"]
[Sat Jul 18 23:46:39.590379 2026] [security2:error] [pid 943918:tid 944176] [client 107.161.92.6:43908] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvx70hbVC6Snzbho9HAAAAQQ"]
[Sat Jul 18 23:46:39.617566 2026] [security2:error] [pid 938041:tid 938254] [client 107.161.92.6:43928] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvyNrzsYMDd5sB11MWAAAAFI"]
[Sat Jul 18 23:46:39.720511 2026] [security2:error] [pid 943918:tid 944126] [client 4.194.24.143:34982] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/sid3.php"] [unique_id "alxkvx70hbVC6Snzbho9JwAAANI"]
[Sat Jul 18 23:46:39.721847 2026] [security2:error] [pid 943918:tid 944070] [client 185.192.71.217:26199] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/chosen.php"] [unique_id "alxkvx70hbVC6Snzbho9KAAAAJo"]
[Sat Jul 18 23:46:39.736476 2026] [security2:error] [pid 943918:tid 944157] [client 185.192.71.223:23517] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/chosen.php"] [unique_id "alxkvx70hbVC6Snzbho9KQAAAPE"]
[Sat Jul 18 23:46:39.738228 2026] [security2:error] [pid 943918:tid 944164] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvx70hbVC6Snzbho9JQAAAPg"]
[Sat Jul 18 23:46:39.741468 2026] [security2:error] [pid 943918:tid 944120] [client 91.230.225.153:49253] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/chosen.php"] [unique_id "alxkvx70hbVC6Snzbho9KgAAAMw"]
[Sat Jul 18 23:46:39.744888 2026] [security2:error] [pid 943918:tid 944122] [client 185.192.71.210:42893] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/chosen.php"] [unique_id "alxkvx70hbVC6Snzbho9KwAAAM4"]
[Sat Jul 18 23:46:39.745982 2026] [security2:error] [pid 938041:tid 938252] [client 185.192.71.223:31813] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/chosen.php"] [unique_id "alxkvyNrzsYMDd5sB11MYAAAAFA"]
[Sat Jul 18 23:46:39.751378 2026] [security2:error] [pid 938041:tid 938190] [client 185.92.25.86:28397] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/chosen.php"] [unique_id "alxkvyNrzsYMDd5sB11MYQAAABI"]
[Sat Jul 18 23:46:39.753675 2026] [security2:error] [pid 938041:tid 938214] [client 45.133.7.95:27523] ModSecurity: Warning. Pattern match "/1\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1543"] [id "900921"] [msg "temporary TUW-72162 logging rule"] [hostname "nikkidesigns.net"] [uri "/wp-admin/1.php"] [unique_id "alxkvyNrzsYMDd5sB11MYgAAACo"]
[Sat Jul 18 23:46:39.753806 2026] [security2:error] [pid 938041:tid 938214] [client 45.133.7.95:27523] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/1.php"] [unique_id "alxkvyNrzsYMDd5sB11MYgAAACo"]
[Sat Jul 18 23:46:39.806552 2026] [security2:error] [pid 943918:tid 943960] [remote 113.160.142.119:46168] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "worbals.com"] [uri "/wp-login.php"] [unique_id "alxkvx70hbVC6Snzbho9NQAAmyg"]
[Sat Jul 18 23:46:39.822426 2026] [security2:error] [pid 943918:tid 944052] [client 173.239.196.164:25635] ModSecurity: Warning. Pattern match "/1\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1543"] [id "900921"] [msg "temporary TUW-72162 logging rule"] [hostname "sixpackminer.org"] [uri "/js/1.php7"] [unique_id "alxkvx70hbVC6Snzbho9NwAAAIg"]
[Sat Jul 18 23:46:39.822541 2026] [security2:error] [pid 943918:tid 944052] [client 173.239.196.164:25635] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/js/1.php7"] [unique_id "alxkvx70hbVC6Snzbho9NwAAAIg"]
[Sat Jul 18 23:46:39.869023 2026] [security2:error] [pid 943918:tid 944171] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvx70hbVC6Snzbho9MwAAAP8"]
[Sat Jul 18 23:46:39.870901 2026] [security2:error] [pid 943918:tid 944123] [client 4.194.24.143:28460] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "nurturemarple.co.uk"] [uri "/index.php"] [unique_id "alxkvx70hbVC6Snzbho9IgAAAM8"]
[Sat Jul 18 23:46:39.896109 2026] [security2:error] [pid 938041:tid 938184] [client 180.252.198.240:52243] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkvyNrzsYMDd5sB11MaAAAAAw"]
[Sat Jul 18 23:46:39.896187 2026] [security2:error] [pid 943918:tid 944125] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.awellpacedlife.com"] [uri "/index.cgi"] [unique_id "alxkvx70hbVC6Snzbho9OQAAANE"]
[Sat Jul 18 23:46:39.896244 2026] [security2:error] [pid 938041:tid 938184] [client 180.252.198.240:52243] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkvyNrzsYMDd5sB11MaAAAAAw"]
[Sat Jul 18 23:46:39.991181 2026] [security2:error] [pid 943918:tid 944056] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkvx70hbVC6Snzbho9LgAAjA4"]
[Sat Jul 18 23:46:39.991453 2026] [security2:error] [pid 943918:tid 943932] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "recruitinginsight.us"] [uri "/.aws/credentials"] [unique_id "alxkvx70hbVC6Snzbho9RQAAjAw"]
[Sat Jul 18 23:46:39.991589 2026] [security2:error] [pid 943918:tid 944056] [client 34.35.112.28:55064] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "recruitinginsight.us"] [uri "/.aws/credentials"] [unique_id "alxkvx70hbVC6Snzbho9RQAAjAw"]
[Sat Jul 18 23:46:40.008322 2026] [security2:error] [pid 943918:tid 944058] [client 91.230.225.162:39973] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/file.php"] [unique_id "alxkwB70hbVC6Snzbho9SgAAAI4"]
[Sat Jul 18 23:46:40.015031 2026] [security2:error] [pid 943918:tid 944161] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkvx70hbVC6Snzbho9IAAA9WM"]
[Sat Jul 18 23:46:40.017733 2026] [security2:error] [pid 943918:tid 944063] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkvx70hbVC6Snzbho9QgAAAJM"]
[Sat Jul 18 23:46:40.020660 2026] [security2:error] [pid 938041:tid 938262] [client 185.92.25.92:50859] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/file.php"] [unique_id "alxkwCNrzsYMDd5sB11MbAAAAFo"]
[Sat Jul 18 23:46:40.022322 2026] [security2:error] [pid 943918:tid 944056] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkvx70hbVC6Snzbho9LQAAjB4"]
[Sat Jul 18 23:46:40.047482 2026] [security2:error] [pid 938041:tid 938183] [client 185.192.71.213:58285] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/file.php"] [unique_id "alxkwCNrzsYMDd5sB11MbQAAAAs"]
[Sat Jul 18 23:46:40.051498 2026] [security2:error] [pid 943918:tid 944059] [client 185.192.71.220:37317] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/file.php"] [unique_id "alxkwB70hbVC6Snzbho9TgAAAI8"]
[Sat Jul 18 23:46:40.054511 2026] [security2:error] [pid 943918:tid 944104] [client 91.230.225.161:28185] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/file.php"] [unique_id "alxkwB70hbVC6Snzbho9TwAAALw"]
[Sat Jul 18 23:46:40.055086 2026] [security2:error] [pid 943918:tid 944141] [client 4.194.24.143:28460] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/sid3.php"] [unique_id "alxkwB70hbVC6Snzbho9UAAAAOE"]
[Sat Jul 18 23:46:40.078344 2026] [security2:error] [pid 943918:tid 943971] [remote 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkvx70hbVC6Snzbho9MgAAjDM"]
[Sat Jul 18 23:46:40.089695 2026] [security2:error] [pid 943918:tid 944056] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkvx70hbVC6Snzbho9MAAAjHo"]
[Sat Jul 18 23:46:40.128041 2026] [security2:error] [pid 938041:tid 938238] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkwCNrzsYMDd5sB11MbgAAAEI"]
[Sat Jul 18 23:46:40.130853 2026] [security2:error] [pid 943918:tid 944056] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkvx70hbVC6Snzbho9PgAAjEY"]
[Sat Jul 18 23:46:40.149292 2026] [security2:error] [pid 943918:tid 944163] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.awellpacedlife.com"] [uri "/index.cgi"] [unique_id "alxkwB70hbVC6Snzbho9UwAAAPc"]
[Sat Jul 18 23:46:40.216446 2026] [security2:error] [pid 943918:tid 944056] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkvx70hbVC6Snzbho9RwAAjBw"]
[Sat Jul 18 23:46:40.221521 2026] [security2:error] [pid 938041:tid 938177] [client 45.134.20.112:64045] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 112.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/bypass.php"] [unique_id "alxkwCNrzsYMDd5sB11MdgAAAAU"]
[Sat Jul 18 23:46:40.236198 2026] [security2:error] [pid 938041:tid 938297] [client 107.161.92.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxkwCNrzsYMDd5sB11MdQAAAH0"]
[Sat Jul 18 23:46:40.261446 2026] [security2:error] [pid 938041:tid 938220] [client 4.194.24.143:30338] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/simple.php"] [unique_id "alxkwCNrzsYMDd5sB11MdwAAADA"]
[Sat Jul 18 23:46:40.307711 2026] [security2:error] [pid 943918:tid 943922] [remote 113.160.142.119:46168] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "worbals.com"] [uri "/wp-login.php"] [unique_id "alxkwB70hbVC6Snzbho9WAAArwI"], referer: https://worbals.com/wp-login.php
[Sat Jul 18 23:46:40.319348 2026] [security2:error] [pid 943918:tid 944102] [client 185.92.25.135:65205] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/flower.php"] [unique_id "alxkwB70hbVC6Snzbho9WQAAALo"]
[Sat Jul 18 23:46:40.324500 2026] [security2:error] [pid 938041:tid 938198] [client 91.230.225.152:23181] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/flower.php"] [unique_id "alxkwCNrzsYMDd5sB11MeAAAABo"]
[Sat Jul 18 23:46:40.355794 2026] [security2:error] [pid 943918:tid 944049] [client 185.92.25.93:55049] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/flower.php"] [unique_id "alxkwB70hbVC6Snzbho9YAAAAIU"]
[Sat Jul 18 23:46:40.362502 2026] [security2:error] [pid 943918:tid 944137] [client 91.230.225.158:34843] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/flower.php"] [unique_id "alxkwB70hbVC6Snzbho9YgAAAN0"]
[Sat Jul 18 23:46:40.366515 2026] [security2:error] [pid 943918:tid 944068] [client 185.192.71.211:38093] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/flower.php"] [unique_id "alxkwB70hbVC6Snzbho9ZAAAAJg"]
[Sat Jul 18 23:46:40.383980 2026] [security2:error] [pid 938041:tid 938080] [remote 157.66.47.83:43154] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "petpawo.com"] [uri "/wp-login.php"] [unique_id "alxkwCNrzsYMDd5sB11MewAAISU"]
[Sat Jul 18 23:46:40.439104 2026] [security2:error] [pid 943918:tid 944103] [client 45.133.7.59:41107] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 59.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "alxkwB70hbVC6Snzbho9aAAAALs"]
[Sat Jul 18 23:46:40.560606 2026] [security2:error] [pid 943918:tid 944172] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/waf.php"] [unique_id "alxkwB70hbVC6Snzbho9bwAAAQA"]
[Sat Jul 18 23:46:40.560710 2026] [security2:error] [pid 943918:tid 944172] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/waf.php"] [unique_id "alxkwB70hbVC6Snzbho9bwAAAQA"]
[Sat Jul 18 23:46:40.561544 2026] [security2:error] [pid 943918:tid 944056] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkvx70hbVC6Snzbho9RgAAjA4"]
[Sat Jul 18 23:46:40.561671 2026] [security2:error] [pid 943918:tid 944056] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkvx70hbVC6Snzbho9SAAAjAw"]
[Sat Jul 18 23:46:40.561767 2026] [security2:error] [pid 943918:tid 944056] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkvx70hbVC6Snzbho9SQAAjBE"]
[Sat Jul 18 23:46:40.561844 2026] [security2:error] [pid 943918:tid 944056] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkwB70hbVC6Snzbho9SwAAjBg"]
[Sat Jul 18 23:46:40.597008 2026] [security2:error] [pid 943918:tid 944085] [client 4.194.24.143:23064] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/simple.php"] [unique_id "alxkwB70hbVC6Snzbho9dAAAAKk"]
[Sat Jul 18 23:46:40.624293 2026] [security2:error] [pid 943918:tid 944157] [client 91.230.225.162:37957] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/gifclass.php"] [unique_id "alxkwB70hbVC6Snzbho9dgAAAPE"]
[Sat Jul 18 23:46:40.644768 2026] [security2:error] [pid 943918:tid 944076] [client 91.230.225.153:22659] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/gifclass.php"] [unique_id "alxkwB70hbVC6Snzbho9eQAAAKA"]
[Sat Jul 18 23:46:40.647129 2026] [security2:error] [pid 943918:tid 944120] [client 185.192.71.209:63985] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/gifclass.php"] [unique_id "alxkwB70hbVC6Snzbho9egAAAMw"]
[Sat Jul 18 23:46:40.664981 2026] [security2:error] [pid 938041:tid 938275] [client 173.239.196.164:30515] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 164.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes/twentytwentyfour/install.php"] [unique_id "alxkwCNrzsYMDd5sB11MgQAAAGc"]
[Sat Jul 18 23:46:40.761792 2026] [security2:error] [pid 943918:tid 944152] [client 185.92.25.82:41819] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/chosen.php"] [unique_id "alxkwB70hbVC6Snzbho9fwAAAOw"]
[Sat Jul 18 23:46:40.771040 2026] [security2:error] [pid 943918:tid 944160] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkwB70hbVC6Snzbho9ZwAA9D4"]
[Sat Jul 18 23:46:40.781545 2026] [security2:error] [pid 938041:tid 938128] [remote 157.66.47.83:43154] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "petpawo.com"] [uri "/wp-login.php"] [unique_id "alxkwCNrzsYMDd5sB11MhgAABlU"], referer: https://petpawo.com/wp-login.php
[Sat Jul 18 23:46:40.804156 2026] [security2:error] [pid 938041:tid 938225] [client 4.194.24.143:28431] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/sitemap.php"] [unique_id "alxkwCNrzsYMDd5sB11MiAAAADU"]
[Sat Jul 18 23:46:40.810449 2026] [security2:error] [pid 943918:tid 943962] [remote 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkwB70hbVC6Snzbho9cgAAjCo"]
[Sat Jul 18 23:46:40.916172 2026] [security2:error] [pid 943918:tid 944096] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/xstelth.php"] [unique_id "alxkwB70hbVC6Snzbho9iQAAALQ"]
[Sat Jul 18 23:46:40.916257 2026] [security2:error] [pid 943918:tid 944096] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/xstelth.php"] [unique_id "alxkwB70hbVC6Snzbho9iQAAALQ"]
[Sat Jul 18 23:46:40.927152 2026] [security2:error] [pid 943918:tid 944064] [client 185.92.25.90:58027] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/chosen.php"] [unique_id "alxkwB70hbVC6Snzbho9igAAAJQ"]
[Sat Jul 18 23:46:40.957362 2026] [security2:error] [pid 943918:tid 944136] [client 185.92.25.84:48357] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/bless.php"] [unique_id "alxkwB70hbVC6Snzbho9jQAAANw"]
[Sat Jul 18 23:46:40.977762 2026] [security2:error] [pid 938041:tid 938272] [client 91.230.225.164:62281] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/bless.php"] [unique_id "alxkwCNrzsYMDd5sB11MiQAAAGQ"]
[Sat Jul 18 23:46:41.012246 2026] [security2:error] [pid 943918:tid 944056] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkwB70hbVC6Snzbho9gAAAjB8"]
[Sat Jul 18 23:46:41.044787 2026] [security2:error] [pid 943918:tid 944148] [client 185.192.71.220:64747] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/file.php"] [unique_id "alxkwR70hbVC6Snzbho9ngAAAOg"]
[Sat Jul 18 23:46:41.049362 2026] [security2:error] [pid 943918:tid 944155] [client 185.92.25.88:51417] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/file.php"] [unique_id "alxkwR70hbVC6Snzbho9nwAAAO8"]
[Sat Jul 18 23:46:41.100949 2026] [security2:error] [pid 943918:tid 944095] [client 45.134.20.138:63283] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 138.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/class.php"] [unique_id "alxkwR70hbVC6Snzbho9oQAAALM"]
[Sat Jul 18 23:46:41.138768 2026] [security2:error] [pid 943918:tid 944111] [client 4.194.24.143:30346] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/sitemap.php"] [unique_id "alxkwR70hbVC6Snzbho9owAAAMM"]
[Sat Jul 18 23:46:41.142356 2026] [security2:error] [pid 943918:tid 944068] [client 45.133.7.89:25777] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 89.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/wp-conflg.php"] [unique_id "alxkwR70hbVC6Snzbho9pAAAAJg"]
[Sat Jul 18 23:46:41.148886 2026] [security2:error] [pid 943918:tid 944056] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkwB70hbVC6Snzbho9hQAAjFA"]
[Sat Jul 18 23:46:41.251093 2026] [security2:error] [pid 943918:tid 944172] [client 91.230.225.158:44747] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/class-t.api.php"] [unique_id "alxkwR70hbVC6Snzbho9pgAAAQA"]
[Sat Jul 18 23:46:41.253452 2026] [security2:error] [pid 943918:tid 943975] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 28.112.35.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "recruitinginsight.us"] [uri "/wp-login.php"] [unique_id "alxkwR70hbVC6Snzbho9pQAA1jc"], referer: https://recruitinginsight.us/login
[Sat Jul 18 23:46:41.261891 2026] [security2:error] [pid 943918:tid 944134] [client 185.192.71.211:49415] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/class-t.api.php"] [unique_id "alxkwR70hbVC6Snzbho9pwAAANo"]
[Sat Jul 18 23:46:41.321811 2026] [security2:error] [pid 938041:tid 938286] [client 185.192.71.223:62939] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/flower.php"] [unique_id "alxkwSNrzsYMDd5sB11MkgAAAHI"]
[Sat Jul 18 23:46:41.328911 2026] [security2:error] [pid 938041:tid 938179] [client 185.192.71.206:38483] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/flower.php"] [unique_id "alxkwSNrzsYMDd5sB11MlAAAAAc"]
[Sat Jul 18 23:46:41.364864 2026] [security2:error] [pid 943918:tid 944055] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkwR70hbVC6Snzbho9mgAAizs"]
[Sat Jul 18 23:46:41.402819 2026] [security2:error] [pid 943918:tid 944117] [client 4.194.24.143:28467] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/size.php"] [unique_id "alxkwR70hbVC6Snzbho9rgAAAMk"]
[Sat Jul 18 23:46:41.515755 2026] [security2:error] [pid 943918:tid 944119] [client 173.239.196.160:23931] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/assets/min.php"] [unique_id "alxkwR70hbVC6Snzbho9sgAAAMs"]
[Sat Jul 18 23:46:41.533422 2026] [security2:error] [pid 938041:tid 938289] [client 185.92.25.85:61985] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/blurbs.php"] [unique_id "alxkwSNrzsYMDd5sB11MmAAAAHU"]
[Sat Jul 18 23:46:41.582402 2026] [security2:error] [pid 943918:tid 944170] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkwR70hbVC6Snzbho9qgAA_jU"]
[Sat Jul 18 23:46:41.607020 2026] [security2:error] [pid 943918:tid 944062] [client 185.92.25.91:65199] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/gifclass.php"] [unique_id "alxkwR70hbVC6Snzbho9twAAAJI"]
[Sat Jul 18 23:46:41.616492 2026] [security2:error] [pid 943918:tid 944132] [client 185.192.71.207:50431] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/gifclass.php"] [unique_id "alxkwR70hbVC6Snzbho9uAAAANg"]
[Sat Jul 18 23:46:41.628215 2026] [security2:error] [pid 943918:tid 944053] [client 185.92.25.91:55115] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/gifclass.php"] [unique_id "alxkwR70hbVC6Snzbho9uQAAAIk"]
[Sat Jul 18 23:46:41.681056 2026] [security2:error] [pid 943918:tid 944109] [client 4.194.24.143:16794] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/size.php"] [unique_id "alxkwR70hbVC6Snzbho9vQAAAME"]
[Sat Jul 18 23:46:41.768396 2026] [security2:error] [pid 943918:tid 944041] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "recruitinginsight.us"] [uri "/graphql"] [unique_id "alxkwR70hbVC6Snzbho9xgAA3Hk"]
[Sat Jul 18 23:46:41.770191 2026] [security2:error] [pid 943918:tid 943989] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\.bak|\\\\.bak\\\\.php)$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1260"] [id "390582"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that nclude .bak)"] [severity "CRITICAL"] [hostname "recruitinginsight.us"] [uri "/.env.bak"] [unique_id "alxkwR70hbVC6Snzbho9xwAA3EU"]
[Sat Jul 18 23:46:41.788558 2026] [security2:error] [pid 943918:tid 944004] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.old$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1263"] [id "390583"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .old)"] [severity "CRITICAL"] [hostname "recruitinginsight.us"] [uri "/.env.old"] [unique_id "alxkwR70hbVC6Snzbho9yQAA3FQ"]
[Sat Jul 18 23:46:41.815556 2026] [security2:error] [pid 938041:tid 938282] [client 185.192.71.214:39421] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/gifclass.php"] [unique_id "alxkwSNrzsYMDd5sB11MngAAAG4"]
[Sat Jul 18 23:46:41.817259 2026] [security2:error] [pid 938041:tid 938204] [client 91.230.225.161:20719] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/akcc.php"] [unique_id "alxkwSNrzsYMDd5sB11MnwAAACA"]
[Sat Jul 18 23:46:41.822569 2026] [security2:error] [pid 943918:tid 944098] [client 45.133.7.84:65419] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 84.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/classwithtostring.php"] [unique_id "alxkwR70hbVC6Snzbho9ygAAALY"]
[Sat Jul 18 23:46:41.827045 2026] [security2:error] [pid 943918:tid 944077] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/wp-links.php"] [unique_id "alxkwR70hbVC6Snzbho9ywAAAKE"]
[Sat Jul 18 23:46:41.827156 2026] [security2:error] [pid 943918:tid 944077] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/wp-links.php"] [unique_id "alxkwR70hbVC6Snzbho9ywAAAKE"]
[Sat Jul 18 23:46:41.884021 2026] [security2:error] [pid 938041:tid 938189] [client 185.192.71.213:29363] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/bless.php"] [unique_id "alxkwSNrzsYMDd5sB11MoQAAABE"]
[Sat Jul 18 23:46:41.907043 2026] [security2:error] [pid 943918:tid 944138] [client 91.230.225.151:35977] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/bless.php"] [unique_id "alxkwR70hbVC6Snzbho9zwAAAN4"]
[Sat Jul 18 23:46:41.912892 2026] [security2:error] [pid 943918:tid 944101] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkwR70hbVC6Snzbho9tgAAuSI"]
[Sat Jul 18 23:46:41.920741 2026] [security2:error] [pid 943918:tid 944135] [client 185.92.25.91:57165] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/bless.php"] [unique_id "alxkwR70hbVC6Snzbho90QAAANs"]
[Sat Jul 18 23:46:41.921224 2026] [security2:error] [pid 938041:tid 938195] [client 185.192.71.212:21515] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/bless.php"] [unique_id "alxkwSNrzsYMDd5sB11MogAAABc"]
[Sat Jul 18 23:46:41.944267 2026] [security2:error] [pid 943918:tid 944161] [client 4.194.24.143:20627] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/sm.php"] [unique_id "alxkwR70hbVC6Snzbho90wAAAPU"]
[Sat Jul 18 23:46:41.955198 2026] [security2:error] [pid 943918:tid 944106] [client 45.134.20.134:34985] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 134.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/light/profile.php"] [unique_id "alxkwR70hbVC6Snzbho91QAAAL4"]
[Sat Jul 18 23:46:41.987680 2026] [security2:error] [pid 943918:tid 944136] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkwR70hbVC6Snzbho9wwAA3Dg"]
[Sat Jul 18 23:46:42.023506 2026] [security2:error] [pid 943918:tid 944136] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkwR70hbVC6Snzbho9xQAA3D0"]
[Sat Jul 18 23:46:42.094864 2026] [security2:error] [pid 943918:tid 944094] [client 185.192.71.225:35637] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/bless.php"] [unique_id "alxkwh70hbVC6Snzbho93gAAALI"]
[Sat Jul 18 23:46:42.097814 2026] [security2:error] [pid 943918:tid 943986] [remote 148.113.130.141:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "Mozilla\\\\/5\\\\.0 \\\\(compatible; AhrefsBot\\\\/\\\\d\\\\.\\\\d; \\\\+http:\\\\/\\\\/ahrefs\\\\.com\\\\/robot\\\\/\\\\)" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "578"] [id "900165"] [msg "AhrefsBot BOT Request"] [hostname "fairwaysonmainteetimes.com"] [uri "/author-sitemap.xml"] [unique_id "alxkwh70hbVC6Snzbho93wABBEI"]
[Sat Jul 18 23:46:42.097999 2026] [security2:error] [pid 943918:tid 944176] [client 148.113.130.141:0] ModSecurity: Warning. Matched phrase "AhrefsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "fairwaysonmainteetimes.com"] [uri "/author-sitemap.xml"] [unique_id "alxkwh70hbVC6Snzbho93wABBEI"]
[Sat Jul 18 23:46:42.106309 2026] [security2:error] [pid 938041:tid 938235] [client 91.230.225.155:57071] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/abcd.php"] [unique_id "alxkwiNrzsYMDd5sB11MowAAAD8"]
[Sat Jul 18 23:46:42.152539 2026] [security2:error] [pid 943918:tid 943974] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "recruitinginsight.us"] [uri "/.env"] [unique_id "alxkwh70hbVC6Snzbho95gAAoDY"]
[Sat Jul 18 23:46:42.162472 2026] [security2:error] [pid 943918:tid 944157] [client 185.92.25.134:55709] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/class-t.api.php"] [unique_id "alxkwh70hbVC6Snzbho95wAAAPE"]
[Sat Jul 18 23:46:42.183605 2026] [security2:error] [pid 943918:tid 944036] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.backup$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1279"] [id "390588"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .backup)"] [severity "CRITICAL"] [hostname "recruitinginsight.us"] [uri "/.env.backup"] [unique_id "alxkwh70hbVC6Snzbho96gAA7XQ"]
[Sat Jul 18 23:46:42.189512 2026] [security2:error] [pid 943918:tid 943980] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "recruitinginsight.us"] [uri "/backend/.env"] [unique_id "alxkwh70hbVC6Snzbho97QAA7Tw"]
[Sat Jul 18 23:46:42.189514 2026] [security2:error] [pid 943918:tid 944025] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "recruitinginsight.us"] [uri "/api/.env"] [unique_id "alxkwh70hbVC6Snzbho97AAA7Wk"]
[Sat Jul 18 23:46:42.190552 2026] [security2:error] [pid 943918:tid 944034] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "recruitinginsight.us"] [uri "/config/.env"] [unique_id "alxkwh70hbVC6Snzbho98AAA7XI"]
[Sat Jul 18 23:46:42.191648 2026] [security2:error] [pid 943918:tid 944174] [client 185.192.71.217:49477] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/class-t.api.php"] [unique_id "alxkwh70hbVC6Snzbho98gAAAQI"]
[Sat Jul 18 23:46:42.214716 2026] [security2:error] [pid 938041:tid 938285] [client 185.92.25.79:25087] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/class-t.api.php"] [unique_id "alxkwiNrzsYMDd5sB11MpgAAAHE"]
[Sat Jul 18 23:46:42.221098 2026] [security2:error] [pid 943918:tid 944065] [client 91.230.225.161:52091] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/class-t.api.php"] [unique_id "alxkwh70hbVC6Snzbho99wAAAJU"]
[Sat Jul 18 23:46:42.222018 2026] [security2:error] [pid 943918:tid 944111] [client 4.194.24.143:23086] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/sm.php"] [unique_id "alxkwh70hbVC6Snzbho9-QAAAMM"]
[Sat Jul 18 23:46:42.231518 2026] [security2:error] [pid 943918:tid 944026] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "recruitinginsight.us"] [uri "/api/graphql"] [unique_id "alxkwh70hbVC6Snzbho9-gAA7Wo"]
[Sat Jul 18 23:46:42.232960 2026] [security2:error] [pid 943918:tid 944165] [client 18.193.106.195:39874] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 195.106.193.18.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxkwh70hbVC6Snzbho9-AAAAPk"]
[Sat Jul 18 23:46:42.241043 2026] [security2:error] [pid 938041:tid 938193] [client 91.230.225.152:41041] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/file.php"] [unique_id "alxkwiNrzsYMDd5sB11MqQAAABU"]
[Sat Jul 18 23:46:42.284941 2026] [security2:error] [pid 943918:tid 944050] [client 138.252.89.100:61173] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkwh70hbVC6Snzbho9_gAAAIY"]
[Sat Jul 18 23:46:42.285681 2026] [security2:error] [pid 943918:tid 944050] [client 138.252.89.100:61173] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkwh70hbVC6Snzbho9_gAAAIY"]
[Sat Jul 18 23:46:42.331047 2026] [security2:error] [pid 943918:tid 944046] [remote 163.227.186.27:59892] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "amalia-capital.com"] [uri "/wp-login.php"] [unique_id "alxkwh70hbVC6Snzbho-AQAAkH4"]
[Sat Jul 18 23:46:42.363132 2026] [security2:error] [pid 943918:tid 944083] [client 173.239.196.160:35985] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/wp-conflg.php"] [unique_id "alxkwh70hbVC6Snzbho-AgAAAKc"]
[Sat Jul 18 23:46:42.385698 2026] [security2:error] [pid 943918:tid 944122] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "alxkwh70hbVC6Snzbho-BQAAAM4"]
[Sat Jul 18 23:46:42.385904 2026] [security2:error] [pid 943918:tid 944122] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "alxkwh70hbVC6Snzbho-BQAAAM4"]
[Sat Jul 18 23:46:42.430455 2026] [security2:error] [pid 943918:tid 944129] [client 91.230.225.163:63371] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/shelp.php"] [unique_id "alxkwh70hbVC6Snzbho-CAAAANU"]
[Sat Jul 18 23:46:42.447671 2026] [security2:error] [pid 943918:tid 944149] [client 91.230.225.164:32409] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/blurbs.php"] [unique_id "alxkwh70hbVC6Snzbho-CQAAAOk"]
[Sat Jul 18 23:46:42.448404 2026] [security2:error] [pid 943918:tid 944153] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkwh70hbVC6Snzbho96wAA7Vw"]
[Sat Jul 18 23:46:42.455856 2026] [security2:error] [pid 943918:tid 944153] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkwh70hbVC6Snzbho96AAA7WA"]
[Sat Jul 18 23:46:42.457849 2026] [security2:error] [pid 943918:tid 944153] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkwh70hbVC6Snzbho97gAA7TE"]
[Sat Jul 18 23:46:42.474584 2026] [security2:error] [pid 938041:tid 938250] [client 185.192.71.217:48651] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/blurbs.php"] [unique_id "alxkwiNrzsYMDd5sB11MsgAAAE4"]
[Sat Jul 18 23:46:42.491032 2026] [security2:error] [pid 938041:tid 938273] [client 185.92.25.79:51711] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/blurbs.php"] [unique_id "alxkwiNrzsYMDd5sB11MswAAAGU"]
[Sat Jul 18 23:46:42.503614 2026] [security2:error] [pid 943918:tid 944079] [client 45.133.7.83:25329] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/css/av.php"] [unique_id "alxkwh70hbVC6Snzbho-DQAAAKM"]
[Sat Jul 18 23:46:42.505207 2026] [security2:error] [pid 938041:tid 938258] [client 185.92.25.134:65125] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/blurbs.php"] [unique_id "alxkwiNrzsYMDd5sB11MtAAAAFY"]
[Sat Jul 18 23:46:42.507167 2026] [security2:error] [pid 938041:tid 938209] [client 4.194.24.143:23054] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/sql.php"] [unique_id "alxkwiNrzsYMDd5sB11MtQAAACU"]
[Sat Jul 18 23:46:42.524415 2026] [security2:error] [pid 943918:tid 944032] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "recruitinginsight.us"] [uri "/v1/graphql"] [unique_id "alxkwh70hbVC6Snzbho-DgAA7XA"]
[Sat Jul 18 23:46:42.526857 2026] [security2:error] [pid 943918:tid 944153] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkwh70hbVC6Snzbho9_AAA7To"]
[Sat Jul 18 23:46:42.536593 2026] [security2:error] [pid 943918:tid 944108] [client 91.230.225.161:36273] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/flower.php"] [unique_id "alxkwh70hbVC6Snzbho-DwAAAMA"]
[Sat Jul 18 23:46:42.554979 2026] [security2:error] [pid 943918:tid 944153] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkwh70hbVC6Snzbho9_wAA7W0"]
[Sat Jul 18 23:46:42.567417 2026] [security2:error] [pid 943918:tid 944145] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkwh70hbVC6Snzbho95QAA5Wg"]
[Sat Jul 18 23:46:42.595285 2026] [security2:error] [pid 938041:tid 938251] [client 91.230.225.157:64993] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/blurbs.php"] [unique_id "alxkwiNrzsYMDd5sB11MtwAAAE8"]
[Sat Jul 18 23:46:42.626432 2026] [security2:error] [pid 943918:tid 944153] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkwh70hbVC6Snzbho-AwAA7WE"]
[Sat Jul 18 23:46:42.643918 2026] [security2:error] [pid 943918:tid 944153] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkwh70hbVC6Snzbho-BAAA7Ws"]
[Sat Jul 18 23:46:42.657602 2026] [security2:error] [pid 943918:tid 944045] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "recruitinginsight.us"] [uri "/key.json"] [unique_id "alxkwh70hbVC6Snzbho-GAAAr30"]
[Sat Jul 18 23:46:42.661671 2026] [security2:error] [pid 943918:tid 943924] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "recruitinginsight.us"] [uri "/serviceAccountKey.json"] [unique_id "alxkwh70hbVC6Snzbho-GQAAvAQ"]
[Sat Jul 18 23:46:42.733439 2026] [security2:error] [pid 943918:tid 944175] [client 185.192.71.214:26303] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/cord.php"] [unique_id "alxkwh70hbVC6Snzbho-IAAAAQM"]
[Sat Jul 18 23:46:42.749246 2026] [security2:error] [pid 938041:tid 938298] [client 91.230.225.151:27421] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/akcc.php"] [unique_id "alxkwiNrzsYMDd5sB11MugAAAH4"]
[Sat Jul 18 23:46:42.762283 2026] [security2:error] [pid 938041:tid 938237] [client 185.192.71.223:32387] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/akcc.php"] [unique_id "alxkwiNrzsYMDd5sB11MvQAAAEE"]
[Sat Jul 18 23:46:42.775112 2026] [security2:error] [pid 943918:tid 944136] [client 185.92.25.79:47937] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/akcc.php"] [unique_id "alxkwh70hbVC6Snzbho-IwAAANw"]
[Sat Jul 18 23:46:42.791820 2026] [security2:error] [pid 938041:tid 938281] [client 4.194.24.143:34956] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/sql.php"] [unique_id "alxkwiNrzsYMDd5sB11MwAAAAG0"]
[Sat Jul 18 23:46:42.806165 2026] [security2:error] [pid 943918:tid 944069] [client 185.92.25.93:30763] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/akcc.php"] [unique_id "alxkwh70hbVC6Snzbho-JAAAAJk"]
[Sat Jul 18 23:46:42.814096 2026] [security2:error] [pid 938041:tid 938182] [client 45.134.20.122:48763] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/product.php"] [unique_id "alxkwiNrzsYMDd5sB11MwgAAAAo"]
[Sat Jul 18 23:46:42.823252 2026] [security2:error] [pid 938041:tid 938220] [client 3.64.55.230:65320] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.55.64.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxkwiNrzsYMDd5sB11MwQAAADA"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:46:42.824772 2026] [security2:error] [pid 943918:tid 943923] [remote 163.227.186.27:59892] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "amalia-capital.com"] [uri "/wp-login.php"] [unique_id "alxkwh70hbVC6Snzbho-KAAAsgM"], referer: https://amalia-capital.com/wp-login.php
[Sat Jul 18 23:46:42.949497 2026] [authz_core:error] [pid 943918:tid 943929] [remote 34.35.112.28:55064] AH01630: client denied by server configuration: /home1/recrujj8/public_html/.htpasswd
[Sat Jul 18 23:46:43.051429 2026] [security2:error] [pid 943918:tid 944111] [client 91.230.225.153:24645] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/dex.php"] [unique_id "alxkwx70hbVC6Snzbho-NQAAAMM"]
[Sat Jul 18 23:46:43.061002 2026] [security2:error] [pid 943918:tid 943926] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "recruitinginsight.us"] [uri "/.ssh/id_ed25519"] [unique_id "alxkwx70hbVC6Snzbho-NgAAuQY"]
[Sat Jul 18 23:46:43.076589 2026] [security2:error] [pid 938041:tid 938299] [client 185.92.25.90:40093] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/abcd.php"] [unique_id "alxkwyNrzsYMDd5sB11MxgAAAH8"]
[Sat Jul 18 23:46:43.078152 2026] [security2:error] [pid 943918:tid 944130] [client 4.194.24.143:23103] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/ss.php"] [unique_id "alxkwx70hbVC6Snzbho-OwAAANY"]
[Sat Jul 18 23:46:43.079195 2026] [security2:error] [pid 938041:tid 938187] [client 185.192.71.212:54087] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/abcd.php"] [unique_id "alxkwyNrzsYMDd5sB11MxwAAAA8"]
[Sat Jul 18 23:46:43.081736 2026] [security2:error] [pid 938041:tid 938242] [client 91.230.225.153:28929] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/abcd.php"] [unique_id "alxkwyNrzsYMDd5sB11MyAAAAEY"]
[Sat Jul 18 23:46:43.092515 2026] [security2:error] [pid 938041:tid 938279] [client 185.92.25.80:42517] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/abcd.php"] [unique_id "alxkwyNrzsYMDd5sB11MygAAAGs"]
[Sat Jul 18 23:46:43.104098 2026] [security2:error] [pid 943918:tid 944030] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "recruitinginsight.us"] [uri "/.ssh/id_rsa"] [unique_id "alxkwx70hbVC6Snzbho-PQAAuW4"]
[Sat Jul 18 23:46:43.182456 2026] [security2:error] [pid 943918:tid 944126] [client 45.133.7.81:63043] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 81.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/images/waf_defender.php"] [unique_id "alxkwx70hbVC6Snzbho-QAAAANI"]
[Sat Jul 18 23:46:43.195574 2026] [security2:error] [pid 943918:tid 944105] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkwh70hbVC6Snzbho-JQAAvWw"]
[Sat Jul 18 23:46:43.211265 2026] [security2:error] [pid 938041:tid 938244] [client 143.198.112.195:40736] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "mourgroup.com"] [uri "/index.php"] [unique_id "alxkwyNrzsYMDd5sB11MyQAAAEg"], referer: https://mourgroup.com/
[Sat Jul 18 23:46:43.249485 2026] [security2:error] [pid 943918:tid 944087] [client 173.239.196.163:46311] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/backup/autoload_classmap.php"] [unique_id "alxkwx70hbVC6Snzbho-SQAAAKs"]
[Sat Jul 18 23:46:43.277272 2026] [security2:error] [pid 943918:tid 944166] [client 20.206.105.145:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 145.105.206.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.awellpacedlife.com"] [uri "/aaa.php"] [unique_id "alxkwx70hbVC6Snzbho-SwAAAPo"]
[Sat Jul 18 23:46:43.277410 2026] [security2:error] [pid 943918:tid 944166] [client 20.206.105.145:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.awellpacedlife.com"] [uri "/aaa.php"] [unique_id "alxkwx70hbVC6Snzbho-SwAAAPo"]
[Sat Jul 18 23:46:43.319974 2026] [security2:error] [pid 943918:tid 944101] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkwh70hbVC6Snzbho-GwAAuV4"]
[Sat Jul 18 23:46:43.324485 2026] [security2:error] [pid 943918:tid 944035] [remote 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkwh70hbVC6Snzbho-GgAAuXM"]
[Sat Jul 18 23:46:43.333880 2026] [security2:error] [pid 943918:tid 944101] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkwh70hbVC6Snzbho-HAAAuW8"]
[Sat Jul 18 23:46:43.335926 2026] [security2:error] [pid 943918:tid 944119] [client 185.92.25.84:34271] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxkwx70hbVC6Snzbho-TwAAAMs"]
[Sat Jul 18 23:46:43.337124 2026] [security2:error] [pid 943918:tid 944165] [client 4.194.24.143:23073] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/ss.php"] [unique_id "alxkwx70hbVC6Snzbho-UAAAAPk"]
[Sat Jul 18 23:46:43.361476 2026] [security2:error] [pid 943918:tid 944112] [client 185.92.25.89:39425] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/shelp.php"] [unique_id "alxkwx70hbVC6Snzbho-UQAAAMQ"]
[Sat Jul 18 23:46:43.363182 2026] [security2:error] [pid 943918:tid 944127] [client 185.192.71.212:31813] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/shelp.php"] [unique_id "alxkwx70hbVC6Snzbho-UgAAANM"]
[Sat Jul 18 23:46:43.377704 2026] [security2:error] [pid 943918:tid 944120] [client 91.230.225.157:23629] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/shelp.php"] [unique_id "alxkwx70hbVC6Snzbho-UwAAAMw"]
[Sat Jul 18 23:46:43.389177 2026] [security2:error] [pid 943918:tid 944129] [client 185.92.25.85:63801] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/shelp.php"] [unique_id "alxkwx70hbVC6Snzbho-VAAAANU"]
[Sat Jul 18 23:46:43.435860 2026] [security2:error] [pid 938041:tid 938249] [client 185.92.25.85:54247] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/class-t.api.php"] [unique_id "alxkwyNrzsYMDd5sB11M1QAAAE0"]
[Sat Jul 18 23:46:43.611926 2026] [security2:error] [pid 943918:tid 943931] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "recruitinginsight.us"] [uri "/.ssh/id_dsa"] [unique_id "alxkwx70hbVC6Snzbho-XAAAuQs"]
[Sat Jul 18 23:46:43.612079 2026] [security2:error] [pid 943918:tid 944101] [client 34.35.112.28:55064] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "recruitinginsight.us"] [uri "/.ssh/id_dsa"] [unique_id "alxkwx70hbVC6Snzbho-XAAAuQs"]
[Sat Jul 18 23:46:43.633407 2026] [security2:error] [pid 943918:tid 944145] [client 91.230.225.151:54579] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/zwso.php"] [unique_id "alxkwx70hbVC6Snzbho-XQAAAOU"]
[Sat Jul 18 23:46:43.642576 2026] [security2:error] [pid 943918:tid 944156] [client 185.192.71.215:64473] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/cord.php"] [unique_id "alxkwx70hbVC6Snzbho-XgAAAPA"]
[Sat Jul 18 23:46:43.647815 2026] [security2:error] [pid 943918:tid 943964] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "recruitinginsight.us"] [uri "/.ssh/config"] [unique_id "alxkwx70hbVC6Snzbho-XwAAuSw"]
[Sat Jul 18 23:46:43.648671 2026] [security2:error] [pid 943918:tid 944099] [client 185.192.71.225:36547] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/cord.php"] [unique_id "alxkwx70hbVC6Snzbho-YAAAALc"]
[Sat Jul 18 23:46:43.653673 2026] [security2:error] [pid 943918:tid 943947] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "recruitinginsight.us"] [uri "/.ssh/known_hosts"] [unique_id "alxkwx70hbVC6Snzbho-YgAAuRs"]
[Sat Jul 18 23:46:43.653817 2026] [security2:error] [pid 943918:tid 944101] [client 34.35.112.28:55064] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "recruitinginsight.us"] [uri "/.ssh/known_hosts"] [unique_id "alxkwx70hbVC6Snzbho-YgAAuRs"]
[Sat Jul 18 23:46:43.671198 2026] [security2:error] [pid 938041:tid 938289] [client 4.194.24.143:23100] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/stats.php"] [unique_id "alxkwyNrzsYMDd5sB11M4AAAAHU"]
[Sat Jul 18 23:46:43.696092 2026] [security2:error] [pid 943918:tid 944153] [client 45.134.20.114:52753] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/uploads/autoload_classmap.php"] [unique_id "alxkwx70hbVC6Snzbho-ZAAAAO0"]
[Sat Jul 18 23:46:43.716308 2026] [security2:error] [pid 943918:tid 944104] [client 185.92.25.93:36625] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/cord.php"] [unique_id "alxkwx70hbVC6Snzbho-ZQAAALw"]
[Sat Jul 18 23:46:43.720278 2026] [security2:error] [pid 943918:tid 944155] [client 185.92.25.92:29977] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/cord.php"] [unique_id "alxkwx70hbVC6Snzbho-ZgAAAO8"]
[Sat Jul 18 23:46:43.745161 2026] [security2:error] [pid 943918:tid 944019] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "recruitinginsight.us"] [uri "/id_rsa"] [unique_id "alxkwx70hbVC6Snzbho-aAAAuWM"]
[Sat Jul 18 23:46:43.767494 2026] [security2:error] [pid 943918:tid 944148] [client 185.92.25.89:64805] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/blurbs.php"] [unique_id "alxkwx70hbVC6Snzbho-aQAAAOg"]
[Sat Jul 18 23:46:43.794914 2026] [security2:error] [pid 943918:tid 944115] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkwx70hbVC6Snzbho-VgAAxw0"]
[Sat Jul 18 23:46:43.860296 2026] [security2:error] [pid 943918:tid 944137] [client 45.133.7.58:20579] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "alxkwx70hbVC6Snzbho-bgAAAN0"]
[Sat Jul 18 23:46:43.873866 2026] [security2:error] [pid 943918:tid 944102] [client 91.230.225.156:23383] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/gifclass.php"] [unique_id "alxkwx70hbVC6Snzbho-cAAAALo"]
[Sat Jul 18 23:46:43.878251 2026] [security2:error] [pid 943918:tid 944141] [client 4.194.24.143:34964] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/stats.php"] [unique_id "alxkwx70hbVC6Snzbho-cQAAAOE"]
[Sat Jul 18 23:46:43.933794 2026] [security2:error] [pid 943918:tid 944157] [client 185.192.71.218:37173] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxkwx70hbVC6Snzbho-dAAAAPE"]
[Sat Jul 18 23:46:43.934803 2026] [security2:error] [pid 943918:tid 944071] [client 185.192.71.222:21939] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/akcc.php"] [unique_id "alxkwx70hbVC6Snzbho-dQAAAJs"]
[Sat Jul 18 23:46:43.947539 2026] [security2:error] [pid 943918:tid 944174] [client 91.230.225.156:61741] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/dex.php"] [unique_id "alxkwx70hbVC6Snzbho-dwAAAQI"]
[Sat Jul 18 23:46:44.001592 2026] [security2:error] [pid 943918:tid 944161] [client 185.92.25.134:59979] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/dex.php"] [unique_id "alxkxB70hbVC6Snzbho-eQAAAPU"]
[Sat Jul 18 23:46:44.007413 2026] [security2:error] [pid 943918:tid 944138] [client 91.230.225.156:63489] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/dex.php"] [unique_id "alxkxB70hbVC6Snzbho-ewAAAN4"]
[Sat Jul 18 23:46:44.045078 2026] [security2:error] [pid 943918:tid 944065] [client 185.192.71.225:57211] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/akcc.php"] [unique_id "alxkxB70hbVC6Snzbho-fAAAAJU"]
[Sat Jul 18 23:46:44.059021 2026] [security2:error] [pid 943918:tid 943945] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "recruitinginsight.us"] [uri "/id_ed25519"] [unique_id "alxkxB70hbVC6Snzbho-fgAAuRk"]
[Sat Jul 18 23:46:44.059891 2026] [security2:error] [pid 943918:tid 943938] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "recruitinginsight.us"] [uri "/id_ecdsa"] [unique_id "alxkxB70hbVC6Snzbho-gAAAuRI"]
[Sat Jul 18 23:46:44.060044 2026] [security2:error] [pid 943918:tid 943990] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:id_(?:r|d)sa$|key\\\\.pem$|(?:myserver|private-?key)\\\\.key$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1291"] [id "350591"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw Private cryto keys"] [severity "CRITICAL"] [hostname "recruitinginsight.us"] [uri "/id_dsa"] [unique_id "alxkxB70hbVC6Snzbho-fwAAuUY"]
[Sat Jul 18 23:46:44.111708 2026] [security2:error] [pid 943918:tid 944140] [client 173.239.196.161:45899] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 161.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/uploads/uploads.php"] [unique_id "alxkxB70hbVC6Snzbho-gQAAAOA"]
[Sat Jul 18 23:46:44.168008 2026] [security2:error] [pid 943918:tid 944101] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkwh70hbVC6Snzbho-LgAAuXc"]
[Sat Jul 18 23:46:44.175483 2026] [security2:error] [pid 943918:tid 944043] [remote 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkwh70hbVC6Snzbho-LAAAuXs"]
[Sat Jul 18 23:46:44.177997 2026] [security2:error] [pid 943918:tid 944103] [client 91.230.225.162:61071] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/bless.php"] [unique_id "alxkxB70hbVC6Snzbho-gwAAALs"]
[Sat Jul 18 23:46:44.178410 2026] [security2:error] [pid 943918:tid 944101] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkwh70hbVC6Snzbho-MQAAuQU"]
[Sat Jul 18 23:46:44.178541 2026] [security2:error] [pid 943918:tid 944101] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkwh70hbVC6Snzbho-MgAAuXE"]
[Sat Jul 18 23:46:44.184110 2026] [security2:error] [pid 943918:tid 943921] [remote 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkwx70hbVC6Snzbho-PAAAuQE"]
[Sat Jul 18 23:46:44.191082 2026] [security2:error] [pid 943918:tid 944101] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkwx70hbVC6Snzbho-PgAAuQc"]
[Sat Jul 18 23:46:44.230655 2026] [security2:error] [pid 943918:tid 944107] [client 185.192.71.220:38135] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/bolt.php"] [unique_id "alxkxB70hbVC6Snzbho-hAAAAL8"]
[Sat Jul 18 23:46:44.236279 2026] [security2:error] [pid 943918:tid 944083] [client 91.230.225.150:34265] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/abcd.php"] [unique_id "alxkxB70hbVC6Snzbho-hwAAAKc"]
[Sat Jul 18 23:46:44.252577 2026] [security2:error] [pid 943918:tid 944158] [client 4.194.24.143:23090] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/sump1.php"] [unique_id "alxkxB70hbVC6Snzbho-igAAAPI"]
[Sat Jul 18 23:46:44.303195 2026] [security2:error] [pid 943918:tid 944123] [client 185.192.71.217:26841] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxkxB70hbVC6Snzbho-kAAAAM8"]
[Sat Jul 18 23:46:44.324428 2026] [security2:error] [pid 943918:tid 944101] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkwx70hbVC6Snzbho-TgAAuQA"]
[Sat Jul 18 23:46:44.358417 2026] [security2:error] [pid 943918:tid 943949] [remote 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkwx70hbVC6Snzbho-WQAAuR0"]
[Sat Jul 18 23:46:44.377860 2026] [security2:error] [pid 943918:tid 944132] [client 185.92.25.93:32937] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxkxB70hbVC6Snzbho-lwAAANg"]
[Sat Jul 18 23:46:44.402240 2026] [security2:error] [pid 943918:tid 944080] [client 185.92.25.80:65251] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/abcd.php"] [unique_id "alxkxB70hbVC6Snzbho-mQAAAKQ"]
[Sat Jul 18 23:46:44.421790 2026] [security2:error] [pid 943918:tid 944171] [client 4.194.24.143:16799] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/sump1.php"] [unique_id "alxkxB70hbVC6Snzbho-mgAAAP8"]
[Sat Jul 18 23:46:44.464357 2026] [security2:error] [pid 943918:tid 944077] [client 185.192.71.212:20547] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/class-t.api.php"] [unique_id "alxkxB70hbVC6Snzbho-nAAAAKE"]
[Sat Jul 18 23:46:44.513757 2026] [security2:error] [pid 943918:tid 944163] [client 185.92.25.135:47331] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/cjfuns.php"] [unique_id "alxkxB70hbVC6Snzbho-nwAAAPc"]
[Sat Jul 18 23:46:44.527134 2026] [security2:error] [pid 943918:tid 944059] [client 185.192.71.210:24123] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/shelp.php"] [unique_id "alxkxB70hbVC6Snzbho-oQAAAI8"]
[Sat Jul 18 23:46:44.542162 2026] [security2:error] [pid 943918:tid 944104] [client 45.133.7.97:23017] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 97.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/small.php"] [unique_id "alxkxB70hbVC6Snzbho-ogAAALw"]
[Sat Jul 18 23:46:44.553462 2026] [security2:error] [pid 938041:tid 938258] [client 45.134.20.114:59039] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/ask.php"] [unique_id "alxkxCNrzsYMDd5sB11M7AAAAFY"]
[Sat Jul 18 23:46:44.569462 2026] [security2:error] [pid 943918:tid 944101] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxB70hbVC6Snzbho-kgAAuRg"]
[Sat Jul 18 23:46:44.616601 2026] [security2:error] [pid 938041:tid 938251] [client 185.92.25.88:50367] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/zwso.php"] [unique_id "alxkxCNrzsYMDd5sB11M8gAAAE8"]
[Sat Jul 18 23:46:44.660525 2026] [security2:error] [pid 943918:tid 944058] [client 185.92.25.85:50761] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/zwso.php"] [unique_id "alxkxB70hbVC6Snzbho-qAAAAI4"]
[Sat Jul 18 23:46:44.696404 2026] [security2:error] [pid 943918:tid 944097] [client 185.192.71.221:26999] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/shelp.php"] [unique_id "alxkxB70hbVC6Snzbho-qQAAALU"]
[Sat Jul 18 23:46:44.743737 2026] [security2:error] [pid 943918:tid 944102] [client 185.192.71.216:36387] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/blurbs.php"] [unique_id "alxkxB70hbVC6Snzbho-qwAAALo"]
[Sat Jul 18 23:46:44.795583 2026] [security2:error] [pid 943918:tid 944147] [client 4.194.24.143:16828] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/system.php"] [unique_id "alxkxB70hbVC6Snzbho-rgAAAOc"]
[Sat Jul 18 23:46:44.795949 2026] [security2:error] [pid 943918:tid 944088] [client 91.230.225.155:33857] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/wp-admin/css/index.php"] [unique_id "alxkxB70hbVC6Snzbho-rwAAAKw"]
[Sat Jul 18 23:46:44.805910 2026] [security2:error] [pid 938041:tid 938205] [client 185.92.25.92:45321] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/cord.php"] [unique_id "alxkxCNrzsYMDd5sB11M9QAAACE"]
[Sat Jul 18 23:46:44.817035 2026] [security2:error] [pid 943918:tid 943928] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "recruitinginsight.us"] [uri "/.openclaw/.env"] [unique_id "alxkxB70hbVC6Snzbho-swABAgg"]
[Sat Jul 18 23:46:44.834780 2026] [security2:error] [pid 943918:tid 943935] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "recruitinginsight.us"] [uri "/key.pem"] [unique_id "alxkxB70hbVC6Snzbho-uAABAg8"]
[Sat Jul 18 23:46:44.834778 2026] [security2:error] [pid 943918:tid 943967] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "recruitinginsight.us"] [uri "/privatekey.key"] [unique_id "alxkxB70hbVC6Snzbho-twABAi8"]
[Sat Jul 18 23:46:44.834970 2026] [security2:error] [pid 943918:tid 944174] [client 34.35.112.28:55064] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "recruitinginsight.us"] [uri "/privatekey.key"] [unique_id "alxkxB70hbVC6Snzbho-twABAi8"]
[Sat Jul 18 23:46:44.945225 2026] [security2:error] [pid 943918:tid 944072] [client 185.192.71.216:39119] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxkxB70hbVC6Snzbho-vgAAAJw"]
[Sat Jul 18 23:46:44.961544 2026] [security2:error] [pid 943918:tid 944106] [client 4.194.24.143:28479] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/system.php"] [unique_id "alxkxB70hbVC6Snzbho-wAAAAL4"]
[Sat Jul 18 23:46:44.967821 2026] [security2:error] [pid 938041:tid 938283] [client 173.239.196.165:45081] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/file.php"] [unique_id "alxkxCNrzsYMDd5sB11M_AAAAG8"]
[Sat Jul 18 23:46:44.973399 2026] [security2:error] [pid 943918:tid 944110] [client 185.192.71.220:29393] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/cord.php"] [unique_id "alxkxB70hbVC6Snzbho-wQAAAMI"]
[Sat Jul 18 23:46:45.025126 2026] [security2:error] [pid 943918:tid 944098] [client 185.192.71.215:56253] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/akcc.php"] [unique_id "alxkxR70hbVC6Snzbho-xAAAALY"]
[Sat Jul 18 23:46:45.083272 2026] [security2:error] [pid 943918:tid 944084] [client 185.92.25.91:40029] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/dex.php"] [unique_id "alxkxR70hbVC6Snzbho-yAAAAKg"]
[Sat Jul 18 23:46:45.084544 2026] [security2:error] [pid 943918:tid 944112] [client 185.92.25.93:20649] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/wp-content/plugins/index.php"] [unique_id "alxkxR70hbVC6Snzbho-yQAAAMQ"]
[Sat Jul 18 23:46:45.090325 2026] [security2:error] [pid 938041:tid 938245] [client 91.230.225.153:46521] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/dex.php"] [unique_id "alxkxSNrzsYMDd5sB11NAAAAAEk"]
[Sat Jul 18 23:46:45.214994 2026] [security2:error] [pid 943918:tid 944174] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxB70hbVC6Snzbho-tgABAio"]
[Sat Jul 18 23:46:45.221503 2026] [security2:error] [pid 943918:tid 944174] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxB70hbVC6Snzbho-sQABAhA"]
[Sat Jul 18 23:46:45.221641 2026] [security2:error] [pid 943918:tid 944055] [client 185.192.71.222:56539] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/bolt.php"] [unique_id "alxkxR70hbVC6Snzbho-zwAAAIs"]
[Sat Jul 18 23:46:45.226625 2026] [security2:error] [pid 938041:tid 938212] [client 45.133.7.100:47991] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "alxkxSNrzsYMDd5sB11NAwAAACg"]
[Sat Jul 18 23:46:45.226872 2026] [security2:error] [pid 943918:tid 944174] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxB70hbVC6Snzbho-tQABAj8"]
[Sat Jul 18 23:46:45.257664 2026] [security2:error] [pid 943918:tid 944082] [client 91.230.225.163:37691] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/dex.php"] [unique_id "alxkxR70hbVC6Snzbho-0QAAAKY"]
[Sat Jul 18 23:46:45.258975 2026] [security2:error] [pid 943918:tid 944174] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxB70hbVC6Snzbho-tAABAj4"]
[Sat Jul 18 23:46:45.265952 2026] [security2:error] [pid 943918:tid 944174] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxB70hbVC6Snzbho-sgABAjI"]
[Sat Jul 18 23:46:45.274325 2026] [security2:error] [pid 943918:tid 943952] [remote 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxB70hbVC6Snzbho-uQABAiA"]
[Sat Jul 18 23:46:45.282622 2026] [security2:error] [pid 943918:tid 944174] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxB70hbVC6Snzbho-sAABAgo"]
[Sat Jul 18 23:46:45.301946 2026] [security2:error] [pid 938041:tid 938201] [client 185.192.71.225:51443] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/abcd.php"] [unique_id "alxkxSNrzsYMDd5sB11NBAAAAB0"]
[Sat Jul 18 23:46:45.337672 2026] [security2:error] [pid 938041:tid 938225] [client 4.194.24.143:20624] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/system/03n1hob7p03r2npdefault.php"] [unique_id "alxkxSNrzsYMDd5sB11NBQAAADU"]
[Sat Jul 18 23:46:45.352057 2026] [security2:error] [pid 943918:tid 944174] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxB70hbVC6Snzbho-vwABAh8"]
[Sat Jul 18 23:46:45.362045 2026] [security2:error] [pid 938041:tid 938299] [client 185.192.71.216:41487] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxkxSNrzsYMDd5sB11NCQAAAH8"]
[Sat Jul 18 23:46:45.369550 2026] [security2:error] [pid 938041:tid 938242] [client 91.230.225.151:55019] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/wp-content/index.php"] [unique_id "alxkxSNrzsYMDd5sB11NCgAAAEY"]
[Sat Jul 18 23:46:45.371155 2026] [security2:error] [pid 938041:tid 938227] [client 185.192.71.222:47563] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxkxSNrzsYMDd5sB11NDAAAADc"]
[Sat Jul 18 23:46:45.402979 2026] [security2:error] [pid 943918:tid 943979] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "recruitinginsight.us"] [uri "/.codex/config.toml"] [unique_id "alxkxR70hbVC6Snzbho-1QABAjs"]
[Sat Jul 18 23:46:45.404900 2026] [security2:error] [pid 943918:tid 944040] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "recruitinginsight.us"] [uri "/.hermes/.env"] [unique_id "alxkxR70hbVC6Snzbho-1wABAng"]
[Sat Jul 18 23:46:45.408031 2026] [security2:error] [pid 943918:tid 944096] [client 45.134.20.116:31849] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 116.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "alxkxR70hbVC6Snzbho-2QAAALQ"]
[Sat Jul 18 23:46:45.411767 2026] [security2:error] [pid 943918:tid 944174] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxB70hbVC6Snzbho-wwABAk8"]
[Sat Jul 18 23:46:45.448998 2026] [security2:error] [pid 943918:tid 944156] [client 185.92.25.85:60507] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxkxR70hbVC6Snzbho-3AAAAPA"]
[Sat Jul 18 23:46:45.458313 2026] [security2:error] [pid 938041:tid 938220] [client 36.83.95.75:57234] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkxSNrzsYMDd5sB11NDwAAADA"]
[Sat Jul 18 23:46:45.458459 2026] [security2:error] [pid 938041:tid 938220] [client 36.83.95.75:57234] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxkxSNrzsYMDd5sB11NDwAAADA"]
[Sat Jul 18 23:46:45.536516 2026] [security2:error] [pid 943918:tid 944167] [client 185.192.71.214:57265] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/cjfuns.php"] [unique_id "alxkxR70hbVC6Snzbho-5AAAAPs"]
[Sat Jul 18 23:46:45.545301 2026] [security2:error] [pid 943918:tid 944120] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkxR70hbVC6Snzbho-zAAAzFA"]
[Sat Jul 18 23:46:45.562676 2026] [security2:error] [pid 943918:tid 944136] [client 185.192.71.216:49387] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxkxR70hbVC6Snzbho-6AAAANw"]
[Sat Jul 18 23:46:45.590311 2026] [security2:error] [pid 943918:tid 944109] [client 4.194.24.143:16811] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/system/03n1hob7p03r2npdefault.php"] [unique_id "alxkxR70hbVC6Snzbho-6gAAAME"]
[Sat Jul 18 23:46:45.640339 2026] [security2:error] [pid 943918:tid 944147] [client 185.192.71.210:28697] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/zwso.php"] [unique_id "alxkxR70hbVC6Snzbho-8AAAAOc"]
[Sat Jul 18 23:46:45.645811 2026] [security2:error] [pid 943918:tid 944174] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxR70hbVC6Snzbho-1gABAkw"]
[Sat Jul 18 23:46:45.651760 2026] [security2:error] [pid 943918:tid 944143] [client 185.92.25.135:55349] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/zwso.php"] [unique_id "alxkxR70hbVC6Snzbho-8gAAAOM"]
[Sat Jul 18 23:46:45.653194 2026] [security2:error] [pid 943918:tid 944176] [client 185.192.71.222:20739] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/ioxi-o.php"] [unique_id "alxkxR70hbVC6Snzbho-8wAAAQQ"]
[Sat Jul 18 23:46:45.695951 2026] [security2:error] [pid 943918:tid 943989] [remote 103.75.185.95:41916] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tbd.jxc.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxkxR70hbVC6Snzbho-9gAA5EU"]
[Sat Jul 18 23:46:45.730170 2026] [security2:error] [pid 938041:tid 938291] [client 185.92.25.79:29519] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/zwso.php"] [unique_id "alxkxSNrzsYMDd5sB11NEwAAAHc"]
[Sat Jul 18 23:46:45.832134 2026] [security2:error] [pid 943918:tid 944166] [client 185.92.25.87:37077] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/wp-admin/css/index.php"] [unique_id "alxkxR70hbVC6Snzbho_AAAAAPo"]
[Sat Jul 18 23:46:45.865858 2026] [security2:error] [pid 943918:tid 944089] [client 173.239.196.162:28247] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 162.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-content/themes.php"] [unique_id "alxkxR70hbVC6Snzbho_BQAAAK0"]
[Sat Jul 18 23:46:45.874234 2026] [security2:error] [pid 943918:tid 944005] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "recruitinginsight.us"] [uri "/.zshrc"] [unique_id "alxkxR70hbVC6Snzbho_CQAAqVU"]
[Sat Jul 18 23:46:45.874374 2026] [security2:error] [pid 943918:tid 943986] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "recruitinginsight.us"] [uri "/.bash_profile"] [unique_id "alxkxR70hbVC6Snzbho_CwAAqUI"]
[Sat Jul 18 23:46:45.874381 2026] [security2:error] [pid 943918:tid 944085] [client 34.35.112.28:55064] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "recruitinginsight.us"] [uri "/.zshrc"] [unique_id "alxkxR70hbVC6Snzbho_CQAAqVU"]
[Sat Jul 18 23:46:45.906892 2026] [security2:error] [pid 943918:tid 944053] [client 45.133.7.57:55361] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 57.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/NewFile.php"] [unique_id "alxkxR70hbVC6Snzbho_DwAAAIk"]
[Sat Jul 18 23:46:45.911406 2026] [security2:error] [pid 943918:tid 944140] [client 4.194.24.143:16800] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/system/cj5ha2rah8lyiqqdefault.php"] [unique_id "alxkxR70hbVC6Snzbho_EAAAAOA"]
[Sat Jul 18 23:46:45.915860 2026] [security2:error] [pid 943918:tid 944085] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxR70hbVC6Snzbho-9AAAqXk"]
[Sat Jul 18 23:46:45.920330 2026] [security2:error] [pid 938041:tid 938172] [client 185.192.71.220:35027] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxkxSNrzsYMDd5sB11NFgAAAAA"]
[Sat Jul 18 23:46:45.924262 2026] [security2:error] [pid 943918:tid 943980] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-config\\\\.php(?:\\\\W[a-z]*|bak)" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "300"] [id "900256"] [msg "Wp-Config Backup/edit file request"] [hostname "recruitinginsight.us"] [uri "/wp-config.php.old"] [unique_id "alxkxR70hbVC6Snzbho_FQAAqTw"]
[Sat Jul 18 23:46:45.938783 2026] [security2:error] [pid 943918:tid 944050] [client 91.230.225.162:57859] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxkxR70hbVC6Snzbho_GAAAAIY"]
[Sat Jul 18 23:46:45.939893 2026] [security2:error] [pid 943918:tid 944114] [client 91.230.225.162:42793] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/insc.php"] [unique_id "alxkxR70hbVC6Snzbho_GQAAAMY"]
[Sat Jul 18 23:46:45.941708 2026] [security2:error] [pid 943918:tid 944034] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-config\\\\.php(?:\\\\W[a-z]*|bak)" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "300"] [id "900256"] [msg "Wp-Config Backup/edit file request"] [hostname "recruitinginsight.us"] [uri "/wp-config.php.bak"] [unique_id "alxkxR70hbVC6Snzbho_GgAAqXI"]
[Sat Jul 18 23:46:45.950047 2026] [security2:error] [pid 943918:tid 944150] [client 103.160.26.178:61094] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkxR70hbVC6Snzbho_FwAAAOo"]
[Sat Jul 18 23:46:45.950161 2026] [security2:error] [pid 943918:tid 944150] [client 103.160.26.178:61094] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxkxR70hbVC6Snzbho_FwAAAOo"]
[Sat Jul 18 23:46:45.973313 2026] [security2:error] [pid 943918:tid 944132] [client 185.92.25.82:47617] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxkxR70hbVC6Snzbho_HQAAANg"]
[Sat Jul 18 23:46:46.007294 2026] [security2:error] [pid 938041:tid 938292] [client 185.92.25.85:28783] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxkxiNrzsYMDd5sB11NHAAAAHg"]
[Sat Jul 18 23:46:46.131348 2026] [security2:error] [pid 943918:tid 944082] [client 4.194.24.143:20666] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/system/cj5ha2rah8lyiqqdefault.php"] [unique_id "alxkxh70hbVC6Snzbho_IgAAAKY"]
[Sat Jul 18 23:46:46.159093 2026] [security2:error] [pid 943918:tid 944175] [client 185.192.71.216:53547] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/wp-content/plugins/index.php"] [unique_id "alxkxh70hbVC6Snzbho_IwAAAQM"]
[Sat Jul 18 23:46:46.185031 2026] [security2:error] [pid 943918:tid 943984] [remote 103.75.185.95:41916] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tbd.jxc.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxkxh70hbVC6Snzbho_JAAA-0A"], referer: https://tbd.jxc.mybluehost.me/wp-login.php
[Sat Jul 18 23:46:46.195341 2026] [security2:error] [pid 943918:tid 944115] [client 185.192.71.208:53617] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/bolt.php"] [unique_id "alxkxh70hbVC6Snzbho_JwAAAMc"]
[Sat Jul 18 23:46:46.224482 2026] [security2:error] [pid 938041:tid 938264] [client 57.141.18.28:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxkxiNrzsYMDd5sB11NHQAAAFw"]
[Sat Jul 18 23:46:46.224850 2026] [security2:error] [pid 943918:tid 944154] [client 185.92.25.84:38377] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/classwithtostring.php"] [unique_id "alxkxh70hbVC6Snzbho_KgAAAO4"]
[Sat Jul 18 23:46:46.256744 2026] [security2:error] [pid 938041:tid 938235] [client 91.230.225.162:49491] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/bolt.php"] [unique_id "alxkxiNrzsYMDd5sB11NIwAAAD8"]
[Sat Jul 18 23:46:46.273569 2026] [security2:error] [pid 943918:tid 944141] [client 45.134.20.106:50141] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/css/css.php"] [unique_id "alxkxh70hbVC6Snzbho_KwAAAOE"]
[Sat Jul 18 23:46:46.287378 2026] [security2:error] [pid 943918:tid 944083] [client 185.192.71.210:37983] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/bolt.php"] [unique_id "alxkxh70hbVC6Snzbho_LQAAAKc"]
[Sat Jul 18 23:46:46.313638 2026] [security2:error] [pid 943918:tid 944085] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxR70hbVC6Snzbho_CgAAqTg"]
[Sat Jul 18 23:46:46.321700 2026] [security2:error] [pid 943918:tid 944010] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "recruitinginsight.us"] [uri "/laravel/.env"] [unique_id "alxkxh70hbVC6Snzbho_LgAAqVo"]
[Sat Jul 18 23:46:46.322423 2026] [security2:error] [pid 943918:tid 943981] [remote 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxR70hbVC6Snzbho_BwAAqT0"]
[Sat Jul 18 23:46:46.334848 2026] [security2:error] [pid 943918:tid 944085] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxR70hbVC6Snzbho_CAAAqV8"]
[Sat Jul 18 23:46:46.338242 2026] [security2:error] [pid 943918:tid 944016] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 28.112.35.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "recruitinginsight.us"] [uri "/config/.env.php"] [unique_id "alxkxh70hbVC6Snzbho_MAAAqWA"]
[Sat Jul 18 23:46:46.342964 2026] [security2:error] [pid 943918:tid 944085] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxR70hbVC6Snzbho_BgAAqUc"]
[Sat Jul 18 23:46:46.364933 2026] [security2:error] [pid 943918:tid 944085] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxR70hbVC6Snzbho_GwAAqVg"]
[Sat Jul 18 23:46:46.384055 2026] [security2:error] [pid 943918:tid 944085] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxR70hbVC6Snzbho_FgAAqWk"]
[Sat Jul 18 23:46:46.385738 2026] [security2:error] [pid 943918:tid 944044] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "recruitinginsight.us"] [uri "/core/.env"] [unique_id "alxkxh70hbVC6Snzbho_NAAAqXw"]
[Sat Jul 18 23:46:46.388090 2026] [security2:error] [pid 943918:tid 943978] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 28.112.35.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "recruitinginsight.us"] [uri "/.env.php.bak"] [unique_id "alxkxh70hbVC6Snzbho_NgAAqTo"]
[Sat Jul 18 23:46:46.418809 2026] [security2:error] [pid 943918:tid 944085] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxh70hbVC6Snzbho_JQAAqX4"]
[Sat Jul 18 23:46:46.450104 2026] [security2:error] [pid 943918:tid 944169] [client 185.192.71.210:23071] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/wp-content/index.php"] [unique_id "alxkxh70hbVC6Snzbho_OQAAAP0"]
[Sat Jul 18 23:46:46.453712 2026] [security2:error] [pid 938041:tid 938215] [client 4.194.24.143:20656] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/system_log.php"] [unique_id "alxkxiNrzsYMDd5sB11NKAAAACs"]
[Sat Jul 18 23:46:46.529116 2026] [security2:error] [pid 938041:tid 938259] [client 185.92.25.83:64929] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/txets.php"] [unique_id "alxkxiNrzsYMDd5sB11NLQAAAFc"]
[Sat Jul 18 23:46:46.540026 2026] [security2:error] [pid 938041:tid 938174] [client 185.92.25.84:48467] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/cjfuns.php"] [unique_id "alxkxiNrzsYMDd5sB11NLgAAAAI"]
[Sat Jul 18 23:46:46.564059 2026] [security2:error] [pid 943918:tid 944061] [client 185.92.25.88:56225] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/cjfuns.php"] [unique_id "alxkxh70hbVC6Snzbho_PwAAAJE"]
[Sat Jul 18 23:46:46.585198 2026] [security2:error] [pid 943918:tid 944076] [client 45.133.7.104:24583] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/uploads/index.php"] [unique_id "alxkxh70hbVC6Snzbho_QgAAAKA"]
[Sat Jul 18 23:46:46.621359 2026] [security2:error] [pid 943918:tid 944085] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxh70hbVC6Snzbho_NQAAqXA"]
[Sat Jul 18 23:46:46.640116 2026] [security2:error] [pid 943918:tid 944158] [client 185.192.71.215:24161] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/shelp.php"] [unique_id "alxkxh70hbVC6Snzbho_RQAAAPI"]
[Sat Jul 18 23:46:46.681172 2026] [security2:error] [pid 943918:tid 944126] [client 4.194.24.143:28440] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/system_log.php"] [unique_id "alxkxh70hbVC6Snzbho_RwAAANI"]
[Sat Jul 18 23:46:46.737738 2026] [security2:error] [pid 943918:tid 944045] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 28.112.35.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "recruitinginsight.us"] [uri "/config.php.bak"] [unique_id "alxkxh70hbVC6Snzbho_TgAA6X0"]
[Sat Jul 18 23:46:46.771864 2026] [security2:error] [pid 943918:tid 944114] [client 173.239.196.165:22867] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 165.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "alxkxh70hbVC6Snzbho_UgAAAMY"]
[Sat Jul 18 23:46:46.772865 2026] [security2:error] [pid 943918:tid 944023] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "recruitinginsight.us"] [uri "/web/.env"] [unique_id "alxkxh70hbVC6Snzbho_UwAA5mc"]
[Sat Jul 18 23:46:46.774389 2026] [security2:error] [pid 943918:tid 943923] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "recruitinginsight.us"] [uri "/configuration.php.bak"] [unique_id "alxkxh70hbVC6Snzbho_VgAA5gM"]
[Sat Jul 18 23:46:46.774475 2026] [security2:error] [pid 943918:tid 943957] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "recruitinginsight.us"] [uri "/public/.env"] [unique_id "alxkxh70hbVC6Snzbho_WwAA5iU"]
[Sat Jul 18 23:46:46.775898 2026] [security2:error] [pid 943918:tid 944047] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.sw[a-z]$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1275"] [id "390587"] [rev "5"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .sw)"] [severity "CRITICAL"] [hostname "recruitinginsight.us"] [uri "/.env.swp"] [unique_id "alxkxh70hbVC6Snzbho_WQAA5n8"]
[Sat Jul 18 23:46:46.826852 2026] [security2:error] [pid 943918:tid 944117] [client 185.192.71.225:35121] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/wp-admin/css/index.php"] [unique_id "alxkxh70hbVC6Snzbho_XgAAAMk"]
[Sat Jul 18 23:46:46.831248 2026] [security2:error] [pid 943918:tid 944057] [client 91.230.225.157:45381] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/wp-content/themes/txets.php"] [unique_id "alxkxh70hbVC6Snzbho_YAAAAI0"]
[Sat Jul 18 23:46:46.839371 2026] [security2:error] [pid 943918:tid 944075] [client 185.192.71.217:48837] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/wp-admin/css/index.php"] [unique_id "alxkxh70hbVC6Snzbho_YQAAAJ8"]
[Sat Jul 18 23:46:46.915463 2026] [security2:error] [pid 943918:tid 944133] [client 185.192.71.215:42579] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/cord.php"] [unique_id "alxkxh70hbVC6Snzbho_ZAAAANk"]
[Sat Jul 18 23:46:46.942739 2026] [security2:error] [pid 943918:tid 944155] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkxh70hbVC6Snzbho_QAAA72g"]
[Sat Jul 18 23:46:46.963206 2026] [security2:error] [pid 938041:tid 938245] [client 185.92.25.92:28729] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/zwso.php"] [unique_id "alxkxiNrzsYMDd5sB11NPQAAAEk"]
[Sat Jul 18 23:46:46.993981 2026] [security2:error] [pid 943918:tid 944129] [client 4.194.24.143:28421] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/t.php"] [unique_id "alxkxh70hbVC6Snzbho_aQAAANU"]
[Sat Jul 18 23:46:47.122975 2026] [security2:error] [pid 943918:tid 944136] [client 185.192.71.225:36459] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/wp-content/plugins/index.php"] [unique_id "alxkxx70hbVC6Snzbho_awAAANw"]
[Sat Jul 18 23:46:47.127434 2026] [security2:error] [pid 943918:tid 944097] [client 45.134.20.139:28761] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 139.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/init.php"] [unique_id "alxkxx70hbVC6Snzbho_bQAAALU"]
[Sat Jul 18 23:46:47.129566 2026] [security2:error] [pid 943918:tid 944154] [client 185.192.71.215:31571] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/wp-admin/txets.php"] [unique_id "alxkxx70hbVC6Snzbho_bgAAAO4"]
[Sat Jul 18 23:46:47.130322 2026] [security2:error] [pid 943918:tid 944083] [client 185.192.71.215:59063] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/wp-content/plugins/index.php"] [unique_id "alxkxx70hbVC6Snzbho_bwAAAKc"]
[Sat Jul 18 23:46:47.189007 2026] [security2:error] [pid 943918:tid 944056] [client 185.192.71.217:58575] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/dex.php"] [unique_id "alxkxx70hbVC6Snzbho_dgAAAIw"]
[Sat Jul 18 23:46:47.229047 2026] [security2:error] [pid 943918:tid 944073] [client 4.194.24.143:20640] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/t.php"] [unique_id "alxkxx70hbVC6Snzbho_eQAAAJ0"]
[Sat Jul 18 23:46:47.238509 2026] [security2:error] [pid 943918:tid 944169] [client 185.92.25.79:61119] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxkxx70hbVC6Snzbho_ewAAAP0"]
[Sat Jul 18 23:46:47.268906 2026] [security2:error] [pid 943918:tid 944061] [client 45.133.7.60:39887] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 60.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/error.php"] [unique_id "alxkxx70hbVC6Snzbho_fQAAAJE"]
[Sat Jul 18 23:46:47.304728 2026] [security2:error] [pid 943918:tid 944146] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxh70hbVC6Snzbho_UAAA5gQ"]
[Sat Jul 18 23:46:47.314456 2026] [security2:error] [pid 943918:tid 944146] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxh70hbVC6Snzbho_VwAA5lk"]
[Sat Jul 18 23:46:47.319633 2026] [security2:error] [pid 943918:tid 944146] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxh70hbVC6Snzbho_VQAA5kE"]
[Sat Jul 18 23:46:47.324641 2026] [security2:error] [pid 943918:tid 944146] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxh70hbVC6Snzbho_VAAA5nY"]
[Sat Jul 18 23:46:47.326791 2026] [security2:error] [pid 938041:tid 938218] [client 185.92.25.83:48207] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/bolt.php"] [unique_id "alxkxyNrzsYMDd5sB11NQQAAAC4"]
[Sat Jul 18 23:46:47.336004 2026] [security2:error] [pid 943918:tid 943940] [remote 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxh70hbVC6Snzbho_WgAA5hQ"]
[Sat Jul 18 23:46:47.336039 2026] [security2:error] [pid 943918:tid 944146] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxh70hbVC6Snzbho_WAAA5gk"]
[Sat Jul 18 23:46:47.442260 2026] [security2:error] [pid 943918:tid 944084] [client 185.192.71.215:39459] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/wp-includes/txets.php"] [unique_id "alxkxx70hbVC6Snzbho_iQAAAKg"]
[Sat Jul 18 23:46:47.443642 2026] [security2:error] [pid 943918:tid 944149] [client 91.230.225.160:58155] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/wp-content/index.php"] [unique_id "alxkxx70hbVC6Snzbho_iwAAAOk"]
[Sat Jul 18 23:46:47.443935 2026] [security2:error] [pid 938041:tid 938261] [client 185.92.25.82:58079] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/wp-content/index.php"] [unique_id "alxkxyNrzsYMDd5sB11NQwAAAFk"]
[Sat Jul 18 23:46:47.491285 2026] [security2:error] [pid 943918:tid 944170] [client 91.230.225.154:25509] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxkxx70hbVC6Snzbho_jgAAAP4"]
[Sat Jul 18 23:46:47.521696 2026] [security2:error] [pid 943918:tid 944123] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkxx70hbVC6Snzbho_cQAAz3M"]
[Sat Jul 18 23:46:47.537617 2026] [security2:error] [pid 943918:tid 944158] [client 4.194.24.143:23055] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/term.php"] [unique_id "alxkxx70hbVC6Snzbho_lAAAAPI"]
[Sat Jul 18 23:46:47.548567 2026] [security2:error] [pid 943918:tid 944137] [client 185.92.25.79:48977] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/cjfuns.php"] [unique_id "alxkxx70hbVC6Snzbho_lQAAAN0"]
[Sat Jul 18 23:46:47.549619 2026] [security2:error] [pid 943918:tid 944075] [client 91.230.225.162:34201] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/bolt.php"] [unique_id "alxkxx70hbVC6Snzbho_lgAAAJ8"]
[Sat Jul 18 23:46:47.551933 2026] [security2:error] [pid 943918:tid 943964] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "recruitinginsight.us"] [uri "/appsettings.json"] [unique_id "alxkxx70hbVC6Snzbho_lwAAvyw"]
[Sat Jul 18 23:46:47.607920 2026] [security2:error] [pid 943918:tid 944074] [client 185.92.25.91:51595] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/cjfuns.php"] [unique_id "alxkxx70hbVC6Snzbho_ngAAAJ4"]
[Sat Jul 18 23:46:47.722071 2026] [security2:error] [pid 943918:tid 944091] [client 185.92.25.85:46345] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/goods.php"] [unique_id "alxkxx70hbVC6Snzbho_qAAAAK8"]
[Sat Jul 18 23:46:47.726956 2026] [security2:error] [pid 938041:tid 938244] [client 185.192.71.210:49469] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/ioxi-o.php"] [unique_id "alxkxyNrzsYMDd5sB11NSwAAAEg"]
[Sat Jul 18 23:46:47.747230 2026] [security2:error] [pid 943918:tid 944087] [client 91.230.225.162:53855] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/ioxi-o.php"] [unique_id "alxkxx70hbVC6Snzbho_qgAAAKs"]
[Sat Jul 18 23:46:47.768044 2026] [security2:error] [pid 943918:tid 944055] [client 4.194.24.143:16785] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/term.php"] [unique_id "alxkxx70hbVC6Snzbho_qwAAAIs"]
[Sat Jul 18 23:46:47.776202 2026] [security2:error] [pid 938041:tid 938179] [client 185.192.71.208:46959] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/zwso.php"] [unique_id "alxkxyNrzsYMDd5sB11NTQAAAAc"]
[Sat Jul 18 23:46:47.829302 2026] [security2:error] [pid 938041:tid 938180] [client 185.92.25.87:64271] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/wp-admin/css/index.php"] [unique_id "alxkxyNrzsYMDd5sB11NUAAAAAg"]
[Sat Jul 18 23:46:47.836221 2026] [security2:error] [pid 938041:tid 938286] [client 185.92.25.134:37081] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/cjfuns.php"] [unique_id "alxkxyNrzsYMDd5sB11NUgAAAHI"]
[Sat Jul 18 23:46:47.882015 2026] [security2:error] [pid 943918:tid 944039] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "web.config"] [severity "CRITICAL"] [hostname "recruitinginsight.us"] [uri "/web.config"] [unique_id "alxkxx70hbVC6Snzbho_sgAAv3c"]
[Sat Jul 18 23:46:47.897453 2026] [security2:error] [pid 943918:tid 943921] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "recruitinginsight.us"] [uri "/config/database.yml"] [unique_id "alxkxx70hbVC6Snzbho_twAAvwE"]
[Sat Jul 18 23:46:47.897990 2026] [security2:error] [pid 943918:tid 944141] [client 185.92.25.92:40221] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/wp-admin/css/index.php"] [unique_id "alxkxx70hbVC6Snzbho_uAAAAOE"]
[Sat Jul 18 23:46:47.948485 2026] [security2:error] [pid 938041:tid 938199] [client 45.133.7.94:29237] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 94.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/pwnd/admin-footer.php"] [unique_id "alxkxyNrzsYMDd5sB11NVAAAABs"]
[Sat Jul 18 23:46:48.012391 2026] [security2:error] [pid 943918:tid 944073] [client 185.192.71.213:27893] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/wp-editor.php"] [unique_id "alxkyB70hbVC6Snzbho_vQAAAJ0"]
[Sat Jul 18 23:46:48.034437 2026] [security2:error] [pid 938041:tid 938172] [client 45.134.20.114:60593] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "alxkxyNrzsYMDd5sB11NVwAAAAA"]
[Sat Jul 18 23:46:48.035860 2026] [security2:error] [pid 943918:tid 944138] [client 91.230.225.155:22775] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/insc.php"] [unique_id "alxkyB70hbVC6Snzbho_vgAAAN4"]
[Sat Jul 18 23:46:48.080201 2026] [security2:error] [pid 943918:tid 944071] [client 4.194.24.143:16784] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/test.php"] [unique_id "alxkyB70hbVC6Snzbho_wQAAAJs"]
[Sat Jul 18 23:46:48.084827 2026] [security2:error] [pid 943918:tid 944153] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkxx70hbVC6Snzbho_qQAA7Rk"]
[Sat Jul 18 23:46:48.103865 2026] [security2:error] [pid 943918:tid 944063] [client 173.239.196.163:64285] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/load.php"] [unique_id "alxkyB70hbVC6Snzbho_0gAAAJM"]
[Sat Jul 18 23:46:48.120847 2026] [security2:error] [pid 943918:tid 944101] [client 185.192.71.216:64765] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/wp-admin/css/index.php"] [unique_id "alxkyB70hbVC6Snzbho_1AAAALk"]
[Sat Jul 18 23:46:48.193000 2026] [security2:error] [pid 943918:tid 944085] [client 185.192.71.212:65385] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/wp-content/plugins/index.php"] [unique_id "alxkyB70hbVC6Snzbho_2QAAAKk"]
[Sat Jul 18 23:46:48.194168 2026] [security2:error] [pid 943918:tid 944107] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxx70hbVC6Snzbho_nAAAvx4"]
[Sat Jul 18 23:46:48.195650 2026] [security2:error] [pid 943918:tid 944107] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxx70hbVC6Snzbho_mgAAv1E"]
[Sat Jul 18 23:46:48.209846 2026] [security2:error] [pid 943918:tid 944107] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxx70hbVC6Snzbho_mwAAv2M"]
[Sat Jul 18 23:46:48.214242 2026] [security2:error] [pid 943918:tid 944107] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxx70hbVC6Snzbho_mAAAvxs"]
[Sat Jul 18 23:46:48.217027 2026] [security2:error] [pid 943918:tid 944107] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxx70hbVC6Snzbho_mQAAvys"]
[Sat Jul 18 23:46:48.220477 2026] [security2:error] [pid 943918:tid 944168] [client 163.61.1.17:51741] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkyB70hbVC6Snzbho_3AAAAPw"]
[Sat Jul 18 23:46:48.220595 2026] [security2:error] [pid 943918:tid 944168] [client 163.61.1.17:51741] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxkyB70hbVC6Snzbho_3AAAAPw"]
[Sat Jul 18 23:46:48.324833 2026] [security2:error] [pid 943918:tid 944005] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "recruitinginsight.us"] [uri "/settings.py"] [unique_id "alxkyB70hbVC6Snzbho_-gAAv1U"]
[Sat Jul 18 23:46:48.325094 2026] [security2:error] [pid 943918:tid 944107] [client 34.35.112.28:55064] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "recruitinginsight.us"] [uri "/settings.py"] [unique_id "alxkyB70hbVC6Snzbho_-gAAv1U"]
[Sat Jul 18 23:46:48.327841 2026] [security2:error] [pid 938041:tid 938189] [client 4.194.24.143:16793] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/test.php"] [unique_id "alxkyCNrzsYMDd5sB11NXwAAABE"]
[Sat Jul 18 23:46:48.399594 2026] [security2:error] [pid 943918:tid 944107] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxx70hbVC6Snzbho_tgAAv3E"]
[Sat Jul 18 23:46:48.399893 2026] [security2:error] [pid 943918:tid 944107] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxx70hbVC6Snzbho_tQAAvwU"]
[Sat Jul 18 23:46:48.402400 2026] [security2:error] [pid 943918:tid 944158] [client 91.230.225.152:57697] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/wp-content/plugins/index.php"] [unique_id "alxkyB70hbVC6SnzbhpAAQAAAPI"]
[Sat Jul 18 23:46:48.415080 2026] [security2:error] [pid 943918:tid 944107] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxx70hbVC6Snzbho_uQAAvwc"]
[Sat Jul 18 23:46:48.419795 2026] [security2:error] [pid 943918:tid 944107] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkxx70hbVC6Snzbho_ugAAvww"]
[Sat Jul 18 23:46:48.479429 2026] [security2:error] [pid 943918:tid 944134] [client 185.192.71.218:49739] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/wp-content/index.php"] [unique_id "alxkyB70hbVC6SnzbhpABgAAANo"]
[Sat Jul 18 23:46:48.544650 2026] [security2:error] [pid 943918:tid 944107] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkyB70hbVC6Snzbho_4AAAvz4"]
[Sat Jul 18 23:46:48.568891 2026] [security2:error] [pid 943918:tid 944026] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "recruitinginsight.us"] [uri "/.streamlit/secrets.toml"] [unique_id "alxkyB70hbVC6SnzbhpACwAAv2o"]
[Sat Jul 18 23:46:48.629656 2026] [security2:error] [pid 943918:tid 944163] [client 45.133.7.80:24549] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "alxkyB70hbVC6SnzbhpAEgAAAPc"]
[Sat Jul 18 23:46:48.676844 2026] [security2:error] [pid 943918:tid 944062] [client 4.194.24.143:23056] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/test1.php"] [unique_id "alxkyB70hbVC6SnzbhpAFAAAAJI"]
[Sat Jul 18 23:46:48.704638 2026] [autoindex:error] [pid 943918:tid 944115] [client 34.172.185.49:0] AH01276: Cannot serve directory /home1/acaiandc/public_html/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: http://acaiandcitystreets.com/?rest_route=/batch/v1
[Sat Jul 18 23:46:48.720891 2026] [security2:error] [pid 943918:tid 944170] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkyB70hbVC6Snzbho_-AAA_iI"]
[Sat Jul 18 23:46:48.758473 2026] [security2:error] [pid 943918:tid 944072] [client 185.92.25.85:62705] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/ioxi-o.php"] [unique_id "alxkyB70hbVC6SnzbhpAIAAAAJw"]
[Sat Jul 18 23:46:48.809618 2026] [security2:error] [pid 943918:tid 944008] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "recruitinginsight.us"] [uri "/frontend/.env"] [unique_id "alxkyB70hbVC6SnzbhpAIwAAv1g"]
[Sat Jul 18 23:46:48.864261 2026] [security2:error] [pid 943918:tid 944025] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "recruitinginsight.us"] [uri "/app/.env"] [unique_id "alxkyB70hbVC6SnzbhpAJQAAv2k"]
[Sat Jul 18 23:46:48.865311 2026] [security2:error] [pid 943918:tid 944044] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "recruitinginsight.us"] [uri "/server/.env"] [unique_id "alxkyB70hbVC6SnzbhpAJgAAv3w"]
[Sat Jul 18 23:46:48.866245 2026] [security2:error] [pid 943918:tid 943969] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "recruitinginsight.us"] [uri "/src/.env"] [unique_id "alxkyB70hbVC6SnzbhpAJwAAvzE"]
[Sat Jul 18 23:46:48.890568 2026] [security2:error] [pid 938041:tid 938266] [client 45.134.20.138:32573] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 138.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/autoload_classmap/function.php"] [unique_id "alxkyCNrzsYMDd5sB11NaQAAAF4"]
[Sat Jul 18 23:46:48.897115 2026] [security2:error] [pid 943918:tid 944154] [client 4.194.24.143:20664] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/test1.php"] [unique_id "alxkyB70hbVC6SnzbhpAKQAAAO4"]
[Sat Jul 18 23:46:48.902433 2026] [security2:error] [pid 943918:tid 944160] [client 185.92.25.79:58859] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/ioxi-o.php"] [unique_id "alxkyB70hbVC6SnzbhpAKwAAAPQ"]
[Sat Jul 18 23:46:48.956673 2026] [security2:error] [pid 943918:tid 944032] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "recruitinginsight.us"] [uri "/dev/.env"] [unique_id "alxkyB70hbVC6SnzbhpAMAAAv3A"]
[Sat Jul 18 23:46:48.961445 2026] [security2:error] [pid 938041:tid 938253] [client 106.222.249.209:13159] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkyCNrzsYMDd5sB11NagAAAFE"]
[Sat Jul 18 23:46:48.961566 2026] [security2:error] [pid 938041:tid 938253] [client 106.222.249.209:13159] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxkyCNrzsYMDd5sB11NagAAAFE"]
[Sat Jul 18 23:46:48.977273 2026] [security2:error] [pid 943918:tid 944144] [client 173.239.196.166:51205] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "alxkyB70hbVC6SnzbhpAMgAAAOQ"]
[Sat Jul 18 23:46:49.088491 2026] [security2:error] [pid 943918:tid 944158] [client 185.92.25.89:44271] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "alxkyR70hbVC6SnzbhpAOQAAAPI"]
[Sat Jul 18 23:46:49.118492 2026] [security2:error] [pid 943918:tid 943926] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "recruitinginsight.us"] [uri "/production/.env"] [unique_id "alxkyR70hbVC6SnzbhpAPQAAvwY"]
[Sat Jul 18 23:46:49.172583 2026] [security2:error] [pid 943918:tid 944107] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkyB70hbVC6Snzbho_-QAAv04"]
[Sat Jul 18 23:46:49.199428 2026] [security2:error] [pid 943918:tid 944069] [client 185.192.71.216:64033] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/insc.php"] [unique_id "alxkyR70hbVC6SnzbhpAQwAAAJk"]
[Sat Jul 18 23:46:49.200147 2026] [security2:error] [pid 943918:tid 944166] [client 185.192.71.214:22389] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/insc.php"] [unique_id "alxkyR70hbVC6SnzbhpARAAAAPo"]
[Sat Jul 18 23:46:49.212927 2026] [security2:error] [pid 943918:tid 944030] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\.bak|\\\\.bak\\\\.php)$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1260"] [id "390582"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that nclude .bak)"] [severity "CRITICAL"] [hostname "recruitinginsight.us"] [uri "/.env.prod.bak"] [unique_id "alxkyR70hbVC6SnzbhpARQAAv24"]
[Sat Jul 18 23:46:49.223941 2026] [security2:error] [pid 943918:tid 944027] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "recruitinginsight.us"] [uri "/docker/.env"] [unique_id "alxkyR70hbVC6SnzbhpARgAAv2s"]
[Sat Jul 18 23:46:49.244079 2026] [security2:error] [pid 943918:tid 944082] [client 185.92.25.135:57283] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/wp-content/plugins/index.php"] [unique_id "alxkyR70hbVC6SnzbhpASQAAAKY"]
[Sat Jul 18 23:46:49.266644 2026] [security2:error] [pid 938041:tid 938250] [client 4.194.24.143:28420] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/tfm.php"] [unique_id "alxkySNrzsYMDd5sB11NdQAAAE4"]
[Sat Jul 18 23:46:49.298651 2026] [security2:error] [pid 943918:tid 944028] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "recruitinginsight.us"] [uri "/staging/.env"] [unique_id "alxkyR70hbVC6SnzbhpATwAAv2w"]
[Sat Jul 18 23:46:49.299314 2026] [security2:error] [pid 943918:tid 944024] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\.bak|\\\\.bak\\\\.php)$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1260"] [id "390582"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that nclude .bak)"] [severity "CRITICAL"] [hostname "recruitinginsight.us"] [uri "/.env.production.bak"] [unique_id "alxkyR70hbVC6SnzbhpATgAAv2g"]
[Sat Jul 18 23:46:49.310706 2026] [security2:error] [pid 943918:tid 944051] [client 45.133.7.77:34619] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 77.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/languages/themes/index.php"] [unique_id "alxkyR70hbVC6SnzbhpAUAAAAIc"]
[Sat Jul 18 23:46:49.355559 2026] [security2:error] [pid 943918:tid 944107] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkyB70hbVC6SnzbhpACQAAv2Y"]
[Sat Jul 18 23:46:49.360898 2026] [security2:error] [pid 943918:tid 944102] [client 185.192.71.214:43005] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/classwithtostring.php"] [unique_id "alxkyR70hbVC6SnzbhpAVQAAALo"]
[Sat Jul 18 23:46:49.367921 2026] [security2:error] [pid 943918:tid 944107] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkyB70hbVC6SnzbhpADAAAv0A"]
[Sat Jul 18 23:46:49.382695 2026] [security2:error] [pid 943918:tid 944126] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkyB70hbVC6SnzbhpALwAA0kQ"]
[Sat Jul 18 23:46:49.388229 2026] [security2:error] [pid 943918:tid 944107] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkyB70hbVC6SnzbhpADQAAv1Y"]
[Sat Jul 18 23:46:49.394688 2026] [security2:error] [pid 943918:tid 944107] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkyB70hbVC6SnzbhpAFwAAv1o"]
[Sat Jul 18 23:46:49.438832 2026] [security2:error] [pid 943918:tid 944107] [client 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkyB70hbVC6SnzbhpACgAAv1M"]
[Sat Jul 18 23:46:49.439174 2026] [security2:error] [pid 943918:tid 944076] [client 4.194.24.143:16831] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/tfm.php"] [unique_id "alxkyR70hbVC6SnzbhpAWwAAAKA"]
[Sat Jul 18 23:46:49.451481 2026] [security2:error] [pid 943918:tid 944141] [client 185.92.25.93:32697] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/bolt.php"] [unique_id "alxkyR70hbVC6SnzbhpAXAAAAOE"]
[Sat Jul 18 23:46:49.466180 2026] [security2:error] [pid 943918:tid 944007] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "recruitinginsight.us"] [uri "/@fs/.env"] [unique_id "alxkyR70hbVC6SnzbhpAXQAAlVc"]
[Sat Jul 18 23:46:49.484201 2026] [security2:error] [pid 938041:tid 938277] [client 185.192.71.225:36309] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/lufix.php"] [unique_id "alxkySNrzsYMDd5sB11NewAAAGk"]
[Sat Jul 18 23:46:49.558260 2026] [security2:error] [pid 943918:tid 944159] [client 1.92.217.201:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxkxx70hbVC6Snzbho_rwAA80Y"]
[Sat Jul 18 23:46:49.564399 2026] [security2:error] [pid 943918:tid 943985] [remote 34.35.112.28:55064] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "recruitinginsight.us"] [uri "/@fs/root/.env"] [unique_id "alxkyR70hbVC6SnzbhpAZQAAlEE"]
[Sat Jul 18 23:46:49.597900 2026] [security2:error] [pid 938041:tid 938273] [client 180.252.198.240:52763] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkySNrzsYMDd5sB11NggAAAGU"]
[Sat Jul 18 23:46:49.598072 2026] [security2:error] [pid 938041:tid 938273] [client 180.252.198.240:52763] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxkySNrzsYMDd5sB11NggAAAGU"]
[Sat Jul 18 23:46:49.603880 2026] [security2:error] [pid 938041:tid 938227] [client 185.192.71.221:63301] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/classwithtostring.php"] [unique_id "alxkySNrzsYMDd5sB11NgwAAADc"]
[Sat Jul 18 23:46:49.612538 2026] [security2:error] [pid 943918:tid 944157] [client 185.192.71.209:46873] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/classwithtostring.php"] [unique_id "alxkyR70hbVC6SnzbhpAaAAAAPE"]
[Sat Jul 18 23:46:49.685207 2026] [security2:error] [pid 943918:tid 944131] [client 91.230.225.164:44319] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/wp-content/index.php"] [unique_id "alxkyR70hbVC6SnzbhpAbQAAANc"]
[Sat Jul 18 23:46:49.700986 2026] [security2:error] [pid 943918:tid 944079] [client 185.92.25.92:25969] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/txets.php"] [unique_id "alxkyR70hbVC6SnzbhpAbwAAAKM"]
[Sat Jul 18 23:46:49.703832 2026] [security2:error] [pid 943918:tid 943946] [remote 34.35.112.28:55064] ModSecurity: Access denied with connection close (phase 1). Pattern match "proc/self/environ" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1161"] [id "999997"] [msg "proc environ"] [hostname "recruitinginsight.us"] [uri "/@fs/proc/self/environ"] [unique_id "alxkyR70hbVC6SnzbhpAcAAAkxo"]
[Sat Jul 18 23:46:49.746607 2026] [security2:error] [pid 938041:tid 938224] [client 185.192.71.211:62549] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/wp-content/index.php"] [unique_id "alxkySNrzsYMDd5sB11NhAAAADQ"]
[Sat Jul 18 23:46:49.747933 2026] [security2:error] [pid 943918:tid 944099] [client 45.134.20.133:51569] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/item.php"] [unique_id "alxkyR70hbVC6SnzbhpAcgAAALc"]
[Sat Jul 18 23:46:49.761787 2026] [security2:error] [pid 943918:tid 944127] [client 185.192.71.217:31943] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/cjfuns.php"] [unique_id "alxkyR70hbVC6SnzbhpAcwAAANM"]
[Sat Jul 18 23:46:49.808041 2026] [security2:error] [pid 943918:tid 944038] [remote 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkyR70hbVC6SnzbhpAZgAAk3Y"]
[Sat Jul 18 23:46:49.810576 2026] [security2:error] [pid 938041:tid 938186] [client 4.194.24.143:30878] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/thebe.php"] [unique_id "alxkySNrzsYMDd5sB11NhwAAAA4"]
[Sat Jul 18 23:46:49.862902 2026] [security2:error] [pid 938041:tid 938286] [client 173.239.196.160:30781] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.196.239.173.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "sixpackminer.org"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "alxkySNrzsYMDd5sB11NiQAAAHI"]
[Sat Jul 18 23:46:49.917446 2026] [security2:error] [pid 943918:tid 943929] [remote 34.35.112.28:55064] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkyR70hbVC6SnzbhpAbAAAkwk"]
[Sat Jul 18 23:46:49.989243 2026] [security2:error] [pid 943918:tid 944119] [client 45.133.7.93:34201] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 93.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-files.php"] [unique_id "alxkyR70hbVC6SnzbhpAfAAAAMs"]
[Sat Jul 18 23:46:49.991919 2026] [security2:error] [pid 938041:tid 938220] [client 4.194.24.143:34973] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/thebe.php"] [unique_id "alxkySNrzsYMDd5sB11NjQAAADA"]
[Sat Jul 18 23:46:49.994769 2026] [security2:error] [pid 943918:tid 944128] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkyR70hbVC6SnzbhpAawAA1DA"]
[Sat Jul 18 23:46:50.130292 2026] [security2:error] [pid 943918:tid 944074] [client 91.230.225.151:35215] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/txets.php"] [unique_id "alxkyh70hbVC6SnzbhpAgwAAAJ4"]
[Sat Jul 18 23:46:50.131177 2026] [security2:error] [pid 938041:tid 938249] [client 91.230.225.151:31093] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/txets.php"] [unique_id "alxkyiNrzsYMDd5sB11NlgAAAE0"]
[Sat Jul 18 23:46:50.145219 2026] [security2:error] [pid 943918:tid 944097] [client 91.230.225.161:25191] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/ioxi-o.php"] [unique_id "alxkyh70hbVC6SnzbhpAhAAAALU"]
[Sat Jul 18 23:46:50.170466 2026] [security2:error] [pid 938041:tid 938232] [client 185.92.25.87:33441] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/ioxi-o.php"] [unique_id "alxkyiNrzsYMDd5sB11NlwAAADw"]
[Sat Jul 18 23:46:50.173180 2026] [security2:error] [pid 938041:tid 938184] [client 185.92.25.82:59937] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/wp-admin/css/index.php"] [unique_id "alxkyiNrzsYMDd5sB11NmQAAAAw"]
[Sat Jul 18 23:46:50.340310 2026] [security2:error] [pid 943918:tid 944084] [client 185.192.71.218:60957] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/insc.php"] [unique_id "alxkyh70hbVC6SnzbhpAigAAAKg"]
[Sat Jul 18 23:46:50.353430 2026] [security2:error] [pid 938041:tid 938264] [client 4.194.24.143:23053] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/themes.php"] [unique_id "alxkyiNrzsYMDd5sB11NnAAAAFw"]
[Sat Jul 18 23:46:50.396904 2026] [security2:error] [pid 938041:tid 938230] [client 92.71.98.48:55646] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.sesamegreenbeans.com"] [uri "/index.php"] [unique_id "alxkyiNrzsYMDd5sB11NmAAAOgM"]
[Sat Jul 18 23:46:50.416437 2026] [security2:error] [pid 943918:tid 944129] [client 185.192.71.213:55643] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/wp-content/themes/txets.php"] [unique_id "alxkyh70hbVC6SnzbhpAjwAAANU"]
[Sat Jul 18 23:46:50.416548 2026] [security2:error] [pid 943918:tid 944121] [client 185.192.71.221:35763] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/wp-content/themes/txets.php"] [unique_id "alxkyh70hbVC6SnzbhpAkAAAAM0"]
[Sat Jul 18 23:46:50.445921 2026] [security2:error] [pid 943918:tid 944115] [client 185.192.71.212:26265] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/insc.php"] [unique_id "alxkyh70hbVC6SnzbhpAkgAAAMc"]
[Sat Jul 18 23:46:50.450793 2026] [security2:error] [pid 943918:tid 944151] [client 185.192.71.206:36211] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/wp-content/plugins/index.php"] [unique_id "alxkyh70hbVC6SnzbhpAkwAAAOs"]
[Sat Jul 18 23:46:50.457273 2026] [security2:error] [pid 943918:tid 944170] [client 91.230.225.163:25699] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/insc.php"] [unique_id "alxkyh70hbVC6SnzbhpAlAAAAP4"]
[Sat Jul 18 23:46:50.543803 2026] [security2:error] [pid 943918:tid 944120] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkyh70hbVC6SnzbhpAhgAAzCc"]
[Sat Jul 18 23:46:50.562362 2026] [security2:error] [pid 943918:tid 944087] [client 4.194.24.143:20661] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/themes.php"] [unique_id "alxkyh70hbVC6SnzbhpAmQAAAKs"]
[Sat Jul 18 23:46:50.599746 2026] [security2:error] [pid 943918:tid 944083] [client 45.134.20.120:54985] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 120.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/assets/index.php"] [unique_id "alxkyh70hbVC6SnzbhpAngAAAKc"]
[Sat Jul 18 23:46:50.668952 2026] [security2:error] [pid 943918:tid 944169] [client 45.133.7.86:51901] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 86.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/functions.php"] [unique_id "alxkyh70hbVC6SnzbhpAqAAAAP0"]
[Sat Jul 18 23:46:50.716152 2026] [security2:error] [pid 943918:tid 944085] [client 173.239.196.164:62959] ModSecurity: Access denied with connection close (phase 1). Pattern match "c99\\\\.php|r57shell\\\\.php|r57\\\\.php|c99\\\\.txt" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1164"] [id "900010"] [rev "1"] [msg "c99 variant "] [severity "CRITICAL"] [hostname "sixpackminer.org"] [uri "/images/c99.php"] [unique_id "alxkyh70hbVC6SnzbhpArgAAAKk"]
[Sat Jul 18 23:46:50.722226 2026] [security2:error] [pid 943918:tid 944146] [client 185.192.71.218:37669] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/classwithtostring.php"] [unique_id "alxkyh70hbVC6SnzbhpArwAAAOY"]
[Sat Jul 18 23:46:50.731018 2026] [security2:error] [pid 943918:tid 944144] [client 185.92.25.82:24357] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/wp-admin/txets.php"] [unique_id "alxkyh70hbVC6SnzbhpAsAAAAOQ"]
[Sat Jul 18 23:46:50.740861 2026] [security2:error] [pid 943918:tid 944089] [client 185.92.25.86:23855] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/classwithtostring.php"] [unique_id "alxkyh70hbVC6SnzbhpAsgAAAK0"]
[Sat Jul 18 23:46:50.787877 2026] [security2:error] [pid 943918:tid 944057] [client 185.192.71.214:30819] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/wp-admin/txets.php"] [unique_id "alxkyh70hbVC6SnzbhpAtgAAAI0"]
[Sat Jul 18 23:46:50.795398 2026] [security2:error] [pid 943918:tid 944124] [client 91.230.225.150:62493] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/classwithtostring.php"] [unique_id "alxkyh70hbVC6SnzbhpAtwAAANA"]
[Sat Jul 18 23:46:50.823653 2026] [security2:error] [pid 943918:tid 944148] [client 91.230.225.154:58015] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/wp-content/index.php"] [unique_id "alxkyh70hbVC6SnzbhpAuQAAAOg"]
[Sat Jul 18 23:46:50.921400 2026] [security2:error] [pid 943918:tid 944165] [client 4.194.24.143:20645] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/tiny.php"] [unique_id "alxkyh70hbVC6SnzbhpAvwAAAPk"]
[Sat Jul 18 23:46:50.942687 2026] [security2:error] [pid 943918:tid 944075] [client 185.92.25.89:62733] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "autodiscover.kdg.jiv.mybluehost.me"] [uri "/style.php"] [unique_id "alxkyh70hbVC6SnzbhpAwQAAAJ8"]
[Sat Jul 18 23:46:51.052427 2026] [security2:error] [pid 943918:tid 944170] [client 185.192.71.222:60183] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/txets.php"] [unique_id "alxkyx70hbVC6SnzbhpAyAAAAP4"]
[Sat Jul 18 23:46:51.065419 2026] [security2:error] [pid 943918:tid 944095] [client 91.230.225.160:63489] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/wp-includes/txets.php"] [unique_id "alxkyx70hbVC6SnzbhpAywAAALM"]
[Sat Jul 18 23:46:51.065762 2026] [security2:error] [pid 943918:tid 944125] [client 185.192.71.225:38817] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/txets.php"] [unique_id "alxkyx70hbVC6SnzbhpAzAAAANE"]
[Sat Jul 18 23:46:51.070349 2026] [security2:error] [pid 943918:tid 944080] [client 185.192.71.215:29067] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/wp-includes/txets.php"] [unique_id "alxkyx70hbVC6SnzbhpAzQAAAKQ"]
[Sat Jul 18 23:46:51.082237 2026] [security2:error] [pid 943918:tid 944168] [client 185.192.71.209:30991] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/txets.php"] [unique_id "alxkyx70hbVC6SnzbhpAzgAAAPw"]
[Sat Jul 18 23:46:51.103682 2026] [security2:error] [pid 943918:tid 944128] [client 4.194.24.143:23062] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/tiny.php"] [unique_id "alxkyx70hbVC6SnzbhpAzwAAANQ"]
[Sat Jul 18 23:46:51.129367 2026] [security2:error] [pid 943918:tid 944117] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkyh70hbVC6SnzbhpAtAAAyRE"]
[Sat Jul 18 23:46:51.347550 2026] [security2:error] [pid 943918:tid 944152] [client 185.192.71.224:59045] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/wp-content/themes/txets.php"] [unique_id "alxkyx70hbVC6SnzbhpA4wAAAOw"]
[Sat Jul 18 23:46:51.349537 2026] [security2:error] [pid 943918:tid 944157] [client 45.133.7.70:49111] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "alxkyx70hbVC6SnzbhpA5AAAAPE"]
[Sat Jul 18 23:46:51.356047 2026] [security2:error] [pid 943918:tid 944056] [client 91.230.225.160:57459] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/wp-content/themes/txets.php"] [unique_id "alxkyx70hbVC6SnzbhpA5QAAAIw"]
[Sat Jul 18 23:46:51.357553 2026] [security2:error] [pid 943918:tid 944153] [client 185.92.25.91:36525] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/wp-content/themes/txets.php"] [unique_id "alxkyx70hbVC6SnzbhpA5gAAAO0"]
[Sat Jul 18 23:46:51.358450 2026] [security2:error] [pid 938041:tid 938211] [client 185.92.25.89:27151] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/wp-content/themes/txets.php"] [unique_id "alxkyyNrzsYMDd5sB11NqwAAACc"]
[Sat Jul 18 23:46:51.362477 2026] [security2:error] [pid 943918:tid 944077] [client 91.230.225.150:22397] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/goods.php"] [unique_id "alxkyx70hbVC6SnzbhpA6AAAAKE"]
[Sat Jul 18 23:46:51.465431 2026] [security2:error] [pid 943918:tid 944098] [client 45.134.20.137:38869] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 137.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/pki-validation/index.php"] [unique_id "alxkyx70hbVC6SnzbhpA9QAAALY"]
[Sat Jul 18 23:46:51.475312 2026] [security2:error] [pid 938041:tid 938205] [client 4.194.24.143:16822] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lutheranphilosopher.com"] [uri "/tmp/byp.php"] [unique_id "alxkyyNrzsYMDd5sB11NrwAAACE"]
[Sat Jul 18 23:46:51.561160 2026] [security2:error] [pid 943918:tid 944059] [client 34.35.112.28:33724] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkyx70hbVC6SnzbhpA2wAAjxs"]
[Sat Jul 18 23:46:51.570703 2026] [security2:error] [pid 938041:tid 938217] [client 173.239.196.161:60579] ModSecurity: Access denied with connection close (phase 1). Pattern match "c99\\\\.php|r57shell\\\\.php|r57\\\\.php|c99\\\\.txt" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1164"] [id "900010"] [rev "1"] [msg "c99 variant "] [severity "CRITICAL"] [hostname "sixpackminer.org"] [uri "/images/c99.php"] [unique_id "alxkyyNrzsYMDd5sB11NswAAAC0"]
[Sat Jul 18 23:46:51.580605 2026] [security2:error] [pid 943918:tid 944162] [client 50.116.65.227:53248] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxkyx70hbVC6SnzbhpBAwAAAPY"]
[Sat Jul 18 23:46:51.591073 2026] [security2:error] [pid 943918:tid 944059] [client 34.35.112.28:33724] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkyx70hbVC6SnzbhpA4AAAj0s"]
[Sat Jul 18 23:46:51.597317 2026] [security2:error] [pid 943918:tid 944119] [client 50.116.65.227:34652] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxkyx70hbVC6SnzbhpBBAAAAMs"]
[Sat Jul 18 23:46:51.607944 2026] [security2:error] [pid 943918:tid 944059] [client 34.35.112.28:33724] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkyx70hbVC6SnzbhpA3QAAjz8"]
[Sat Jul 18 23:46:51.645250 2026] [security2:error] [pid 938041:tid 938233] [client 4.194.24.143:17035] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nurturemarple.co.uk"] [uri "/tmp/byp.php"] [unique_id "alxkyyNrzsYMDd5sB11NtAAAAD0"]
[Sat Jul 18 23:46:51.647344 2026] [security2:error] [pid 938041:tid 938250] [client 185.92.25.81:59041] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/wp-admin/txets.php"] [unique_id "alxkyyNrzsYMDd5sB11NtQAAAE4"]
[Sat Jul 18 23:46:51.665593 2026] [security2:error] [pid 938041:tid 938178] [client 185.92.25.85:42263] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/wp-admin/txets.php"] [unique_id "alxkyyNrzsYMDd5sB11NtwAAAAY"]
[Sat Jul 18 23:46:51.666015 2026] [security2:error] [pid 938041:tid 938216] [client 185.192.71.220:59991] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/wp-admin/txets.php"] [unique_id "alxkyyNrzsYMDd5sB11NuAAAACw"]
[Sat Jul 18 23:46:51.690124 2026] [security2:error] [pid 943918:tid 944135] [client 91.230.225.163:51789] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/wp-admin/txets.php"] [unique_id "alxkyx70hbVC6SnzbhpBCAAAANs"]
[Sat Jul 18 23:46:51.765667 2026] [security2:error] [pid 943918:tid 944089] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkyx70hbVC6SnzbhpA4QAArQo"]
[Sat Jul 18 23:46:52.029387 2026] [security2:error] [pid 938041:tid 938179] [client 45.133.7.82:65373] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "alxkzCNrzsYMDd5sB11NwwAAAAc"]
[Sat Jul 18 23:46:52.039111 2026] [security2:error] [pid 938041:tid 938260] [client 185.92.25.83:34921] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/wp-includes/txets.php"] [unique_id "alxkzCNrzsYMDd5sB11NxAAAAFg"]
[Sat Jul 18 23:46:52.046075 2026] [security2:error] [pid 938041:tid 938294] [client 185.92.25.87:29009] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/wp-includes/txets.php"] [unique_id "alxkzCNrzsYMDd5sB11NxQAAAHo"]
[Sat Jul 18 23:46:52.052700 2026] [security2:error] [pid 938041:tid 938221] [client 91.230.225.160:30055] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/wp-includes/txets.php"] [unique_id "alxkzCNrzsYMDd5sB11NxwAAADE"]
[Sat Jul 18 23:46:52.052704 2026] [security2:error] [pid 938041:tid 938261] [client 185.192.71.217:31073] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/wp-includes/txets.php"] [unique_id "alxkzCNrzsYMDd5sB11NxgAAAFk"]
[Sat Jul 18 23:46:52.134136 2026] [security2:error] [pid 943918:tid 943970] [remote 34.35.112.28:33724] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkyx70hbVC6SnzbhpA3wAAjzI"]
[Sat Jul 18 23:46:52.134898 2026] [security2:error] [pid 943918:tid 943977] [remote 34.35.112.28:33724] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkyx70hbVC6SnzbhpA3gAAjzk"]
[Sat Jul 18 23:46:52.139621 2026] [security2:error] [pid 943918:tid 943963] [remote 34.35.112.28:33724] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkyx70hbVC6SnzbhpA3AAAjys"]
[Sat Jul 18 23:46:52.144509 2026] [security2:error] [pid 943918:tid 943954] [remote 104.131.116.82:46282] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.116.131.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxkzB70hbVC6SnzbhpBHgAAhiI"]
[Sat Jul 18 23:46:52.330554 2026] [security2:error] [pid 938041:tid 938184] [client 45.134.20.123:56697] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 123.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/uploads/admin.php"] [unique_id "alxkzCNrzsYMDd5sB11N1QAAAAw"]
[Sat Jul 18 23:46:52.337928 2026] [security2:error] [pid 943918:tid 944052] [client 91.230.225.155:28515] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/ioxi-o.php"] [unique_id "alxkzB70hbVC6SnzbhpBKwAAAIg"]
[Sat Jul 18 23:46:52.366859 2026] [security2:error] [pid 943918:tid 943992] [remote 34.35.112.28:33724] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkyx70hbVC6SnzbhpA_AAAj0g"]
[Sat Jul 18 23:46:52.379541 2026] [security2:error] [pid 943918:tid 944033] [remote 34.35.112.28:33724] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkyx70hbVC6SnzbhpBAAAAj3E"]
[Sat Jul 18 23:46:52.381824 2026] [security2:error] [pid 938041:tid 938189] [client 91.230.225.157:36055] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/goods.php"] [unique_id "alxkzCNrzsYMDd5sB11N1wAAABE"]
[Sat Jul 18 23:46:52.382973 2026] [security2:error] [pid 938041:tid 938190] [client 91.230.225.153:56875] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/goods.php"] [unique_id "alxkzCNrzsYMDd5sB11N2AAAABI"]
[Sat Jul 18 23:46:52.383617 2026] [security2:error] [pid 938041:tid 938203] [client 91.230.225.152:35783] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/goods.php"] [unique_id "alxkzCNrzsYMDd5sB11N2QAAAB8"]
[Sat Jul 18 23:46:52.387696 2026] [security2:error] [pid 943918:tid 944155] [client 91.230.225.158:34985] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/goods.php"] [unique_id "alxkzB70hbVC6SnzbhpBMAAAAO8"]
[Sat Jul 18 23:46:52.392541 2026] [security2:error] [pid 943918:tid 943925] [remote 34.35.112.28:33724] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkyx70hbVC6SnzbhpBAQAAjwU"]
[Sat Jul 18 23:46:52.398982 2026] [security2:error] [pid 943918:tid 943986] [remote 34.35.112.28:33724] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkyx70hbVC6SnzbhpA_gAAj0I"]
[Sat Jul 18 23:46:52.428086 2026] [security2:error] [pid 943918:tid 944005] [remote 34.35.112.28:33724] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkyx70hbVC6SnzbhpA_wAAj1U"]
[Sat Jul 18 23:46:52.429931 2026] [security2:error] [pid 943918:tid 943947] [remote 34.35.112.28:33724] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "recruitinginsight.us"] [uri "/index.php"] [unique_id "alxkyx70hbVC6SnzbhpA-wAAjxs"]
[Sat Jul 18 23:46:52.435634 2026] [security2:error] [pid 943918:tid 944165] [client 173.239.196.166:53299] ModSecurity: Access denied with connection close (phase 1). Pattern match "c99\\\\.php|r57shell\\\\.php|r57\\\\.php|c99\\\\.txt" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1164"] [id "900010"] [rev "1"] [msg "c99 variant "] [severity "CRITICAL"] [hostname "sixpackminer.org"] [uri "/images/c99.php"] [unique_id "alxkzB70hbVC6SnzbhpBPAAAAPk"]
[Sat Jul 18 23:46:52.458550 2026] [security2:error] [pid 943918:tid 944138] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkzB70hbVC6SnzbhpBGgAA3jg"]
[Sat Jul 18 23:46:52.498652 2026] [security2:error] [pid 943918:tid 944130] [client 185.92.25.82:29253] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/goods.php"] [unique_id "alxkzB70hbVC6SnzbhpBQQAAANY"]
[Sat Jul 18 23:46:52.688466 2026] [security2:error] [pid 943918:tid 944067] [client 185.192.71.217:57041] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/insc.php"] [unique_id "alxkzB70hbVC6SnzbhpBSAAAAJc"]
[Sat Jul 18 23:46:52.691893 2026] [security2:error] [pid 938041:tid 938230] [client 185.92.25.92:58689] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/wp-editor.php"] [unique_id "alxkzCNrzsYMDd5sB11N2gAAADo"]
[Sat Jul 18 23:46:52.692230 2026] [security2:error] [pid 943918:tid 944117] [client 185.192.71.214:56345] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/wp-editor.php"] [unique_id "alxkzB70hbVC6SnzbhpBSQAAAMk"]
[Sat Jul 18 23:46:52.717945 2026] [security2:error] [pid 938041:tid 938198] [client 45.133.7.96:57987] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 96.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/aks.php"] [unique_id "alxkzCNrzsYMDd5sB11N3AAAABo"]
[Sat Jul 18 23:46:52.735348 2026] [security2:error] [pid 938041:tid 938290] [client 91.230.225.161:24517] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/wp-editor.php"] [unique_id "alxkzCNrzsYMDd5sB11N3gAAAHY"]
[Sat Jul 18 23:46:52.781066 2026] [security2:error] [pid 943918:tid 944069] [client 185.92.25.84:51433] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/wp-editor.php"] [unique_id "alxkzB70hbVC6SnzbhpBTwAAAJk"]
[Sat Jul 18 23:46:52.906677 2026] [security2:error] [pid 943918:tid 944109] [client 185.192.71.213:49321] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/wp-editor.php"] [unique_id "alxkzB70hbVC6SnzbhpBWwAAAME"]
[Sat Jul 18 23:46:53.024249 2026] [security2:error] [pid 943918:tid 944079] [client 185.192.71.206:45291] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/lufix.php"] [unique_id "alxkzR70hbVC6SnzbhpBYgAAAKM"]
[Sat Jul 18 23:46:53.036666 2026] [security2:error] [pid 943918:tid 944157] [client 91.230.225.154:39525] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/classwithtostring.php"] [unique_id "alxkzR70hbVC6SnzbhpBYwAAAPE"]
[Sat Jul 18 23:46:53.041371 2026] [security2:error] [pid 938041:tid 938177] [client 185.192.71.215:57619] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/lufix.php"] [unique_id "alxkzSNrzsYMDd5sB11N6wAAAAU"]
[Sat Jul 18 23:46:53.052763 2026] [security2:error] [pid 943918:tid 944022] [remote 31.42.184.154:58776] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxkzR70hbVC6SnzbhpBZQAA32Y"]
[Sat Jul 18 23:46:53.055100 2026] [security2:error] [pid 943918:tid 944059] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkzB70hbVC6SnzbhpBSgAAj30"]
[Sat Jul 18 23:46:53.060511 2026] [security2:error] [pid 938041:tid 938188] [client 91.230.225.154:58419] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/lufix.php"] [unique_id "alxkzSNrzsYMDd5sB11N7AAAABA"]
[Sat Jul 18 23:46:53.187798 2026] [security2:error] [pid 938041:tid 938217] [client 45.134.20.118:33829] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/css/admin.php"] [unique_id "alxkzSNrzsYMDd5sB11N8QAAAC0"]
[Sat Jul 18 23:46:53.220379 2026] [security2:error] [pid 943918:tid 944068] [client 185.192.71.209:45869] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/lufix.php"] [unique_id "alxkzR70hbVC6SnzbhpBbAAAAJg"]
[Sat Jul 18 23:46:53.310476 2026] [security2:error] [pid 943918:tid 944123] [client 173.239.196.166:54381] ModSecurity: Access denied with connection close (phase 1). Pattern match "c99\\\\.php|r57shell\\\\.php|r57\\\\.php|c99\\\\.txt" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1164"] [id "900010"] [rev "1"] [msg "c99 variant "] [severity "CRITICAL"] [hostname "sixpackminer.org"] [uri "/images/c99.php"] [unique_id "alxkzR70hbVC6SnzbhpBewAAAM8"]
[Sat Jul 18 23:46:53.398630 2026] [security2:error] [pid 938041:tid 938267] [client 45.133.7.79:34105] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 79.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/litespeed.php"] [unique_id "alxkzSNrzsYMDd5sB11N-QAAAF8"]
[Sat Jul 18 23:46:53.405082 2026] [security2:error] [pid 943918:tid 944138] [client 185.192.71.221:52377] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "kdg.jiv.mybluehost.me"] [uri "/style.php"] [unique_id "alxkzR70hbVC6SnzbhpBgAAAAN4"]
[Sat Jul 18 23:46:53.497766 2026] [security2:error] [pid 938041:tid 938242] [client 185.192.71.208:31295] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/txets.php"] [unique_id "alxkzSNrzsYMDd5sB11N_AAAAEY"]
[Sat Jul 18 23:46:53.498620 2026] [security2:error] [pid 943918:tid 944130] [client 185.92.25.84:61971] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "mail.kdg.jiv.mybluehost.me"] [uri "/style.php"] [unique_id "alxkzR70hbVC6SnzbhpBhQAAANY"]
[Sat Jul 18 23:46:53.498736 2026] [security2:error] [pid 943918:tid 944085] [client 185.92.25.82:30247] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webdisk.kdg.jiv.mybluehost.me"] [uri "/style.php"] [unique_id "alxkzR70hbVC6SnzbhpBhgAAAKk"]
[Sat Jul 18 23:46:53.506871 2026] [security2:error] [pid 943918:tid 943990] [remote 104.131.116.82:46282] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.116.131.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxkzR70hbVC6SnzbhpBhAAA9kY"], referer: https://sesamegreenbeans.com/wp-login.php
[Sat Jul 18 23:46:53.518078 2026] [security2:error] [pid 943918:tid 944055] [client 185.92.25.86:47391] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcontacts.kdg.jiv.mybluehost.me"] [uri "/style.php"] [unique_id "alxkzR70hbVC6SnzbhpBhwAAAIs"]
[Sat Jul 18 23:46:53.570463 2026] [security2:error] [pid 943918:tid 943940] [remote 31.42.184.154:58776] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxkzR70hbVC6SnzbhpBiQAAwBQ"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:46:53.839676 2026] [security2:error] [pid 943918:tid 944087] [client 185.192.71.215:39273] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/wp-content/themes/txets.php"] [unique_id "alxkzR70hbVC6SnzbhpBkwAAAKs"]
[Sat Jul 18 23:46:54.045586 2026] [security2:error] [pid 943918:tid 944129] [client 45.134.20.113:53969] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/adminfuns.php"] [unique_id "alxkzh70hbVC6SnzbhpBpAAAANU"]
[Sat Jul 18 23:46:54.080140 2026] [security2:error] [pid 943918:tid 944072] [client 45.133.7.80:34243] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/img/about.php"] [unique_id "alxkzh70hbVC6SnzbhpBpwAAAJw"]
[Sat Jul 18 23:46:54.142065 2026] [security2:error] [pid 943918:tid 944076] [client 138.252.89.100:61686] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkzh70hbVC6SnzbhpBqgAAAKA"]
[Sat Jul 18 23:46:54.142210 2026] [security2:error] [pid 943918:tid 944076] [client 138.252.89.100:61686] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxkzh70hbVC6SnzbhpBqgAAAKA"]
[Sat Jul 18 23:46:54.152485 2026] [security2:error] [pid 938041:tid 938062] [remote 103.90.233.75:44698] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.233.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.savilerowtravel.com"] [uri "/wp-login.php"] [unique_id "alxkziNrzsYMDd5sB11OCAAAchM"], referer: https://savilerowtravel.co.uk/wp-login.php
[Sat Jul 18 23:46:54.176571 2026] [security2:error] [pid 938041:tid 938240] [client 185.192.71.218:36591] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/lufix.php"] [unique_id "alxkziNrzsYMDd5sB11OCQAAAEQ"]
[Sat Jul 18 23:46:54.360712 2026] [security2:error] [pid 938041:tid 938203] [client 185.92.25.81:33725] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/wp-admin/txets.php"] [unique_id "alxkziNrzsYMDd5sB11OEwAAAB8"]
[Sat Jul 18 23:46:54.378468 2026] [security2:error] [pid 943918:tid 944064] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkzh70hbVC6SnzbhpBogAAlHc"]
[Sat Jul 18 23:46:54.498090 2026] [security2:error] [pid 943918:tid 944148] [client 185.92.25.79:51571] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "webmail.kdg.jiv.mybluehost.me"] [uri "/style.php"] [unique_id "alxkzh70hbVC6SnzbhpBugAAAOg"]
[Sat Jul 18 23:46:54.572260 2026] [security2:error] [pid 938041:tid 938150] [remote 78.46.99.182:43682] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 182.99.46.78.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "suretybonds-california.com"] [uri "/wp-login.php"] [unique_id "alxkziNrzsYMDd5sB11OFwAAD2s"]
[Sat Jul 18 23:46:54.723177 2026] [security2:error] [pid 943918:tid 944151] [client 91.230.225.154:61451] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/wp-includes/txets.php"] [unique_id "alxkzh70hbVC6SnzbhpBxQAAAOs"]
[Sat Jul 18 23:46:54.764065 2026] [security2:error] [pid 943918:tid 944089] [client 45.133.7.79:22157] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 79.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/class-feed-index.php"] [unique_id "alxkzh70hbVC6SnzbhpBzgAAAK0"]
[Sat Jul 18 23:46:54.769536 2026] [security2:error] [pid 938041:tid 938128] [remote 78.46.99.182:43682] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 182.99.46.78.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "suretybonds-california.com"] [uri "/wp-login.php"] [unique_id "alxkziNrzsYMDd5sB11OGQAAUlU"], referer: https://suretybonds-california.com/wp-login.php
[Sat Jul 18 23:46:54.908655 2026] [security2:error] [pid 938041:tid 938262] [client 45.134.20.127:49113] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 127.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/autoload_classmap.php"] [unique_id "alxkziNrzsYMDd5sB11OHQAAAFo"]
[Sat Jul 18 23:46:54.937929 2026] [security2:error] [pid 943918:tid 944055] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxkzh70hbVC6SnzbhpBvQAAiyQ"]
[Sat Jul 18 23:46:55.040839 2026] [security2:error] [pid 938041:tid 938064] [remote 103.90.233.75:44698] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.233.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.savilerowtravel.com"] [uri "/wp-login.php"] [unique_id "alxkzyNrzsYMDd5sB11OHwAAZhU"], referer: https://savilerowtravel.co.uk/wp-login.php
[Sat Jul 18 23:46:55.047136 2026] [security2:error] [pid 943918:tid 944114] [client 91.230.225.163:58537] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/goods.php"] [unique_id "alxkzx70hbVC6SnzbhpB3AAAAMY"]
[Sat Jul 18 23:46:55.450762 2026] [security2:error] [pid 943918:tid 944096] [client 45.133.7.66:44235] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 66.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wpn.php"] [unique_id "alxkzx70hbVC6SnzbhpB9wAAALQ"]
[Sat Jul 18 23:46:55.479776 2026] [security2:error] [pid 943918:tid 944119] [client 185.92.25.81:52731] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/wp-editor.php"] [unique_id "alxkzx70hbVC6SnzbhpB_wAAAMs"]
[Sat Jul 18 23:46:55.600198 2026] [security2:error] [pid 943918:tid 944069] [client 50.116.65.227:53250] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxkzx70hbVC6SnzbhpCCgAAAJk"]
[Sat Jul 18 23:46:55.613202 2026] [security2:error] [pid 943918:tid 944176] [client 50.116.65.227:34702] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxkzx70hbVC6SnzbhpCDAAAAQQ"]
[Sat Jul 18 23:46:55.763202 2026] [security2:error] [pid 938041:tid 938192] [client 45.134.20.116:34441] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 116.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp_wlx.php"] [unique_id "alxkzyNrzsYMDd5sB11OKQAAABQ"]
[Sat Jul 18 23:46:55.853311 2026] [security2:error] [pid 943918:tid 944139] [client 185.92.25.81:55133] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/lufix.php"] [unique_id "alxkzx70hbVC6SnzbhpCFAAAAN8"]
[Sat Jul 18 23:46:56.052265 2026] [security2:error] [pid 938041:tid 938205] [client 36.83.95.75:57715] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxk0CNrzsYMDd5sB11OMwAAACE"]
[Sat Jul 18 23:46:56.052449 2026] [security2:error] [pid 938041:tid 938205] [client 36.83.95.75:57715] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxk0CNrzsYMDd5sB11OMwAAACE"]
[Sat Jul 18 23:46:56.129393 2026] [security2:error] [pid 938041:tid 938255] [client 185.92.25.92:34927] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/style.php"] [unique_id "alxk0CNrzsYMDd5sB11ONAAAAFM"]
[Sat Jul 18 23:46:56.129957 2026] [security2:error] [pid 943918:tid 944050] [client 45.133.7.95:31963] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/classwithtostring.php"] [unique_id "alxk0B70hbVC6SnzbhpCKAAAAIY"]
[Sat Jul 18 23:46:56.160734 2026] [security2:error] [pid 938041:tid 938258] [client 216.244.66.203:36642] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.samdothan.org"] [uri "/robots.txt"] [unique_id "alxk0CNrzsYMDd5sB11ONQAAAFY"]
[Sat Jul 18 23:46:56.160913 2026] [security2:error] [pid 938041:tid 938258] [client 216.244.66.203:36642] ModSecurity: Warning. Matched phrase "Dotbot" at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "www.samdothan.org"] [uri "/robots.txt"] [unique_id "alxk0CNrzsYMDd5sB11ONQAAAFY"]
[Sat Jul 18 23:46:56.418303 2026] [security2:error] [pid 943918:tid 944161] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk0B70hbVC6SnzbhpCIwAA9T8"]
[Sat Jul 18 23:46:56.454132 2026] [security2:error] [pid 938041:tid 938216] [client 103.160.26.178:61560] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxk0CNrzsYMDd5sB11OOwAAACw"]
[Sat Jul 18 23:46:56.454225 2026] [security2:error] [pid 938041:tid 938216] [client 103.160.26.178:61560] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxk0CNrzsYMDd5sB11OOwAAACw"]
[Sat Jul 18 23:46:56.620268 2026] [security2:error] [pid 943918:tid 944172] [client 45.134.20.125:45605] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 125.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "alxk0B70hbVC6SnzbhpCPQAAAQA"]
[Sat Jul 18 23:46:56.812160 2026] [security2:error] [pid 943918:tid 944129] [client 45.133.7.57:45367] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 57.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/acme-challenge/iR7SzrsOUEP.php"] [unique_id "alxk0B70hbVC6SnzbhpCSAAAANU"]
[Sat Jul 18 23:46:57.263273 2026] [security2:error] [pid 938041:tid 938219] [client 51.68.107.159:15403] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "omenana.com"] [uri "/robots.txt"] [unique_id "alxk0SNrzsYMDd5sB11OUwAAAC8"]
[Sat Jul 18 23:46:57.263371 2026] [security2:error] [pid 938041:tid 938219] [client 51.68.107.159:15403] ModSecurity: Warning. Matched phrase "MJ12bot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "omenana.com"] [uri "/robots.txt"] [unique_id "alxk0SNrzsYMDd5sB11OUwAAAC8"]
[Sat Jul 18 23:46:57.488119 2026] [security2:error] [pid 943918:tid 944089] [client 45.134.20.113:40969] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "alxk0R70hbVC6SnzbhpCagAAAK0"]
[Sat Jul 18 23:46:57.491906 2026] [security2:error] [pid 943918:tid 944083] [client 45.133.7.86:42205] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 86.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "alxk0R70hbVC6SnzbhpCawAAAKc"]
[Sat Jul 18 23:46:57.539728 2026] [security2:error] [pid 943918:tid 944067] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk0R70hbVC6SnzbhpCXAAAlzw"]
[Sat Jul 18 23:46:57.826525 2026] [security2:error] [pid 943918:tid 944172] [client 217.217.245.230:22815] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.245.217.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxk0R70hbVC6SnzbhpCegAAAQA"]
[Sat Jul 18 23:46:57.826633 2026] [security2:error] [pid 943918:tid 944172] [client 217.217.245.230:22815] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxk0R70hbVC6SnzbhpCegAAAQA"]
[Sat Jul 18 23:46:58.056137 2026] [security2:error] [pid 943918:tid 944063] [client 74.7.227.179:52108] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxk0R70hbVC6SnzbhpCfgAAkzg"], referer: https://tejasenvironmental.com/p=237067
[Sat Jul 18 23:46:58.163149 2026] [security2:error] [pid 943918:tid 944079] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk0R70hbVC6SnzbhpCeQAAo1w"]
[Sat Jul 18 23:46:58.173498 2026] [security2:error] [pid 943918:tid 944113] [client 45.133.7.87:37001] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 87.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/twentytwentyfour/functions.php"] [unique_id "alxk0h70hbVC6SnzbhpCkAAAAMU"]
[Sat Jul 18 23:46:58.327667 2026] [security2:error] [pid 938041:tid 938225] [client 92.114.249.18:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxk0CNrzsYMDd5sB11OPgAAADU"]
[Sat Jul 18 23:46:58.347408 2026] [security2:error] [pid 943918:tid 944141] [client 45.134.20.112:36391] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 112.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp.php"] [unique_id "alxk0h70hbVC6SnzbhpCmQAAAOE"]
[Sat Jul 18 23:46:58.738359 2026] [security2:error] [pid 938041:tid 938173] [client 163.61.1.17:52222] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxk0iNrzsYMDd5sB11OigAAAAE"]
[Sat Jul 18 23:46:58.738459 2026] [security2:error] [pid 938041:tid 938173] [client 163.61.1.17:52222] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxk0iNrzsYMDd5sB11OigAAAAE"]
[Sat Jul 18 23:46:58.853181 2026] [security2:error] [pid 938041:tid 938236] [client 45.133.7.84:51383] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 84.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/db.php"] [unique_id "alxk0iNrzsYMDd5sB11OjgAAAEA"]
[Sat Jul 18 23:46:58.854362 2026] [security2:error] [pid 943918:tid 944139] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk0h70hbVC6SnzbhpCnQAA32s"]
[Sat Jul 18 23:46:59.210134 2026] [security2:error] [pid 938041:tid 938231] [client 45.134.20.110:40529] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/blue/wp-trackback.php"] [unique_id "alxk0yNrzsYMDd5sB11OlgAAADs"]
[Sat Jul 18 23:46:59.357807 2026] [proxy:error] [pid 943918:tid 944066] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:46:59.357875 2026] [proxy_http:error] [pid 943918:tid 944066] [client 82.39.206.157:45372] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:46:59.358351 2026] [proxy:error] [pid 943918:tid 944066] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:46:59.358378 2026] [proxy_http:error] [pid 943918:tid 944066] [client 82.39.206.157:45372] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:46:59.437550 2026] [security2:error] [pid 943918:tid 944063] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk0x70hbVC6SnzbhpCvgAAk1k"]
[Sat Jul 18 23:46:59.447165 2026] [security2:error] [pid 943918:tid 944096] [client 106.222.249.209:26381] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxk0x70hbVC6SnzbhpCzwAAALQ"]
[Sat Jul 18 23:46:59.447348 2026] [security2:error] [pid 943918:tid 944096] [client 106.222.249.209:26381] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxk0x70hbVC6SnzbhpCzwAAALQ"]
[Sat Jul 18 23:46:59.534300 2026] [security2:error] [pid 938041:tid 938203] [client 45.133.7.90:49597] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 90.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "alxk0yNrzsYMDd5sB11OnwAAAB8"]
[Sat Jul 18 23:46:59.942135 2026] [security2:error] [pid 943918:tid 944174] [client 185.92.25.89:52139] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/wp-editor.php"] [unique_id "alxk0x70hbVC6SnzbhpC4gAAAQI"]
[Sat Jul 18 23:47:00.075195 2026] [security2:error] [pid 943918:tid 944166] [client 45.134.20.123:37401] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 123.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/chosen.php"] [unique_id "alxk1B70hbVC6SnzbhpC5gAAAPo"]
[Sat Jul 18 23:47:00.152516 2026] [security2:error] [pid 943918:tid 944089] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk0x70hbVC6SnzbhpC3AAArXs"]
[Sat Jul 18 23:47:00.213145 2026] [security2:error] [pid 943918:tid 944049] [client 45.133.7.99:55449] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "alxk1B70hbVC6SnzbhpC6QAAAIU"]
[Sat Jul 18 23:47:00.323991 2026] [security2:error] [pid 938041:tid 938192] [client 185.192.71.222:56383] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/lufix.php"] [unique_id "alxk1CNrzsYMDd5sB11OtwAAABQ"]
[Sat Jul 18 23:47:00.692308 2026] [security2:error] [pid 943918:tid 944130] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk1B70hbVC6SnzbhpC7wAA1gs"]
[Sat Jul 18 23:47:00.852228 2026] [security2:error] [pid 938041:tid 938195] [client 180.252.198.240:53268] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxk1CNrzsYMDd5sB11OyAAAABc"]
[Sat Jul 18 23:47:00.852349 2026] [security2:error] [pid 938041:tid 938195] [client 180.252.198.240:53268] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxk1CNrzsYMDd5sB11OyAAAABc"]
[Sat Jul 18 23:47:00.892913 2026] [security2:error] [pid 938041:tid 938293] [client 45.133.7.102:39723] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 102.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "alxk1CNrzsYMDd5sB11OyQAAAHk"]
[Sat Jul 18 23:47:00.973659 2026] [security2:error] [pid 938041:tid 938273] [client 45.134.20.108:26507] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-header.php"] [unique_id "alxk1CNrzsYMDd5sB11OzAAAAGU"]
[Sat Jul 18 23:47:01.244092 2026] [security2:error] [pid 943918:tid 944154] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk1B70hbVC6SnzbhpC_AAA7hY"]
[Sat Jul 18 23:47:01.583505 2026] [security2:error] [pid 943918:tid 944059] [client 45.133.7.71:52831] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 71.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "alxk1R70hbVC6SnzbhpDFQAAAI8"]
[Sat Jul 18 23:47:01.590882 2026] [security2:error] [pid 943918:tid 944152] [client 52.201.135.180:26204] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 180.135.201.52.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxk1R70hbVC6SnzbhpDFgAAAOw"], referer: https://curlsnpearlsss.com/es/limber-de-parcha-passion-fruit-ice-pops/
[Sat Jul 18 23:47:01.715670 2026] [security2:error] [pid 943918:tid 944102] [client 185.192.71.224:60305] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "cpcalendars.kdg.jiv.mybluehost.me"] [uri "/style.php"] [unique_id "alxk1R70hbVC6SnzbhpDHQAAALo"]
[Sat Jul 18 23:47:01.829341 2026] [security2:error] [pid 943918:tid 944171] [client 45.134.20.127:25185] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 127.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/admin.php"] [unique_id "alxk1R70hbVC6SnzbhpDHwAAAP8"]
[Sat Jul 18 23:47:01.878037 2026] [proxy:error] [pid 938041:tid 938201] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:01.878087 2026] [proxy_http:error] [pid 938041:tid 938201] [client 82.39.206.157:37882] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:01.879058 2026] [proxy:error] [pid 938041:tid 938201] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:01.879101 2026] [proxy_http:error] [pid 938041:tid 938201] [client 82.39.206.157:37882] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:02.005746 2026] [proxy:error] [pid 943918:tid 944129] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:02.005831 2026] [proxy_http:error] [pid 943918:tid 944129] [client 193.47.62.168:60964] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:02.006520 2026] [proxy:error] [pid 943918:tid 944129] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:02.006548 2026] [proxy_http:error] [pid 943918:tid 944129] [client 193.47.62.168:60964] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:02.060710 2026] [security2:error] [pid 943918:tid 944077] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk1R70hbVC6SnzbhpDHAAAoUw"]
[Sat Jul 18 23:47:02.276559 2026] [security2:error] [pid 938041:tid 938215] [client 45.133.7.82:25483] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "alxk1iNrzsYMDd5sB11O7AAAACs"]
[Sat Jul 18 23:47:02.603582 2026] [security2:error] [pid 943918:tid 944138] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk1h70hbVC6SnzbhpDNAAA3h8"]
[Sat Jul 18 23:47:02.685826 2026] [security2:error] [pid 938041:tid 938181] [client 45.134.20.111:35493] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/Marvins.php"] [unique_id "alxk1iNrzsYMDd5sB11O-AAAAAk"]
[Sat Jul 18 23:47:02.956039 2026] [security2:error] [pid 938041:tid 938221] [client 45.133.7.97:32573] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 97.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/tinyfilemanager/tinyfilemanager.php"] [unique_id "alxk1iNrzsYMDd5sB11O_AAAADE"]
[Sat Jul 18 23:47:03.334240 2026] [security2:error] [pid 938041:tid 938209] [client 207.241.173.229:34952] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "expo.xp-design.co"] [uri "/api/.env"] [unique_id "alxk1yNrzsYMDd5sB11PBgAAACU"]
[Sat Jul 18 23:47:03.334361 2026] [security2:error] [pid 943918:tid 944049] [client 207.241.173.229:34914] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "expo.xp-design.co"] [uri "/.env"] [unique_id "alxk1x70hbVC6SnzbhpDaQAAAIU"]
[Sat Jul 18 23:47:03.334474 2026] [security2:error] [pid 943918:tid 944153] [client 207.241.173.229:34950] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "expo.xp-design.co"] [uri "/backend/.env"] [unique_id "alxk1x70hbVC6SnzbhpDagAAAO0"]
[Sat Jul 18 23:47:03.393873 2026] [security2:error] [pid 943918:tid 944174] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk1x70hbVC6SnzbhpDWQABAjY"]
[Sat Jul 18 23:47:03.539152 2026] [security2:error] [pid 943918:tid 944148] [client 45.134.20.132:28393] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/about.php"] [unique_id "alxk1x70hbVC6SnzbhpDhwAAAOg"]
[Sat Jul 18 23:47:03.635813 2026] [security2:error] [pid 938041:tid 938285] [client 45.133.7.72:50029] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 72.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/light/colors.min.php"] [unique_id "alxk1yNrzsYMDd5sB11PMwAAAHE"]
[Sat Jul 18 23:47:03.670732 2026] [security2:error] [pid 943918:tid 944094] [client 207.241.173.229:34950] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 229.173.241.207.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "expo.xp-design.co"] [uri "/xmlrpc.php"] [unique_id "alxk1x70hbVC6SnzbhpDjAAAALI"]
[Sat Jul 18 23:47:03.996421 2026] [security2:error] [pid 943918:tid 944138] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk1x70hbVC6SnzbhpDlgAA3nk"]
[Sat Jul 18 23:47:04.317039 2026] [security2:error] [pid 938041:tid 938212] [client 45.133.7.71:52601] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 71.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "alxk2CNrzsYMDd5sB11PUQAAACg"]
[Sat Jul 18 23:47:04.422496 2026] [core:error] [pid 943918:tid 944153] [client 23.137.105.106:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:47:04.422523 2026] [core:error] [pid 943918:tid 944153] [client 23.137.105.106:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:47:04.429347 2026] [security2:error] [pid 943918:tid 944135] [client 45.134.20.135:51737] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-class.php"] [unique_id "alxk2B70hbVC6SnzbhpDuAAAANs"]
[Sat Jul 18 23:47:04.554132 2026] [core:error] [pid 938041:tid 938272] [client 23.137.105.106:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:47:04.554158 2026] [core:error] [pid 938041:tid 938272] [client 23.137.105.106:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:47:04.558930 2026] [core:error] [pid 938041:tid 938180] [client 23.137.105.106:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:47:04.558946 2026] [core:error] [pid 938041:tid 938180] [client 23.137.105.106:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:47:04.595943 2026] [security2:error] [pid 943918:tid 944116] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk2B70hbVC6SnzbhpDsQAAyEI"]
[Sat Jul 18 23:47:05.001490 2026] [security2:error] [pid 938041:tid 938205] [client 45.133.7.67:28577] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "alxk2SNrzsYMDd5sB11PagAAACE"]
[Sat Jul 18 23:47:05.154246 2026] [security2:error] [pid 943918:tid 944167] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk2B70hbVC6SnzbhpDzQAA-2E"]
[Sat Jul 18 23:47:05.286674 2026] [security2:error] [pid 943918:tid 944060] [client 45.134.20.104:50819] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "alxk2R70hbVC6SnzbhpD4AAAAJA"]
[Sat Jul 18 23:47:05.351240 2026] [security2:error] [pid 943918:tid 944090] [client 23.160.60.30:62889] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.ccsdifference.com"] [uri "/index.php"] [unique_id "alxk2R70hbVC6SnzbhpD2AAAAK4"]
[Sat Jul 18 23:47:05.688461 2026] [security2:error] [pid 943918:tid 944137] [client 45.133.7.82:39925] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "alxk2R70hbVC6SnzbhpD9QAAAN0"]
[Sat Jul 18 23:47:05.707036 2026] [security2:error] [pid 943918:tid 943926] [remote 47.86.33.52:22574] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxk2R70hbVC6SnzbhpD9gAAhgY"]
[Sat Jul 18 23:47:05.765105 2026] [security2:error] [pid 943918:tid 944107] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk2R70hbVC6SnzbhpD6QAAvwM"]
[Sat Jul 18 23:47:06.004651 2026] [security2:error] [pid 943918:tid 944062] [client 138.252.89.100:62208] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxk2h70hbVC6SnzbhpEBAAAAJI"]
[Sat Jul 18 23:47:06.004774 2026] [security2:error] [pid 943918:tid 944062] [client 138.252.89.100:62208] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxk2h70hbVC6SnzbhpEBAAAAJI"]
[Sat Jul 18 23:47:06.145620 2026] [security2:error] [pid 938041:tid 938196] [client 45.134.20.104:24633] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/xx.php"] [unique_id "alxk2iNrzsYMDd5sB11PjAAAABg"]
[Sat Jul 18 23:47:06.354831 2026] [security2:error] [pid 943918:tid 944018] [remote 167.71.132.111:54540] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.132.71.167.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/wp-login.php"] [unique_id "alxk2h70hbVC6SnzbhpEFQAAx2I"]
[Sat Jul 18 23:47:06.368608 2026] [security2:error] [pid 943918:tid 944106] [client 45.133.7.78:48303] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 78.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "alxk2h70hbVC6SnzbhpEGgAAAL4"]
[Sat Jul 18 23:47:06.636426 2026] [security2:error] [pid 943918:tid 944009] [remote 167.71.132.111:54540] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.132.71.167.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "securingmemories.com"] [uri "/wp-login.php"] [unique_id "alxk2h70hbVC6SnzbhpEKwAA1lk"], referer: https://securingmemories.com/wp-login.php
[Sat Jul 18 23:47:06.655278 2026] [security2:error] [pid 938041:tid 938201] [client 36.83.95.75:58201] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxk2iNrzsYMDd5sB11PlgAAAB0"]
[Sat Jul 18 23:47:06.655388 2026] [security2:error] [pid 938041:tid 938201] [client 36.83.95.75:58201] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxk2iNrzsYMDd5sB11PlgAAAB0"]
[Sat Jul 18 23:47:07.000807 2026] [security2:error] [pid 943918:tid 944075] [client 45.134.20.119:44061] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/autoload_classmap.php"] [unique_id "alxk2x70hbVC6SnzbhpEOgAAAJ8"]
[Sat Jul 18 23:47:07.052763 2026] [security2:error] [pid 943918:tid 944079] [client 45.133.7.60:52431] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 60.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/Text/options.php"] [unique_id "alxk2x70hbVC6SnzbhpEOwAAAKM"]
[Sat Jul 18 23:47:07.087487 2026] [security2:error] [pid 943918:tid 944071] [client 103.160.26.178:62028] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxk2x70hbVC6SnzbhpEPAAAAJs"]
[Sat Jul 18 23:47:07.087576 2026] [security2:error] [pid 943918:tid 944071] [client 103.160.26.178:62028] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxk2x70hbVC6SnzbhpEPAAAAJs"]
[Sat Jul 18 23:47:07.316260 2026] [cgid:error] [pid 938041:tid 938250] [client 173.239.196.162:62187] AH01264: stderr from /home1/ipqbpvmy/public_html/sixpackminer/cgi-bin: script not found or unable to stat
[Sat Jul 18 23:47:07.524411 2026] [security2:error] [pid 943918:tid 944155] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk2x70hbVC6SnzbhpEPgAA7xw"]
[Sat Jul 18 23:47:07.653701 2026] [security2:error] [pid 943918:tid 943934] [remote 47.86.33.52:22574] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxk2x70hbVC6SnzbhpEVgAAtQ4"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:47:07.734433 2026] [security2:error] [pid 938041:tid 938257] [client 45.133.7.91:26849] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 91.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/acme-challenge/wp-load.php"] [unique_id "alxk2yNrzsYMDd5sB11PqwAAAFU"]
[Sat Jul 18 23:47:07.856535 2026] [security2:error] [pid 943918:tid 944090] [client 45.134.20.130:29403] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 130.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "alxk2x70hbVC6SnzbhpEXgAAAK4"]
[Sat Jul 18 23:47:07.978889 2026] [proxy:error] [pid 938041:tid 938222] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:07.978960 2026] [proxy_http:error] [pid 938041:tid 938222] [client 82.39.206.157:53568] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:07.979376 2026] [proxy:error] [pid 938041:tid 938222] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:07.979400 2026] [proxy_http:error] [pid 938041:tid 938222] [client 82.39.206.157:53568] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:08.084782 2026] [security2:error] [pid 943918:tid 944089] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk2x70hbVC6SnzbhpEWQAArS8"]
[Sat Jul 18 23:47:08.305516 2026] [security2:error] [pid 943918:tid 944080] [client 217.217.245.230:38849] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.245.217.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxk3B70hbVC6SnzbhpEdQAAAKQ"]
[Sat Jul 18 23:47:08.305668 2026] [security2:error] [pid 943918:tid 944080] [client 217.217.245.230:38849] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxk3B70hbVC6SnzbhpEdQAAAKQ"]
[Sat Jul 18 23:47:08.348673 2026] [security2:error] [pid 943918:tid 943939] [remote 20.153.140.50:37974] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxk3B70hbVC6SnzbhpEeQAAvRM"]
[Sat Jul 18 23:47:08.399481 2026] [security2:error] [pid 943918:tid 943975] [remote 31.42.184.154:56134] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxk3B70hbVC6SnzbhpEfAAApjc"]
[Sat Jul 18 23:47:08.399673 2026] [security2:error] [pid 943918:tid 944082] [client 31.42.184.154:56134] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxk3B70hbVC6SnzbhpEfAAApjc"]
[Sat Jul 18 23:47:08.415892 2026] [security2:error] [pid 938041:tid 938195] [client 45.133.7.87:39409] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 87.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/upgrade/cc.php"] [unique_id "alxk3CNrzsYMDd5sB11PwQAAABc"]
[Sat Jul 18 23:47:08.655571 2026] [security2:error] [pid 943918:tid 944059] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk3B70hbVC6SnzbhpEdgAAjxY"]
[Sat Jul 18 23:47:08.708168 2026] [security2:error] [pid 943918:tid 944168] [client 45.134.20.114:35199] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/blue.php"] [unique_id "alxk3B70hbVC6SnzbhpEkgAAAPw"]
[Sat Jul 18 23:47:08.728531 2026] [security2:error] [pid 943918:tid 944004] [remote 20.153.140.50:37974] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxk3B70hbVC6SnzbhpElQAAjVQ"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:47:09.099929 2026] [security2:error] [pid 943918:tid 944077] [client 45.133.7.64:32501] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 64.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/aahana/worksec.php"] [unique_id "alxk3R70hbVC6SnzbhpErAAAAKE"]
[Sat Jul 18 23:47:09.272526 2026] [security2:error] [pid 943918:tid 944140] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk3B70hbVC6SnzbhpEnwAA4FI"]
[Sat Jul 18 23:47:09.354636 2026] [security2:error] [pid 943918:tid 944126] [client 163.61.1.17:52710] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxk3R70hbVC6SnzbhpEtwAAANI"]
[Sat Jul 18 23:47:09.354801 2026] [security2:error] [pid 943918:tid 944126] [client 163.61.1.17:52710] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxk3R70hbVC6SnzbhpEtwAAANI"]
[Sat Jul 18 23:47:09.560081 2026] [security2:error] [pid 943918:tid 944135] [client 45.134.20.124:25067] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 124.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/content.php"] [unique_id "alxk3R70hbVC6SnzbhpEvgAAANs"]
[Sat Jul 18 23:47:09.590504 2026] [security2:error] [pid 938041:tid 938252] [client 23.251.146.115:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "wileybrosmusic.com"] [uri "/index.php"] [unique_id "alxk3SNrzsYMDd5sB11P2AAAUA4"]
[Sat Jul 18 23:47:09.836926 2026] [security2:error] [pid 938041:tid 938227] [client 45.133.7.95:56933] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "alxk3SNrzsYMDd5sB11P-AAAADc"]
[Sat Jul 18 23:47:09.939247 2026] [security2:error] [pid 943918:tid 944158] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk3R70hbVC6SnzbhpEvQAA8l8"]
[Sat Jul 18 23:47:10.085171 2026] [security2:error] [pid 943918:tid 944151] [client 139.167.225.146:58401] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxk3h70hbVC6SnzbhpEzwAAAOs"]
[Sat Jul 18 23:47:10.085274 2026] [security2:error] [pid 943918:tid 944151] [client 139.167.225.146:58401] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxk3h70hbVC6SnzbhpEzwAAAOs"]
[Sat Jul 18 23:47:10.110527 2026] [security2:error] [pid 943918:tid 944145] [client 106.222.249.209:9044] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxk3h70hbVC6SnzbhpE0QAAAOU"]
[Sat Jul 18 23:47:10.110870 2026] [security2:error] [pid 943918:tid 944145] [client 106.222.249.209:9044] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxk3h70hbVC6SnzbhpE0QAAAOU"]
[Sat Jul 18 23:47:10.205608 2026] [security2:error] [pid 938041:tid 938221] [client 23.251.146.115:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "wileybrosmusic.com"] [uri "/index.php"] [unique_id "alxk3SNrzsYMDd5sB11P-wAAMXg"]
[Sat Jul 18 23:47:10.299183 2026] [security2:error] [pid 938041:tid 938241] [client 207.241.173.229:34976] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "expo.xp-design.co"] [uri "/index.php"] [unique_id "alxk1yNrzsYMDd5sB11PCQAAAEU"]
[Sat Jul 18 23:47:10.300120 2026] [security2:error] [pid 943918:tid 944172] [client 207.241.173.229:34912] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "expo.xp-design.co"] [uri "/index.php"] [unique_id "alxk1x70hbVC6SnzbhpDaAAAAQA"]
[Sat Jul 18 23:47:10.300331 2026] [security2:error] [pid 943918:tid 944124] [client 207.241.173.229:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "expo.xp-design.co"] [uri "/index.php"] [unique_id "alxk1x70hbVC6SnzbhpDYgAAANA"]
[Sat Jul 18 23:47:10.300796 2026] [security2:error] [pid 938041:tid 938291] [client 207.241.173.229:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "expo.xp-design.co"] [uri "/index.php"] [unique_id "alxk1yNrzsYMDd5sB11PEQAAAHc"]
[Sat Jul 18 23:47:10.301146 2026] [security2:error] [pid 943918:tid 944061] [client 207.241.173.229:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "expo.xp-design.co"] [uri "/index.php"] [unique_id "alxk1x70hbVC6SnzbhpDcgAAAJE"]
[Sat Jul 18 23:47:10.302125 2026] [security2:error] [pid 943918:tid 944085] [client 207.241.173.229:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "expo.xp-design.co"] [uri "/index.php"] [unique_id "alxk1x70hbVC6SnzbhpDcAAAAKk"]
[Sat Jul 18 23:47:10.302603 2026] [security2:error] [pid 938041:tid 938275] [client 207.241.173.229:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "expo.xp-design.co"] [uri "/index.php"] [unique_id "alxk1yNrzsYMDd5sB11PEwAAAGc"]
[Sat Jul 18 23:47:10.304663 2026] [security2:error] [pid 943918:tid 944120] [client 207.241.173.229:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "expo.xp-design.co"] [uri "/index.php"] [unique_id "alxk1x70hbVC6SnzbhpDcQAAAMw"]
[Sat Jul 18 23:47:10.329999 2026] [security2:error] [pid 938041:tid 938268] [client 207.241.173.229:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "expo.xp-design.co"] [uri "/index.php"] [unique_id "alxk1yNrzsYMDd5sB11PEAAAAGA"]
[Sat Jul 18 23:47:10.413322 2026] [security2:error] [pid 943918:tid 944167] [client 45.134.20.132:25439] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/uploads/about.php"] [unique_id "alxk3h70hbVC6SnzbhpE5wAAAPs"]
[Sat Jul 18 23:47:10.518865 2026] [security2:error] [pid 943918:tid 944169] [client 45.133.7.101:49615] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 101.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/includes/class_api.php"] [unique_id "alxk3h70hbVC6SnzbhpE6QAAAP0"]
[Sat Jul 18 23:47:10.551090 2026] [security2:error] [pid 943918:tid 944176] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk3h70hbVC6SnzbhpE0wABBDw"]
[Sat Jul 18 23:47:10.976699 2026] [security2:error] [pid 938041:tid 938209] [client 57.141.18.70:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "weifangsmefarm.com"] [uri "/index.php"] [unique_id "alxk3CNrzsYMDd5sB11P0AAAACU"]
[Sat Jul 18 23:47:10.992808 2026] [security2:error] [pid 943918:tid 944147] [client 180.252.198.240:53771] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxk3h70hbVC6SnzbhpFCQAAAOc"]
[Sat Jul 18 23:47:10.992901 2026] [security2:error] [pid 943918:tid 944147] [client 180.252.198.240:53771] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxk3h70hbVC6SnzbhpFCQAAAOc"]
[Sat Jul 18 23:47:11.151790 2026] [security2:error] [pid 943918:tid 944090] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk3h70hbVC6SnzbhpE-QAArhA"]
[Sat Jul 18 23:47:11.203165 2026] [security2:error] [pid 938041:tid 938181] [client 45.133.7.70:61379] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/plugins/content/apismtp/apismtp.php"] [unique_id "alxk3yNrzsYMDd5sB11QPAAAAAk"]
[Sat Jul 18 23:47:11.269416 2026] [security2:error] [pid 943918:tid 944105] [client 45.134.20.122:52213] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/wp-login.php"] [unique_id "alxk3x70hbVC6SnzbhpFIgAAAL0"]
[Sat Jul 18 23:47:11.718545 2026] [security2:error] [pid 943918:tid 944138] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk3x70hbVC6SnzbhpFJwAA3gM"]
[Sat Jul 18 23:47:11.881867 2026] [security2:error] [pid 943918:tid 944132] [client 45.133.7.64:26699] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 64.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/includes/class-core-upgrader-first.php"] [unique_id "alxk3x70hbVC6SnzbhpFSwAAANg"]
[Sat Jul 18 23:47:11.948564 2026] [security2:error] [pid 938041:tid 938285] [client 23.251.146.115:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "wileybrosmusic.com"] [uri "/index.php"] [unique_id "alxk3yNrzsYMDd5sB11QYwAAcTU"]
[Sat Jul 18 23:47:12.134153 2026] [security2:error] [pid 938041:tid 938209] [client 45.134.20.116:49655] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 116.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "alxk4CNrzsYMDd5sB11QegAAACU"]
[Sat Jul 18 23:47:12.328917 2026] [security2:error] [pid 943918:tid 944107] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk3x70hbVC6SnzbhpFUAAAv28"]
[Sat Jul 18 23:47:12.561690 2026] [security2:error] [pid 943918:tid 944123] [client 45.133.7.104:50041] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/wp-css.php"] [unique_id "alxk4B70hbVC6SnzbhpFgQAAAM8"]
[Sat Jul 18 23:47:12.754493 2026] [security2:error] [pid 943918:tid 944128] [client 84.32.68.232:48822] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.sesamegreenbeans.com"] [uri "/index.php"] [unique_id "alxk4B70hbVC6SnzbhpFdQAA1BI"]
[Sat Jul 18 23:47:12.883264 2026] [security2:error] [pid 943918:tid 944111] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk4B70hbVC6SnzbhpFdAAAwwQ"]
[Sat Jul 18 23:47:12.986986 2026] [security2:error] [pid 943918:tid 944106] [client 45.134.20.132:24137] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/languages/about.php"] [unique_id "alxk4B70hbVC6SnzbhpFrAAAAL4"]
[Sat Jul 18 23:47:13.241780 2026] [security2:error] [pid 943918:tid 944074] [client 45.133.7.61:27865] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/IXR/goto.php"] [unique_id "alxk4R70hbVC6SnzbhpF6AAAAJ4"]
[Sat Jul 18 23:47:13.436558 2026] [security2:error] [pid 943918:tid 944072] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk4R70hbVC6SnzbhpFxgAAnAs"]
[Sat Jul 18 23:47:13.840835 2026] [security2:error] [pid 943918:tid 944157] [client 45.134.20.118:55613] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/wp-theme-editor/include.php"] [unique_id "alxk4R70hbVC6SnzbhpGPgAAAPE"]
[Sat Jul 18 23:47:13.938988 2026] [security2:error] [pid 943918:tid 944154] [client 45.133.7.56:50031] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 56.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/blue/xboom.php"] [unique_id "alxk4R70hbVC6SnzbhpGSgAAAO4"]
[Sat Jul 18 23:47:13.942857 2026] [security2:error] [pid 943918:tid 943966] [remote 20.153.140.50:37982] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxk4R70hbVC6SnzbhpGSAAA9C4"]
[Sat Jul 18 23:47:13.943059 2026] [security2:error] [pid 943918:tid 944160] [client 20.153.140.50:37982] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxk4R70hbVC6SnzbhpGSAAA9C4"]
[Sat Jul 18 23:47:14.468665 2026] [proxy:error] [pid 943918:tid 944172] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:14.468738 2026] [proxy_http:error] [pid 943918:tid 944172] [client 82.39.206.157:60152] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:14.468816 2026] [proxy:error] [pid 943918:tid 944111] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:14.468862 2026] [proxy_http:error] [pid 943918:tid 944111] [client 82.39.206.157:60116] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:14.468949 2026] [proxy:error] [pid 943918:tid 944078] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:14.468993 2026] [proxy_http:error] [pid 943918:tid 944078] [client 82.39.206.157:60158] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:14.469054 2026] [proxy:error] [pid 943918:tid 944054] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:14.469094 2026] [proxy_http:error] [pid 943918:tid 944054] [client 82.39.206.157:60094] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:14.469180 2026] [proxy:error] [pid 943918:tid 944092] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:14.469234 2026] [proxy_http:error] [pid 943918:tid 944092] [client 82.39.206.157:60114] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:14.469289 2026] [proxy:error] [pid 943918:tid 944111] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:14.469314 2026] [proxy_http:error] [pid 943918:tid 944111] [client 82.39.206.157:60116] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:14.469434 2026] [proxy:error] [pid 943918:tid 944130] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:14.469513 2026] [proxy_http:error] [pid 943918:tid 944130] [client 82.39.206.157:60174] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:14.469569 2026] [proxy:error] [pid 943918:tid 944067] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:14.469601 2026] [proxy_http:error] [pid 943918:tid 944067] [client 82.39.206.157:60140] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:14.469683 2026] [proxy:error] [pid 943918:tid 944060] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:14.469758 2026] [proxy_http:error] [pid 943918:tid 944060] [client 82.39.206.157:60146] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:14.469849 2026] [proxy:error] [pid 943918:tid 944056] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:14.469906 2026] [proxy_http:error] [pid 943918:tid 944056] [client 82.39.206.157:60104] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:14.469960 2026] [proxy:error] [pid 943918:tid 944172] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:14.469989 2026] [proxy_http:error] [pid 943918:tid 944172] [client 82.39.206.157:60152] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:14.470081 2026] [proxy:error] [pid 943918:tid 944149] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:14.470138 2026] [proxy_http:error] [pid 943918:tid 944149] [client 82.39.206.157:60184] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:14.470208 2026] [proxy:error] [pid 943918:tid 944131] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:14.470262 2026] [proxy_http:error] [pid 943918:tid 944131] [client 82.39.206.157:60124] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:14.470312 2026] [proxy:error] [pid 943918:tid 944078] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:14.470341 2026] [proxy_http:error] [pid 943918:tid 944078] [client 82.39.206.157:60158] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:14.470386 2026] [proxy:error] [pid 943918:tid 944054] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:14.470412 2026] [proxy_http:error] [pid 943918:tid 944054] [client 82.39.206.157:60094] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:14.470477 2026] [proxy:error] [pid 943918:tid 944092] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:14.470515 2026] [proxy_http:error] [pid 943918:tid 944092] [client 82.39.206.157:60114] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:14.470569 2026] [proxy:error] [pid 943918:tid 944067] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:14.470598 2026] [proxy_http:error] [pid 943918:tid 944067] [client 82.39.206.157:60140] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:14.470648 2026] [proxy:error] [pid 943918:tid 944130] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:14.470675 2026] [proxy_http:error] [pid 943918:tid 944130] [client 82.39.206.157:60174] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:14.470712 2026] [proxy:error] [pid 943918:tid 944060] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:14.470740 2026] [proxy_http:error] [pid 943918:tid 944060] [client 82.39.206.157:60146] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:14.470821 2026] [proxy:error] [pid 943918:tid 944056] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:14.470868 2026] [proxy_http:error] [pid 943918:tid 944056] [client 82.39.206.157:60104] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:14.470925 2026] [proxy:error] [pid 943918:tid 944149] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:14.470956 2026] [proxy_http:error] [pid 943918:tid 944149] [client 82.39.206.157:60184] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:14.471004 2026] [proxy:error] [pid 943918:tid 944131] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:14.471032 2026] [proxy_http:error] [pid 943918:tid 944131] [client 82.39.206.157:60124] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:14.579240 2026] [proxy:error] [pid 943918:tid 944166] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:14.579324 2026] [proxy_http:error] [pid 943918:tid 944166] [client 82.39.206.157:53572] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:14.579939 2026] [proxy:error] [pid 943918:tid 944166] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:14.579970 2026] [proxy_http:error] [pid 943918:tid 944166] [client 82.39.206.157:53572] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:14.623730 2026] [security2:error] [pid 943918:tid 944117] [client 45.133.7.65:34735] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 65.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/kadence/functions.php"] [unique_id "alxk4h70hbVC6SnzbhpGnQAAAMk"]
[Sat Jul 18 23:47:14.696785 2026] [security2:error] [pid 943918:tid 944083] [client 45.134.20.130:26149] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 130.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/up/main.php"] [unique_id "alxk4h70hbVC6SnzbhpGnwAAAKc"]
[Sat Jul 18 23:47:15.002871 2026] [security2:error] [pid 943918:tid 944101] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk4h70hbVC6SnzbhpGlwAAuXI"]
[Sat Jul 18 23:47:15.312634 2026] [security2:error] [pid 943918:tid 944082] [client 45.133.7.80:27179] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/Sanskrit.php"] [unique_id "alxk4x70hbVC6SnzbhpG8wAAAKY"]
[Sat Jul 18 23:47:15.552304 2026] [security2:error] [pid 943918:tid 944118] [client 45.134.20.128:24939] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/fonts/fontawesome-webfont.php"] [unique_id "alxk4x70hbVC6SnzbhpHKgAAAMo"]
[Sat Jul 18 23:47:15.557123 2026] [security2:error] [pid 943918:tid 944133] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk4x70hbVC6SnzbhpG6QAA2Xk"]
[Sat Jul 18 23:47:15.995635 2026] [security2:error] [pid 943918:tid 944141] [client 45.133.7.73:62637] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 73.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-fmfile.php"] [unique_id "alxk4x70hbVC6SnzbhpHkAAAAOE"]
[Sat Jul 18 23:47:16.021209 2026] [security2:error] [pid 943918:tid 943926] [remote 86.107.77.57:35030] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 57.77.107.86.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "samueldcohen.com"] [uri "/wp-login.php"] [unique_id "alxk4x70hbVC6SnzbhpHlAAAuwY"]
[Sat Jul 18 23:47:16.130821 2026] [security2:error] [pid 943918:tid 944170] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk4x70hbVC6SnzbhpHVwAA_jw"]
[Sat Jul 18 23:47:16.200140 2026] [security2:error] [pid 943918:tid 944030] [remote 86.107.77.57:35030] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 57.77.107.86.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "samueldcohen.com"] [uri "/wp-login.php"] [unique_id "alxk5B70hbVC6SnzbhpHqwAA2G4"], referer: https://samueldcohen.com/wp-login.php
[Sat Jul 18 23:47:16.410264 2026] [security2:error] [pid 943918:tid 944050] [client 45.134.20.133:50663] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "alxk5B70hbVC6SnzbhpHwQAAAIY"]
[Sat Jul 18 23:47:16.676195 2026] [security2:error] [pid 943918:tid 944058] [client 45.133.7.88:54113] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 88.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.trash7309/index.php"] [unique_id "alxk5B70hbVC6SnzbhpH5wAAAI4"]
[Sat Jul 18 23:47:16.724784 2026] [security2:error] [pid 943918:tid 943988] [remote 47.86.33.52:10226] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.upf.ztf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxk5B70hbVC6SnzbhpH6wAA2kQ"]
[Sat Jul 18 23:47:16.724936 2026] [security2:error] [pid 943918:tid 944134] [client 47.86.33.52:10226] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "mail.upf.ztf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxk5B70hbVC6SnzbhpH6wAA2kQ"]
[Sat Jul 18 23:47:16.757306 2026] [security2:error] [pid 943918:tid 944122] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk5B70hbVC6SnzbhpHvwAAziM"]
[Sat Jul 18 23:47:17.265173 2026] [security2:error] [pid 943918:tid 944054] [client 45.134.20.127:54265] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 127.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/includes/about.php"] [unique_id "alxk5R70hbVC6SnzbhpIMgAAAIo"]
[Sat Jul 18 23:47:17.312193 2026] [security2:error] [pid 943918:tid 944053] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk5B70hbVC6SnzbhpIEAAAiUA"]
[Sat Jul 18 23:47:17.326368 2026] [security2:error] [pid 943918:tid 944051] [client 36.83.95.75:58677] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxk5R70hbVC6SnzbhpINwAAAIc"]
[Sat Jul 18 23:47:17.326466 2026] [security2:error] [pid 943918:tid 944051] [client 36.83.95.75:58677] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxk5R70hbVC6SnzbhpINwAAAIc"]
[Sat Jul 18 23:47:17.354433 2026] [security2:error] [pid 943918:tid 944148] [client 45.133.7.57:24023] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 57.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/revslider/includes/external/page/index.php"] [unique_id "alxk5R70hbVC6SnzbhpIPAAAAOg"]
[Sat Jul 18 23:47:17.674588 2026] [security2:error] [pid 943918:tid 944090] [client 138.252.89.100:62732] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxk5R70hbVC6SnzbhpIRAAAAK4"]
[Sat Jul 18 23:47:17.674743 2026] [security2:error] [pid 943918:tid 944090] [client 138.252.89.100:62732] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxk5R70hbVC6SnzbhpIRAAAAK4"]
[Sat Jul 18 23:47:18.410441 2026] [http2:info] [pid 953994:tid 953994] h2_workers: created with min=128 max=192 idle_ms=600000
[Sat Jul 18 23:47:18.436118 2026] [security2:error] [pid 953994:tid 954124] [client 45.133.7.85:53367] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 85.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/ioxi/ioxi/dropdown.php"] [unique_id "alxk5uyJE89wAff52KU0QQAAAQo"]
[Sat Jul 18 23:47:18.448394 2026] [security2:error] [pid 953994:tid 954128] [client 45.134.20.107:42071] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 107.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "alxk5uyJE89wAff52KU0QgAAAQ4"]
[Sat Jul 18 23:47:18.679986 2026] [security2:error] [pid 953994:tid 954126] [client 103.160.26.178:62494] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxk5uyJE89wAff52KU0egAAAQw"]
[Sat Jul 18 23:47:18.680111 2026] [security2:error] [pid 953994:tid 954126] [client 103.160.26.178:62494] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxk5uyJE89wAff52KU0egAAAQw"]
[Sat Jul 18 23:47:18.771347 2026] [security2:error] [pid 953994:tid 954226] [client 50.116.65.227:11008] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxk5uyJE89wAff52KU0gAAAAXA"]
[Sat Jul 18 23:47:18.787118 2026] [security2:error] [pid 953994:tid 954229] [client 50.116.65.227:11942] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxk5uyJE89wAff52KU0ggAAAXM"]
[Sat Jul 18 23:47:18.846842 2026] [security2:error] [pid 953994:tid 954141] [client 111.225.148.92:23634] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "spencersadventures.com"] [uri "/robots.txt"] [unique_id "alxk5uyJE89wAff52KU0hQAAARs"]
[Sat Jul 18 23:47:19.003212 2026] [security2:error] [pid 953994:tid 954235] [client 217.217.245.230:37099] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.245.217.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxk5-yJE89wAff52KU0kgAAAXk"]
[Sat Jul 18 23:47:19.003297 2026] [security2:error] [pid 953994:tid 954235] [client 217.217.245.230:37099] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxk5-yJE89wAff52KU0kgAAAXk"]
[Sat Jul 18 23:47:19.116894 2026] [security2:error] [pid 953994:tid 954202] [client 45.133.7.97:56415] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 97.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/memberfuns.php"] [unique_id "alxk5-yJE89wAff52KU0mgAAAVg"]
[Sat Jul 18 23:47:19.231296 2026] [security2:error] [pid 943918:tid 944111] [client 139.167.225.146:58982] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxk5x70hbVC6SnzbhpIRgAAAMM"]
[Sat Jul 18 23:47:19.231421 2026] [security2:error] [pid 943918:tid 944111] [client 139.167.225.146:58982] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxk5x70hbVC6SnzbhpIRgAAAMM"]
[Sat Jul 18 23:47:19.307376 2026] [security2:error] [pid 953994:tid 954219] [client 45.134.20.106:51345] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/images/images/about.php"] [unique_id "alxk5-yJE89wAff52KU0rAAAAWk"]
[Sat Jul 18 23:47:19.492126 2026] [security2:error] [pid 953994:tid 954170] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk5-yJE89wAff52KU0nQABOCQ"]
[Sat Jul 18 23:47:19.611374 2026] [security2:error] [pid 953994:tid 954042] [remote 4.205.168.44:33452] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxk5-yJE89wAff52KU0uAABgS8"]
[Sat Jul 18 23:47:19.789759 2026] [security2:error] [pid 953994:tid 954048] [remote 4.205.168.44:33452] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxk5-yJE89wAff52KU0yQABDTU"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:47:19.800872 2026] [security2:error] [pid 953994:tid 954142] [client 45.133.7.75:50309] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/infos.php"] [unique_id "alxk5-yJE89wAff52KU0ywAAARw"]
[Sat Jul 18 23:47:19.897486 2026] [security2:error] [pid 953994:tid 954214] [client 163.61.1.17:53192] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxk5-yJE89wAff52KU01QAAAWQ"]
[Sat Jul 18 23:47:19.897579 2026] [security2:error] [pid 953994:tid 954214] [client 163.61.1.17:53192] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxk5-yJE89wAff52KU01QAAAWQ"]
[Sat Jul 18 23:47:20.181109 2026] [security2:error] [pid 953994:tid 954228] [client 45.134.20.113:35951] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/images/class.php"] [unique_id "alxk6OyJE89wAff52KU06AAAAXI"]
[Sat Jul 18 23:47:20.334074 2026] [ssl:error] [pid 953994:tid 954133] [client 98.88.137.2:21962] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname cpanel.soundmeditationsouthflorida.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:47:20.481288 2026] [security2:error] [pid 953994:tid 954148] [client 45.133.7.97:30911] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 97.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/modules/file.php"] [unique_id "alxk6OyJE89wAff52KU1AAAAASI"]
[Sat Jul 18 23:47:20.482838 2026] [security2:error] [pid 953994:tid 954181] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk6OyJE89wAff52KU03gABQzw"]
[Sat Jul 18 23:47:20.605147 2026] [security2:error] [pid 953994:tid 954176] [client 173.239.196.161:50975] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "655"] [id "900155"] [msg "WP Brute UA block"] [hostname "sixpackminer.org"] [uri "/wp-admin/user/"] [unique_id "alxk6OyJE89wAff52KU1CAAAAT4"]
[Sat Jul 18 23:47:20.796478 2026] [security2:error] [pid 953994:tid 954126] [client 106.222.249.209:30193] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxk6OyJE89wAff52KU1DwAAAQw"]
[Sat Jul 18 23:47:20.796632 2026] [security2:error] [pid 953994:tid 954126] [client 106.222.249.209:30193] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxk6OyJE89wAff52KU1DwAAAQw"]
[Sat Jul 18 23:47:21.029874 2026] [security2:error] [pid 953994:tid 954140] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk6OyJE89wAff52KU1CgABGkw"]
[Sat Jul 18 23:47:21.035637 2026] [security2:error] [pid 953994:tid 954228] [client 45.134.20.132:31393] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/autoload_classmap.php"] [unique_id "alxk6eyJE89wAff52KU1HQAAAXI"]
[Sat Jul 18 23:47:21.148105 2026] [security2:error] [pid 953994:tid 954177] [client 98.82.181.200:18576] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 200.181.82.98.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxk6eyJE89wAff52KU1JwAAAT8"], referer: https://curlsnpearlsss.com/es/limber-de-parcha-passion-fruit-ice-pops/
[Sat Jul 18 23:47:21.171014 2026] [security2:error] [pid 953994:tid 954251] [client 45.133.7.91:36375] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 91.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/x.php"] [unique_id "alxk6eyJE89wAff52KU1KAAAAYk"]
[Sat Jul 18 23:47:21.177669 2026] [security2:error] [pid 953994:tid 954084] [remote 31.42.184.154:39546] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "musichaven.info"] [uri "/wp-login.php"] [unique_id "alxk6eyJE89wAff52KU1KQABJ1k"]
[Sat Jul 18 23:47:21.382888 2026] [security2:error] [pid 953994:tid 954241] [client 57.141.18.104:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "falconarrowshop.com"] [uri "/index.php"] [unique_id "alxk6eyJE89wAff52KU1JgAAAX8"]
[Sat Jul 18 23:47:21.516121 2026] [security2:error] [pid 953994:tid 954139] [client 152.39.232.217:34867] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "guidehunting.com"] [uri "/index.php"] [unique_id "alxk6eyJE89wAff52KU1KwAAARk"]
[Sat Jul 18 23:47:21.579439 2026] [security2:error] [pid 953994:tid 954096] [remote 31.42.184.154:39546] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "musichaven.info"] [uri "/wp-login.php"] [unique_id "alxk6eyJE89wAff52KU1RwABEWU"], referer: https://musichaven.info/wp-login.php
[Sat Jul 18 23:47:21.590580 2026] [security2:error] [pid 953994:tid 954244] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk6eyJE89wAff52KU1LwABglw"]
[Sat Jul 18 23:47:21.616726 2026] [security2:error] [pid 953994:tid 954124] [client 180.252.198.240:54260] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxk6eyJE89wAff52KU1SAAAAQo"]
[Sat Jul 18 23:47:21.616867 2026] [security2:error] [pid 953994:tid 954124] [client 180.252.198.240:54260] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxk6eyJE89wAff52KU1SAAAAQo"]
[Sat Jul 18 23:47:21.826958 2026] [security2:error] [pid 953994:tid 954101] [remote 113.160.142.119:52434] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxk6eyJE89wAff52KU1TwABTGo"]
[Sat Jul 18 23:47:21.849890 2026] [security2:error] [pid 953994:tid 954145] [client 45.133.7.69:32637] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 69.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/wp.php"] [unique_id "alxk6eyJE89wAff52KU1UQAAAR8"]
[Sat Jul 18 23:47:21.891431 2026] [security2:error] [pid 953994:tid 954210] [client 45.134.20.112:47177] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 112.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/web.php"] [unique_id "alxk6eyJE89wAff52KU1VAAAAWA"]
[Sat Jul 18 23:47:22.172075 2026] [security2:error] [pid 953994:tid 954130] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk6eyJE89wAff52KU1UAABEGs"]
[Sat Jul 18 23:47:22.285893 2026] [security2:error] [pid 953994:tid 954175] [client 152.39.232.217:43029] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.guidehunting.com"] [uri "/index.php"] [unique_id "alxk6eyJE89wAff52KU1XAAAAT0"]
[Sat Jul 18 23:47:22.335973 2026] [security2:error] [pid 953994:tid 954113] [remote 113.160.142.119:52434] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxk6uyJE89wAff52KU1bAABHXY"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:47:22.533342 2026] [security2:error] [pid 953994:tid 954176] [client 45.133.7.75:59475] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/options-writing.php"] [unique_id "alxk6uyJE89wAff52KU1egAAAT4"]
[Sat Jul 18 23:47:22.675973 2026] [security2:error] [pid 953994:tid 954141] [client 34.73.105.183:10114] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "villa-m-medjugorje.com"] [uri "/"] [unique_id "alxk6uyJE89wAff52KU1gwAAARs"]
[Sat Jul 18 23:47:22.738908 2026] [security2:error] [pid 953994:tid 954181] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk6uyJE89wAff52KU1cwABQ3k"]
[Sat Jul 18 23:47:22.743988 2026] [security2:error] [pid 953994:tid 954131] [client 45.134.20.108:54553] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/ocean/about.php"] [unique_id "alxk6uyJE89wAff52KU1igAAARE"]
[Sat Jul 18 23:47:23.228879 2026] [security2:error] [pid 953994:tid 954200] [client 45.133.7.105:29633] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/options-reading.php"] [unique_id "alxk6-yJE89wAff52KU1qwAAAVY"]
[Sat Jul 18 23:47:23.297965 2026] [security2:error] [pid 953994:tid 954208] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk6uyJE89wAff52KU1lAABXgs"]
[Sat Jul 18 23:47:23.382130 2026] [security2:error] [pid 953994:tid 954239] [client 57.141.18.105:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxk6-yJE89wAff52KU1qQAAAX0"]
[Sat Jul 18 23:47:23.486255 2026] [security2:error] [pid 953994:tid 954143] [client 45.138.248.4:11568] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.sesamegreenbeans.com"] [uri "/index.php"] [unique_id "alxk6-yJE89wAff52KU1sAABHRA"]
[Sat Jul 18 23:47:23.605103 2026] [security2:error] [pid 953994:tid 954168] [client 45.134.20.119:56287] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/images/index.php"] [unique_id "alxk6-yJE89wAff52KU1xAAAATY"]
[Sat Jul 18 23:47:23.878567 2026] [security2:error] [pid 953994:tid 954127] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk6-yJE89wAff52KU1vgABDRY"]
[Sat Jul 18 23:47:23.911197 2026] [security2:error] [pid 953994:tid 954209] [client 45.133.7.87:39579] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 87.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wsad.php"] [unique_id "alxk6-yJE89wAff52KU14AAAAV8"]
[Sat Jul 18 23:47:24.441587 2026] [security2:error] [pid 953994:tid 954177] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk7OyJE89wAff52KU17wABPy0"]
[Sat Jul 18 23:47:24.467070 2026] [security2:error] [pid 953994:tid 954183] [client 45.134.20.124:37455] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 124.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/bypass.php"] [unique_id "alxk7OyJE89wAff52KU2CQAAAUU"]
[Sat Jul 18 23:47:24.537176 2026] [security2:error] [pid 953994:tid 954134] [client 54.198.0.135:10050] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.0.198.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxk7OyJE89wAff52KU2DgAAARQ"], referer: https://curlsnpearlsss.com/es/limber-de-parcha-passion-fruit-ice-pops/
[Sat Jul 18 23:47:24.595344 2026] [security2:error] [pid 953994:tid 954229] [client 45.133.7.57:23887] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 57.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/nation.php"] [unique_id "alxk7OyJE89wAff52KU2GQAAAXM"]
[Sat Jul 18 23:47:24.599563 2026] [security2:error] [pid 953994:tid 954223] [client 34.73.105.183:37082] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "villa-m-medjugorje.com"] [uri "/wp-json/batch/v1"] [unique_id "alxk7OyJE89wAff52KU2GgAAAW0"]
[Sat Jul 18 23:47:24.763029 2026] [security2:error] [pid 943918:tid 944043] [remote 31.42.184.154:56790] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "michiganhomecaregroup.com"] [uri "/wp-login.php"] [unique_id "alxk7B70hbVC6SnzbhpIRwAA9Hs"]
[Sat Jul 18 23:47:25.187491 2026] [security2:error] [pid 953994:tid 954187] [client 54.211.205.212:58640] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 212.205.211.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxk7eyJE89wAff52KU2QAAAAUk"], referer: https://curlsnpearlsss.com/es/limber-de-parcha-passion-fruit-ice-pops/
[Sat Jul 18 23:47:25.208956 2026] [security2:error] [pid 953994:tid 954070] [remote 20.153.140.50:58440] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "outlookturf.com"] [uri "/wp-login.php"] [unique_id "alxk7eyJE89wAff52KU2QwABh0s"]
[Sat Jul 18 23:47:25.276529 2026] [security2:error] [pid 953994:tid 954164] [client 45.133.7.75:26649] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "alxk7eyJE89wAff52KU2RQAAATI"]
[Sat Jul 18 23:47:25.337736 2026] [security2:error] [pid 953994:tid 954237] [client 45.134.20.111:46219] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "alxk7eyJE89wAff52KU2TQAAAXs"]
[Sat Jul 18 23:47:25.464996 2026] [security2:error] [pid 953994:tid 954207] [client 54.85.69.47:47486] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 47.69.85.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxk7eyJE89wAff52KU2VQAAAV0"], referer: https://curlsnpearlsss.com/es/limber-de-parcha-passion-fruit-ice-pops/
[Sat Jul 18 23:47:25.616894 2026] [security2:error] [pid 953994:tid 954082] [remote 20.153.140.50:58440] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "outlookturf.com"] [uri "/wp-login.php"] [unique_id "alxk7eyJE89wAff52KU2YAABH1c"], referer: https://outlookturf.com/wp-login.php
[Sat Jul 18 23:47:25.956850 2026] [security2:error] [pid 953994:tid 954225] [client 45.133.7.102:46671] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 102.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "alxk7eyJE89wAff52KU2eQAAAW8"]
[Sat Jul 18 23:47:26.036515 2026] [security2:error] [pid 953994:tid 954170] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk7eyJE89wAff52KU2aAABOFo"]
[Sat Jul 18 23:47:26.194270 2026] [security2:error] [pid 953994:tid 954195] [client 45.134.20.108:34175] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/midnight/install.php"] [unique_id "alxk7uyJE89wAff52KU2jgAAAVE"]
[Sat Jul 18 23:47:26.536941 2026] [security2:error] [pid 953994:tid 954107] [remote 194.164.192.228:55138] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 228.192.164.194.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxk7uyJE89wAff52KU2oQABNXA"]
[Sat Jul 18 23:47:26.604591 2026] [security2:error] [pid 953994:tid 954223] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk7uyJE89wAff52KU2kAABbWg"]
[Sat Jul 18 23:47:26.639080 2026] [security2:error] [pid 953994:tid 954161] [client 45.133.7.102:24133] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 102.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "alxk7uyJE89wAff52KU2rwAAAS8"]
[Sat Jul 18 23:47:26.749058 2026] [security2:error] [pid 953994:tid 954108] [remote 194.164.192.228:55138] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 228.192.164.194.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxk7uyJE89wAff52KU2ugABZ3E"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:47:27.049062 2026] [security2:error] [pid 953994:tid 954200] [client 45.134.20.111:39283] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-trackback.php"] [unique_id "alxk7-yJE89wAff52KU2zQAAAVY"]
[Sat Jul 18 23:47:27.153810 2026] [security2:error] [pid 953994:tid 954187] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk7uyJE89wAff52KU2vgABSXo"]
[Sat Jul 18 23:47:27.319133 2026] [security2:error] [pid 953994:tid 954210] [client 45.133.7.94:58603] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 94.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/autoload_classmap/wso.php"] [unique_id "alxk7-yJE89wAff52KU24wAAAWA"]
[Sat Jul 18 23:47:27.452675 2026] [security2:error] [pid 953994:tid 954007] [remote 57.141.18.89:48770] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 89.18.141.57.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/product/3359665"] [unique_id "alxk7-yJE89wAff52KU25wABDQw"]
[Sat Jul 18 23:47:27.685344 2026] [security2:error] [pid 953994:tid 954186] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk7-yJE89wAff52KU25QABSAo"]
[Sat Jul 18 23:47:27.784357 2026] [security2:error] [pid 953994:tid 954235] [client 36.83.95.75:59160] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxk7-yJE89wAff52KU2_wAAAXk"]
[Sat Jul 18 23:47:27.784478 2026] [security2:error] [pid 953994:tid 954235] [client 36.83.95.75:59160] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxk7-yJE89wAff52KU2_wAAAXk"]
[Sat Jul 18 23:47:27.908487 2026] [security2:error] [pid 953994:tid 954206] [client 45.134.20.107:54001] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 107.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "alxk7-yJE89wAff52KU3CAAAAVw"]
[Sat Jul 18 23:47:27.999637 2026] [security2:error] [pid 953994:tid 954218] [client 45.133.7.100:37999] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-atomx.php"] [unique_id "alxk7-yJE89wAff52KU3DQAAAWg"]
[Sat Jul 18 23:47:28.225428 2026] [security2:error] [pid 953994:tid 954179] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk7-yJE89wAff52KU3BQABQQI"]
[Sat Jul 18 23:47:28.229806 2026] [security2:error] [pid 953994:tid 954161] [client 34.73.105.183:37082] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "villa-m-medjugorje.com"] [uri "/"] [unique_id "alxk8OyJE89wAff52KU3GwAAAS8"]
[Sat Jul 18 23:47:28.407236 2026] [security2:error] [pid 953994:tid 954243] [client 103.160.26.178:62966] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxk8OyJE89wAff52KU3KgAAAYE"]
[Sat Jul 18 23:47:28.407355 2026] [security2:error] [pid 953994:tid 954243] [client 103.160.26.178:62966] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxk8OyJE89wAff52KU3KgAAAYE"]
[Sat Jul 18 23:47:28.581571 2026] [security2:error] [pid 953994:tid 954222] [client 34.123.137.137:27542] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "betterbonddogtraining.com"] [uri "/wp-json/batch/v1"] [unique_id "alxk8OyJE89wAff52KU3MgAAAWw"]
[Sat Jul 18 23:47:28.688105 2026] [security2:error] [pid 953994:tid 954187] [client 45.133.7.64:33169] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 64.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/admin-footer.php"] [unique_id "alxk8OyJE89wAff52KU3RgAAAUk"]
[Sat Jul 18 23:47:28.747843 2026] [security2:error] [pid 953994:tid 954048] [remote 31.42.184.154:39562] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "michiganhomecaregroup.com"] [uri "/wp-login.php"] [unique_id "alxk8OyJE89wAff52KU3TQABdTU"], referer: https://michiganhomecaregroup.com/wp-login.php
[Sat Jul 18 23:47:28.790405 2026] [security2:error] [pid 953994:tid 954162] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk8OyJE89wAff52KU3LQABMCU"]
[Sat Jul 18 23:47:28.791025 2026] [security2:error] [pid 953994:tid 954185] [client 45.134.20.127:29127] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 127.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/radio.php"] [unique_id "alxk8OyJE89wAff52KU3UQAAAUc"]
[Sat Jul 18 23:47:28.857254 2026] [security2:error] [pid 953994:tid 954155] [client 34.123.137.137:27542] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "betterbonddogtraining.com"] [uri "/"] [unique_id "alxk8OyJE89wAff52KU3UwAAASk"]
[Sat Jul 18 23:47:29.299673 2026] [security2:error] [pid 953994:tid 954239] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk8OyJE89wAff52KU3WwABfT4"]
[Sat Jul 18 23:47:29.369899 2026] [security2:error] [pid 953994:tid 954248] [client 45.133.7.60:49235] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 60.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/maint/wp-conflg.php"] [unique_id "alxk8eyJE89wAff52KU3cQAAAYY"]
[Sat Jul 18 23:47:29.384227 2026] [security2:error] [pid 953994:tid 954191] [client 138.252.89.100:63243] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxk8eyJE89wAff52KU3dAAAAU0"]
[Sat Jul 18 23:47:29.384979 2026] [security2:error] [pid 953994:tid 954191] [client 138.252.89.100:63243] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxk8eyJE89wAff52KU3dAAAAU0"]
[Sat Jul 18 23:47:29.621281 2026] [security2:error] [pid 953994:tid 954233] [client 217.217.245.230:19739] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.245.217.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxk8eyJE89wAff52KU3hAAAAXc"]
[Sat Jul 18 23:47:29.621376 2026] [security2:error] [pid 953994:tid 954233] [client 217.217.245.230:19739] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxk8eyJE89wAff52KU3hAAAAXc"]
[Sat Jul 18 23:47:29.645738 2026] [security2:error] [pid 953994:tid 954169] [client 45.134.20.105:27087] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/mah.php"] [unique_id "alxk8eyJE89wAff52KU3hgAAATc"]
[Sat Jul 18 23:47:29.878836 2026] [security2:error] [pid 953994:tid 954204] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk8eyJE89wAff52KU3fQABWj8"]
[Sat Jul 18 23:47:30.050454 2026] [security2:error] [pid 953994:tid 954226] [client 45.133.7.82:41055] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/XxX.php"] [unique_id "alxk8uyJE89wAff52KU3qQAAAXA"]
[Sat Jul 18 23:47:30.170353 2026] [security2:error] [pid 953994:tid 954091] [remote 152.228.213.32:59344] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxk8uyJE89wAff52KU3rwABHWA"]
[Sat Jul 18 23:47:30.323557 2026] [security2:error] [pid 953994:tid 954180] [client 163.61.1.17:53667] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxk8uyJE89wAff52KU3twAAAUI"]
[Sat Jul 18 23:47:30.323660 2026] [security2:error] [pid 953994:tid 954180] [client 163.61.1.17:53667] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxk8uyJE89wAff52KU3twAAAUI"]
[Sat Jul 18 23:47:30.405707 2026] [security2:error] [pid 953994:tid 954098] [remote 31.42.184.154:34648] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "myspineworld.com"] [uri "/wp-login.php"] [unique_id "alxk8uyJE89wAff52KU3xwABF2c"]
[Sat Jul 18 23:47:30.463581 2026] [security2:error] [pid 953994:tid 954222] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk8uyJE89wAff52KU3rgABbF0"]
[Sat Jul 18 23:47:30.466204 2026] [security2:error] [pid 953994:tid 954234] [client 139.167.225.146:59583] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxk8uyJE89wAff52KU3zgAAAXg"]
[Sat Jul 18 23:47:30.466309 2026] [security2:error] [pid 953994:tid 954234] [client 139.167.225.146:59583] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxk8uyJE89wAff52KU3zgAAAXg"]
[Sat Jul 18 23:47:30.507572 2026] [security2:error] [pid 953994:tid 954192] [client 45.134.20.112:40895] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 112.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/dummyyummy/wp-signup.php"] [unique_id "alxk8uyJE89wAff52KU32QAAAU4"]
[Sat Jul 18 23:47:30.642646 2026] [security2:error] [pid 953994:tid 954113] [remote 31.42.184.154:34648] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "myspineworld.com"] [uri "/wp-login.php"] [unique_id "alxk8uyJE89wAff52KU33QABPHY"], referer: https://myspineworld.com/wp-login.php
[Sat Jul 18 23:47:30.744970 2026] [security2:error] [pid 953994:tid 954205] [client 45.133.7.71:25177] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 71.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/ubh/install.php"] [unique_id "alxk8uyJE89wAff52KU36wAAAVs"]
[Sat Jul 18 23:47:31.108872 2026] [security2:error] [pid 953994:tid 954140] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk8uyJE89wAff52KU36AABGnU"]
[Sat Jul 18 23:47:31.120120 2026] [security2:error] [pid 953994:tid 954148] [client 34.123.137.137:27542] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "betterbonddogtraining.com"] [uri "/index.php"] [unique_id "alxk8eyJE89wAff52KU3jQAAASI"], referer: http://betterbonddogtraining.com/wp-json/batch/v1
[Sat Jul 18 23:47:31.422172 2026] [security2:error] [pid 953994:tid 954213] [client 45.134.20.110:37499] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "alxk8-yJE89wAff52KU4HAAAAWM"]
[Sat Jul 18 23:47:31.423772 2026] [security2:error] [pid 953994:tid 954186] [client 45.133.7.66:46097] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 66.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "alxk8-yJE89wAff52KU4IQAAAUg"]
[Sat Jul 18 23:47:31.658650 2026] [security2:error] [pid 953994:tid 954227] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk8-yJE89wAff52KU4FAABcQ0"]
[Sat Jul 18 23:47:31.718080 2026] [security2:error] [pid 953994:tid 954192] [client 106.222.249.209:3273] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxk8-yJE89wAff52KU4MgAAAU4"]
[Sat Jul 18 23:47:31.718192 2026] [security2:error] [pid 953994:tid 954192] [client 106.222.249.209:3273] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxk8-yJE89wAff52KU4MgAAAU4"]
[Sat Jul 18 23:47:31.759615 2026] [security2:error] [pid 953994:tid 954206] [client 180.252.198.240:54752] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxk8-yJE89wAff52KU4NAAAAVw"]
[Sat Jul 18 23:47:31.759703 2026] [security2:error] [pid 953994:tid 954206] [client 180.252.198.240:54752] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxk8-yJE89wAff52KU4NAAAAVw"]
[Sat Jul 18 23:47:31.923040 2026] [security2:error] [pid 953994:tid 954026] [remote 74.235.96.117:49960] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.235.74.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "taskidsvirginia.com"] [uri "/wp-login.php"] [unique_id "alxk8-yJE89wAff52KU4PAABSh8"]
[Sat Jul 18 23:47:32.111503 2026] [security2:error] [pid 953994:tid 954198] [client 45.133.7.104:25647] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "alxk9OyJE89wAff52KU4QwAAAVQ"]
[Sat Jul 18 23:47:32.134678 2026] [security2:error] [pid 953994:tid 954030] [remote 74.235.96.117:49960] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.235.74.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "taskidsvirginia.com"] [uri "/wp-login.php"] [unique_id "alxk9OyJE89wAff52KU4RAABCiM"], referer: https://taskidsvirginia.com/wp-login.php
[Sat Jul 18 23:47:32.285655 2026] [security2:error] [pid 953994:tid 954150] [client 45.134.20.127:38129] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 127.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-conflg.php"] [unique_id "alxk9OyJE89wAff52KU4TwAAASQ"]
[Sat Jul 18 23:47:32.496142 2026] [security2:error] [pid 953994:tid 954037] [remote 152.228.213.32:59344] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxk9OyJE89wAff52KU4YAABPSo"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:47:32.599546 2026] [security2:error] [pid 953994:tid 954137] [client 74.208.214.194:45332] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxk9OyJE89wAff52KU4awAAARc"]
[Sat Jul 18 23:47:32.795604 2026] [security2:error] [pid 953994:tid 954215] [client 45.133.7.57:50675] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 57.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "alxk9OyJE89wAff52KU4cgAAAWU"]
[Sat Jul 18 23:47:32.881883 2026] [security2:error] [pid 953994:tid 954235] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk9OyJE89wAff52KU4ZQABeSs"]
[Sat Jul 18 23:47:33.143041 2026] [security2:error] [pid 953994:tid 954201] [client 45.134.20.124:39541] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 124.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-setup.php"] [unique_id "alxk9eyJE89wAff52KU4kQAAAVc"]
[Sat Jul 18 23:47:33.424348 2026] [security2:error] [pid 953994:tid 954186] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk9eyJE89wAff52KU4kAABSCE"]
[Sat Jul 18 23:47:33.481341 2026] [security2:error] [pid 953994:tid 954242] [client 45.133.7.60:24269] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 60.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/twentytwentyfour/content-index.php"] [unique_id "alxk9eyJE89wAff52KU4pAAAAYA"]
[Sat Jul 18 23:47:33.618622 2026] [security2:error] [pid 953994:tid 954228] [client 140.245.98.209:59982] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.98.245.140.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "juniper3medical.com"] [uri "/wp-login.php"] [unique_id "alxk9eyJE89wAff52KU4tgAAAXI"]
[Sat Jul 18 23:47:33.995326 2026] [security2:error] [pid 953994:tid 954189] [client 140.245.98.209:60038] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.98.245.140.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "juniper3medical.com"] [uri "/wp-login.php"] [unique_id "alxk9eyJE89wAff52KU41wAAAUs"], referer: https://www.google.com/
[Sat Jul 18 23:47:34.009626 2026] [security2:error] [pid 953994:tid 954181] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk9eyJE89wAff52KU4uAABQ0Y"]
[Sat Jul 18 23:47:34.012407 2026] [security2:error] [pid 953994:tid 954209] [client 45.134.20.105:55229] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/ms-themes.php"] [unique_id "alxk9uyJE89wAff52KU42QAAAV8"]
[Sat Jul 18 23:47:34.160424 2026] [security2:error] [pid 953994:tid 954140] [client 45.133.7.61:64247] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/admin/controller/extension/extension/alfa.php"] [unique_id "alxk9uyJE89wAff52KU45QAAARo"]
[Sat Jul 18 23:47:34.282374 2026] [security2:error] [pid 953994:tid 954198] [client 89.167.13.70:21305] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.13.167.89.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "americanbubbleball.com"] [uri "/contact.php"] [unique_id "alxk9uyJE89wAff52KU48gAAAVQ"], referer: https://www.google.com/
[Sat Jul 18 23:47:34.483281 2026] [security2:error] [pid 953994:tid 954190] [client 89.167.13.70:21301] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.13.167.89.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "americanbubbleball.com"] [uri "/contact-us.php"] [unique_id "alxk9uyJE89wAff52KU5AwAAAUw"], referer: https://www.google.com/
[Sat Jul 18 23:47:34.493402 2026] [security2:error] [pid 953994:tid 954135] [client 89.167.13.70:22924] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.13.167.89.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "americanbubbleball.com"] [uri "/delivery.php"] [unique_id "alxk9uyJE89wAff52KU5BQAAARU"], referer: https://www.google.com/
[Sat Jul 18 23:47:34.495979 2026] [security2:error] [pid 953994:tid 954236] [client 89.167.13.70:62915] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.13.167.89.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "americanbubbleball.com"] [uri "/shipping.php"] [unique_id "alxk9uyJE89wAff52KU5BwAAAXo"], referer: https://www.google.com/
[Sat Jul 18 23:47:34.558949 2026] [security2:error] [pid 953994:tid 954213] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk9uyJE89wAff52KU46AABYzA"]
[Sat Jul 18 23:47:34.691631 2026] [security2:error] [pid 953994:tid 954193] [client 89.167.13.70:21303] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.13.167.89.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "americanbubbleball.com"] [uri "/about.php"] [unique_id "alxk9uyJE89wAff52KU5EgAAAU8"], referer: https://www.google.com/
[Sat Jul 18 23:47:34.721459 2026] [security2:error] [pid 953994:tid 954141] [client 4.194.24.143:53534] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/nine2code.php"] [unique_id "alxk9uyJE89wAff52KU5GAAAARs"]
[Sat Jul 18 23:47:34.822917 2026] [autoindex:error] [pid 953994:tid 954218] [client 173.239.196.162:64651] AH01276: Cannot serve directory /home1/ipqbpvmy/public_html/sixpackminer/.well-known/acme-challenge/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:47:34.841723 2026] [security2:error] [pid 953994:tid 954130] [client 45.133.7.61:57813] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/twentytwentyfour/system_cache.php%20"] [unique_id "alxk9uyJE89wAff52KU5IgAAARA"]
[Sat Jul 18 23:47:34.881068 2026] [security2:error] [pid 953994:tid 954196] [client 45.134.20.134:39209] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 134.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/assets/about.php"] [unique_id "alxk9uyJE89wAff52KU5JgAAAVI"]
[Sat Jul 18 23:47:34.931463 2026] [security2:error] [pid 953994:tid 954111] [remote 41.76.213.235:57686] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.idf.ldc.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxk9uyJE89wAff52KU5KwABQHQ"]
[Sat Jul 18 23:47:34.931647 2026] [security2:error] [pid 953994:tid 954178] [client 41.76.213.235:57686] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "mail.idf.ldc.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxk9uyJE89wAff52KU5KwABQHQ"]
[Sat Jul 18 23:47:35.058614 2026] [security2:error] [pid 953994:tid 954163] [client 187.204.15.199:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "healthylifegourmet.org"] [uri "/index.php"] [unique_id "alxk9uyJE89wAff52KU5GQAAATE"]
[Sat Jul 18 23:47:35.160475 2026] [security2:error] [pid 953994:tid 954206] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk9uyJE89wAff52KU5HwABXHc"]
[Sat Jul 18 23:47:35.163601 2026] [security2:error] [pid 953994:tid 954016] [remote 31.42.184.154:34662] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxk9-yJE89wAff52KU5XQABRBU"]
[Sat Jul 18 23:47:35.173118 2026] [security2:error] [pid 953994:tid 954180] [client 89.167.13.70:30559] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.13.167.89.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "americanbubbleball.com"] [uri "/info.php"] [unique_id "alxk9-yJE89wAff52KU5XwAAAUI"], referer: https://www.google.com/
[Sat Jul 18 23:47:35.177376 2026] [security2:error] [pid 953994:tid 954155] [client 89.167.13.70:30556] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.13.167.89.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "americanbubbleball.com"] [uri "/about-us.php"] [unique_id "alxk9-yJE89wAff52KU5YAAAASk"], referer: https://www.google.com/
[Sat Jul 18 23:47:35.486269 2026] [security2:error] [pid 953994:tid 954030] [remote 31.42.184.154:34662] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxk9-yJE89wAff52KU5cwABVCM"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:47:35.523020 2026] [security2:error] [pid 953994:tid 954190] [client 45.133.7.85:58267] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 85.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/modern/colors.css.php"] [unique_id "alxk9-yJE89wAff52KU5dgAAAUw"]
[Sat Jul 18 23:47:35.533513 2026] [security2:error] [pid 953994:tid 954162] [client 4.194.24.143:15594] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/num.php"] [unique_id "alxk9-yJE89wAff52KU5eAAAATA"]
[Sat Jul 18 23:47:35.714763 2026] [security2:error] [pid 953994:tid 954225] [client 20.226.60.151:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "nzfoodstory.com"] [uri "/index.php"] [unique_id "alxk9-yJE89wAff52KU5agABbxY"]
[Sat Jul 18 23:47:35.733913 2026] [security2:error] [pid 953994:tid 954213] [client 45.134.20.118:63211] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/style.php"] [unique_id "alxk9-yJE89wAff52KU5jgAAAWM"]
[Sat Jul 18 23:47:36.203869 2026] [security2:error] [pid 953994:tid 954174] [client 45.133.7.97:55487] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 97.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "alxk-OyJE89wAff52KU5sgAAATw"]
[Sat Jul 18 23:47:36.230395 2026] [security2:error] [pid 953994:tid 954144] [client 4.194.24.143:53562] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/odf7udtspqtpxzyxmw2rccdefault.php"] [unique_id "alxk-OyJE89wAff52KU5tgAAAR4"]
[Sat Jul 18 23:47:36.329037 2026] [security2:error] [pid 953994:tid 954230] [client 113.160.97.242:63740] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxk-OyJE89wAff52KU5uwAAAXQ"]
[Sat Jul 18 23:47:36.598371 2026] [security2:error] [pid 953994:tid 954139] [client 45.134.20.108:34295] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/infi.php"] [unique_id "alxk-OyJE89wAff52KU5zgAAARk"]
[Sat Jul 18 23:47:36.832299 2026] [security2:error] [pid 953994:tid 954187] [client 4.194.24.143:15751] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/option.php"] [unique_id "alxk-OyJE89wAff52KU53QAAAUk"]
[Sat Jul 18 23:47:36.883376 2026] [security2:error] [pid 953994:tid 954236] [client 45.133.7.78:50501] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 78.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/css/media-widget-vide02.php"] [unique_id "alxk-OyJE89wAff52KU53wAAAXo"]
[Sat Jul 18 23:47:37.291880 2026] [security2:error] [pid 953994:tid 954172] [client 34.172.185.49:5934] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "according2plant.com"] [uri "/wp-json/batch/v1"] [unique_id "alxk-eyJE89wAff52KU59QAAATo"]
[Sat Jul 18 23:47:37.470030 2026] [security2:error] [pid 953994:tid 954251] [client 45.134.20.138:26573] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 138.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/maint/index.php"] [unique_id "alxk-eyJE89wAff52KU6AQAAAYk"]
[Sat Jul 18 23:47:37.563647 2026] [security2:error] [pid 953994:tid 954241] [client 45.133.7.73:38365] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 73.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "alxk-eyJE89wAff52KU6DQAAAX8"]
[Sat Jul 18 23:47:37.582351 2026] [security2:error] [pid 953994:tid 954087] [remote 47.86.33.52:30288] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "boz.rnn.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxk-eyJE89wAff52KU6DgABVVw"]
[Sat Jul 18 23:47:37.654932 2026] [security2:error] [pid 953994:tid 954250] [client 34.172.185.49:5934] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "according2plant.com"] [uri "/"] [unique_id "alxk-eyJE89wAff52KU6FgAAAYg"]
[Sat Jul 18 23:47:37.659095 2026] [security2:error] [pid 953994:tid 954155] [client 4.194.24.143:15807] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/p.php"] [unique_id "alxk-eyJE89wAff52KU6FwAAASk"]
[Sat Jul 18 23:47:38.128594 2026] [security2:error] [pid 953994:tid 954209] [client 94.205.146.150:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "liquidationteam.com"] [uri "/index.php"] [unique_id "alxk-eyJE89wAff52KU6BQAAAV8"]
[Sat Jul 18 23:47:38.148646 2026] [security2:error] [pid 953994:tid 954226] [client 74.208.214.194:38368] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxk-uyJE89wAff52KU6LAAAAXA"]
[Sat Jul 18 23:47:38.214433 2026] [security2:error] [pid 953994:tid 954153] [client 4.194.24.143:15782] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/past.php"] [unique_id "alxk-uyJE89wAff52KU6MQAAASc"]
[Sat Jul 18 23:47:38.249021 2026] [security2:error] [pid 953994:tid 954137] [client 45.133.7.96:51641] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 96.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/images/buy.php"] [unique_id "alxk-uyJE89wAff52KU6NwAAARc"]
[Sat Jul 18 23:47:38.332522 2026] [security2:error] [pid 953994:tid 954169] [client 45.134.20.138:32195] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 138.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/x.php"] [unique_id "alxk-uyJE89wAff52KU6PgAAATc"]
[Sat Jul 18 23:47:38.385531 2026] [security2:error] [pid 953994:tid 954162] [client 36.83.95.75:59645] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxk-uyJE89wAff52KU6SAAAATA"]
[Sat Jul 18 23:47:38.385634 2026] [security2:error] [pid 953994:tid 954162] [client 36.83.95.75:59645] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxk-uyJE89wAff52KU6SAAAATA"]
[Sat Jul 18 23:47:38.807278 2026] [security2:error] [pid 953994:tid 954131] [client 4.194.24.143:15767] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/php.php"] [unique_id "alxk-uyJE89wAff52KU6XgAAARE"]
[Sat Jul 18 23:47:38.826701 2026] [security2:error] [pid 953994:tid 954105] [remote 47.86.33.52:30288] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "boz.rnn.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxk-uyJE89wAff52KU6YAABOG4"], referer: https://boz.rnn.mybluehost.me/wp-login.php
[Sat Jul 18 23:47:38.930548 2026] [security2:error] [pid 953994:tid 954201] [client 45.133.7.76:57361] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 76.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/templates/beez3/av.php"] [unique_id "alxk-uyJE89wAff52KU6aQAAAVc"]
[Sat Jul 18 23:47:39.004570 2026] [security2:error] [pid 953994:tid 954210] [client 103.160.26.178:63432] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxk--yJE89wAff52KU6bAAAAWA"]
[Sat Jul 18 23:47:39.004663 2026] [security2:error] [pid 953994:tid 954210] [client 103.160.26.178:63432] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxk--yJE89wAff52KU6bAAAAWA"]
[Sat Jul 18 23:47:39.192910 2026] [security2:error] [pid 953994:tid 954204] [client 45.134.20.128:39201] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "alxk--yJE89wAff52KU6cwAAAVo"]
[Sat Jul 18 23:47:39.349726 2026] [security2:error] [pid 953994:tid 954148] [client 4.194.24.143:15756] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/php8.php"] [unique_id "alxk--yJE89wAff52KU6gAAAASI"]
[Sat Jul 18 23:47:39.615486 2026] [security2:error] [pid 953994:tid 954187] [client 45.133.7.68:57025] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 68.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "alxk--yJE89wAff52KU6jgAAAUk"]
[Sat Jul 18 23:47:39.623727 2026] [security2:error] [pid 953994:tid 954013] [remote 8.217.108.67:41310] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "wgs.doq.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxk--yJE89wAff52KU6jQABhBI"]
[Sat Jul 18 23:47:39.623888 2026] [security2:error] [pid 953994:tid 954246] [client 8.217.108.67:41310] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "wgs.doq.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxk--yJE89wAff52KU6jQABhBI"]
[Sat Jul 18 23:47:39.678061 2026] [security2:error] [pid 953994:tid 954116] [remote 31.42.184.154:34674] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "phillipbloch.com"] [uri "/wp-login.php"] [unique_id "alxk--yJE89wAff52KU6kgABXnk"]
[Sat Jul 18 23:47:39.764134 2026] [security2:error] [pid 953994:tid 954249] [client 144.172.91.227:53237] ModSecurity: Access denied with code 406 (phase 1). Pattern match "python-requests|python-urllib" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "1460"] [id "909111"] [msg "Python UA brute"] [hostname "charisandchesed.com"] [uri "/kickstart.php"] [unique_id "alxk--yJE89wAff52KU6ogAAAYc"]
[Sat Jul 18 23:47:39.891152 2026] [security2:error] [pid 953994:tid 954237] [client 4.194.24.143:38933] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/phpinfo.php"] [unique_id "alxk--yJE89wAff52KU6qQAAAXs"]
[Sat Jul 18 23:47:39.933762 2026] [security2:error] [pid 953994:tid 954035] [remote 31.42.184.154:34674] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "phillipbloch.com"] [uri "/wp-login.php"] [unique_id "alxk--yJE89wAff52KU6qwABQCg"], referer: https://phillipbloch.com/wp-login.php
[Sat Jul 18 23:47:40.048504 2026] [security2:error] [pid 953994:tid 954247] [client 45.134.20.114:41871] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/css/index.php"] [unique_id "alxk_OyJE89wAff52KU6rQAAAYU"]
[Sat Jul 18 23:47:40.294976 2026] [security2:error] [pid 953994:tid 954162] [client 45.133.7.55:48507] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 55.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/install.php"] [unique_id "alxk_OyJE89wAff52KU6wQAAATA"]
[Sat Jul 18 23:47:40.301317 2026] [security2:error] [pid 953994:tid 954219] [client 217.217.245.230:14231] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.245.217.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxk_OyJE89wAff52KU6wgAAAWk"]
[Sat Jul 18 23:47:40.301442 2026] [security2:error] [pid 953994:tid 954219] [client 217.217.245.230:14231] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxk_OyJE89wAff52KU6wgAAAWk"]
[Sat Jul 18 23:47:40.514058 2026] [core:error] [pid 953994:tid 954222] [client 4.194.24.143:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:47:40.514090 2026] [core:error] [pid 953994:tid 954222] [client 4.194.24.143:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:47:40.840442 2026] [security2:error] [pid 953994:tid 954195] [client 163.61.1.17:54140] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxk_OyJE89wAff52KU65gAAAVE"]
[Sat Jul 18 23:47:40.840561 2026] [security2:error] [pid 953994:tid 954195] [client 163.61.1.17:54140] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxk_OyJE89wAff52KU65gAAAVE"]
[Sat Jul 18 23:47:40.908595 2026] [security2:error] [pid 953994:tid 954152] [client 45.134.20.106:23097] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/images/index22.php"] [unique_id "alxk_OyJE89wAff52KU66wAAASY"]
[Sat Jul 18 23:47:40.977568 2026] [security2:error] [pid 953994:tid 954147] [client 45.133.7.89:25375] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 89.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/plugins/function.php"] [unique_id "alxk_OyJE89wAff52KU67QAAASE"]
[Sat Jul 18 23:47:41.075355 2026] [security2:error] [pid 953994:tid 954162] [client 4.194.24.143:15747] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/post.php"] [unique_id "alxk_eyJE89wAff52KU68gAAATA"]
[Sat Jul 18 23:47:41.270273 2026] [security2:error] [pid 953994:tid 954212] [client 138.252.89.100:63758] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxk_eyJE89wAff52KU6-AAAAWI"]
[Sat Jul 18 23:47:41.270373 2026] [security2:error] [pid 953994:tid 954212] [client 138.252.89.100:63758] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxk_eyJE89wAff52KU6-AAAAWI"]
[Sat Jul 18 23:47:41.357279 2026] [security2:error] [pid 953994:tid 954164] [client 34.172.185.49:5934] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "according2plant.com"] [uri "/index.php"] [unique_id "alxk-uyJE89wAff52KU6YwAAATI"], referer: http://according2plant.com/wp-json/batch/v1
[Sat Jul 18 23:47:41.618002 2026] [security2:error] [pid 953994:tid 954237] [client 4.194.24.143:16325] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/public/assets/design_1/css/parts/course_cards/grid_card_1.min.php"] [unique_id "alxk_eyJE89wAff52KU7GAAAAXs"]
[Sat Jul 18 23:47:41.656414 2026] [security2:error] [pid 953994:tid 954206] [client 45.133.7.99:60193] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/header.php"] [unique_id "alxk_eyJE89wAff52KU7GgAAAVw"]
[Sat Jul 18 23:47:41.773726 2026] [security2:error] [pid 953994:tid 954157] [client 45.134.20.115:51627] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-user.php"] [unique_id "alxk_eyJE89wAff52KU7HQAAASs"]
[Sat Jul 18 23:47:42.226902 2026] [security2:error] [pid 953994:tid 954227] [client 106.222.249.209:24218] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxk_uyJE89wAff52KU7PgAAAXE"]
[Sat Jul 18 23:47:42.227088 2026] [security2:error] [pid 953994:tid 954227] [client 106.222.249.209:24218] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxk_uyJE89wAff52KU7PgAAAXE"]
[Sat Jul 18 23:47:42.237530 2026] [security2:error] [pid 953994:tid 954228] [client 4.194.24.143:38953] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/public/css.php"] [unique_id "alxk_uyJE89wAff52KU7PwAAAXI"]
[Sat Jul 18 23:47:42.320281 2026] [security2:error] [pid 953994:tid 954091] [remote 104.131.116.82:34878] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.116.131.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "friendlyspreadsheet.com"] [uri "/wp-login.php"] [unique_id "alxk_uyJE89wAff52KU7QgABDWA"]
[Sat Jul 18 23:47:42.337980 2026] [security2:error] [pid 953994:tid 954202] [client 45.133.7.55:22811] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 55.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wordpress/wp-content/uploads/install.php"] [unique_id "alxk_uyJE89wAff52KU7QwAAAVg"]
[Sat Jul 18 23:47:42.482710 2026] [security2:error] [pid 953994:tid 954096] [remote 104.131.116.82:34878] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.116.131.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "friendlyspreadsheet.com"] [uri "/wp-login.php"] [unique_id "alxk_uyJE89wAff52KU7TgABVGU"], referer: https://friendlyspreadsheet.com/wp-login.php
[Sat Jul 18 23:47:42.627159 2026] [security2:error] [pid 953994:tid 954149] [client 45.134.20.135:57921] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "alxk_uyJE89wAff52KU7VwAAASM"]
[Sat Jul 18 23:47:42.785529 2026] [security2:error] [pid 953994:tid 954242] [client 173.239.196.162:64651] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "655"] [id "900155"] [msg "WP Brute UA block"] [hostname "sixpackminer.org"] [uri "/wp-admin/css/colors/coffee/"] [unique_id "alxk_uyJE89wAff52KU7YgAAAYA"]
[Sat Jul 18 23:47:42.801634 2026] [security2:error] [pid 953994:tid 954155] [client 180.252.198.240:55241] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxk_uyJE89wAff52KU7ZQAAASk"]
[Sat Jul 18 23:47:42.801710 2026] [security2:error] [pid 953994:tid 954155] [client 180.252.198.240:55241] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxk_uyJE89wAff52KU7ZQAAASk"]
[Sat Jul 18 23:47:42.830867 2026] [security2:error] [pid 953994:tid 954129] [client 4.194.24.143:38974] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/r.php"] [unique_id "alxk_uyJE89wAff52KU7aAAAAQ8"]
[Sat Jul 18 23:47:42.950722 2026] [security2:error] [pid 953994:tid 954226] [client 136.64.169.133:30494] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "friendlyspreadsheet.com"] [uri "/wp-json/batch/v1"] [unique_id "alxk_uyJE89wAff52KU7egAAAXA"]
[Sat Jul 18 23:47:43.018867 2026] [security2:error] [pid 953994:tid 954205] [client 45.133.7.81:33827] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 81.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/pki-validation/server.php"] [unique_id "alxk_-yJE89wAff52KU7iwAAAVs"]
[Sat Jul 18 23:47:43.065827 2026] [security2:error] [pid 953994:tid 954009] [remote 31.42.184.154:56216] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxk_-yJE89wAff52KU7jQABKg4"]
[Sat Jul 18 23:47:43.184867 2026] [security2:error] [pid 953994:tid 954152] [client 136.64.169.133:30494] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "friendlyspreadsheet.com"] [uri "/"] [unique_id "alxk_-yJE89wAff52KU7kQAAASY"]
[Sat Jul 18 23:47:43.324644 2026] [security2:error] [pid 953994:tid 954008] [remote 31.42.184.154:56216] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxk_-yJE89wAff52KU7mAABaw0"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:47:43.375519 2026] [security2:error] [pid 953994:tid 954175] [client 4.194.24.143:38937] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/radio.php"] [unique_id "alxk_-yJE89wAff52KU7mgAAAT0"]
[Sat Jul 18 23:47:43.489524 2026] [security2:error] [pid 953994:tid 954132] [client 45.134.20.118:56547] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "alxk_-yJE89wAff52KU7pQAAARI"]
[Sat Jul 18 23:47:43.699061 2026] [security2:error] [pid 953994:tid 954222] [client 45.133.7.101:30313] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 101.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/autoload_classmap/install.php"] [unique_id "alxk_-yJE89wAff52KU7twAAAWw"]
[Sat Jul 18 23:47:43.918175 2026] [security2:error] [pid 953994:tid 954249] [client 4.194.24.143:38941] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/randkeyword.php7"] [unique_id "alxk_-yJE89wAff52KU7xQAAAYc"]
[Sat Jul 18 23:47:43.958242 2026] [security2:error] [pid 953994:tid 954016] [remote 31.42.184.154:56404] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.alexsandbergmusic.com"] [uri "/wp-login.php"] [unique_id "alxk_-yJE89wAff52KU7yQABdhU"]
[Sat Jul 18 23:47:44.139402 2026] [security2:error] [pid 953994:tid 954206] [client 92.50.23.180:28448] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.sesamegreenbeans.com"] [uri "/index.php"] [unique_id "alxk_-yJE89wAff52KU7wgABXHc"]
[Sat Jul 18 23:47:44.185148 2026] [security2:error] [pid 953994:tid 954211] [client 136.64.169.133:30494] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "friendlyspreadsheet.com"] [uri "/index.php"] [unique_id "alxlAOyJE89wAff52KU70gAAAWE"], referer: http://friendlyspreadsheet.com/wp-json/batch/v1
[Sat Jul 18 23:47:44.345012 2026] [security2:error] [pid 953994:tid 954124] [client 45.134.20.112:57031] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 112.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/config.php"] [unique_id "alxlAOyJE89wAff52KU75wAAAQo"]
[Sat Jul 18 23:47:44.379627 2026] [security2:error] [pid 953994:tid 954213] [client 45.133.7.88:23207] ModSecurity: Warning. Pattern match "/1\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1543"] [id "900921"] [msg "temporary TUW-72162 logging rule"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/pwnd/1.php"] [unique_id "alxlAOyJE89wAff52KU76QAAAWM"]
[Sat Jul 18 23:47:44.379769 2026] [security2:error] [pid 953994:tid 954213] [client 45.133.7.88:23207] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 88.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/pwnd/1.php"] [unique_id "alxlAOyJE89wAff52KU76QAAAWM"]
[Sat Jul 18 23:47:44.476575 2026] [security2:error] [pid 953994:tid 954209] [client 4.194.24.143:38956] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/readme.php"] [unique_id "alxlAOyJE89wAff52KU78AAAAV8"]
[Sat Jul 18 23:47:44.781596 2026] [security2:error] [pid 953994:tid 954153] [client 50.116.65.227:39416] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxlAOyJE89wAff52KU8DAAAASc"]
[Sat Jul 18 23:47:44.794488 2026] [security2:error] [pid 953994:tid 954246] [client 50.116.65.227:33570] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxlAOyJE89wAff52KU8DQAAAYQ"]
[Sat Jul 18 23:47:45.025258 2026] [security2:error] [pid 953994:tid 954212] [client 4.194.24.143:16381] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/reze.php"] [unique_id "alxlAeyJE89wAff52KU8GAAAAWI"]
[Sat Jul 18 23:47:45.061670 2026] [security2:error] [pid 953994:tid 954202] [client 45.133.7.63:51205] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/ubh/av.php"] [unique_id "alxlAeyJE89wAff52KU8HgAAAVg"]
[Sat Jul 18 23:47:45.205948 2026] [security2:error] [pid 953994:tid 954238] [client 45.134.20.119:60901] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/special.php"] [unique_id "alxlAeyJE89wAff52KU8KQAAAXw"]
[Sat Jul 18 23:47:45.377866 2026] [security2:error] [pid 953994:tid 954143] [client 3.109.49.224:56588] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.49.109.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxlAeyJE89wAff52KU8LgAAAR0"]
[Sat Jul 18 23:47:45.510458 2026] [proxy:error] [pid 953994:tid 954162] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:45.510514 2026] [proxy_http:error] [pid 953994:tid 954162] [client 193.47.62.168:56560] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:45.511353 2026] [proxy:error] [pid 953994:tid 954162] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:45.511405 2026] [proxy_http:error] [pid 953994:tid 954162] [client 193.47.62.168:56560] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:45.581776 2026] [security2:error] [pid 953994:tid 954251] [client 4.194.24.143:53530] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/rh.php"] [unique_id "alxlAeyJE89wAff52KU8RAAAAYk"]
[Sat Jul 18 23:47:45.586819 2026] [security2:error] [pid 953994:tid 954053] [remote 31.42.184.154:56404] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.alexsandbergmusic.com"] [uri "/wp-login.php"] [unique_id "alxlAeyJE89wAff52KU8RQABLTo"], referer: https://mail.alexsandbergmusic.com/wp-login.php
[Sat Jul 18 23:47:45.740758 2026] [security2:error] [pid 953994:tid 954161] [client 45.133.7.64:52201] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 64.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/uploads/anas.php"] [unique_id "alxlAeyJE89wAff52KU8UwAAAS8"]
[Sat Jul 18 23:47:45.836496 2026] [security2:error] [pid 953994:tid 954184] [client 78.126.166.195:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "bandsir.com"] [uri "/index.php"] [unique_id "alxlAOyJE89wAff52KU8EgAAAUY"]
[Sat Jul 18 23:47:45.871940 2026] [security2:error] [pid 953994:tid 954062] [remote 8.217.108.67:41316] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxlAeyJE89wAff52KU8VwABfUM"]
[Sat Jul 18 23:47:45.948619 2026] [security2:error] [pid 953994:tid 954249] [client 50.116.65.227:33614] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "learnthissecret.com"] [uri "/index.php"] [unique_id "alxlAeyJE89wAff52KU8TAAAAYc"]
[Sat Jul 18 23:47:46.059316 2026] [security2:error] [pid 953994:tid 954208] [client 45.134.20.116:23035] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 116.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/assets/script.js.php"] [unique_id "alxlAuyJE89wAff52KU8ZQAAAV4"]
[Sat Jul 18 23:47:46.124814 2026] [security2:error] [pid 953994:tid 954147] [client 4.194.24.143:53536] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/rip.php"] [unique_id "alxlAuyJE89wAff52KU8bwAAASE"]
[Sat Jul 18 23:47:46.245130 2026] [security2:error] [pid 953994:tid 954092] [remote 8.217.108.67:41316] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxlAuyJE89wAff52KU8eAABiWE"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:47:46.250526 2026] [security2:error] [pid 953994:tid 954199] [client 50.116.65.227:33628] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "learnthissecret.com"] [uri "/index.php"] [unique_id "alxlAeyJE89wAff52KU8XQAAAVU"]
[Sat Jul 18 23:47:46.423801 2026] [security2:error] [pid 953994:tid 954139] [client 45.133.7.56:27601] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 56.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/blue/shell.php"] [unique_id "alxlAuyJE89wAff52KU8gwAAARk"]
[Sat Jul 18 23:47:46.664067 2026] [security2:error] [pid 953994:tid 954220] [client 4.194.24.143:16373] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/root.php"] [unique_id "alxlAuyJE89wAff52KU8lQAAAWo"]
[Sat Jul 18 23:47:46.919644 2026] [security2:error] [pid 953994:tid 954231] [client 45.134.20.137:63677] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 137.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/twentytwentythree/patterns/index.php"] [unique_id "alxlAuyJE89wAff52KU8oAAAAXU"]
[Sat Jul 18 23:47:47.102343 2026] [security2:error] [pid 953994:tid 954218] [client 45.133.7.55:20005] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 55.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/erinyani/default.php"] [unique_id "alxlA-yJE89wAff52KU8rgAAAWg"]
[Sat Jul 18 23:47:47.270126 2026] [security2:error] [pid 953994:tid 954146] [client 4.194.24.143:16363] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/s.php"] [unique_id "alxlA-yJE89wAff52KU8uQAAASA"]
[Sat Jul 18 23:47:47.343487 2026] [security2:error] [pid 953994:tid 954159] [client 54.211.205.212:60378] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 212.205.211.54.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxlA-yJE89wAff52KU8ugAAAS0"]
[Sat Jul 18 23:47:47.343569 2026] [security2:error] [pid 953994:tid 954159] [client 54.211.205.212:60378] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxlA-yJE89wAff52KU8ugAAAS0"]
[Sat Jul 18 23:47:47.514525 2026] [security2:error] [pid 953994:tid 954207] [client 50.116.65.227:39428] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxlA-yJE89wAff52KU8wwAAAV0"]
[Sat Jul 18 23:47:47.530581 2026] [security2:error] [pid 953994:tid 954202] [client 50.116.65.227:33644] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxlA-yJE89wAff52KU8xAAAAVg"]
[Sat Jul 18 23:47:47.589017 2026] [security2:error] [pid 953994:tid 954175] [client 3.109.49.224:56600] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.49.109.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxlA-yJE89wAff52KU8ygAAAT0"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:47:47.780287 2026] [security2:error] [pid 953994:tid 954167] [client 45.134.20.119:60629] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/sunrise/colors_95.php"] [unique_id "alxlA-yJE89wAff52KU83AAAATU"]
[Sat Jul 18 23:47:47.781800 2026] [security2:error] [pid 953994:tid 954218] [client 45.133.7.80:49649] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/Text/index.php"] [unique_id "alxlA-yJE89wAff52KU83QAAAWg"]
[Sat Jul 18 23:47:47.897678 2026] [security2:error] [pid 953994:tid 954209] [client 4.194.24.143:38960] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/sang.php"] [unique_id "alxlA-yJE89wAff52KU84wAAAV8"]
[Sat Jul 18 23:47:47.914203 2026] [security2:error] [pid 953994:tid 954008] [remote 31.42.184.154:56232] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxlA-yJE89wAff52KU85QABMg0"]
[Sat Jul 18 23:47:48.008564 2026] [security2:error] [pid 953994:tid 954229] [client 43.153.10.13:33536] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "box5936.bluehost.com"] [uri "/index.cgi"] [unique_id "alxlA-yJE89wAff52KU85gAAAXM"]
[Sat Jul 18 23:47:48.177101 2026] [security2:error] [pid 953994:tid 954022] [remote 31.42.184.154:56232] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxlBOyJE89wAff52KU88gABEhs"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:47:48.262193 2026] [security2:error] [pid 953994:tid 953996] [remote 20.153.140.50:39124] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxlBOyJE89wAff52KU8_wABFAE"]
[Sat Jul 18 23:47:48.262382 2026] [security2:error] [pid 953994:tid 954134] [client 20.153.140.50:39124] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxlBOyJE89wAff52KU8_wABFAE"]
[Sat Jul 18 23:47:48.324634 2026] [security2:error] [pid 953994:tid 954003] [remote 31.42.184.154:56414] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "worbals.com"] [uri "/wp-login.php"] [unique_id "alxlBOyJE89wAff52KU9AgABFQg"]
[Sat Jul 18 23:47:48.364192 2026] [security2:error] [pid 953994:tid 954007] [remote 113.160.142.119:44128] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "website-e36532c6.faadenergy.com"] [uri "/wp-login.php"] [unique_id "alxlBOyJE89wAff52KU9AwABQAw"]
[Sat Jul 18 23:47:48.465409 2026] [security2:error] [pid 953994:tid 954243] [client 45.133.7.88:31989] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 88.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/xex.php"] [unique_id "alxlBOyJE89wAff52KU9CAAAAYE"]
[Sat Jul 18 23:47:48.583852 2026] [security2:error] [pid 953994:tid 954239] [client 4.194.24.143:16324] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/scxy.php"] [unique_id "alxlBOyJE89wAff52KU9DAAAAX0"]
[Sat Jul 18 23:47:48.659938 2026] [security2:error] [pid 953994:tid 954116] [remote 31.42.184.154:56414] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "worbals.com"] [uri "/wp-login.php"] [unique_id "alxlBOyJE89wAff52KU9EgABeXk"], referer: https://worbals.com/wp-login.php
[Sat Jul 18 23:47:48.660104 2026] [security2:error] [pid 953994:tid 954214] [client 45.134.20.127:27829] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 127.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "alxlBOyJE89wAff52KU9EwAAAWQ"]
[Sat Jul 18 23:47:48.860409 2026] [proxy:error] [pid 953994:tid 954226] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:48.860470 2026] [proxy_http:error] [pid 953994:tid 954226] [client 193.47.62.168:56572] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:48.860939 2026] [proxy:error] [pid 953994:tid 954226] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:47:48.860977 2026] [proxy_http:error] [pid 953994:tid 954226] [client 193.47.62.168:56572] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:47:48.913186 2026] [security2:error] [pid 953994:tid 954027] [remote 113.160.142.119:44128] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "website-e36532c6.faadenergy.com"] [uri "/wp-login.php"] [unique_id "alxlBOyJE89wAff52KU9MAABPyA"], referer: https://website-e36532c6.faadenergy.com/wp-login.php
[Sat Jul 18 23:47:49.037457 2026] [security2:error] [pid 953994:tid 954240] [client 36.83.95.75:60131] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlBeyJE89wAff52KU9NgAAAX4"]
[Sat Jul 18 23:47:49.037575 2026] [security2:error] [pid 953994:tid 954240] [client 36.83.95.75:60131] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlBeyJE89wAff52KU9NgAAAX4"]
[Sat Jul 18 23:47:49.134855 2026] [security2:error] [pid 953994:tid 954162] [client 4.194.24.143:53544] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/sd.php"] [unique_id "alxlBeyJE89wAff52KU9OgAAATA"]
[Sat Jul 18 23:47:49.144120 2026] [security2:error] [pid 953994:tid 954241] [client 45.133.7.73:22989] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 73.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/about.php"] [unique_id "alxlBeyJE89wAff52KU9PAAAAX8"]
[Sat Jul 18 23:47:49.517192 2026] [security2:error] [pid 953994:tid 954000] [remote 143.110.183.208:40782] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 208.183.110.143.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tophatroofingcompany.com"] [uri "/wp-login.php"] [unique_id "alxlBeyJE89wAff52KU9UwABQwU"]
[Sat Jul 18 23:47:49.518052 2026] [security2:error] [pid 953994:tid 954229] [client 45.134.20.122:61349] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/uploads/wp.php"] [unique_id "alxlBeyJE89wAff52KU9VgAAAXM"]
[Sat Jul 18 23:47:49.707828 2026] [security2:error] [pid 953994:tid 954172] [client 4.194.24.143:38963] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/sf.php"] [unique_id "alxlBeyJE89wAff52KU9XgAAATo"]
[Sat Jul 18 23:47:49.730154 2026] [security2:error] [pid 953994:tid 954236] [client 103.160.26.178:63904] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlBeyJE89wAff52KU9YQAAAXo"]
[Sat Jul 18 23:47:49.730257 2026] [security2:error] [pid 953994:tid 954236] [client 103.160.26.178:63904] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlBeyJE89wAff52KU9YQAAAXo"]
[Sat Jul 18 23:47:49.822138 2026] [security2:error] [pid 953994:tid 954251] [client 45.133.7.85:52355] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 85.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/pwnd/install.php"] [unique_id "alxlBeyJE89wAff52KU9bAAAAYk"]
[Sat Jul 18 23:47:49.922624 2026] [security2:error] [pid 953994:tid 954057] [remote 143.110.183.208:40782] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 208.183.110.143.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tophatroofingcompany.com"] [uri "/wp-login.php"] [unique_id "alxlBeyJE89wAff52KU9dQABSD4"], referer: https://tophatroofingcompany.com/wp-login.php
[Sat Jul 18 23:47:50.020796 2026] [security2:error] [pid 953994:tid 954032] [remote 157.66.47.83:47070] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxlBuyJE89wAff52KU9egABNyU"]
[Sat Jul 18 23:47:50.021041 2026] [security2:error] [pid 953994:tid 954169] [client 157.66.47.83:47070] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxlBuyJE89wAff52KU9egABNyU"]
[Sat Jul 18 23:47:50.122253 2026] [security2:error] [pid 953994:tid 954069] [remote 217.113.60.80:36046] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.60.113.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxlBuyJE89wAff52KU9fwABIEo"]
[Sat Jul 18 23:47:50.247169 2026] [security2:error] [pid 953994:tid 954220] [client 4.194.24.143:48579] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/shell.php"] [unique_id "alxlBuyJE89wAff52KU9iQAAAWo"]
[Sat Jul 18 23:47:50.360097 2026] [security2:error] [pid 953994:tid 954062] [remote 217.113.60.80:36046] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.60.113.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxlBuyJE89wAff52KU9lAABc0M"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:47:50.373222 2026] [security2:error] [pid 953994:tid 954210] [client 45.134.20.119:60821] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "alxlBuyJE89wAff52KU9mAAAAWA"]
[Sat Jul 18 23:47:50.504043 2026] [security2:error] [pid 953994:tid 954221] [client 45.133.7.87:46995] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 87.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/upload/install.php"] [unique_id "alxlBuyJE89wAff52KU9nAAAAWs"]
[Sat Jul 18 23:47:50.815417 2026] [core:error] [pid 953994:tid 954129] [client 4.194.24.143:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:47:50.815438 2026] [core:error] [pid 953994:tid 954129] [client 4.194.24.143:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:47:50.866147 2026] [security2:error] [pid 953994:tid 954091] [remote 68.183.22.192:60848] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 192.22.183.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxlBuyJE89wAff52KU9sgABY2A"]
[Sat Jul 18 23:47:51.036524 2026] [security2:error] [pid 953994:tid 954072] [remote 68.183.22.192:60848] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 192.22.183.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxlB-yJE89wAff52KU9vAABVE0"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:47:51.192485 2026] [security2:error] [pid 953994:tid 954204] [client 45.133.7.96:27997] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 96.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-head.php"] [unique_id "alxlB-yJE89wAff52KU9wAAAAVo"]
[Sat Jul 18 23:47:51.220795 2026] [security2:error] [pid 953994:tid 954140] [client 163.61.1.17:54620] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlB-yJE89wAff52KU9wgAAARo"]
[Sat Jul 18 23:47:51.226352 2026] [security2:error] [pid 953994:tid 954140] [client 163.61.1.17:54620] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlB-yJE89wAff52KU9wgAAARo"]
[Sat Jul 18 23:47:51.234842 2026] [security2:error] [pid 953994:tid 954151] [client 45.134.20.108:54477] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/cgi-bin/class.api.php"] [unique_id "alxlB-yJE89wAff52KU9wwAAASU"]
[Sat Jul 18 23:47:51.391842 2026] [security2:error] [pid 953994:tid 954142] [client 4.194.24.143:15772] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/sid3.php"] [unique_id "alxlB-yJE89wAff52KU91gAAARw"]
[Sat Jul 18 23:47:51.736079 2026] [security2:error] [pid 953994:tid 954211] [client 13.232.206.133:55952] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.206.232.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxlB-yJE89wAff52KU97AAAAWE"]
[Sat Jul 18 23:47:51.736209 2026] [security2:error] [pid 953994:tid 954211] [client 13.232.206.133:55952] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxlB-yJE89wAff52KU97AAAAWE"]
[Sat Jul 18 23:47:51.872816 2026] [security2:error] [pid 953994:tid 954247] [client 45.133.7.87:28711] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 87.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/admin-footer.php"] [unique_id "alxlB-yJE89wAff52KU99AAAAYU"]
[Sat Jul 18 23:47:51.954810 2026] [security2:error] [pid 953994:tid 954135] [client 4.194.24.143:53507] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/simple.php"] [unique_id "alxlB-yJE89wAff52KU9-QAAARU"]
[Sat Jul 18 23:47:52.091443 2026] [security2:error] [pid 953994:tid 954216] [client 45.134.20.124:35975] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 124.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/cache/index.php"] [unique_id "alxlCOyJE89wAff52KU-BAAAAWY"]
[Sat Jul 18 23:47:52.445241 2026] [security2:error] [pid 953994:tid 954086] [remote 167.71.132.111:39582] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.132.71.167.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxlCOyJE89wAff52KU-GgABEls"]
[Sat Jul 18 23:47:52.556675 2026] [security2:error] [pid 953994:tid 954178] [client 45.133.7.87:41303] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 87.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/upgrade/wp-conflg.php"] [unique_id "alxlCOyJE89wAff52KU-HwAAAUA"]
[Sat Jul 18 23:47:52.564736 2026] [security2:error] [pid 953994:tid 954208] [client 180.252.198.240:55755] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlCOyJE89wAff52KU-IAAAAV4"]
[Sat Jul 18 23:47:52.565852 2026] [security2:error] [pid 953994:tid 954208] [client 180.252.198.240:55755] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlCOyJE89wAff52KU-IAAAAV4"]
[Sat Jul 18 23:47:52.613317 2026] [security2:error] [pid 953994:tid 954166] [client 4.194.24.143:53529] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/sitemap.php"] [unique_id "alxlCOyJE89wAff52KU-IgAAATQ"]
[Sat Jul 18 23:47:52.718316 2026] [security2:error] [pid 953994:tid 954240] [client 152.42.242.202:59049] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "alaraycreative.com"] [uri "/"] [unique_id "alxlCOyJE89wAff52KU-JwAAAX4"]
[Sat Jul 18 23:47:52.740384 2026] [security2:error] [pid 953994:tid 954004] [remote 167.71.132.111:39582] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.132.71.167.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxlCOyJE89wAff52KU-KQABZwk"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:47:52.915599 2026] [security2:error] [pid 953994:tid 954237] [client 138.252.89.100:64269] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlCOyJE89wAff52KU-NAAAAXs"]
[Sat Jul 18 23:47:52.915685 2026] [security2:error] [pid 953994:tid 954237] [client 138.252.89.100:64269] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlCOyJE89wAff52KU-NAAAAXs"]
[Sat Jul 18 23:47:52.928589 2026] [security2:error] [pid 953994:tid 954003] [remote 31.42.184.154:58392] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "civitansuncitiesaz.org"] [uri "/wp-login.php"] [unique_id "alxlCOyJE89wAff52KU-NwABYQg"]
[Sat Jul 18 23:47:52.964170 2026] [security2:error] [pid 953994:tid 954160] [client 45.134.20.114:47661] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "alxlCOyJE89wAff52KU-PgAAAS4"]
[Sat Jul 18 23:47:53.154491 2026] [security2:error] [pid 953994:tid 954140] [client 4.194.24.143:16337] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/size.php"] [unique_id "alxlCeyJE89wAff52KU-RgAAARo"]
[Sat Jul 18 23:47:53.240518 2026] [security2:error] [pid 953994:tid 954142] [client 45.133.7.73:57877] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 73.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/makeasmtp.php"] [unique_id "alxlCeyJE89wAff52KU-TQAAARw"]
[Sat Jul 18 23:47:53.286544 2026] [security2:error] [pid 953994:tid 954128] [client 106.222.249.209:20326] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxlCeyJE89wAff52KU-UAAAAQ4"]
[Sat Jul 18 23:47:53.286636 2026] [security2:error] [pid 953994:tid 954128] [client 106.222.249.209:20326] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxlCeyJE89wAff52KU-UAAAAQ4"]
[Sat Jul 18 23:47:53.328442 2026] [fcgid:warn] [pid 953994:tid 954147] (70014)End of file found: [client 62.210.111.125:60173] mod_fcgid: can't get data from http client
[Sat Jul 18 23:47:53.450611 2026] [security2:error] [pid 953994:tid 954026] [remote 31.42.184.154:58392] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "civitansuncitiesaz.org"] [uri "/wp-login.php"] [unique_id "alxlCeyJE89wAff52KU-VgABWh8"], referer: https://civitansuncitiesaz.org/wp-login.php
[Sat Jul 18 23:47:53.727164 2026] [security2:error] [pid 953994:tid 954159] [client 4.194.24.143:16022] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/sm.php"] [unique_id "alxlCeyJE89wAff52KU-aAAAAS0"]
[Sat Jul 18 23:47:53.785853 2026] [security2:error] [pid 953994:tid 954190] [client 13.232.206.133:55960] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.206.232.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxlCeyJE89wAff52KU-cgAAAUw"]
[Sat Jul 18 23:47:53.820970 2026] [security2:error] [pid 953994:tid 954125] [client 45.134.20.112:57399] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 112.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/edit.php"] [unique_id "alxlCeyJE89wAff52KU-dAAAAQs"]
[Sat Jul 18 23:47:53.929455 2026] [security2:error] [pid 953994:tid 954180] [client 45.133.7.55:25099] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 55.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/wp-sup.php"] [unique_id "alxlCeyJE89wAff52KU-fgAAAUI"]
[Sat Jul 18 23:47:54.212906 2026] [security2:error] [pid 953994:tid 954249] [client 13.232.206.133:55972] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.206.232.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cryptomeaning.com"] [uri "/xmlrpc.php"] [unique_id "alxlCuyJE89wAff52KU-kAAAAYc"]
[Sat Jul 18 23:47:54.212991 2026] [security2:error] [pid 953994:tid 954249] [client 13.232.206.133:55972] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cryptomeaning.com"] [uri "/xmlrpc.php"] [unique_id "alxlCuyJE89wAff52KU-kAAAAYc"]
[Sat Jul 18 23:47:54.287870 2026] [security2:error] [pid 953994:tid 954201] [client 4.194.24.143:16051] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/sql.php"] [unique_id "alxlCuyJE89wAff52KU-kwAAAVc"]
[Sat Jul 18 23:47:54.414186 2026] [security2:error] [pid 953994:tid 954040] [remote 102.134.101.35:41500] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 35.101.134.102.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "narv.co"] [uri "/xmlrpc.php"] [unique_id "alxlCuyJE89wAff52KU-nAABTS0"]
[Sat Jul 18 23:47:54.414436 2026] [security2:error] [pid 953994:tid 954191] [client 102.134.101.35:41500] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "narv.co"] [uri "/xmlrpc.php"] [unique_id "alxlCuyJE89wAff52KU-nAABTS0"]
[Sat Jul 18 23:47:54.425361 2026] [security2:error] [pid 953994:tid 954209] [client 98.82.181.200:47602] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 200.181.82.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxlCuyJE89wAff52KU-mwAAAV8"]
[Sat Jul 18 23:47:54.615469 2026] [security2:error] [pid 953994:tid 954216] [client 45.133.7.69:44015] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 69.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wordpress/wp-includes/class-wp-http-ixr-client-view.php"] [unique_id "alxlCuyJE89wAff52KU-tQAAAWY"]
[Sat Jul 18 23:47:54.674082 2026] [security2:error] [pid 953994:tid 954181] [client 45.134.20.115:30303] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/webdb.php"] [unique_id "alxlCuyJE89wAff52KU-uwAAAUM"]
[Sat Jul 18 23:47:54.765684 2026] [security2:error] [pid 953994:tid 954230] [client 54.145.191.230:10186] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.191.145.54.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxlCuyJE89wAff52KU-vgAAAXQ"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:47:54.846337 2026] [security2:error] [pid 953994:tid 954151] [client 4.194.24.143:16019] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/ss.php"] [unique_id "alxlCuyJE89wAff52KU-wwAAASU"]
[Sat Jul 18 23:47:55.192824 2026] [security2:error] [pid 953994:tid 954124] [client 3.109.49.224:61862] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.49.109.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxlC-yJE89wAff52KU-4AAAAQo"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:47:55.301731 2026] [security2:error] [pid 953994:tid 954247] [client 45.133.7.105:29141] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/images/bypass.php"] [unique_id "alxlC-yJE89wAff52KU-5QAAAYU"]
[Sat Jul 18 23:47:55.387898 2026] [security2:error] [pid 953994:tid 954244] [client 4.194.24.143:53547] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/stats.php"] [unique_id "alxlC-yJE89wAff52KU-6AAAAYI"]
[Sat Jul 18 23:47:55.528556 2026] [security2:error] [pid 953994:tid 954240] [client 45.134.20.131:28985] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/assets/images/doc.php"] [unique_id "alxlC-yJE89wAff52KU-9gAAAX4"]
[Sat Jul 18 23:47:55.870832 2026] [security2:error] [pid 953994:tid 954088] [remote 67.20.76.238:47358] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 238.76.20.67.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxlC-yJE89wAff52KU_DQABVl0"]
[Sat Jul 18 23:47:55.929322 2026] [security2:error] [pid 953994:tid 954197] [client 4.194.24.143:16320] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/sump1.php"] [unique_id "alxlC-yJE89wAff52KU_EQAAAVM"]
[Sat Jul 18 23:47:55.981301 2026] [security2:error] [pid 953994:tid 954226] [client 45.133.7.74:34267] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "alxlC-yJE89wAff52KU_EwAAAXA"]
[Sat Jul 18 23:47:56.066560 2026] [security2:error] [pid 953994:tid 954098] [remote 67.20.76.238:47358] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 238.76.20.67.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxlDOyJE89wAff52KU_GgABDmc"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:47:56.408288 2026] [security2:error] [pid 953994:tid 954158] [client 45.134.20.123:32459] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 123.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/file2.php"] [unique_id "alxlDOyJE89wAff52KU_NgAAASw"]
[Sat Jul 18 23:47:56.482231 2026] [security2:error] [pid 953994:tid 954198] [client 4.194.24.143:53512] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/system.php"] [unique_id "alxlDOyJE89wAff52KU_PAAAAVQ"]
[Sat Jul 18 23:47:56.662551 2026] [security2:error] [pid 953994:tid 954137] [client 45.133.7.64:24485] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 64.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/edit.php"] [unique_id "alxlDOyJE89wAff52KU_TAAAARc"]
[Sat Jul 18 23:47:57.024312 2026] [security2:error] [pid 953994:tid 954171] [client 4.194.24.143:41490] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/system/03n1hob7p03r2npdefault.php"] [unique_id "alxlDeyJE89wAff52KU_WAAAATk"]
[Sat Jul 18 23:47:57.131369 2026] [security2:error] [pid 953994:tid 954086] [remote 31.42.184.154:58412] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "rentorangegrove.com"] [uri "/wp-login.php"] [unique_id "alxlDeyJE89wAff52KU_YQABDls"]
[Sat Jul 18 23:47:57.263622 2026] [security2:error] [pid 953994:tid 954240] [client 45.134.20.137:28411] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 137.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "alxlDeyJE89wAff52KU_egAAAX4"]
[Sat Jul 18 23:47:57.341432 2026] [security2:error] [pid 953994:tid 954175] [client 45.133.7.74:55481] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/info.php"] [unique_id "alxlDeyJE89wAff52KU_fAAAAT0"]
[Sat Jul 18 23:47:57.366488 2026] [security2:error] [pid 953994:tid 954010] [remote 31.42.184.154:58398] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "allergyantidotes.com"] [uri "/wp-login.php"] [unique_id "alxlDeyJE89wAff52KU_fgABQQ8"]
[Sat Jul 18 23:47:57.369343 2026] [security2:error] [pid 953994:tid 954015] [remote 31.42.184.154:58412] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "rentorangegrove.com"] [uri "/wp-login.php"] [unique_id "alxlDeyJE89wAff52KU_fwABMBQ"], referer: https://rentorangegrove.com/wp-login.php
[Sat Jul 18 23:47:57.577631 2026] [security2:error] [pid 953994:tid 954250] [client 4.194.24.143:15480] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/system/cj5ha2rah8lyiqqdefault.php"] [unique_id "alxlDeyJE89wAff52KU_hgAAAYg"]
[Sat Jul 18 23:47:57.673812 2026] [security2:error] [pid 953994:tid 954116] [remote 41.186.86.12:12032] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxlDeyJE89wAff52KU_jgABUXk"]
[Sat Jul 18 23:47:58.020726 2026] [security2:error] [pid 953994:tid 954215] [client 45.133.7.60:57271] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 60.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/autoload_classmap.php"] [unique_id "alxlDuyJE89wAff52KU_pgAAAWU"]
[Sat Jul 18 23:47:58.128724 2026] [security2:error] [pid 953994:tid 954240] [client 45.134.20.128:22995] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/alfa.php"] [unique_id "alxlDuyJE89wAff52KU_qAAAAX4"]
[Sat Jul 18 23:47:58.154889 2026] [security2:error] [pid 953994:tid 954236] [client 4.194.24.143:16054] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/system_log.php"] [unique_id "alxlDuyJE89wAff52KU_rQAAAXo"]
[Sat Jul 18 23:47:58.196137 2026] [security2:error] [pid 953994:tid 954030] [remote 41.186.86.12:12032] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxlDuyJE89wAff52KU_sAABOiM"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:47:58.697583 2026] [security2:error] [pid 953994:tid 954156] [client 4.194.24.143:16009] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/t.php"] [unique_id "alxlDuyJE89wAff52KU_0QAAASo"]
[Sat Jul 18 23:47:58.700693 2026] [security2:error] [pid 953994:tid 954204] [client 45.133.7.69:63683] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 69.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/blue/navi.php"] [unique_id "alxlDuyJE89wAff52KU_0gAAAVo"]
[Sat Jul 18 23:47:58.931662 2026] [security2:error] [pid 953994:tid 954049] [remote 31.42.184.154:58398] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "allergyantidotes.com"] [uri "/wp-login.php"] [unique_id "alxlDuyJE89wAff52KU_4AABLDY"], referer: https://allergyantidotes.com/wp-login.php
[Sat Jul 18 23:47:59.006528 2026] [security2:error] [pid 953994:tid 954141] [client 45.134.20.112:43851] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 112.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/blue/admin.php"] [unique_id "alxlD-yJE89wAff52KU_4wAAARs"]
[Sat Jul 18 23:47:59.250630 2026] [security2:error] [pid 953994:tid 954199] [client 4.194.24.143:16042] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/term.php"] [unique_id "alxlD-yJE89wAff52KU_8wAAAVU"]
[Sat Jul 18 23:47:59.380432 2026] [security2:error] [pid 953994:tid 954166] [client 45.133.7.67:63479] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "alxlD-yJE89wAff52KVABQAAATQ"]
[Sat Jul 18 23:47:59.519521 2026] [security2:error] [pid 953994:tid 954127] [client 36.83.95.75:60606] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlD-yJE89wAff52KVAEQAAAQ0"]
[Sat Jul 18 23:47:59.519643 2026] [security2:error] [pid 953994:tid 954127] [client 36.83.95.75:60606] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlD-yJE89wAff52KVAEQAAAQ0"]
[Sat Jul 18 23:47:59.808389 2026] [security2:error] [pid 953994:tid 954244] [client 4.194.24.143:53534] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/test.php"] [unique_id "alxlD-yJE89wAff52KVAIQAAAYI"]
[Sat Jul 18 23:47:59.868628 2026] [security2:error] [pid 953994:tid 954160] [client 45.134.20.133:62037] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/click.php"] [unique_id "alxlD-yJE89wAff52KVAKAAAAS4"]
[Sat Jul 18 23:48:00.059737 2026] [security2:error] [pid 953994:tid 954197] [client 45.133.7.62:55169] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/xp.php%20"] [unique_id "alxlEOyJE89wAff52KVANQAAAVM"]
[Sat Jul 18 23:48:00.130338 2026] [security2:error] [pid 953994:tid 954193] [client 74.7.227.179:37834] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxlD-yJE89wAff52KVALgABT1A"], referer: https://tejasenvironmental.com/p=9873
[Sat Jul 18 23:48:00.348892 2026] [security2:error] [pid 953994:tid 954166] [client 4.194.24.143:16338] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/test1.php"] [unique_id "alxlEOyJE89wAff52KVATgAAATQ"]
[Sat Jul 18 23:48:00.360075 2026] [security2:error] [pid 953994:tid 954137] [client 103.160.26.178:64374] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlEOyJE89wAff52KVATAAAARc"]
[Sat Jul 18 23:48:00.360161 2026] [security2:error] [pid 953994:tid 954137] [client 103.160.26.178:64374] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlEOyJE89wAff52KVATAAAARc"]
[Sat Jul 18 23:48:00.723987 2026] [security2:error] [pid 953994:tid 954090] [remote 163.227.186.27:50534] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.factsandminds.com"] [uri "/wp-login.php"] [unique_id "alxlEOyJE89wAff52KVAcwABX18"]
[Sat Jul 18 23:48:00.732023 2026] [security2:error] [pid 953994:tid 954250] [client 45.134.20.131:56019] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/wp-conflg.php"] [unique_id "alxlEOyJE89wAff52KVAdQAAAYg"]
[Sat Jul 18 23:48:00.742769 2026] [security2:error] [pid 953994:tid 954193] [client 45.133.7.73:62939] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 73.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/languages/bypass.php"] [unique_id "alxlEOyJE89wAff52KVAdwAAAU8"]
[Sat Jul 18 23:48:00.889184 2026] [security2:error] [pid 953994:tid 954131] [client 4.194.24.143:16017] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/tfm.php"] [unique_id "alxlEOyJE89wAff52KVAgQAAARE"]
[Sat Jul 18 23:48:01.198137 2026] [security2:error] [pid 953994:tid 954006] [remote 163.227.186.27:50534] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.factsandminds.com"] [uri "/wp-login.php"] [unique_id "alxlEeyJE89wAff52KVAkwABVAs"], referer: https://mail.factsandminds.com/wp-login.php
[Sat Jul 18 23:48:01.422017 2026] [security2:error] [pid 953994:tid 954221] [client 45.133.7.54:53213] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/bypass_1.php"] [unique_id "alxlEeyJE89wAff52KVAsAAAAWs"]
[Sat Jul 18 23:48:01.461431 2026] [security2:error] [pid 953994:tid 954185] [client 4.194.24.143:16321] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/thebe.php"] [unique_id "alxlEeyJE89wAff52KVAswAAAUc"]
[Sat Jul 18 23:48:01.588754 2026] [security2:error] [pid 953994:tid 954206] [client 45.134.20.117:41445] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/blue/atomlib.php"] [unique_id "alxlEeyJE89wAff52KVAuwAAAVw"]
[Sat Jul 18 23:48:01.900253 2026] [security2:error] [pid 953994:tid 954126] [client 163.61.1.17:55094] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlEeyJE89wAff52KVA1AAAAQw"]
[Sat Jul 18 23:48:01.901680 2026] [security2:error] [pid 953994:tid 954126] [client 163.61.1.17:55094] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlEeyJE89wAff52KVA1AAAAQw"]
[Sat Jul 18 23:48:02.004765 2026] [security2:error] [pid 953994:tid 954183] [client 4.194.24.143:15622] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/themes.php"] [unique_id "alxlEuyJE89wAff52KVA2QAAAUU"]
[Sat Jul 18 23:48:02.105045 2026] [security2:error] [pid 953994:tid 954134] [client 45.133.7.99:35869] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/js/elementskit.php"] [unique_id "alxlEuyJE89wAff52KVA3QAAARQ"]
[Sat Jul 18 23:48:02.446988 2026] [security2:error] [pid 953994:tid 954180] [client 45.134.20.132:28887] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/js/widgets/bypass.php"] [unique_id "alxlEuyJE89wAff52KVA_wAAAUI"]
[Sat Jul 18 23:48:02.581737 2026] [security2:error] [pid 953994:tid 954246] [client 4.194.24.143:16050] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/tiny.php"] [unique_id "alxlEuyJE89wAff52KVBBQAAAYQ"]
[Sat Jul 18 23:48:02.784878 2026] [security2:error] [pid 953994:tid 954179] [client 45.133.7.87:52099] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 87.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "alxlEuyJE89wAff52KVBDQAAAUE"]
[Sat Jul 18 23:48:03.134454 2026] [security2:error] [pid 953994:tid 954186] [client 4.194.24.143:16052] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "elementfix.co.uk"] [uri "/tmp/byp.php"] [unique_id "alxlE-yJE89wAff52KVBJAAAAUg"]
[Sat Jul 18 23:48:03.299999 2026] [security2:error] [pid 953994:tid 954137] [client 45.134.20.110:29263] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "alxlE-yJE89wAff52KVBLAAAARc"]
[Sat Jul 18 23:48:03.467743 2026] [security2:error] [pid 953994:tid 954124] [client 45.133.7.100:49747] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/pki-validation/kur.php"] [unique_id "alxlE-yJE89wAff52KVBPQAAAQo"]
[Sat Jul 18 23:48:03.925317 2026] [security2:error] [pid 953994:tid 954205] [client 180.252.198.240:56250] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlE-yJE89wAff52KVBWAAAAVs"]
[Sat Jul 18 23:48:03.925410 2026] [security2:error] [pid 953994:tid 954205] [client 180.252.198.240:56250] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlE-yJE89wAff52KVBWAAAAVs"]
[Sat Jul 18 23:48:03.995900 2026] [security2:error] [pid 953994:tid 954198] [client 106.222.249.209:33222] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxlE-yJE89wAff52KVBXAAAAVQ"]
[Sat Jul 18 23:48:03.996018 2026] [security2:error] [pid 953994:tid 954198] [client 106.222.249.209:33222] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxlE-yJE89wAff52KVBXAAAAVQ"]
[Sat Jul 18 23:48:04.148188 2026] [security2:error] [pid 953994:tid 954248] [client 45.133.7.82:47069] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/click.php"] [unique_id "alxlFOyJE89wAff52KVBbQAAAYY"]
[Sat Jul 18 23:48:04.159625 2026] [security2:error] [pid 953994:tid 954140] [client 45.134.20.136:62949] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 136.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/index.php"] [unique_id "alxlFOyJE89wAff52KVBbgAAARo"]
[Sat Jul 18 23:48:04.819737 2026] [security2:error] [pid 953994:tid 954076] [remote 188.138.102.156:35138] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxlFOyJE89wAff52KVBmgABXVE"]
[Sat Jul 18 23:48:04.819989 2026] [security2:error] [pid 953994:tid 954207] [client 188.138.102.156:35138] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxlFOyJE89wAff52KVBmgABXVE"]
[Sat Jul 18 23:48:04.828101 2026] [security2:error] [pid 953994:tid 954168] [client 45.133.7.57:59555] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 57.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "alxlFOyJE89wAff52KVBmwAAATY"]
[Sat Jul 18 23:48:04.866236 2026] [security2:error] [pid 953994:tid 954202] [client 138.252.89.100:64786] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlFOyJE89wAff52KVBnQAAAVg"]
[Sat Jul 18 23:48:04.866343 2026] [security2:error] [pid 953994:tid 954202] [client 138.252.89.100:64786] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlFOyJE89wAff52KVBnQAAAVg"]
[Sat Jul 18 23:48:05.026964 2026] [security2:error] [pid 953994:tid 954056] [remote 31.42.184.154:56848] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxlFeyJE89wAff52KVBqgABSz0"]
[Sat Jul 18 23:48:05.079528 2026] [security2:error] [pid 953994:tid 954215] [client 45.134.20.118:27069] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/edit.php"] [unique_id "alxlFeyJE89wAff52KVBrQAAAWU"]
[Sat Jul 18 23:48:05.449245 2026] [security2:error] [pid 953994:tid 954233] [client 178.156.189.249:35612] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "windowtx.com"] [uri "/index.php"] [unique_id "alxlFOyJE89wAff52KVBoAAAAXc"], referer: https://windowtx.com
[Sat Jul 18 23:48:05.500233 2026] [security2:error] [pid 953994:tid 954094] [remote 31.42.184.154:56848] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxlFeyJE89wAff52KVB0wABXmM"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:48:05.522263 2026] [security2:error] [pid 953994:tid 954180] [client 45.133.7.72:45285] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 72.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "alxlFeyJE89wAff52KVB1QAAAUI"]
[Sat Jul 18 23:48:05.604581 2026] [security2:error] [pid 953994:tid 954125] [client 57.141.18.33:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxlFeyJE89wAff52KVBwwAAAQs"]
[Sat Jul 18 23:48:05.624826 2026] [security2:error] [pid 953994:tid 954090] [remote 131.72.236.158:36846] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 158.236.72.131.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "latiendadejorge.com.gt"] [uri "/wp-login.php"] [unique_id "alxlFeyJE89wAff52KVB2AABP18"]
[Sat Jul 18 23:48:05.943368 2026] [security2:error] [pid 953994:tid 954250] [client 45.134.20.134:63083] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 134.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/WordPressCore/index.php"] [unique_id "alxlFeyJE89wAff52KVB5AAAAYg"]
[Sat Jul 18 23:48:06.197082 2026] [security2:error] [pid 953994:tid 954108] [remote 131.72.236.158:36846] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 158.236.72.131.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "latiendadejorge.com.gt"] [uri "/wp-login.php"] [unique_id "alxlFuyJE89wAff52KVB_AABU3E"], referer: https://latiendadejorge.com.gt/wp-login.php
[Sat Jul 18 23:48:06.200865 2026] [security2:error] [pid 953994:tid 954224] [client 45.133.7.89:32669] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 89.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/error.php"] [unique_id "alxlFuyJE89wAff52KVB_QAAAW4"]
[Sat Jul 18 23:48:06.327293 2026] [security2:error] [pid 953994:tid 954185] [client 66.249.89.67:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "tiokubito.cl"] [uri "/index.php"] [unique_id "alxlFuyJE89wAff52KVB9gABR2k"], referer: https://tiokubito.cl/producto/preventa-happy-life-one-piece-monkey-d-luffy/
[Sat Jul 18 23:48:06.536863 2026] [security2:error] [pid 953994:tid 954111] [remote 14.128.14.9:43120] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.14.128.14.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "civitansuncitiesaz.org"] [uri "/wp-login.php"] [unique_id "alxlFuyJE89wAff52KVCEAABPnQ"]
[Sat Jul 18 23:48:06.801405 2026] [security2:error] [pid 953994:tid 954149] [client 45.134.20.105:51367] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/cgi-bin/autoload_classmap.php"] [unique_id "alxlFuyJE89wAff52KVCLwAAASM"]
[Sat Jul 18 23:48:06.878786 2026] [security2:error] [pid 953994:tid 954222] [client 45.133.7.99:34163] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/ALFA_DATA/alfacgiapi/all.php"] [unique_id "alxlFuyJE89wAff52KVCNAAAAWw"]
[Sat Jul 18 23:48:07.079015 2026] [security2:error] [pid 953994:tid 954112] [remote 14.128.14.9:43120] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.14.128.14.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "civitansuncitiesaz.org"] [uri "/wp-login.php"] [unique_id "alxlF-yJE89wAff52KVCSgABL3U"], referer: https://civitansuncitiesaz.org/wp-login.php
[Sat Jul 18 23:48:07.211100 2026] [proxy:error] [pid 953994:tid 954153] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:48:07.211163 2026] [proxy_http:error] [pid 953994:tid 954153] [client 185.147.157.29:26870] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:48:07.211621 2026] [proxy:error] [pid 953994:tid 954153] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:48:07.211648 2026] [proxy_http:error] [pid 953994:tid 954153] [client 185.147.157.29:26870] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:48:07.269262 2026] [core:error] [pid 953994:tid 954167] [client 185.147.157.29:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:48:07.269288 2026] [core:error] [pid 953994:tid 954167] [client 185.147.157.29:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:48:07.478414 2026] [core:error] [pid 953994:tid 954169] [client 185.147.157.29:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:48:07.478439 2026] [core:error] [pid 953994:tid 954169] [client 185.147.157.29:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:48:07.478847 2026] [core:error] [pid 953994:tid 954247] [client 185.147.157.29:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:48:07.478874 2026] [core:error] [pid 953994:tid 954247] [client 185.147.157.29:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:48:07.570347 2026] [security2:error] [pid 953994:tid 954226] [client 45.133.7.66:33295] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 66.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/images/autoload_classmap.php"] [unique_id "alxlF-yJE89wAff52KVCegAAAXA"]
[Sat Jul 18 23:48:07.663685 2026] [security2:error] [pid 953994:tid 954158] [client 45.134.20.129:60809] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-links-opml.php"] [unique_id "alxlF-yJE89wAff52KVCgwAAASw"]
[Sat Jul 18 23:48:07.969289 2026] [security2:error] [pid 953994:tid 954017] [remote 152.53.111.131:51120] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.111.53.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxlF-yJE89wAff52KVCjwABchY"]
[Sat Jul 18 23:48:08.193363 2026] [security2:error] [pid 953994:tid 954023] [remote 152.53.111.131:51120] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.111.53.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxlGOyJE89wAff52KVCowABVxw"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:48:08.252106 2026] [security2:error] [pid 953994:tid 954240] [client 45.133.7.65:49775] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 65.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/pki-validation/xmrlpc.php"] [unique_id "alxlGOyJE89wAff52KVCqQAAAX4"]
[Sat Jul 18 23:48:08.563162 2026] [security2:error] [pid 953994:tid 954251] [client 45.134.20.110:35067] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/user/network.php"] [unique_id "alxlGOyJE89wAff52KVCvAAAAYk"]
[Sat Jul 18 23:48:08.934049 2026] [security2:error] [pid 953994:tid 954130] [client 45.133.7.78:51075] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 78.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/maint/repairs.php"] [unique_id "alxlGOyJE89wAff52KVC2wAAARA"]
[Sat Jul 18 23:48:09.425255 2026] [security2:error] [pid 953994:tid 954149] [client 45.134.20.113:46493] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/atomlib.php"] [unique_id "alxlGeyJE89wAff52KVC-gAAASM"]
[Sat Jul 18 23:48:09.612320 2026] [security2:error] [pid 953994:tid 954222] [client 45.133.7.98:43607] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 98.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "alxlGeyJE89wAff52KVDAwAAAWw"]
[Sat Jul 18 23:48:10.179670 2026] [security2:error] [pid 953994:tid 954151] [client 36.83.95.75:61093] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlGuyJE89wAff52KVDJAAAASU"]
[Sat Jul 18 23:48:10.179815 2026] [security2:error] [pid 953994:tid 954151] [client 36.83.95.75:61093] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlGuyJE89wAff52KVDJAAAASU"]
[Sat Jul 18 23:48:10.281289 2026] [security2:error] [pid 953994:tid 954246] [client 45.134.20.132:29761] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "alxlGuyJE89wAff52KVDLgAAAYQ"]
[Sat Jul 18 23:48:10.292071 2026] [security2:error] [pid 953994:tid 954202] [client 45.133.7.54:22215] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin.php"] [unique_id "alxlGuyJE89wAff52KVDMAAAAVg"]
[Sat Jul 18 23:48:10.494850 2026] [security2:error] [pid 953994:tid 954088] [remote 152.228.213.32:41284] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "katsklar.com"] [uri "/wp-login.php"] [unique_id "alxlGuyJE89wAff52KVDNQABiV0"]
[Sat Jul 18 23:48:10.685407 2026] [security2:error] [pid 953994:tid 954043] [remote 152.228.213.32:41284] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "katsklar.com"] [uri "/wp-login.php"] [unique_id "alxlGuyJE89wAff52KVDRAABbjA"], referer: https://katsklar.com/wp-login.php
[Sat Jul 18 23:48:10.983261 2026] [security2:error] [pid 953994:tid 954198] [client 45.133.7.88:61597] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 88.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-header.php%20"] [unique_id "alxlGuyJE89wAff52KVDXwAAAVQ"]
[Sat Jul 18 23:48:11.087552 2026] [security2:error] [pid 953994:tid 954245] [client 103.160.26.178:64853] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlG-yJE89wAff52KVDaAAAAYM"]
[Sat Jul 18 23:48:11.087682 2026] [security2:error] [pid 953994:tid 954245] [client 103.160.26.178:64853] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlG-yJE89wAff52KVDaAAAAYM"]
[Sat Jul 18 23:48:11.143847 2026] [security2:error] [pid 953994:tid 954166] [client 45.134.20.118:46655] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/xl2023.php"] [unique_id "alxlG-yJE89wAff52KVDbwAAATQ"]
[Sat Jul 18 23:48:11.705339 2026] [security2:error] [pid 953994:tid 954132] [client 45.133.7.94:20547] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 94.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/file.php%20"] [unique_id "alxlG-yJE89wAff52KVDlAAAARI"]
[Sat Jul 18 23:48:12.006915 2026] [security2:error] [pid 953994:tid 954251] [client 45.134.20.138:38565] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 138.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/certificates/admin.php"] [unique_id "alxlHOyJE89wAff52KVDqwAAAYk"]
[Sat Jul 18 23:48:12.383867 2026] [security2:error] [pid 953994:tid 954219] [client 45.133.7.55:48825] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 55.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.tmb/doc.php"] [unique_id "alxlHOyJE89wAff52KVDxwAAAWk"]
[Sat Jul 18 23:48:12.548900 2026] [security2:error] [pid 953994:tid 954226] [client 163.61.1.17:55573] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlHOyJE89wAff52KVD2QAAAXA"]
[Sat Jul 18 23:48:12.550460 2026] [security2:error] [pid 953994:tid 954226] [client 163.61.1.17:55573] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlHOyJE89wAff52KVD2QAAAXA"]
[Sat Jul 18 23:48:12.837082 2026] [security2:error] [pid 953994:tid 954034] [remote 98.70.32.248:35362] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.32.70.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxlHOyJE89wAff52KVD9AABfic"]
[Sat Jul 18 23:48:12.860095 2026] [security2:error] [pid 953994:tid 954179] [client 45.134.20.136:25533] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 136.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/images/media/dog.php"] [unique_id "alxlHOyJE89wAff52KVD-QAAAUE"]
[Sat Jul 18 23:48:13.070854 2026] [security2:error] [pid 953994:tid 954167] [client 45.133.7.57:49347] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 57.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-editor.php"] [unique_id "alxlHeyJE89wAff52KVEBQAAATU"]
[Sat Jul 18 23:48:13.220842 2026] [security2:error] [pid 953994:tid 954047] [remote 98.70.32.248:35362] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.32.70.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxlHeyJE89wAff52KVEGgABFjQ"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:48:13.709335 2026] [security2:error] [pid 953994:tid 954214] [client 180.252.198.240:56738] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlHeyJE89wAff52KVENwAAAWQ"]
[Sat Jul 18 23:48:13.709424 2026] [security2:error] [pid 953994:tid 954214] [client 180.252.198.240:56738] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlHeyJE89wAff52KVENwAAAWQ"]
[Sat Jul 18 23:48:13.725417 2026] [security2:error] [pid 953994:tid 954135] [client 45.134.20.111:46157] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/xp.php"] [unique_id "alxlHeyJE89wAff52KVEOgAAARU"]
[Sat Jul 18 23:48:13.751312 2026] [security2:error] [pid 953994:tid 954125] [client 45.133.7.72:38419] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 72.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/style-engine-session.php"] [unique_id "alxlHeyJE89wAff52KVEPAAAAQs"]
[Sat Jul 18 23:48:14.386647 2026] [security2:error] [pid 953994:tid 954173] [client 23.233.214.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxlHuyJE89wAff52KVEXwABO2M"]
[Sat Jul 18 23:48:14.429437 2026] [security2:error] [pid 953994:tid 954219] [client 45.133.7.105:31117] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/images/install.php"] [unique_id "alxlHuyJE89wAff52KVEdAAAAWk"]
[Sat Jul 18 23:48:14.585240 2026] [security2:error] [pid 953994:tid 954209] [client 45.134.20.109:31173] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 109.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "alxlHuyJE89wAff52KVEfwAAAV8"]
[Sat Jul 18 23:48:15.111350 2026] [security2:error] [pid 953994:tid 954241] [client 45.133.7.103:28197] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/adminfusm.php"] [unique_id "alxlH-yJE89wAff52KVEowAAAX8"]
[Sat Jul 18 23:48:15.173102 2026] [security2:error] [pid 953994:tid 954195] [client 106.222.249.209:20413] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxlH-yJE89wAff52KVEpwAAAVE"]
[Sat Jul 18 23:48:15.173290 2026] [security2:error] [pid 953994:tid 954195] [client 106.222.249.209:20413] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxlH-yJE89wAff52KVEpwAAAVE"]
[Sat Jul 18 23:48:15.439795 2026] [security2:error] [pid 953994:tid 954150] [client 45.134.20.135:50669] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/assets/index.php"] [unique_id "alxlH-yJE89wAff52KVEvAAAASQ"]
[Sat Jul 18 23:48:15.790062 2026] [security2:error] [pid 953994:tid 954241] [client 45.133.7.93:32951] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 93.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/adminfusm.php"] [unique_id "alxlH-yJE89wAff52KVE2QAAAX8"]
[Sat Jul 18 23:48:15.792006 2026] [ssl:error] [pid 953994:tid 954246] [client 98.88.137.2:63591] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname autodiscover.karimnawfal.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:48:15.889722 2026] [security2:error] [pid 953994:tid 954219] [client 62.150.67.110:9629] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "ali-alghanim.net"] [uri "/index.php"] [unique_id "alxlH-yJE89wAff52KVEzQAAAWk"]
[Sat Jul 18 23:48:16.220364 2026] [security2:error] [pid 953994:tid 954173] [client 18.192.166.72:22016] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "mtlegnews.gov"] [uri "/index.php"] [unique_id "alxlH-yJE89wAff52KVE5gAAATs"], referer: https://mtlegnews.gov/
[Sat Jul 18 23:48:16.297765 2026] [security2:error] [pid 953994:tid 954167] [client 45.134.20.130:41755] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 130.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-links.php"] [unique_id "alxlIOyJE89wAff52KVFCQAAATU"]
[Sat Jul 18 23:48:16.478716 2026] [security2:error] [pid 953994:tid 954176] [client 45.133.7.102:53093] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 102.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/js/js1.php"] [unique_id "alxlIOyJE89wAff52KVFEAAAAT4"]
[Sat Jul 18 23:48:16.543164 2026] [security2:error] [pid 953994:tid 954136] [client 138.252.89.100:65303] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlIOyJE89wAff52KVFFgAAARY"]
[Sat Jul 18 23:48:16.543272 2026] [security2:error] [pid 953994:tid 954136] [client 138.252.89.100:65303] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlIOyJE89wAff52KVFFgAAARY"]
[Sat Jul 18 23:48:16.812196 2026] [security2:error] [pid 953994:tid 954214] [client 195.40.31.96:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "greenvillemoving.com"] [uri "/index.php"] [unique_id "alxlIOyJE89wAff52KVFIwAAAWQ"]
[Sat Jul 18 23:48:16.958623 2026] [security2:error] [pid 953994:tid 954150] [client 57.141.18.112:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxlIOyJE89wAff52KVFLwAAASQ"]
[Sat Jul 18 23:48:17.152825 2026] [security2:error] [pid 953994:tid 954239] [client 45.134.20.139:29035] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 139.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/as.php"] [unique_id "alxlIeyJE89wAff52KVFTQAAAX0"]
[Sat Jul 18 23:48:17.157227 2026] [security2:error] [pid 953994:tid 954247] [client 45.133.7.96:23049] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 96.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "alxlIeyJE89wAff52KVFTwAAAYU"]
[Sat Jul 18 23:48:17.836002 2026] [security2:error] [pid 953994:tid 954142] [client 45.133.7.93:31747] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 93.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "alxlIeyJE89wAff52KVFegAAARw"]
[Sat Jul 18 23:48:18.009450 2026] [security2:error] [pid 953994:tid 954239] [client 45.134.20.106:33825] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/css/index.php"] [unique_id "alxlIuyJE89wAff52KVFgwAAAX0"]
[Sat Jul 18 23:48:18.514043 2026] [security2:error] [pid 953994:tid 954151] [client 45.133.7.69:38239] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 69.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/mu-plugins/admin.php"] [unique_id "alxlIuyJE89wAff52KVFqAAAASU"]
[Sat Jul 18 23:48:18.865576 2026] [security2:error] [pid 953994:tid 954199] [client 45.134.20.124:20405] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 124.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "alxlIuyJE89wAff52KVFxQAAAVU"]
[Sat Jul 18 23:48:18.898140 2026] [security2:error] [pid 953994:tid 954245] [client 50.116.65.227:18670] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "recruitinginsight.us"] [uri "/wp-cron.php"] [unique_id "alxlIuyJE89wAff52KVFyQAAAYM"]
[Sat Jul 18 23:48:19.202001 2026] [security2:error] [pid 953994:tid 954248] [client 45.133.7.94:28739] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 94.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "alxlI-yJE89wAff52KVF2QAAAYY"]
[Sat Jul 18 23:48:19.735730 2026] [security2:error] [pid 953994:tid 954231] [client 45.134.20.137:26227] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 137.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/pomo/admin.php"] [unique_id "alxlI-yJE89wAff52KVF-wAAAXU"]
[Sat Jul 18 23:48:20.232210 2026] [security2:error] [pid 953994:tid 954218] [client 45.133.7.78:53969] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 78.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/about/function.php%20"] [unique_id "alxlJOyJE89wAff52KVGJAAAAWg"]
[Sat Jul 18 23:48:20.452411 2026] [security2:error] [pid 953994:tid 954100] [remote 103.28.36.122:53436] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.36.28.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "maplerespiteservices.com"] [uri "/wp-login.php"] [unique_id "alxlJOyJE89wAff52KVGKQABLWk"]
[Sat Jul 18 23:48:20.631979 2026] [security2:error] [pid 953994:tid 954129] [client 45.134.20.108:27145] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/IXR/security.php"] [unique_id "alxlJOyJE89wAff52KVGOQAAAQ8"]
[Sat Jul 18 23:48:20.746417 2026] [security2:error] [pid 953994:tid 954130] [client 36.83.95.75:61576] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlJOyJE89wAff52KVGQwAAARA"]
[Sat Jul 18 23:48:20.746522 2026] [security2:error] [pid 953994:tid 954130] [client 36.83.95.75:61576] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlJOyJE89wAff52KVGQwAAARA"]
[Sat Jul 18 23:48:20.913611 2026] [security2:error] [pid 953994:tid 954135] [client 45.133.7.96:27731] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 96.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/images/install.php"] [unique_id "alxlJOyJE89wAff52KVGSwAAARU"]
[Sat Jul 18 23:48:20.941417 2026] [security2:error] [pid 953994:tid 954112] [remote 103.28.36.122:53436] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.36.28.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "maplerespiteservices.com"] [uri "/wp-login.php"] [unique_id "alxlJOyJE89wAff52KVGTgABHnU"], referer: https://maplerespiteservices.com/wp-login.php
[Sat Jul 18 23:48:21.491720 2026] [security2:error] [pid 953994:tid 954247] [client 45.134.20.108:27729] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/phpadmin/as.php"] [unique_id "alxlJeyJE89wAff52KVGdgAAAYU"]
[Sat Jul 18 23:48:21.594344 2026] [security2:error] [pid 953994:tid 954176] [client 45.133.7.87:37851] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 87.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "alxlJeyJE89wAff52KVGewAAAT4"]
[Sat Jul 18 23:48:21.763168 2026] [security2:error] [pid 953994:tid 954228] [client 103.160.26.178:65328] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlJeyJE89wAff52KVGhgAAAXI"]
[Sat Jul 18 23:48:21.763264 2026] [security2:error] [pid 953994:tid 954228] [client 103.160.26.178:65328] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlJeyJE89wAff52KVGhgAAAXI"]
[Sat Jul 18 23:48:22.276913 2026] [security2:error] [pid 953994:tid 954183] [client 45.133.7.63:53539] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/js/widgets/doc.php"] [unique_id "alxlJuyJE89wAff52KVGpgAAAUU"]
[Sat Jul 18 23:48:22.353119 2026] [security2:error] [pid 953994:tid 954129] [client 45.134.20.124:47199] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 124.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "alxlJuyJE89wAff52KVGsAAAAQ8"]
[Sat Jul 18 23:48:22.463534 2026] [security2:error] [pid 953994:tid 954219] [client 34.71.230.24:22340] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "canqungarments.com"] [uri "/wp-json/batch/v1"] [unique_id "alxlJuyJE89wAff52KVGtgAAAWk"]
[Sat Jul 18 23:48:22.755495 2026] [security2:error] [pid 953994:tid 954151] [client 34.71.230.24:22340] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "canqungarments.com"] [uri "/"] [unique_id "alxlJuyJE89wAff52KVGwAAAASU"]
[Sat Jul 18 23:48:22.836912 2026] [security2:error] [pid 953994:tid 954066] [remote 47.86.33.52:15362] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nextlevelpressurewashing.com"] [uri "/wp-login.php"] [unique_id "alxlJuyJE89wAff52KVGzAABJ0c"]
[Sat Jul 18 23:48:22.931969 2026] [security2:error] [pid 953994:tid 954244] [client 163.61.1.17:56053] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlJuyJE89wAff52KVG2gAAAYI"]
[Sat Jul 18 23:48:22.932088 2026] [security2:error] [pid 953994:tid 954244] [client 163.61.1.17:56053] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlJuyJE89wAff52KVG2gAAAYI"]
[Sat Jul 18 23:48:22.955669 2026] [security2:error] [pid 953994:tid 954147] [client 45.133.7.95:51993] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/f35_SpaceTn.php"] [unique_id "alxlJuyJE89wAff52KVG3AAAASE"]
[Sat Jul 18 23:48:23.206871 2026] [security2:error] [pid 953994:tid 954169] [client 45.134.20.137:29493] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 137.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/hello.php"] [unique_id "alxlJ-yJE89wAff52KVG7QAAATc"]
[Sat Jul 18 23:48:23.219075 2026] [security2:error] [pid 953994:tid 954012] [remote 164.92.212.216:49342] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.212.92.164.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "falconarrowshop.com"] [uri "/phpinfo.php"] [unique_id "alxlJ-yJE89wAff52KVG8AABeBE"]
[Sat Jul 18 23:48:23.224908 2026] [security2:error] [pid 953994:tid 954054] [remote 164.92.212.216:49326] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.212.92.164.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "falconarrowshop.com"] [uri "/wp-admin/install.php"] [unique_id "alxlJ-yJE89wAff52KVG7gABcjs"]
[Sat Jul 18 23:48:23.241730 2026] [security2:error] [pid 953994:tid 954047] [remote 164.92.212.216:49328] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.212.92.164.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "falconarrowshop.com"] [uri "/xmlrpc.php"] [unique_id "alxlJ-yJE89wAff52KVG7wABfDQ"]
[Sat Jul 18 23:48:23.268822 2026] [security2:error] [pid 953994:tid 954046] [remote 164.92.212.216:49352] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 216.212.92.164.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "falconarrowshop.com"] [uri "/info.php"] [unique_id "alxlJ-yJE89wAff52KVHDQABEjM"]
[Sat Jul 18 23:48:23.291990 2026] [authz_core:error] [pid 953994:tid 954177] [client 164.92.212.216:0] AH01630: client denied by server configuration: /home1/zopdxpmy/public_html/error_log
[Sat Jul 18 23:48:23.642257 2026] [security2:error] [pid 953994:tid 954185] [client 45.133.7.55:49667] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 55.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/sunrise/bypass.php"] [unique_id "alxlJ-yJE89wAff52KVHIwAAAUc"]
[Sat Jul 18 23:48:23.647002 2026] [security2:error] [pid 953994:tid 954033] [remote 47.86.33.52:15362] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nextlevelpressurewashing.com"] [uri "/wp-login.php"] [unique_id "alxlJ-yJE89wAff52KVHIgABLyY"], referer: https://nextlevelpressurewashing.com/wp-login.php
[Sat Jul 18 23:48:23.994840 2026] [security2:error] [pid 953994:tid 954219] [client 34.71.230.24:13152] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "canqungarments.com"] [uri "/wp-json/batch/v1"] [unique_id "alxlJ-yJE89wAff52KVHOAAAAWk"]
[Sat Jul 18 23:48:24.060369 2026] [security2:error] [pid 953994:tid 954199] [client 45.134.20.105:32553] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/seoo/about.php"] [unique_id "alxlKOyJE89wAff52KVHOwAAAVU"]
[Sat Jul 18 23:48:24.132895 2026] [security2:error] [pid 953994:tid 954184] [client 180.252.198.240:57213] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlKOyJE89wAff52KVHQwAAAUY"]
[Sat Jul 18 23:48:24.133058 2026] [security2:error] [pid 953994:tid 954184] [client 180.252.198.240:57213] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlKOyJE89wAff52KVHQwAAAUY"]
[Sat Jul 18 23:48:24.238711 2026] [security2:error] [pid 953994:tid 954232] [client 164.92.212.216:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "falconarrowshop.com"] [uri "/index.php"] [unique_id "alxlJ-yJE89wAff52KVHBwAAAXY"]
[Sat Jul 18 23:48:24.238924 2026] [security2:error] [pid 953994:tid 954153] [client 164.92.212.216:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "falconarrowshop.com"] [uri "/index.php"] [unique_id "alxlJ-yJE89wAff52KVHCwAAASc"]
[Sat Jul 18 23:48:24.239103 2026] [security2:error] [pid 953994:tid 954196] [client 164.92.212.216:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "falconarrowshop.com"] [uri "/index.php"] [unique_id "alxlJ-yJE89wAff52KVHCgAAAVI"]
[Sat Jul 18 23:48:24.246682 2026] [security2:error] [pid 953994:tid 954230] [client 164.92.212.216:49310] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "falconarrowshop.com"] [uri "/index.php"] [unique_id "alxlJ-yJE89wAff52KVHCAABdD0"]
[Sat Jul 18 23:48:24.248894 2026] [security2:error] [pid 953994:tid 954152] [client 164.92.212.216:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "falconarrowshop.com"] [uri "/index.php"] [unique_id "alxlJ-yJE89wAff52KVHBgAAASY"]
[Sat Jul 18 23:48:24.254436 2026] [security2:error] [pid 953994:tid 954154] [client 164.92.212.216:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "falconarrowshop.com"] [uri "/index.php"] [unique_id "alxlJ-yJE89wAff52KVHBAAAASg"]
[Sat Jul 18 23:48:24.324701 2026] [security2:error] [pid 953994:tid 954172] [client 45.133.7.101:43727] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 101.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/fixed.php"] [unique_id "alxlKOyJE89wAff52KVHTQAAATo"]
[Sat Jul 18 23:48:24.339533 2026] [security2:error] [pid 953994:tid 954208] [client 34.71.230.24:13152] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "canqungarments.com"] [uri "/"] [unique_id "alxlKOyJE89wAff52KVHTwAAAV4"]
[Sat Jul 18 23:48:24.432833 2026] [security2:error] [pid 953994:tid 954088] [remote 152.228.213.32:46266] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxlKOyJE89wAff52KVHVgABa10"]
[Sat Jul 18 23:48:24.432944 2026] [security2:error] [pid 953994:tid 954221] [client 152.228.213.32:46266] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxlKOyJE89wAff52KVHVgABa10"]
[Sat Jul 18 23:48:24.506657 2026] [security2:error] [pid 953994:tid 954168] [client 139.167.225.146:62847] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxlKOyJE89wAff52KVHXwAAATY"]
[Sat Jul 18 23:48:24.506768 2026] [security2:error] [pid 953994:tid 954168] [client 139.167.225.146:62847] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxlKOyJE89wAff52KVHXwAAATY"]
[Sat Jul 18 23:48:24.924012 2026] [security2:error] [pid 953994:tid 954145] [client 45.134.20.113:54837] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/fonts/about.php"] [unique_id "alxlKOyJE89wAff52KVHfwAAAR8"]
[Sat Jul 18 23:48:25.011793 2026] [security2:error] [pid 953994:tid 954213] [client 45.133.7.86:42703] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 86.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/js/widgets/themes.php"] [unique_id "alxlKeyJE89wAff52KVHhgAAAWM"]
[Sat Jul 18 23:48:25.698530 2026] [security2:error] [pid 953994:tid 954248] [client 45.133.7.85:29749] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 85.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/fix/bypass.php"] [unique_id "alxlKeyJE89wAff52KVHrgAAAYY"]
[Sat Jul 18 23:48:25.716036 2026] [ssl:error] [pid 953994:tid 954231] [client 104.48.69.105:41452] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname blog.danwolfe.us provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:48:25.781237 2026] [security2:error] [pid 953994:tid 954217] [client 45.134.20.110:40813] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/moon.php"] [unique_id "alxlKeyJE89wAff52KVHsgAAAWc"]
[Sat Jul 18 23:48:26.382590 2026] [security2:error] [pid 953994:tid 954133] [client 45.133.7.70:45539] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/category-double.php"] [unique_id "alxlKuyJE89wAff52KVH2gAAARM"]
[Sat Jul 18 23:48:26.668017 2026] [security2:error] [pid 953994:tid 954239] [client 45.134.20.109:23135] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 109.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/user/about.php"] [unique_id "alxlKuyJE89wAff52KVH7wAAAX0"]
[Sat Jul 18 23:48:27.061610 2026] [security2:error] [pid 953994:tid 954234] [client 45.133.7.64:24077] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 64.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/maint/admin.php"] [unique_id "alxlK-yJE89wAff52KVIEAAAAXg"]
[Sat Jul 18 23:48:27.169735 2026] [security2:error] [pid 953994:tid 954214] [client 57.141.18.38:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxlKuyJE89wAff52KVIBgAAAWQ"]
[Sat Jul 18 23:48:27.469988 2026] [security2:error] [pid 953994:tid 954184] [client 34.171.169.105:35430] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "appelmanimages.com"] [uri "/wp-json/batch/v1"] [unique_id "alxlK-yJE89wAff52KVIHwAAAUY"]
[Sat Jul 18 23:48:27.525363 2026] [security2:error] [pid 953994:tid 954179] [client 45.134.20.119:54681] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/js/widgets/index.php"] [unique_id "alxlK-yJE89wAff52KVIKAAAAUE"]
[Sat Jul 18 23:48:27.688121 2026] [security2:error] [pid 953994:tid 954132] [client 34.171.169.105:35430] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "appelmanimages.com"] [uri "/"] [unique_id "alxlK-yJE89wAff52KVIOAAAARI"]
[Sat Jul 18 23:48:27.714153 2026] [security2:error] [pid 953994:tid 954038] [remote 31.42.184.154:34882] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "timespans.org"] [uri "/wp-login.php"] [unique_id "alxlK-yJE89wAff52KVIPAABICs"]
[Sat Jul 18 23:48:27.741478 2026] [security2:error] [pid 953994:tid 954247] [client 45.133.7.69:45149] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 69.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/blog/signatur.php"] [unique_id "alxlK-yJE89wAff52KVIPQAAAYU"]
[Sat Jul 18 23:48:27.946945 2026] [security2:error] [pid 953994:tid 954190] [client 173.239.196.161:46543] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "655"] [id "900155"] [msg "WP Brute UA block"] [hostname "sixpackminer.org"] [uri "/wp-admin/images/html-api/"] [unique_id "alxlK-yJE89wAff52KVITgAAAUw"]
[Sat Jul 18 23:48:27.955369 2026] [security2:error] [pid 953994:tid 954029] [remote 31.42.184.154:34882] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "timespans.org"] [uri "/wp-login.php"] [unique_id "alxlK-yJE89wAff52KVIUwABciI"], referer: https://timespans.org/wp-login.php
[Sat Jul 18 23:48:27.983469 2026] [security2:error] [pid 953994:tid 954046] [remote 72.167.132.114:48648] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxlK-yJE89wAff52KVIVAABGDM"]
[Sat Jul 18 23:48:27.983659 2026] [security2:error] [pid 953994:tid 954138] [client 72.167.132.114:48648] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxlK-yJE89wAff52KVIVAABGDM"]
[Sat Jul 18 23:48:28.140585 2026] [security2:error] [pid 953994:tid 954234] [client 138.252.89.100:49445] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlLOyJE89wAff52KVIYgAAAXg"]
[Sat Jul 18 23:48:28.141389 2026] [security2:error] [pid 953994:tid 954234] [client 138.252.89.100:49445] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlLOyJE89wAff52KVIYgAAAXg"]
[Sat Jul 18 23:48:28.387110 2026] [security2:error] [pid 953994:tid 954128] [client 45.134.20.127:55317] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 127.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/webadmin.php"] [unique_id "alxlLOyJE89wAff52KVIaQAAAQ4"]
[Sat Jul 18 23:48:28.420570 2026] [security2:error] [pid 953994:tid 954147] [client 45.133.7.63:38935] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/assets/db.php"] [unique_id "alxlLOyJE89wAff52KVIawAAASE"]
[Sat Jul 18 23:48:28.535909 2026] [security2:error] [pid 953994:tid 954251] [client 106.222.249.209:2007] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxlLOyJE89wAff52KVIdgAAAYk"]
[Sat Jul 18 23:48:28.536008 2026] [security2:error] [pid 953994:tid 954251] [client 106.222.249.209:2007] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxlLOyJE89wAff52KVIdgAAAYk"]
[Sat Jul 18 23:48:29.028447 2026] [security2:error] [pid 953994:tid 954053] [remote 103.90.234.13:48952] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.234.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxlLeyJE89wAff52KVInQABCzo"]
[Sat Jul 18 23:48:29.114986 2026] [security2:error] [pid 953994:tid 954187] [client 45.133.7.94:32675] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 94.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/widgets/security.php"] [unique_id "alxlLeyJE89wAff52KVIowAAAUk"]
[Sat Jul 18 23:48:29.244804 2026] [security2:error] [pid 953994:tid 954169] [client 45.134.20.130:63529] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 130.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "alxlLeyJE89wAff52KVIrQAAATc"]
[Sat Jul 18 23:48:29.556424 2026] [security2:error] [pid 953994:tid 954097] [remote 103.90.234.13:48952] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.234.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxlLeyJE89wAff52KVIuwABDGY"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:48:29.739613 2026] [ssl:error] [pid 953994:tid 954154] [client 104.48.69.105:58950] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname www.bandsir.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:48:29.798503 2026] [security2:error] [pid 953994:tid 954230] [client 45.133.7.87:42757] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 87.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/include/install.php"] [unique_id "alxlLeyJE89wAff52KVIzQAAAXQ"]
[Sat Jul 18 23:48:30.104843 2026] [security2:error] [pid 953994:tid 954242] [client 45.134.20.110:25419] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/about.php"] [unique_id "alxlLuyJE89wAff52KVI7gAAAYA"]
[Sat Jul 18 23:48:30.479850 2026] [security2:error] [pid 953994:tid 954129] [client 45.133.7.82:21031] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/gm.php"] [unique_id "alxlLuyJE89wAff52KVJAQAAAQ8"]
[Sat Jul 18 23:48:30.502904 2026] [security2:error] [pid 953994:tid 954222] [client 74.208.214.194:50470] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxlLuyJE89wAff52KVJAwAAAWw"]
[Sat Jul 18 23:48:30.964955 2026] [security2:error] [pid 953994:tid 954203] [client 45.134.20.116:64877] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 116.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/xl2023.php"] [unique_id "alxlLuyJE89wAff52KVJJAAAAVk"]
[Sat Jul 18 23:48:31.042122 2026] [security2:error] [pid 953994:tid 954117] [remote 113.160.142.119:37486] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxlL-yJE89wAff52KVJKAABdHo"]
[Sat Jul 18 23:48:31.150161 2026] [security2:error] [pid 953994:tid 954226] [client 65.21.113.250:0] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "404"] [hostname "noisepacks.com"] [uri "/cgi-sys/404.html"] [unique_id "alxlL-yJE89wAff52KVJNwAAAXA"]
[Sat Jul 18 23:48:31.152965 2026] [security2:error] [pid 953994:tid 954204] [client 65.21.113.250:37014] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "404"] [hostname "noisepacks.com"] [uri "/robots.txt"] [unique_id "alxlL-yJE89wAff52KVJMwAAAVo"]
[Sat Jul 18 23:48:31.161663 2026] [security2:error] [pid 953994:tid 954172] [client 45.133.7.70:39893] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "alxlL-yJE89wAff52KVJOgAAATo"]
[Sat Jul 18 23:48:31.338251 2026] [security2:error] [pid 953994:tid 954225] [client 36.83.95.75:62064] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlL-yJE89wAff52KVJSwAAAW8"]
[Sat Jul 18 23:48:31.338336 2026] [security2:error] [pid 953994:tid 954225] [client 36.83.95.75:62064] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlL-yJE89wAff52KVJSwAAAW8"]
[Sat Jul 18 23:48:31.476906 2026] [security2:error] [pid 953994:tid 954000] [remote 31.42.184.154:52934] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "verdunestate.com"] [uri "/wp-login.php"] [unique_id "alxlL-yJE89wAff52KVJVQABQwU"]
[Sat Jul 18 23:48:31.541033 2026] [security2:error] [pid 953994:tid 954041] [remote 113.160.142.119:37486] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxlL-yJE89wAff52KVJVwABKi4"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:48:31.764349 2026] [security2:error] [pid 953994:tid 954023] [remote 31.42.184.154:52934] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "verdunestate.com"] [uri "/wp-login.php"] [unique_id "alxlL-yJE89wAff52KVJawABNxw"], referer: https://verdunestate.com/wp-login.php
[Sat Jul 18 23:48:31.773792 2026] [security2:error] [pid 953994:tid 954212] [client 50.116.65.227:24346] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxlL-yJE89wAff52KVJbAAAAWI"]
[Sat Jul 18 23:48:31.789467 2026] [security2:error] [pid 953994:tid 954155] [client 50.116.65.227:36372] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxlL-yJE89wAff52KVJbgAAASk"]
[Sat Jul 18 23:48:31.822125 2026] [security2:error] [pid 953994:tid 954234] [client 45.134.20.137:45323] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 137.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/go.php"] [unique_id "alxlL-yJE89wAff52KVJcQAAAXg"]
[Sat Jul 18 23:48:31.836395 2026] [autoindex:error] [pid 953994:tid 954170] [client 65.21.113.250:0] AH01276: Cannot serve directory /home3/alpchxmy/public_html/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:48:31.836870 2026] [security2:error] [pid 953994:tid 954170] [client 65.21.113.250:0] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "404"] [hostname "noisepacks.com"] [uri "/cgi-sys/403.html"] [unique_id "alxlL-yJE89wAff52KVJcgAAATg"]
[Sat Jul 18 23:48:31.839924 2026] [security2:error] [pid 953994:tid 954130] [client 65.21.113.250:37020] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "403"] [hostname "noisepacks.com"] [uri "/"] [unique_id "alxlL-yJE89wAff52KVJbwAAARA"]
[Sat Jul 18 23:48:31.840012 2026] [security2:error] [pid 953994:tid 954141] [client 45.133.7.70:29801] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/js/content-type.php"] [unique_id "alxlL-yJE89wAff52KVJcwAAARs"]
[Sat Jul 18 23:48:32.324525 2026] [security2:error] [pid 953994:tid 954227] [client 103.10.54.162:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "blog.danwolfe.us"] [uri "/index.php"] [unique_id "alxlMOyJE89wAff52KVJfwAAAXE"], referer: https://blog.danwolfe.us
[Sat Jul 18 23:48:32.431361 2026] [security2:error] [pid 953994:tid 954183] [client 103.160.26.178:49425] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlMOyJE89wAff52KVJmgAAAUU"]
[Sat Jul 18 23:48:32.431445 2026] [security2:error] [pid 953994:tid 954183] [client 103.160.26.178:49425] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlMOyJE89wAff52KVJmgAAAUU"]
[Sat Jul 18 23:48:32.435121 2026] [proxy:error] [pid 953994:tid 954222] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:48:32.435172 2026] [proxy_http:error] [pid 953994:tid 954222] [client 193.47.62.168:58776] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:48:32.435632 2026] [proxy:error] [pid 953994:tid 954222] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:48:32.435664 2026] [proxy_http:error] [pid 953994:tid 954222] [client 193.47.62.168:58776] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:48:32.518546 2026] [security2:error] [pid 953994:tid 954185] [client 45.133.7.86:54583] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 86.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "alxlMOyJE89wAff52KVJoAAAAUc"]
[Sat Jul 18 23:48:32.678263 2026] [security2:error] [pid 953994:tid 954152] [client 45.134.20.119:44543] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/xleet.php"] [unique_id "alxlMOyJE89wAff52KVJsQAAASY"]
[Sat Jul 18 23:48:32.898863 2026] [security2:error] [pid 953994:tid 954079] [remote 157.66.47.83:53358] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxlMOyJE89wAff52KVJwgABKVQ"]
[Sat Jul 18 23:48:32.963650 2026] [security2:error] [pid 953994:tid 954231] [client 220.181.108.174:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "mollycahill.com"] [uri "/index.php"] [unique_id "alxlMOyJE89wAff52KVJrQAAAXU"]
[Sat Jul 18 23:48:33.204965 2026] [security2:error] [pid 953994:tid 954147] [client 45.133.7.81:60915] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 81.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/about/goods.php"] [unique_id "alxlMeyJE89wAff52KVJ0AAAASE"]
[Sat Jul 18 23:48:33.302343 2026] [security2:error] [pid 953994:tid 954091] [remote 157.66.47.83:53358] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.47.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxlMeyJE89wAff52KVJ2gABX2A"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:48:33.537388 2026] [security2:error] [pid 953994:tid 954250] [client 45.134.20.131:52977] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/templates/beez3/bypass.php"] [unique_id "alxlMeyJE89wAff52KVJ5QAAAYg"]
[Sat Jul 18 23:48:33.617360 2026] [security2:error] [pid 953994:tid 954143] [client 217.217.245.230:50731] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.245.217.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxlMeyJE89wAff52KVJ5wAAAR0"]
[Sat Jul 18 23:48:33.617534 2026] [security2:error] [pid 953994:tid 954143] [client 217.217.245.230:50731] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxlMeyJE89wAff52KVJ5wAAAR0"]
[Sat Jul 18 23:48:33.658202 2026] [security2:error] [pid 953994:tid 954187] [client 163.61.1.17:56539] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlMeyJE89wAff52KVJ6QAAAUk"]
[Sat Jul 18 23:48:33.658308 2026] [security2:error] [pid 953994:tid 954187] [client 163.61.1.17:56539] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlMeyJE89wAff52KVJ6QAAAUk"]
[Sat Jul 18 23:48:33.726492 2026] [security2:error] [pid 953994:tid 954078] [remote 103.75.185.95:36042] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/wp-login.php"] [unique_id "alxlMeyJE89wAff52KVJ7wABbFM"]
[Sat Jul 18 23:48:33.883802 2026] [security2:error] [pid 953994:tid 954225] [client 45.133.7.99:28303] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/file/function.php"] [unique_id "alxlMeyJE89wAff52KVKAAAAAW8"]
[Sat Jul 18 23:48:34.219368 2026] [security2:error] [pid 953994:tid 954088] [remote 103.75.185.95:36042] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/wp-login.php"] [unique_id "alxlMuyJE89wAff52KVKFwABWl0"], referer: https://joulecommunications.com/wp-login.php
[Sat Jul 18 23:48:34.376357 2026] [ssl:error] [pid 953994:tid 954224] [client 104.48.69.105:58962] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname www.icemarc.org provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:48:34.390372 2026] [security2:error] [pid 953994:tid 954222] [client 45.134.20.108:52901] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/blue/ahax.php"] [unique_id "alxlMuyJE89wAff52KVKKAAAAWw"]
[Sat Jul 18 23:48:34.563394 2026] [security2:error] [pid 953994:tid 954171] [client 45.133.7.83:63241] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/function/goods.php"] [unique_id "alxlMuyJE89wAff52KVKNAAAATk"]
[Sat Jul 18 23:48:34.612555 2026] [security2:error] [pid 953994:tid 954228] [client 180.252.198.240:57682] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlMuyJE89wAff52KVKNQAAAXI"]
[Sat Jul 18 23:48:34.612699 2026] [security2:error] [pid 953994:tid 954228] [client 180.252.198.240:57682] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlMuyJE89wAff52KVKNQAAAXI"]
[Sat Jul 18 23:48:35.241969 2026] [security2:error] [pid 953994:tid 954212] [client 45.133.7.55:52905] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 55.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/bypass.php"] [unique_id "alxlM-yJE89wAff52KVKZgAAAWI"]
[Sat Jul 18 23:48:35.250021 2026] [security2:error] [pid 953994:tid 954171] [client 45.134.20.119:50401] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/admin.php"] [unique_id "alxlM-yJE89wAff52KVKaQAAATk"]
[Sat Jul 18 23:48:35.920439 2026] [security2:error] [pid 953994:tid 954145] [client 45.133.7.75:42073] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/upgrade/index.php"] [unique_id "alxlM-yJE89wAff52KVKngAAAR8"]
[Sat Jul 18 23:48:36.102955 2026] [security2:error] [pid 953994:tid 954175] [client 45.134.20.116:28199] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 116.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/assets/file.php"] [unique_id "alxlNOyJE89wAff52KVKpAAAAT0"]
[Sat Jul 18 23:48:36.211013 2026] [security2:error] [pid 953994:tid 954178] [client 139.167.225.146:63502] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxlNOyJE89wAff52KVKpwAAAUA"]
[Sat Jul 18 23:48:36.211111 2026] [security2:error] [pid 953994:tid 954178] [client 139.167.225.146:63502] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxlNOyJE89wAff52KVKpwAAAUA"]
[Sat Jul 18 23:48:36.548948 2026] [security2:error] [pid 953994:tid 954025] [remote 31.42.184.154:52938] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxlNOyJE89wAff52KVKwwABCx4"]
[Sat Jul 18 23:48:36.602045 2026] [security2:error] [pid 953994:tid 954147] [client 45.133.7.67:55043] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "alxlNOyJE89wAff52KVKxQAAASE"]
[Sat Jul 18 23:48:36.790445 2026] [security2:error] [pid 953994:tid 954240] [client 74.208.214.194:60616] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxlNOyJE89wAff52KVKywAAAX4"]
[Sat Jul 18 23:48:36.899473 2026] [security2:error] [pid 953994:tid 953997] [remote 31.42.184.154:52938] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxlNOyJE89wAff52KVK2QABeAI"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:48:36.964350 2026] [security2:error] [pid 953994:tid 954193] [client 45.134.20.125:29621] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 125.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/cgi-bin/index.php"] [unique_id "alxlNOyJE89wAff52KVK3gAAAU8"]
[Sat Jul 18 23:48:37.283628 2026] [security2:error] [pid 953994:tid 954231] [client 45.133.7.57:60119] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 57.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/pridmag/db.php"] [unique_id "alxlNeyJE89wAff52KVK8AAAAXU"]
[Sat Jul 18 23:48:37.820829 2026] [security2:error] [pid 953994:tid 954139] [client 45.134.20.120:54657] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 120.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/uploads/file.php"] [unique_id "alxlNeyJE89wAff52KVLFwAAARk"]
[Sat Jul 18 23:48:37.962802 2026] [security2:error] [pid 953994:tid 954144] [client 45.133.7.75:31513] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/plugin-install.php"] [unique_id "alxlNeyJE89wAff52KVLIwAAAR4"]
[Sat Jul 18 23:48:38.642600 2026] [security2:error] [pid 953994:tid 954238] [client 45.133.7.77:35317] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 77.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "alxlNuyJE89wAff52KVLVgAAAXw"]
[Sat Jul 18 23:48:38.673904 2026] [security2:error] [pid 953994:tid 954249] [client 45.134.20.132:41013] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/view-more/ioxi.php"] [unique_id "alxlNuyJE89wAff52KVLWwAAAYc"]
[Sat Jul 18 23:48:39.327183 2026] [security2:error] [pid 953994:tid 954251] [client 45.133.7.66:56289] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 66.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/js/load.php"] [unique_id "alxlN-yJE89wAff52KVLhQAAAYk"]
[Sat Jul 18 23:48:39.533596 2026] [security2:error] [pid 953994:tid 954155] [client 45.134.20.108:55417] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "alxlN-yJE89wAff52KVLogAAASk"]
[Sat Jul 18 23:48:39.608065 2026] [security2:error] [pid 953994:tid 954127] [client 106.222.249.209:9605] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxlN-yJE89wAff52KVLqgAAAQ0"]
[Sat Jul 18 23:48:39.608199 2026] [security2:error] [pid 953994:tid 954127] [client 106.222.249.209:9605] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxlN-yJE89wAff52KVLqgAAAQ0"]
[Sat Jul 18 23:48:39.696460 2026] [security2:error] [pid 953994:tid 954144] [client 138.252.89.100:50095] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlN-yJE89wAff52KVLswAAAR4"]
[Sat Jul 18 23:48:39.696541 2026] [security2:error] [pid 953994:tid 954144] [client 138.252.89.100:50095] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlN-yJE89wAff52KVLswAAAR4"]
[Sat Jul 18 23:48:39.724896 2026] [security2:error] [pid 953994:tid 954160] [client 212.29.233.215:46092] ModSecurity: Access denied with code 406 (phase 1). Pattern match "python-requests|python-urllib" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "1460"] [id "909111"] [msg "Python UA brute"] [hostname "omenana.com"] [uri "/2025/12/23/omenana-34-the-niger-delta-issue/"] [unique_id "alxlN-yJE89wAff52KVLuAAAAS4"]
[Sat Jul 18 23:48:40.018169 2026] [security2:error] [pid 953994:tid 954234] [client 45.133.7.103:39859] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/images/firewall.php7"] [unique_id "alxlOOyJE89wAff52KVLxAAAAXg"]
[Sat Jul 18 23:48:40.384831 2026] [security2:error] [pid 953994:tid 954204] [client 45.134.20.122:26781] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "alxlOOyJE89wAff52KVL2QAAAVo"]
[Sat Jul 18 23:48:40.707898 2026] [security2:error] [pid 953994:tid 954184] [client 45.133.7.67:24963] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "alxlOOyJE89wAff52KVMAgAAAUY"]
[Sat Jul 18 23:48:41.072042 2026] [security2:error] [pid 953994:tid 954219] [client 74.7.244.52:38674] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "fridacom.net"] [uri "/robots.txt"] [unique_id "alxlOeyJE89wAff52KVMGgAAAWk"]
[Sat Jul 18 23:48:41.241029 2026] [security2:error] [pid 953994:tid 954221] [client 45.134.20.104:24335] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/index.php"] [unique_id "alxlOeyJE89wAff52KVMKQAAAWs"]
[Sat Jul 18 23:48:41.284677 2026] [security2:error] [pid 953994:tid 954189] [client 186.7.40.136:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "packerjanitorial.com"] [uri "/index.php"] [unique_id "alxlOOyJE89wAff52KVMCQABSzc"], referer: https://packerjanitorial.com
[Sat Jul 18 23:48:41.388915 2026] [security2:error] [pid 953994:tid 954149] [client 45.133.7.92:27331] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/upgrade/pdf.php"] [unique_id "alxlOeyJE89wAff52KVMMAAAASM"]
[Sat Jul 18 23:48:41.936963 2026] [security2:error] [pid 953994:tid 954201] [client 144.79.241.10:34398] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "50.116.65.227"] [uri "/"] [unique_id "alxlOeyJE89wAff52KVMTwAAAVc"]
[Sat Jul 18 23:48:41.947497 2026] [security2:error] [pid 953994:tid 954202] [client 36.83.95.75:62553] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlOeyJE89wAff52KVMUAAAAVg"]
[Sat Jul 18 23:48:41.947572 2026] [security2:error] [pid 953994:tid 954202] [client 36.83.95.75:62553] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlOeyJE89wAff52KVMUAAAAVg"]
[Sat Jul 18 23:48:42.069688 2026] [security2:error] [pid 953994:tid 954188] [client 45.133.7.80:58949] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/as.php"] [unique_id "alxlOuyJE89wAff52KVMXgAAAUo"]
[Sat Jul 18 23:48:42.114247 2026] [security2:error] [pid 953994:tid 954029] [remote 202.51.202.242:33220] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 242.202.51.202.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "taskidsvirginia.com"] [uri "/wp-login.php"] [unique_id "alxlOuyJE89wAff52KVMYwABXCI"]
[Sat Jul 18 23:48:42.127189 2026] [security2:error] [pid 953994:tid 954189] [client 50.116.65.227:18440] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "lifeisbetterlakeside.com"] [uri "/wp-content/uploads/2024/04/IMG_3272.jpeg"] [unique_id "alxlOuyJE89wAff52KVMZQAAAUs"]
[Sat Jul 18 23:48:42.217231 2026] [security2:error] [pid 953994:tid 954195] [client 144.79.241.10:40390] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "50.116.65.227"] [uri "/"] [unique_id "alxlOuyJE89wAff52KVMbgAAAVE"]
[Sat Jul 18 23:48:42.521544 2026] [security2:error] [pid 953994:tid 954202] [client 45.134.20.127:48623] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 127.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/admin.php"] [unique_id "alxlOuyJE89wAff52KVMjgAAAVg"]
[Sat Jul 18 23:48:42.747603 2026] [security2:error] [pid 953994:tid 954172] [client 45.133.7.67:39985] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/item.php"] [unique_id "alxlOuyJE89wAff52KVMrAAAATo"]
[Sat Jul 18 23:48:43.118631 2026] [security2:error] [pid 953994:tid 954156] [client 103.160.26.178:49911] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlO-yJE89wAff52KVMxgAAASo"]
[Sat Jul 18 23:48:43.118741 2026] [security2:error] [pid 953994:tid 954156] [client 103.160.26.178:49911] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlO-yJE89wAff52KVMxgAAASo"]
[Sat Jul 18 23:48:43.349807 2026] [security2:error] [pid 953994:tid 954151] [client 97.155.247.51:35322] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "lifeisbetterlakeside.com"] [uri "/index.php"] [unique_id "alxlO-yJE89wAff52KVM2gABJXo"], referer: https://lifeisbetterlakeside.com/hola-bienvenido-to-our-cinco-de-mayo-table/
[Sat Jul 18 23:48:43.384489 2026] [security2:error] [pid 953994:tid 954245] [client 45.134.20.136:64811] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 136.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "alxlO-yJE89wAff52KVM-gAAAYM"]
[Sat Jul 18 23:48:43.435065 2026] [security2:error] [pid 953994:tid 954172] [client 45.133.7.83:25257] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "alxlO-yJE89wAff52KVNAAAAATo"]
[Sat Jul 18 23:48:43.839396 2026] [security2:error] [pid 953994:tid 954063] [remote 45.157.54.14:45553] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.mtagcapital.com"] [uri "/xmlrpc.php"] [unique_id "alxlO-yJE89wAff52KVNJgABhUQ"]
[Sat Jul 18 23:48:43.839590 2026] [security2:error] [pid 953994:tid 954247] [client 45.157.54.14:45553] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.mtagcapital.com"] [uri "/xmlrpc.php"] [unique_id "alxlO-yJE89wAff52KVNJgABhUQ"]
[Sat Jul 18 23:48:43.905871 2026] [security2:error] [pid 953994:tid 954220] [client 50.116.65.227:18486] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "lifeisbetterlakeside.com"] [uri "/wp-content/uploads/2024/04/IMG_3272.jpeg"] [unique_id "alxlO-yJE89wAff52KVNJwAAAWw"]
[Sat Jul 18 23:48:44.116493 2026] [security2:error] [pid 953994:tid 954233] [client 45.133.7.83:62759] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/install.php"] [unique_id "alxlPOyJE89wAff52KVNMAAAAXc"]
[Sat Jul 18 23:48:44.168925 2026] [security2:error] [pid 953994:tid 954124] [client 163.61.1.17:57018] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlPOyJE89wAff52KVNNQAAAQo"]
[Sat Jul 18 23:48:44.172800 2026] [security2:error] [pid 953994:tid 954124] [client 163.61.1.17:57018] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlPOyJE89wAff52KVNNQAAAQo"]
[Sat Jul 18 23:48:44.221390 2026] [security2:error] [pid 953994:tid 954046] [remote 202.51.202.242:33220] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 242.202.51.202.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "taskidsvirginia.com"] [uri "/wp-login.php"] [unique_id "alxlPOyJE89wAff52KVNOQABbzM"], referer: https://taskidsvirginia.com/wp-login.php
[Sat Jul 18 23:48:44.257499 2026] [security2:error] [pid 953994:tid 954174] [client 217.217.245.230:58777] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.245.217.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxlPOyJE89wAff52KVNQAAAATw"]
[Sat Jul 18 23:48:44.257618 2026] [security2:error] [pid 953994:tid 954174] [client 217.217.245.230:58777] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxlPOyJE89wAff52KVNQAAAATw"]
[Sat Jul 18 23:48:44.289005 2026] [security2:error] [pid 953994:tid 954212] [client 45.134.20.135:45587] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "alxlPOyJE89wAff52KVNPwAAAWI"]
[Sat Jul 18 23:48:44.425512 2026] [security2:error] [pid 953994:tid 954079] [remote 209.42.18.223:53296] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.18.42.209.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.qix.pfz.mybluehost.me"] [uri "/wp/xmlrpc.php"] [unique_id "alxlPOyJE89wAff52KVNUAABelQ"]
[Sat Jul 18 23:48:44.425672 2026] [security2:error] [pid 953994:tid 954236] [client 209.42.18.223:53296] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "mail.qix.pfz.mybluehost.me"] [uri "/wp/xmlrpc.php"] [unique_id "alxlPOyJE89wAff52KVNUAABelQ"]
[Sat Jul 18 23:48:44.790219 2026] [security2:error] [pid 953994:tid 954182] [client 54.149.239.117:17234] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.239.149.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxlPOyJE89wAff52KVNbQAAAUQ"]
[Sat Jul 18 23:48:44.804608 2026] [security2:error] [pid 953994:tid 954197] [client 45.133.7.75:48809] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/customize/db.php"] [unique_id "alxlPOyJE89wAff52KVNbwAAAVM"]
[Sat Jul 18 23:48:45.071586 2026] [security2:error] [pid 953994:tid 954065] [remote 4.205.168.44:36086] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.upf.ztf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxlPeyJE89wAff52KVNfgABJEY"]
[Sat Jul 18 23:48:45.102855 2026] [security2:error] [pid 953994:tid 954157] [client 180.252.198.240:58180] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlPeyJE89wAff52KVNgAAAASs"]
[Sat Jul 18 23:48:45.103221 2026] [security2:error] [pid 953994:tid 954157] [client 180.252.198.240:58180] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlPeyJE89wAff52KVNgAAAASs"]
[Sat Jul 18 23:48:45.146820 2026] [security2:error] [pid 953994:tid 954246] [client 45.134.20.108:61829] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/ioxi/ioxiworm.php"] [unique_id "alxlPeyJE89wAff52KVNgQAAAYQ"]
[Sat Jul 18 23:48:45.258546 2026] [security2:error] [pid 953994:tid 954056] [remote 4.205.168.44:36086] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.upf.ztf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxlPeyJE89wAff52KVNiAABST0"], referer: https://mail.upf.ztf.mybluehost.me/wp-login.php
[Sat Jul 18 23:48:45.484887 2026] [security2:error] [pid 953994:tid 954182] [client 45.133.7.64:35255] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 64.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/css/fan.php"] [unique_id "alxlPeyJE89wAff52KVNmwAAAUQ"]
[Sat Jul 18 23:48:46.000901 2026] [security2:error] [pid 953994:tid 954152] [client 45.134.20.116:20959] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 116.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/blog/wp-content/about.php"] [unique_id "alxlPuyJE89wAff52KVNwwAAASY"]
[Sat Jul 18 23:48:46.164983 2026] [security2:error] [pid 953994:tid 954163] [client 45.133.7.81:30725] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 81.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/blue/colors.php"] [unique_id "alxlPuyJE89wAff52KVNywAAATE"]
[Sat Jul 18 23:48:46.851479 2026] [security2:error] [pid 953994:tid 954162] [client 45.133.7.85:33575] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 85.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/images/mah.php"] [unique_id "alxlPuyJE89wAff52KVN9wAAATA"]
[Sat Jul 18 23:48:46.865862 2026] [security2:error] [pid 953994:tid 954161] [client 45.134.20.108:63979] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/hehehehe.php"] [unique_id "alxlPuyJE89wAff52KVN-gAAAS8"]
[Sat Jul 18 23:48:47.532320 2026] [security2:error] [pid 953994:tid 954221] [client 45.133.7.95:57051] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/waf_defender.php"] [unique_id "alxlP-yJE89wAff52KVOJwAAAWs"]
[Sat Jul 18 23:48:47.721697 2026] [security2:error] [pid 953994:tid 954161] [client 45.134.20.126:33695] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 126.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/acme-challenge/install.php"] [unique_id "alxlP-yJE89wAff52KVOLgAAAS8"]
[Sat Jul 18 23:48:47.870201 2026] [security2:error] [pid 953994:tid 953998] [remote 217.182.128.41:48158] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.128.182.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxlP-yJE89wAff52KVOMwABfgM"]
[Sat Jul 18 23:48:47.870348 2026] [security2:error] [pid 953994:tid 954240] [client 217.182.128.41:48158] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxlP-yJE89wAff52KVOMwABfgM"]
[Sat Jul 18 23:48:48.061033 2026] [security2:error] [pid 953994:tid 954111] [remote 20.75.217.73:2601] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 73.217.75.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxlQOyJE89wAff52KVOQwABUXQ"]
[Sat Jul 18 23:48:48.210631 2026] [security2:error] [pid 953994:tid 954229] [client 45.133.7.103:50725] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/ectoplasm/content.php"] [unique_id "alxlQOyJE89wAff52KVOSwAAAXM"]
[Sat Jul 18 23:48:48.225271 2026] [security2:error] [pid 953994:tid 954021] [remote 20.75.217.73:2601] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 73.217.75.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxlQOyJE89wAff52KVOTAABUho"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:48:48.579529 2026] [security2:error] [pid 953994:tid 954155] [client 45.134.20.129:47701] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/acme-challenge/plugins.php"] [unique_id "alxlQOyJE89wAff52KVOawAAASk"]
[Sat Jul 18 23:48:48.889072 2026] [security2:error] [pid 953994:tid 954126] [client 45.133.7.88:41415] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 88.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/install.php"] [unique_id "alxlQOyJE89wAff52KVOkQAAAQw"]
[Sat Jul 18 23:48:49.437579 2026] [security2:error] [pid 953994:tid 954162] [client 45.134.20.137:23509] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 137.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/acme-challenge/license.php"] [unique_id "alxlQeyJE89wAff52KVOwgAAATA"]
[Sat Jul 18 23:48:49.445232 2026] [security2:error] [pid 953994:tid 954211] [client 216.246.11.224:17256] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.sesamegreenbeans.com"] [uri "/index.php"] [unique_id "alxlQeyJE89wAff52KVOrQABYVA"]
[Sat Jul 18 23:48:49.567008 2026] [security2:error] [pid 953994:tid 954225] [client 45.133.7.102:30047] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 102.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "alxlQeyJE89wAff52KVO0QAAAW8"]
[Sat Jul 18 23:48:50.032161 2026] [security2:error] [pid 953994:tid 954215] [client 52.167.144.176:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxlQeyJE89wAff52KVOzwABZXg"]
[Sat Jul 18 23:48:50.244499 2026] [security2:error] [pid 953994:tid 954188] [client 45.133.7.103:49873] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/content.php"] [unique_id "alxlQuyJE89wAff52KVPJwAAAUo"]
[Sat Jul 18 23:48:50.291571 2026] [security2:error] [pid 953994:tid 954142] [client 45.134.20.120:47547] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 120.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "alxlQuyJE89wAff52KVPKQAAARw"]
[Sat Jul 18 23:48:50.407389 2026] [security2:error] [pid 953994:tid 954194] [client 106.222.249.209:6204] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxlQuyJE89wAff52KVPLQAAAVA"]
[Sat Jul 18 23:48:50.407493 2026] [security2:error] [pid 953994:tid 954194] [client 106.222.249.209:6204] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxlQuyJE89wAff52KVPLQAAAVA"]
[Sat Jul 18 23:48:50.433844 2026] [security2:error] [pid 953994:tid 954059] [remote 20.153.140.50:40256] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxlQuyJE89wAff52KVPLAABZEA"]
[Sat Jul 18 23:48:50.838718 2026] [security2:error] [pid 953994:tid 954070] [remote 20.153.140.50:40256] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxlQuyJE89wAff52KVPTgABKUs"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:48:50.922786 2026] [security2:error] [pid 953994:tid 954161] [client 45.133.7.78:24345] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 78.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/twentytwentyfour/icascreenshots.php"] [unique_id "alxlQuyJE89wAff52KVPWAAAAS8"]
[Sat Jul 18 23:48:51.178986 2026] [security2:error] [pid 953994:tid 954194] [client 45.134.20.139:42983] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 139.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/astra/inc/fm.php"] [unique_id "alxlQ-yJE89wAff52KVPZAAAAVA"]
[Sat Jul 18 23:48:51.282556 2026] [security2:error] [pid 953994:tid 954201] [client 138.252.89.100:50686] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlQ-yJE89wAff52KVPaQAAAVc"]
[Sat Jul 18 23:48:51.282650 2026] [security2:error] [pid 953994:tid 954201] [client 138.252.89.100:50686] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlQ-yJE89wAff52KVPaQAAAVc"]
[Sat Jul 18 23:48:51.329877 2026] [security2:error] [pid 953994:tid 954085] [remote 45.157.54.14:53880] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.mtagcapital.com"] [uri "/xmlrpc.php"] [unique_id "alxlQ-yJE89wAff52KVPcAABeFo"]
[Sat Jul 18 23:48:51.330035 2026] [security2:error] [pid 953994:tid 954234] [client 45.157.54.14:53880] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.mtagcapital.com"] [uri "/xmlrpc.php"] [unique_id "alxlQ-yJE89wAff52KVPcAABeFo"]
[Sat Jul 18 23:48:51.637318 2026] [security2:error] [pid 953994:tid 954239] [client 45.133.7.61:40309] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/upgrade/bypass.php"] [unique_id "alxlQ-yJE89wAff52KVPfwAAAX0"]
[Sat Jul 18 23:48:51.893087 2026] [security2:error] [pid 953994:tid 954088] [remote 66.249.70.1:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxlQ-yJE89wAff52KVPiAABOV0"]
[Sat Jul 18 23:48:52.034430 2026] [security2:error] [pid 953994:tid 954202] [client 45.134.20.139:31723] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 139.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/ccx/index.php"] [unique_id "alxlROyJE89wAff52KVPmgAAAVg"]
[Sat Jul 18 23:48:52.144315 2026] [security2:error] [pid 953994:tid 954234] [client 50.116.65.227:30178] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxlROyJE89wAff52KVPpQAAAXg"]
[Sat Jul 18 23:48:52.157086 2026] [security2:error] [pid 953994:tid 954151] [client 50.116.65.227:42948] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxlROyJE89wAff52KVPqAAAASU"]
[Sat Jul 18 23:48:52.317857 2026] [security2:error] [pid 953994:tid 954238] [client 45.133.7.105:33435] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/rk2.php"] [unique_id "alxlROyJE89wAff52KVPswAAAXw"]
[Sat Jul 18 23:48:52.410142 2026] [security2:error] [pid 953994:tid 954242] [client 202.154.45.31:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "sergnotes.com"] [uri "/index.php"] [unique_id "alxlROyJE89wAff52KVPuwAAAYA"]
[Sat Jul 18 23:48:52.610612 2026] [security2:error] [pid 953994:tid 954177] [client 36.83.95.75:63057] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlROyJE89wAff52KVP0AAAAT8"]
[Sat Jul 18 23:48:52.610739 2026] [security2:error] [pid 953994:tid 954177] [client 36.83.95.75:63057] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlROyJE89wAff52KVP0AAAAT8"]
[Sat Jul 18 23:48:52.746657 2026] [security2:error] [pid 953994:tid 954237] [client 66.249.70.1:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxlROyJE89wAff52KVPzAABexk"]
[Sat Jul 18 23:48:52.822834 2026] [security2:error] [pid 953994:tid 954241] [client 104.210.56.226:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "savilerowtravel.com"] [uri "/index.php"] [unique_id "alxlQuyJE89wAff52KVPVgAAAX8"]
[Sat Jul 18 23:48:52.889549 2026] [security2:error] [pid 953994:tid 954210] [client 45.134.20.121:54761] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 121.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/index.php"] [unique_id "alxlROyJE89wAff52KVP5QAAAWA"]
[Sat Jul 18 23:48:52.997742 2026] [security2:error] [pid 953994:tid 954170] [client 45.133.7.71:47153] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 71.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/ocean/alam.php"] [unique_id "alxlROyJE89wAff52KVP6wAAATg"]
[Sat Jul 18 23:48:53.412270 2026] [security2:error] [pid 953994:tid 954133] [client 104.210.56.226:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "savilerowtravel.com"] [uri "/index.php"] [unique_id "alxlReyJE89wAff52KVP-gAAARM"]
[Sat Jul 18 23:48:53.678691 2026] [security2:error] [pid 953994:tid 954221] [client 45.133.7.102:50005] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 102.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/b.php"] [unique_id "alxlReyJE89wAff52KVQIQAAAWs"]
[Sat Jul 18 23:48:53.697068 2026] [security2:error] [pid 953994:tid 954207] [client 103.160.26.178:50389] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlReyJE89wAff52KVQIgAAAV0"]
[Sat Jul 18 23:48:53.697156 2026] [security2:error] [pid 953994:tid 954207] [client 103.160.26.178:50389] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlReyJE89wAff52KVQIgAAAV0"]
[Sat Jul 18 23:48:53.748531 2026] [security2:error] [pid 953994:tid 954232] [client 45.134.20.128:50369] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "alxlReyJE89wAff52KVQKAAAAXY"]
[Sat Jul 18 23:48:54.293018 2026] [security2:error] [pid 953994:tid 954134] [client 34.73.232.127:43526] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "jvcmotorsports.com"] [uri "/"] [unique_id "alxlRuyJE89wAff52KVQVAAAARQ"]
[Sat Jul 18 23:48:54.364979 2026] [security2:error] [pid 953994:tid 954232] [client 45.133.7.97:46953] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 97.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/certificates/past.php"] [unique_id "alxlRuyJE89wAff52KVQWgAAAXY"]
[Sat Jul 18 23:48:54.365388 2026] [security2:error] [pid 953994:tid 954174] [client 62.45.36.212:40090] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxlRuyJE89wAff52KVQSAAAATw"]
[Sat Jul 18 23:48:54.607559 2026] [security2:error] [pid 953994:tid 954240] [client 45.134.20.130:22687] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 130.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "alxlRuyJE89wAff52KVQaQAAAX4"]
[Sat Jul 18 23:48:54.678524 2026] [security2:error] [pid 953994:tid 954153] [client 163.61.1.17:57494] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlRuyJE89wAff52KVQbAAAASc"]
[Sat Jul 18 23:48:54.678651 2026] [security2:error] [pid 953994:tid 954153] [client 163.61.1.17:57494] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlRuyJE89wAff52KVQbAAAASc"]
[Sat Jul 18 23:48:54.971119 2026] [security2:error] [pid 953994:tid 954220] [client 217.217.245.230:60727] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.245.217.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxlRuyJE89wAff52KVQhgAAAWo"]
[Sat Jul 18 23:48:54.971199 2026] [security2:error] [pid 953994:tid 954220] [client 217.217.245.230:60727] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxlRuyJE89wAff52KVQhgAAAWo"]
[Sat Jul 18 23:48:55.045800 2026] [security2:error] [pid 953994:tid 954208] [client 45.133.7.95:58029] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/css/as.php"] [unique_id "alxlR-yJE89wAff52KVQiAAAAV4"]
[Sat Jul 18 23:48:55.467256 2026] [security2:error] [pid 953994:tid 954200] [client 45.134.20.138:63723] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 138.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "alxlR-yJE89wAff52KVQpAAAAVY"]
[Sat Jul 18 23:48:55.731851 2026] [security2:error] [pid 953994:tid 954232] [client 45.133.7.57:59399] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 57.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/pwnd/sst.php"] [unique_id "alxlR-yJE89wAff52KVQtgAAAXY"]
[Sat Jul 18 23:48:55.955866 2026] [security2:error] [pid 953994:tid 954179] [client 180.252.198.240:58665] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlR-yJE89wAff52KVQyQAAAUE"]
[Sat Jul 18 23:48:55.956055 2026] [security2:error] [pid 953994:tid 954179] [client 180.252.198.240:58665] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlR-yJE89wAff52KVQyQAAAUE"]
[Sat Jul 18 23:48:56.223645 2026] [security2:error] [pid 953994:tid 954240] [client 50.116.65.227:43038] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.fkconstructionfunding.com"] [uri "/index.php"] [unique_id "alxlR-yJE89wAff52KVQzQAAAX4"]
[Sat Jul 18 23:48:56.291863 2026] [security2:error] [pid 953994:tid 954112] [remote 31.42.184.154:52706] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxlSOyJE89wAff52KVQ5gABUHU"]
[Sat Jul 18 23:48:56.334849 2026] [security2:error] [pid 953994:tid 954145] [client 45.134.20.106:41813] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "alxlSOyJE89wAff52KVQ6gAAAR8"]
[Sat Jul 18 23:48:56.411351 2026] [security2:error] [pid 953994:tid 954127] [client 45.133.7.60:59899] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 60.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/edit-tags.php"] [unique_id "alxlSOyJE89wAff52KVQ8wAAAQ0"]
[Sat Jul 18 23:48:56.417028 2026] [security2:error] [pid 953994:tid 954193] [client 50.116.65.227:43042] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.fkconstructionfunding.com"] [uri "/index.php"] [unique_id "alxlSOyJE89wAff52KVQ3QAAAU8"]
[Sat Jul 18 23:48:56.425217 2026] [security2:error] [pid 953994:tid 954026] [remote 185.115.217.185:51274] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.217.115.185.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxlSOyJE89wAff52KVQ8QABYx8"]
[Sat Jul 18 23:48:56.566866 2026] [security2:error] [pid 953994:tid 954016] [remote 31.42.184.154:52706] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxlSOyJE89wAff52KVQ-QABcxU"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:48:56.611071 2026] [security2:error] [pid 953994:tid 954020] [remote 185.115.217.185:51274] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.217.115.185.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxlSOyJE89wAff52KVQ-wABJhk"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:48:57.091133 2026] [security2:error] [pid 953994:tid 954191] [client 45.133.7.91:54233] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 91.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wsax.php"] [unique_id "alxlSeyJE89wAff52KVRHwAAAU0"]
[Sat Jul 18 23:48:57.188744 2026] [security2:error] [pid 953994:tid 954196] [client 45.134.20.113:64609] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "alxlSeyJE89wAff52KVRIQAAAVI"]
[Sat Jul 18 23:48:57.333885 2026] [security2:error] [pid 953994:tid 954040] [remote 152.228.213.32:46118] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.shantimethod.com"] [uri "/wp-login.php"] [unique_id "alxlSeyJE89wAff52KVRJQABWy0"]
[Sat Jul 18 23:48:57.523284 2026] [security2:error] [pid 953994:tid 954093] [remote 152.228.213.32:46118] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.shantimethod.com"] [uri "/wp-login.php"] [unique_id "alxlSeyJE89wAff52KVRNAABIGI"], referer: https://mail.shantimethod.com/wp-login.php
[Sat Jul 18 23:48:57.758498 2026] [security2:error] [pid 953994:tid 954000] [remote 134.209.147.209:51606] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.147.209.134.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxlSeyJE89wAff52KVRRQABaQU"]
[Sat Jul 18 23:48:57.772249 2026] [security2:error] [pid 953994:tid 954190] [client 45.133.7.102:52009] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 102.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/bless.php%20"] [unique_id "alxlSeyJE89wAff52KVRSQAAAUw"]
[Sat Jul 18 23:48:58.051847 2026] [security2:error] [pid 953994:tid 954237] [client 45.134.20.121:51379] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 121.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "alxlSuyJE89wAff52KVRXAAAAXs"]
[Sat Jul 18 23:48:58.225529 2026] [security2:error] [pid 953994:tid 954059] [remote 134.209.147.209:51606] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.147.209.134.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxlSuyJE89wAff52KVRaAABh0A"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:48:58.451572 2026] [security2:error] [pid 953994:tid 954165] [client 45.133.7.62:60175] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/uploads/system_cache.php"] [unique_id "alxlSuyJE89wAff52KVRdgAAATM"]
[Sat Jul 18 23:48:58.907224 2026] [security2:error] [pid 953994:tid 954128] [client 45.134.20.126:24473] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 126.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/ocean/index.php"] [unique_id "alxlSuyJE89wAff52KVRjwAAAQ4"]
[Sat Jul 18 23:48:59.131525 2026] [security2:error] [pid 953994:tid 954174] [client 45.133.7.100:26777] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/files.php"] [unique_id "alxlS-yJE89wAff52KVRowAAATw"]
[Sat Jul 18 23:48:59.168564 2026] [security2:error] [pid 953994:tid 954153] [client 34.73.232.127:43526] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jvcmotorsports.com"] [uri "/index.php"] [unique_id "alxlSOyJE89wAff52KVRAgAAASc"], referer: http://jvcmotorsports.com/wp-json/batch/v1
[Sat Jul 18 23:48:59.186270 2026] [security2:error] [pid 953994:tid 954191] [client 50.116.65.227:19850] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxlS-yJE89wAff52KVRpQAAAU0"]
[Sat Jul 18 23:48:59.199728 2026] [security2:error] [pid 953994:tid 954162] [client 50.116.65.227:45156] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxlS-yJE89wAff52KVRpgAAATA"]
[Sat Jul 18 23:48:59.507233 2026] [security2:error] [pid 953994:tid 954220] [client 108.174.8.27:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "paultoursafari.com"] [uri "/index.php"] [unique_id "alxlSOyJE89wAff52KVRBgABag8"]
[Sat Jul 18 23:48:59.769777 2026] [security2:error] [pid 953994:tid 954161] [client 45.134.20.114:51901] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/images/media/index.php"] [unique_id "alxlS-yJE89wAff52KVR0QAAAS8"]
[Sat Jul 18 23:48:59.809825 2026] [security2:error] [pid 953994:tid 954190] [client 45.133.7.62:41255] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/tflow/admin-footer.php"] [unique_id "alxlS-yJE89wAff52KVR0gAAAUw"]
[Sat Jul 18 23:49:00.490263 2026] [security2:error] [pid 953994:tid 954185] [client 45.133.7.79:57299] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 79.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "alxlTOyJE89wAff52KVR9QAAAUc"]
[Sat Jul 18 23:49:00.657180 2026] [security2:error] [pid 953994:tid 954221] [client 45.134.20.135:24665] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "alxlTOyJE89wAff52KVSAgAAAWs"]
[Sat Jul 18 23:49:00.745332 2026] [security2:error] [pid 953994:tid 954195] [client 74.7.227.179:54782] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxlTOyJE89wAff52KVR_gABUWM"], referer: https://tejasenvironmental.com/p=1745352
[Sat Jul 18 23:49:00.880875 2026] [security2:error] [pid 953994:tid 954209] [client 173.252.82.4:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.mochawavepublishing.com"] [uri "/index.php"] [unique_id "alxlSuyJE89wAff52KVRiAAAAV8"]
[Sat Jul 18 23:49:01.183563 2026] [security2:error] [pid 953994:tid 954139] [client 45.133.7.102:55763] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 102.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/about.php"] [unique_id "alxlTeyJE89wAff52KVSMgAAARk"]
[Sat Jul 18 23:49:01.518629 2026] [security2:error] [pid 953994:tid 954170] [client 45.134.20.112:38055] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 112.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "alxlTeyJE89wAff52KVSQgAAATg"]
[Sat Jul 18 23:49:01.779563 2026] [security2:error] [pid 953994:tid 954011] [remote 4.205.168.44:42098] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxlTeyJE89wAff52KVSXAABbxA"]
[Sat Jul 18 23:49:01.833232 2026] [security2:error] [pid 953994:tid 954160] [client 216.244.66.194:37512] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "marketingonetoone.net"] [uri "/robots.txt"] [unique_id "alxlTeyJE89wAff52KVSYAAAAS4"]
[Sat Jul 18 23:49:01.833334 2026] [security2:error] [pid 953994:tid 954160] [client 216.244.66.194:37512] ModSecurity: Warning. Matched phrase "Dotbot" at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "marketingonetoone.net"] [uri "/robots.txt"] [unique_id "alxlTeyJE89wAff52KVSYAAAAS4"]
[Sat Jul 18 23:49:01.869158 2026] [security2:error] [pid 953994:tid 954159] [client 45.133.7.69:61467] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 69.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "alxlTeyJE89wAff52KVSYwAAAS0"]
[Sat Jul 18 23:49:01.971601 2026] [security2:error] [pid 953994:tid 954024] [remote 4.205.168.44:42098] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxlTeyJE89wAff52KVSZQABCh0"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:49:02.366850 2026] [security2:error] [pid 953994:tid 954150] [client 106.222.249.209:15091] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxlTuyJE89wAff52KVSgAAAASQ"]
[Sat Jul 18 23:49:02.366998 2026] [security2:error] [pid 953994:tid 954150] [client 106.222.249.209:15091] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxlTuyJE89wAff52KVSgAAAASQ"]
[Sat Jul 18 23:49:02.415501 2026] [security2:error] [pid 953994:tid 954164] [client 45.134.20.123:37063] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 123.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "alxlTuyJE89wAff52KVSgQAAATI"]
[Sat Jul 18 23:49:02.550433 2026] [security2:error] [pid 953994:tid 954245] [client 45.133.7.96:58023] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 96.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/pwnd/cloud.php"] [unique_id "alxlTuyJE89wAff52KVSiwAAAYM"]
[Sat Jul 18 23:49:03.004764 2026] [security2:error] [pid 953994:tid 954141] [client 138.252.89.100:51197] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlT-yJE89wAff52KVSqAAAARs"]
[Sat Jul 18 23:49:03.004858 2026] [security2:error] [pid 953994:tid 954141] [client 138.252.89.100:51197] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlT-yJE89wAff52KVSqAAAARs"]
[Sat Jul 18 23:49:03.095525 2026] [security2:error] [pid 953994:tid 954172] [client 36.83.95.75:63546] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlT-yJE89wAff52KVSrgAAATo"]
[Sat Jul 18 23:49:03.095666 2026] [security2:error] [pid 953994:tid 954172] [client 36.83.95.75:63546] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlT-yJE89wAff52KVSrgAAATo"]
[Sat Jul 18 23:49:03.232480 2026] [security2:error] [pid 953994:tid 954159] [client 45.133.7.73:41583] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 73.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "alxlT-yJE89wAff52KVSugAAAS0"]
[Sat Jul 18 23:49:03.269603 2026] [security2:error] [pid 953994:tid 954139] [client 45.134.20.117:27667] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/maint/themes.php"] [unique_id "alxlT-yJE89wAff52KVSvQAAARk"]
[Sat Jul 18 23:49:03.603316 2026] [security2:error] [pid 953994:tid 954033] [remote 41.186.86.12:51725] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "deltat24.com"] [uri "/wp-login.php"] [unique_id "alxlT-yJE89wAff52KVSyQABCyY"]
[Sat Jul 18 23:49:03.860622 2026] [security2:error] [pid 953994:tid 954029] [remote 41.186.86.12:31458] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.walkingandtalking.net"] [uri "/xmlrpc.php"] [unique_id "alxlT-yJE89wAff52KVS2QABJyI"]
[Sat Jul 18 23:49:03.860799 2026] [security2:error] [pid 953994:tid 954153] [client 41.186.86.12:31458] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "mail.walkingandtalking.net"] [uri "/xmlrpc.php"] [unique_id "alxlT-yJE89wAff52KVS2QABJyI"]
[Sat Jul 18 23:49:03.872093 2026] [security2:error] [pid 953994:tid 954251] [client 103.179.183.245:46720] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "sergnotes.com"] [uri "/"] [unique_id "alxlT-yJE89wAff52KVS2wAAAYk"]
[Sat Jul 18 23:49:03.915165 2026] [security2:error] [pid 953994:tid 954150] [client 45.133.7.76:36745] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 76.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/ubh/adminfus.php"] [unique_id "alxlT-yJE89wAff52KVS4gAAASQ"]
[Sat Jul 18 23:49:04.095534 2026] [security2:error] [pid 953994:tid 954010] [remote 41.186.86.12:51725] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "deltat24.com"] [uri "/wp-login.php"] [unique_id "alxlUOyJE89wAff52KVS7AABGQ8"], referer: https://deltat24.com/wp-login.php
[Sat Jul 18 23:49:04.133130 2026] [security2:error] [pid 953994:tid 954160] [client 45.134.20.113:63757] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/seoplugins/index.php"] [unique_id "alxlUOyJE89wAff52KVS7QAAAS4"]
[Sat Jul 18 23:49:04.285189 2026] [security2:error] [pid 953994:tid 954164] [client 103.160.26.178:51208] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlUOyJE89wAff52KVS-QAAATI"]
[Sat Jul 18 23:49:04.285282 2026] [security2:error] [pid 953994:tid 954164] [client 103.160.26.178:51208] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlUOyJE89wAff52KVS-QAAATI"]
[Sat Jul 18 23:49:04.600559 2026] [security2:error] [pid 953994:tid 954231] [client 45.133.7.98:56227] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 98.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/pki-validation/webdb.php"] [unique_id "alxlUOyJE89wAff52KVTCQAAAXU"]
[Sat Jul 18 23:49:04.643220 2026] [security2:error] [pid 953994:tid 954173] [client 142.147.186.193:22000] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.sesamegreenbeans.com"] [uri "/index.php"] [unique_id "alxlUOyJE89wAff52KVTBQABOzk"]
[Sat Jul 18 23:49:04.958415 2026] [security2:error] [pid 953994:tid 954062] [remote 31.42.184.154:42520] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxlUOyJE89wAff52KVTIAABakM"]
[Sat Jul 18 23:49:04.958524 2026] [security2:error] [pid 953994:tid 954220] [client 31.42.184.154:42520] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxlUOyJE89wAff52KVTIAABakM"]
[Sat Jul 18 23:49:05.004882 2026] [security2:error] [pid 953994:tid 954186] [client 163.61.1.17:57972] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlUeyJE89wAff52KVTJQAAAUg"]
[Sat Jul 18 23:49:05.006448 2026] [security2:error] [pid 953994:tid 954186] [client 163.61.1.17:57972] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlUeyJE89wAff52KVTJQAAAUg"]
[Sat Jul 18 23:49:05.008379 2026] [security2:error] [pid 953994:tid 954164] [client 45.134.20.125:28217] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 125.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/fonts/themes.php"] [unique_id "alxlUeyJE89wAff52KVTJgAAATI"]
[Sat Jul 18 23:49:05.116287 2026] [security2:error] [pid 953994:tid 954071] [remote 194.164.170.191:53300] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 191.170.164.194.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxlUeyJE89wAff52KVTLQABG0w"]
[Sat Jul 18 23:49:05.116447 2026] [security2:error] [pid 953994:tid 954141] [client 194.164.170.191:53300] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxlUeyJE89wAff52KVTLQABG0w"]
[Sat Jul 18 23:49:05.341726 2026] [security2:error] [pid 953994:tid 954140] [client 45.133.7.65:22881] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 65.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "alxlUeyJE89wAff52KVTOwAAARo"]
[Sat Jul 18 23:49:05.566407 2026] [security2:error] [pid 953994:tid 954233] [client 217.217.245.230:61387] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.245.217.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxlUeyJE89wAff52KVTSQAAAXc"]
[Sat Jul 18 23:49:05.566488 2026] [security2:error] [pid 953994:tid 954233] [client 217.217.245.230:61387] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxlUeyJE89wAff52KVTSQAAAXc"]
[Sat Jul 18 23:49:05.586420 2026] [security2:error] [pid 953994:tid 954168] [client 177.93.34.166:61026] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "sergnotes.com"] [uri "/wp-includes/fonts/dashicons.eot"] [unique_id "alxlUeyJE89wAff52KVTSgAAATY"]
[Sat Jul 18 23:49:05.782763 2026] [security2:error] [pid 953994:tid 954095] [remote 117.0.21.154:55650] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-login.php"] [unique_id "alxlUeyJE89wAff52KVTUwABcmQ"]
[Sat Jul 18 23:49:05.864381 2026] [security2:error] [pid 953994:tid 954134] [client 45.134.20.139:26389] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 139.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/twentytwentytwo/assets/fonts/index.php"] [unique_id "alxlUeyJE89wAff52KVTXQAAARQ"]
[Sat Jul 18 23:49:05.984192 2026] [security2:error] [pid 953994:tid 954009] [remote 45.157.54.14:13760] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.mtaginv.com"] [uri "/xmlrpc.php"] [unique_id "alxlUeyJE89wAff52KVTYwABZw4"]
[Sat Jul 18 23:49:05.984399 2026] [security2:error] [pid 953994:tid 954217] [client 45.157.54.14:13760] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.mtaginv.com"] [uri "/xmlrpc.php"] [unique_id "alxlUeyJE89wAff52KVTYwABZw4"]
[Sat Jul 18 23:49:06.020081 2026] [security2:error] [pid 953994:tid 954174] [client 45.133.7.71:45497] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 71.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/js/admin.php"] [unique_id "alxlUuyJE89wAff52KVTZQAAATw"]
[Sat Jul 18 23:49:06.089374 2026] [security2:error] [pid 953994:tid 954249] [client 180.252.198.240:59141] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlUuyJE89wAff52KVTZwAAAYc"]
[Sat Jul 18 23:49:06.089490 2026] [security2:error] [pid 953994:tid 954249] [client 180.252.198.240:59141] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlUuyJE89wAff52KVTZwAAAYc"]
[Sat Jul 18 23:49:06.325959 2026] [security2:error] [pid 953994:tid 954231] [client 14.224.227.113:54809] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxlUuyJE89wAff52KVTdQAAAXU"]
[Sat Jul 18 23:49:06.464907 2026] [security2:error] [pid 953994:tid 954063] [remote 117.0.21.154:55650] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "samdothan.org"] [uri "/wp-login.php"] [unique_id "alxlUuyJE89wAff52KVTgAABQEQ"], referer: https://samdothan.org/wp-login.php
[Sat Jul 18 23:49:06.698897 2026] [security2:error] [pid 953994:tid 954192] [client 45.133.7.82:59961] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/js/widgets/item.php"] [unique_id "alxlUuyJE89wAff52KVTiwAAAU4"]
[Sat Jul 18 23:49:06.737093 2026] [security2:error] [pid 953994:tid 954149] [client 45.134.20.128:31197] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/certificates/index.php"] [unique_id "alxlUuyJE89wAff52KVTjQAAASM"]
[Sat Jul 18 23:49:07.376451 2026] [security2:error] [pid 953994:tid 954230] [client 45.133.7.99:29159] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/uploads/xsec.php"] [unique_id "alxlU-yJE89wAff52KVTswAAAXQ"]
[Sat Jul 18 23:49:07.589904 2026] [security2:error] [pid 953994:tid 954196] [client 45.134.20.135:43529] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/byp.php"] [unique_id "alxlU-yJE89wAff52KVTwAAAAVI"]
[Sat Jul 18 23:49:07.767078 2026] [security2:error] [pid 953994:tid 954210] [client 54.184.226.94:60288] ModSecurity: Warning. Matched phrase "Sucuri" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "www.thecreole.com"] [uri "/index.cgi"] [unique_id "alxlU-yJE89wAff52KVTygAAAWA"]
[Sat Jul 18 23:49:07.876262 2026] [security2:error] [pid 953994:tid 954141] [client 175.141.93.237:38606] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "sergnotes.com"] [uri "/wp-includes/fonts/dashicons.eot"] [unique_id "alxlU-yJE89wAff52KVTzgAAARs"]
[Sat Jul 18 23:49:08.055935 2026] [security2:error] [pid 953994:tid 954233] [client 45.133.7.61:64783] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/images/Marvins.php"] [unique_id "alxlVOyJE89wAff52KVT5AAAAXc"]
[Sat Jul 18 23:49:08.215692 2026] [security2:error] [pid 953994:tid 954126] [client 58.186.218.251:24714] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "sergnotes.com"] [uri "/wp-includes/fonts/dashicons.ttf"] [unique_id "alxlVOyJE89wAff52KVT6wAAAQw"]
[Sat Jul 18 23:49:08.435333 2026] [security2:error] [pid 953994:tid 954167] [client 46.105.48.30:31337] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.sesamegreenbeans.com"] [uri "/robots.txt"] [unique_id "alxlVOyJE89wAff52KVT-QAAATU"]
[Sat Jul 18 23:49:08.435404 2026] [security2:error] [pid 953994:tid 954167] [client 46.105.48.30:31337] ModSecurity: Warning. Matched phrase "MJ12bot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "www.sesamegreenbeans.com"] [uri "/robots.txt"] [unique_id "alxlVOyJE89wAff52KVT-QAAATU"]
[Sat Jul 18 23:49:08.443464 2026] [security2:error] [pid 953994:tid 954125] [client 45.134.20.133:37479] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/blog/wp-includes/about.php"] [unique_id "alxlVOyJE89wAff52KVT-wAAAQs"]
[Sat Jul 18 23:49:08.548991 2026] [security2:error] [pid 953994:tid 954090] [remote 117.0.21.154:55660] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxlVOyJE89wAff52KVUBgABZl8"]
[Sat Jul 18 23:49:08.741428 2026] [security2:error] [pid 953994:tid 954161] [client 45.133.7.57:61771] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 57.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/pwnd-1/kurd.php"] [unique_id "alxlVOyJE89wAff52KVUFgAAAS8"]
[Sat Jul 18 23:49:09.019317 2026] [security2:error] [pid 953994:tid 954034] [remote 117.0.21.154:55660] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxlVeyJE89wAff52KVUJAABbic"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:49:09.349419 2026] [security2:error] [pid 953994:tid 954140] [client 45.134.20.133:60677] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "alxlVeyJE89wAff52KVUOgAAARo"]
[Sat Jul 18 23:49:09.419404 2026] [security2:error] [pid 953994:tid 954168] [client 45.133.7.83:31909] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/tflow/install.php"] [unique_id "alxlVeyJE89wAff52KVUQgAAATY"]
[Sat Jul 18 23:49:09.429195 2026] [security2:error] [pid 953994:tid 954087] [remote 188.138.102.156:37212] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "myspineworld.com"] [uri "/wp-login.php"] [unique_id "alxlVeyJE89wAff52KVUQwABE1w"]
[Sat Jul 18 23:49:09.511107 2026] [security2:error] [pid 953994:tid 954070] [remote 194.164.192.228:44528] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 228.192.164.194.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxlVeyJE89wAff52KVUSAABZks"]
[Sat Jul 18 23:49:09.511221 2026] [security2:error] [pid 953994:tid 954216] [client 194.164.192.228:44528] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxlVeyJE89wAff52KVUSAABZks"]
[Sat Jul 18 23:49:09.635258 2026] [security2:error] [pid 953994:tid 954085] [remote 188.138.102.156:37212] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "myspineworld.com"] [uri "/wp-login.php"] [unique_id "alxlVeyJE89wAff52KVUUgABeFo"], referer: https://myspineworld.com/wp-login.php
[Sat Jul 18 23:49:10.109847 2026] [security2:error] [pid 953994:tid 954203] [client 45.133.7.55:34147] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 55.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/languages/radio.php"] [unique_id "alxlVuyJE89wAff52KVUawAAAVk"]
[Sat Jul 18 23:49:10.211299 2026] [security2:error] [pid 953994:tid 954142] [client 45.134.20.139:56083] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 139.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/blog/wp-admin/about.php"] [unique_id "alxlVuyJE89wAff52KVUcgAAARw"]
[Sat Jul 18 23:49:10.568119 2026] [security2:error] [pid 953994:tid 954082] [remote 45.157.54.14:19587] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.mtaginv.com"] [uri "/xmlrpc.php"] [unique_id "alxlVuyJE89wAff52KVUggABelc"]
[Sat Jul 18 23:49:10.568304 2026] [security2:error] [pid 953994:tid 954236] [client 45.157.54.14:19587] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.mtaginv.com"] [uri "/xmlrpc.php"] [unique_id "alxlVuyJE89wAff52KVUggABelc"]
[Sat Jul 18 23:49:10.788821 2026] [security2:error] [pid 953994:tid 954241] [client 45.133.7.60:27063] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 60.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/uploads/fileman.php"] [unique_id "alxlVuyJE89wAff52KVUjwAAAX8"]
[Sat Jul 18 23:49:10.937572 2026] [security2:error] [pid 953994:tid 954098] [remote 31.42.184.154:48978] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/wp-login.php"] [unique_id "alxlVuyJE89wAff52KVUlgABVGc"]
[Sat Jul 18 23:49:11.074376 2026] [security2:error] [pid 953994:tid 954147] [client 45.134.20.106:22769] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/twentyfive/include.php"] [unique_id "alxlV-yJE89wAff52KVUmwAAASE"]
[Sat Jul 18 23:49:11.200118 2026] [security2:error] [pid 953994:tid 954095] [remote 31.42.184.154:48978] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "truthmedicalaesthetics.com"] [uri "/wp-login.php"] [unique_id "alxlV-yJE89wAff52KVUpwABJmQ"], referer: https://truthmedicalaesthetics.com/wp-login.php
[Sat Jul 18 23:49:11.472408 2026] [security2:error] [pid 953994:tid 954196] [client 45.133.7.93:25447] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 93.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "alxlV-yJE89wAff52KVUsQAAAVI"]
[Sat Jul 18 23:49:11.526017 2026] [security2:error] [pid 953994:tid 954186] [client 47.128.122.241:17046] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "sustaintheart.com"] [uri "/robots.txt"] [unique_id "alxlV-yJE89wAff52KVUtAAAAUg"]
[Sat Jul 18 23:49:11.745255 2026] [security2:error] [pid 953994:tid 954101] [remote 98.156.100.191:39862] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 191.100.156.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxlV-yJE89wAff52KVUvgABFmo"]
[Sat Jul 18 23:49:11.931894 2026] [security2:error] [pid 953994:tid 954244] [client 45.134.20.129:34761] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/css/about.php"] [unique_id "alxlV-yJE89wAff52KVUxwAAAYI"]
[Sat Jul 18 23:49:12.150242 2026] [security2:error] [pid 953994:tid 954182] [client 45.133.7.67:48733] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "alxlWOyJE89wAff52KVU2QAAAUQ"]
[Sat Jul 18 23:49:12.395025 2026] [security2:error] [pid 953994:tid 954083] [remote 141.94.161.61:58042] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.161.94.141.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxlWOyJE89wAff52KVU4QABeFg"]
[Sat Jul 18 23:49:12.606810 2026] [security2:error] [pid 953994:tid 954077] [remote 141.94.161.61:58042] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.161.94.141.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxlWOyJE89wAff52KVU6AABFlI"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:49:12.793931 2026] [security2:error] [pid 953994:tid 954246] [client 45.134.20.117:49537] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/cgi-bin/install.php"] [unique_id "alxlWOyJE89wAff52KVU6wAAAYQ"]
[Sat Jul 18 23:49:12.829960 2026] [security2:error] [pid 953994:tid 954179] [client 45.133.7.84:23563] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 84.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/admin.php%20"] [unique_id "alxlWOyJE89wAff52KVU8AAAAUE"]
[Sat Jul 18 23:49:12.958210 2026] [security2:error] [pid 953994:tid 954050] [remote 31.42.184.154:48970] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxlWOyJE89wAff52KVU-gABajc"]
[Sat Jul 18 23:49:13.435645 2026] [security2:error] [pid 953994:tid 954049] [remote 31.42.184.154:48970] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxlWeyJE89wAff52KVVJwABiDY"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:49:13.498228 2026] [security2:error] [pid 953994:tid 954117] [remote 47.86.33.52:64990] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxlWeyJE89wAff52KVVKAABTXo"]
[Sat Jul 18 23:49:13.508598 2026] [security2:error] [pid 953994:tid 954124] [client 45.133.7.102:36761] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 102.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/hong1.php"] [unique_id "alxlWeyJE89wAff52KVVKwAAAQo"]
[Sat Jul 18 23:49:13.649943 2026] [security2:error] [pid 953994:tid 954222] [client 45.134.20.126:31463] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 126.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/wso.php"] [unique_id "alxlWeyJE89wAff52KVVMgAAAWw"]
[Sat Jul 18 23:49:13.695244 2026] [security2:error] [pid 953994:tid 954118] [remote 195.26.253.119:56512] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.253.26.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxlWeyJE89wAff52KVVNgABbXs"]
[Sat Jul 18 23:49:13.695362 2026] [security2:error] [pid 953994:tid 954223] [client 195.26.253.119:56512] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxlWeyJE89wAff52KVVNgABbXs"]
[Sat Jul 18 23:49:13.696590 2026] [security2:error] [pid 953994:tid 954154] [client 36.83.95.75:64369] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlWeyJE89wAff52KVVOAAAASg"]
[Sat Jul 18 23:49:13.696673 2026] [security2:error] [pid 953994:tid 954154] [client 36.83.95.75:64369] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlWeyJE89wAff52KVVOAAAASg"]
[Sat Jul 18 23:49:14.178411 2026] [security2:error] [pid 953994:tid 954200] [client 106.222.249.209:21233] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.249.222.106.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxlWuyJE89wAff52KVVSQAAAVY"]
[Sat Jul 18 23:49:14.178680 2026] [security2:error] [pid 953994:tid 954200] [client 106.222.249.209:21233] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "newoffice.ca"] [uri "/xmlrpc.php"] [unique_id "alxlWuyJE89wAff52KVVSQAAAVY"]
[Sat Jul 18 23:49:14.187878 2026] [security2:error] [pid 953994:tid 954206] [client 45.133.7.97:42277] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 97.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/maint/byps.php"] [unique_id "alxlWuyJE89wAff52KVVTAAAAVw"]
[Sat Jul 18 23:49:14.515886 2026] [security2:error] [pid 953994:tid 954193] [client 45.134.20.125:53377] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 125.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/class.api.php"] [unique_id "alxlWuyJE89wAff52KVVZgAAAU8"]
[Sat Jul 18 23:49:14.530784 2026] [security2:error] [pid 953994:tid 954061] [remote 47.86.33.52:64990] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxlWuyJE89wAff52KVVZwABRkI"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:49:14.544543 2026] [proxy:error] [pid 953994:tid 954154] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:49:14.544631 2026] [proxy_http:error] [pid 953994:tid 954154] [client 193.47.62.168:50022] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:49:14.545838 2026] [proxy:error] [pid 953994:tid 954154] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:49:14.545878 2026] [proxy_http:error] [pid 953994:tid 954154] [client 193.47.62.168:50022] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:49:14.642369 2026] [security2:error] [pid 953994:tid 954190] [client 138.252.89.100:51714] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlWuyJE89wAff52KVVcgAAAUw"]
[Sat Jul 18 23:49:14.642469 2026] [security2:error] [pid 953994:tid 954190] [client 138.252.89.100:51714] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlWuyJE89wAff52KVVcgAAAUw"]
[Sat Jul 18 23:49:14.873969 2026] [security2:error] [pid 953994:tid 954130] [client 45.133.7.74:57625] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "alxlWuyJE89wAff52KVVhwAAARA"]
[Sat Jul 18 23:49:14.970524 2026] [security2:error] [pid 953994:tid 954241] [client 103.160.26.178:51830] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlWuyJE89wAff52KVVjAAAAX8"]
[Sat Jul 18 23:49:14.970646 2026] [security2:error] [pid 953994:tid 954241] [client 103.160.26.178:51830] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlWuyJE89wAff52KVVjAAAAX8"]
[Sat Jul 18 23:49:15.145826 2026] [security2:error] [pid 953994:tid 954018] [remote 72.167.132.114:46210] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxlW-yJE89wAff52KVVlgABPxc"]
[Sat Jul 18 23:49:15.446851 2026] [security2:error] [pid 953994:tid 954149] [client 45.134.20.117:26311] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "alxlW-yJE89wAff52KVVqQAAASM"]
[Sat Jul 18 23:49:15.465308 2026] [security2:error] [pid 953994:tid 954141] [client 2404:4408:9900:d0:d80a:1fd7:f683:f504:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "origine.nz"] [uri "/index.php"] [unique_id "alxlWuyJE89wAff52KVVfwABG2E"], referer: https://origine.nz/
[Sat Jul 18 23:49:15.554428 2026] [security2:error] [pid 953994:tid 954144] [client 45.133.7.54:23453] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "alxlW-yJE89wAff52KVVsAAAAR4"]
[Sat Jul 18 23:49:15.579708 2026] [security2:error] [pid 953994:tid 954145] [client 163.61.1.17:58460] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlW-yJE89wAff52KVVsQAAAR8"]
[Sat Jul 18 23:49:15.581040 2026] [security2:error] [pid 953994:tid 954145] [client 163.61.1.17:58460] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlW-yJE89wAff52KVVsQAAAR8"]
[Sat Jul 18 23:49:16.087589 2026] [security2:error] [pid 953994:tid 954088] [remote 72.167.132.114:46210] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxlXOyJE89wAff52KVVygABT10"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:49:16.136829 2026] [security2:error] [pid 953994:tid 954182] [client 13.232.206.133:37400] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.206.232.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxlXOyJE89wAff52KVVzAAAAUQ"]
[Sat Jul 18 23:49:16.136968 2026] [security2:error] [pid 953994:tid 954182] [client 13.232.206.133:37400] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxlXOyJE89wAff52KVVzAAAAUQ"]
[Sat Jul 18 23:49:16.235679 2026] [security2:error] [pid 953994:tid 954136] [client 45.133.7.65:26441] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 65.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/twentytwentyfour/patterns/content-type.php"] [unique_id "alxlXOyJE89wAff52KVV1wAAARY"]
[Sat Jul 18 23:49:16.252856 2026] [security2:error] [pid 953994:tid 954165] [client 74.208.214.194:49182] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxlXOyJE89wAff52KVV2QAAATM"]
[Sat Jul 18 23:49:16.299883 2026] [security2:error] [pid 953994:tid 954137] [client 217.217.245.230:22731] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.245.217.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxlXOyJE89wAff52KVV4AAAARc"]
[Sat Jul 18 23:49:16.299988 2026] [security2:error] [pid 953994:tid 954137] [client 217.217.245.230:22731] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxlXOyJE89wAff52KVV4AAAARc"]
[Sat Jul 18 23:49:16.310179 2026] [security2:error] [pid 953994:tid 954181] [client 45.134.20.115:20619] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/radio.php"] [unique_id "alxlXOyJE89wAff52KVV4wAAAUM"]
[Sat Jul 18 23:49:16.401235 2026] [security2:error] [pid 953994:tid 954198] [client 180.252.198.240:59622] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlXOyJE89wAff52KVV7QAAAVQ"]
[Sat Jul 18 23:49:16.401369 2026] [security2:error] [pid 953994:tid 954198] [client 180.252.198.240:59622] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlXOyJE89wAff52KVV7QAAAVQ"]
[Sat Jul 18 23:49:16.887992 2026] [security2:error] [pid 953994:tid 954099] [remote 117.0.21.154:60698] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "whiteoutcb.com"] [uri "/wp-login.php"] [unique_id "alxlXOyJE89wAff52KVWAAABaWg"]
[Sat Jul 18 23:49:16.923609 2026] [security2:error] [pid 953994:tid 954229] [client 45.133.7.67:46107] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/network/class.php"] [unique_id "alxlXOyJE89wAff52KVWDAAAAXM"]
[Sat Jul 18 23:49:17.129994 2026] [security2:error] [pid 953994:tid 954063] [remote 98.156.100.191:39862] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 191.100.156.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxlXeyJE89wAff52KVWGAABiEQ"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:49:17.165413 2026] [security2:error] [pid 953994:tid 954198] [client 45.134.20.113:24829] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/system_log.php"] [unique_id "alxlXeyJE89wAff52KVWHAAAAVQ"]
[Sat Jul 18 23:49:17.546288 2026] [security2:error] [pid 953994:tid 954002] [remote 117.0.21.154:60698] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "whiteoutcb.com"] [uri "/wp-login.php"] [unique_id "alxlXeyJE89wAff52KVWMAABbQc"], referer: https://whiteoutcb.com/wp-login.php
[Sat Jul 18 23:49:17.613375 2026] [security2:error] [pid 953994:tid 954172] [client 45.133.7.91:53229] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 91.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "alxlXeyJE89wAff52KVWNgAAATo"]
[Sat Jul 18 23:49:18.023978 2026] [security2:error] [pid 953994:tid 954235] [client 45.134.20.114:60259] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.alf.php"] [unique_id "alxlXuyJE89wAff52KVWUwAAAXk"]
[Sat Jul 18 23:49:18.299505 2026] [security2:error] [pid 953994:tid 954236] [client 45.133.7.79:26813] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 79.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/ms-file.php"] [unique_id "alxlXuyJE89wAff52KVWbAAAAXo"]
[Sat Jul 18 23:49:18.879687 2026] [security2:error] [pid 953994:tid 954184] [client 45.134.20.129:60565] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wso.php"] [unique_id "alxlXuyJE89wAff52KVWkgAAAUY"]
[Sat Jul 18 23:49:18.921196 2026] [security2:error] [pid 953994:tid 954216] [client 50.116.65.227:12140] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "learnthissecret.com"] [uri "/index.php"] [unique_id "alxlXuyJE89wAff52KVWhQAAAWY"]
[Sat Jul 18 23:49:19.032730 2026] [security2:error] [pid 953994:tid 954186] [client 45.133.7.96:22999] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 96.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "alxlXuyJE89wAff52KVWoQAAAUg"]
[Sat Jul 18 23:49:19.210994 2026] [security2:error] [pid 953994:tid 954223] [client 50.116.65.227:48230] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "learnthissecret.com"] [uri "/index.php"] [unique_id "alxlXuyJE89wAff52KVWlwAAAW0"]
[Sat Jul 18 23:49:19.363670 2026] [security2:error] [pid 953994:tid 954065] [remote 31.42.184.154:48982] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxlX-yJE89wAff52KVWsgABOEY"]
[Sat Jul 18 23:49:19.363811 2026] [security2:error] [pid 953994:tid 954170] [client 31.42.184.154:48982] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxlX-yJE89wAff52KVWsgABOEY"]
[Sat Jul 18 23:49:19.712399 2026] [security2:error] [pid 953994:tid 954161] [client 45.133.7.77:47271] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 77.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/widgets/av.php"] [unique_id "alxlX-yJE89wAff52KVWygAAAS8"]
[Sat Jul 18 23:49:19.734412 2026] [security2:error] [pid 953994:tid 954137] [client 45.134.20.105:39293] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "alxlX-yJE89wAff52KVWywAAARc"]
[Sat Jul 18 23:49:20.393776 2026] [security2:error] [pid 953994:tid 954200] [client 45.133.7.93:47721] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 93.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/chosen.php%20"] [unique_id "alxlYOyJE89wAff52KVW7wAAAVY"]
[Sat Jul 18 23:49:20.592517 2026] [security2:error] [pid 953994:tid 954197] [client 45.134.20.116:46033] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 116.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/flower.php"] [unique_id "alxlYOyJE89wAff52KVXAwAAAVM"]
[Sat Jul 18 23:49:21.044833 2026] [security2:error] [pid 953994:tid 954044] [remote 72.167.132.114:35420] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxlYeyJE89wAff52KVXFAABezE"]
[Sat Jul 18 23:49:21.073448 2026] [security2:error] [pid 953994:tid 954143] [client 45.133.7.57:61521] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 57.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/bs1.php"] [unique_id "alxlYeyJE89wAff52KVXFwAAAR0"]
[Sat Jul 18 23:49:21.210455 2026] [security2:error] [pid 953994:tid 954009] [remote 103.90.233.75:59060] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.233.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ferrellroofing.com"] [uri "/wp-login.php"] [unique_id "alxlYeyJE89wAff52KVXIwABdA4"]
[Sat Jul 18 23:49:21.311980 2026] [security2:error] [pid 953994:tid 954096] [remote 72.167.132.114:35420] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxlYeyJE89wAff52KVXKQABRmU"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:49:21.456984 2026] [security2:error] [pid 953994:tid 954240] [client 45.134.20.134:50359] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 134.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/wp-class.php"] [unique_id "alxlYeyJE89wAff52KVXNQAAAX4"]
[Sat Jul 18 23:49:21.635045 2026] [security2:error] [pid 953994:tid 954077] [remote 103.90.233.75:59060] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.233.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ferrellroofing.com"] [uri "/wp-login.php"] [unique_id "alxlYeyJE89wAff52KVXRAABWlI"], referer: https://ferrellroofing.com/wp-login.php
[Sat Jul 18 23:49:21.757295 2026] [security2:error] [pid 953994:tid 954144] [client 45.133.7.54:29275] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "alxlYeyJE89wAff52KVXSwAAAR4"]
[Sat Jul 18 23:49:22.314168 2026] [security2:error] [pid 953994:tid 954198] [client 45.134.20.125:31467] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 125.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/js/autoload_classmap.php"] [unique_id "alxlYuyJE89wAff52KVXbQAAAVQ"]
[Sat Jul 18 23:49:22.327557 2026] [security2:error] [pid 953994:tid 954093] [remote 72.167.132.114:35432] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "website-3c1c9eb1.nextlvlmarketingco.com"] [uri "/wp-login.php"] [unique_id "alxlYuyJE89wAff52KVXbgABVmI"]
[Sat Jul 18 23:49:22.405116 2026] [security2:error] [pid 953994:tid 954127] [client 193.47.62.167:60138] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "mail.allergyantidotes.com"] [uri "/index.php"] [unique_id "alxlYeyJE89wAff52KVXMAAAAQ0"]
[Sat Jul 18 23:49:22.437330 2026] [security2:error] [pid 953994:tid 954227] [client 45.133.7.77:63083] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 77.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/network.php"] [unique_id "alxlYuyJE89wAff52KVXcQAAAXE"]
[Sat Jul 18 23:49:22.630489 2026] [security2:error] [pid 953994:tid 954069] [remote 72.167.132.114:35432] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "website-3c1c9eb1.nextlvlmarketingco.com"] [uri "/wp-login.php"] [unique_id "alxlYuyJE89wAff52KVXfwABSko"], referer: https://website-3c1c9eb1.nextlvlmarketingco.com/wp-login.php
[Sat Jul 18 23:49:23.047814 2026] [security2:error] [pid 953994:tid 954159] [client 152.42.242.202:59430] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "verdunestate.com"] [uri "/"] [unique_id "alxlY-yJE89wAff52KVXlgAAAS0"]
[Sat Jul 18 23:49:23.117290 2026] [security2:error] [pid 953994:tid 954226] [client 45.133.7.84:54487] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 84.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/page.php"] [unique_id "alxlY-yJE89wAff52KVXnAAAAXA"]
[Sat Jul 18 23:49:23.166942 2026] [security2:error] [pid 953994:tid 954230] [client 45.134.20.104:58497] ModSecurity: Warning. Pattern match "/1\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1543"] [id "900921"] [msg "temporary TUW-72162 logging rule"] [hostname "swafforddetailing.com"] [uri "/wp-content/1.php"] [unique_id "alxlY-yJE89wAff52KVXogAAAXQ"]
[Sat Jul 18 23:49:23.167038 2026] [security2:error] [pid 953994:tid 954230] [client 45.134.20.104:58497] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/1.php"] [unique_id "alxlY-yJE89wAff52KVXogAAAXQ"]
[Sat Jul 18 23:49:23.797030 2026] [security2:error] [pid 953994:tid 954248] [client 45.133.7.103:34787] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/includes/index.php"] [unique_id "alxlY-yJE89wAff52KVXwQAAAYY"]
[Sat Jul 18 23:49:24.022831 2026] [security2:error] [pid 953994:tid 954164] [client 45.134.20.118:24475] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/ioxi-o.php"] [unique_id "alxlZOyJE89wAff52KVXzwAAATI"]
[Sat Jul 18 23:49:24.185845 2026] [security2:error] [pid 953994:tid 954243] [client 57.141.18.50:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxlY-yJE89wAff52KVXzQAAAYE"]
[Sat Jul 18 23:49:24.419730 2026] [security2:error] [pid 953994:tid 954198] [client 36.83.95.75:64982] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlZOyJE89wAff52KVX4wAAAVQ"]
[Sat Jul 18 23:49:24.419836 2026] [security2:error] [pid 953994:tid 954198] [client 36.83.95.75:64982] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlZOyJE89wAff52KVX4wAAAVQ"]
[Sat Jul 18 23:49:24.476075 2026] [security2:error] [pid 953994:tid 954125] [client 45.133.7.86:45205] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 86.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/uploads/chosen.php"] [unique_id "alxlZOyJE89wAff52KVX5AAAAQs"]
[Sat Jul 18 23:49:24.718154 2026] [proxy:error] [pid 953994:tid 954218] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:49:24.718190 2026] [proxy_http:error] [pid 953994:tid 954218] [client 206.189.196.255:51618] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:49:24.718639 2026] [proxy:error] [pid 953994:tid 954218] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:49:24.718661 2026] [proxy_http:error] [pid 953994:tid 954218] [client 206.189.196.255:51618] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:49:24.891984 2026] [security2:error] [pid 953994:tid 954150] [client 45.134.20.124:57705] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 124.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/info.php"] [unique_id "alxlZOyJE89wAff52KVYAAAAASQ"]
[Sat Jul 18 23:49:24.943013 2026] [security2:error] [pid 953994:tid 954081] [remote 98.70.32.248:50134] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.32.70.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "christiancountytrumpet.com"] [uri "/wp-login.php"] [unique_id "alxlZOyJE89wAff52KVYAQABd1Y"]
[Sat Jul 18 23:49:25.051741 2026] [security2:error] [pid 953994:tid 954210] [client 206.189.196.255:51628] ModSecurity: Access denied with code 406 (phase 1). Pattern match "python-requests|python-urllib" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "1460"] [id "909111"] [msg "Python UA brute"] [hostname "cpcalendars.kanameds.com"] [uri "/"] [unique_id "alxlZeyJE89wAff52KVYBAAAAWA"]
[Sat Jul 18 23:49:25.166843 2026] [security2:error] [pid 953994:tid 954154] [client 45.133.7.64:57933] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 64.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/WordPressCore/include.php"] [unique_id "alxlZeyJE89wAff52KVYCQAAASg"]
[Sat Jul 18 23:49:25.283106 2026] [security2:error] [pid 953994:tid 954207] [client 18.139.208.24:32968] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.208.139.18.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxlZeyJE89wAff52KVYFQAAAV0"]
[Sat Jul 18 23:49:25.283196 2026] [security2:error] [pid 953994:tid 954207] [client 18.139.208.24:32968] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxlZeyJE89wAff52KVYFQAAAV0"]
[Sat Jul 18 23:49:25.321954 2026] [security2:error] [pid 953994:tid 954068] [remote 98.70.32.248:50134] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.32.70.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "christiancountytrumpet.com"] [uri "/wp-login.php"] [unique_id "alxlZeyJE89wAff52KVYGAABPkk"], referer: https://christiancountytrumpet.com/wp-login.php
[Sat Jul 18 23:49:25.618404 2026] [security2:error] [pid 953994:tid 954146] [client 103.160.26.178:52324] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlZeyJE89wAff52KVYJwAAASA"]
[Sat Jul 18 23:49:25.618505 2026] [security2:error] [pid 953994:tid 954146] [client 103.160.26.178:52324] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlZeyJE89wAff52KVYJwAAASA"]
[Sat Jul 18 23:49:25.645237 2026] [proxy:error] [pid 953994:tid 954240] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:49:25.645309 2026] [proxy_http:error] [pid 953994:tid 954240] [client 193.47.62.168:37904] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:49:25.645868 2026] [proxy:error] [pid 953994:tid 954240] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:49:25.645904 2026] [proxy_http:error] [pid 953994:tid 954240] [client 193.47.62.168:37904] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:49:25.774798 2026] [security2:error] [pid 953994:tid 954129] [client 45.134.20.136:59891] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 136.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/setup.php"] [unique_id "alxlZeyJE89wAff52KVYNwAAAQ8"]
[Sat Jul 18 23:49:25.787896 2026] [security2:error] [pid 953994:tid 954106] [remote 188.138.102.156:39260] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "dlu.cjf.mybluehost.me"] [uri "/blog/xmlrpc.php"] [unique_id "alxlZeyJE89wAff52KVYPgABdW8"]
[Sat Jul 18 23:49:25.788031 2026] [security2:error] [pid 953994:tid 954231] [client 188.138.102.156:39260] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "dlu.cjf.mybluehost.me"] [uri "/blog/xmlrpc.php"] [unique_id "alxlZeyJE89wAff52KVYPgABdW8"]
[Sat Jul 18 23:49:25.846441 2026] [security2:error] [pid 953994:tid 954177] [client 45.133.7.103:62693] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/admin-footer.php"] [unique_id "alxlZeyJE89wAff52KVYRQAAAT8"]
[Sat Jul 18 23:49:25.995793 2026] [security2:error] [pid 953994:tid 954215] [client 146.75.146.77:17621] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "gertoger.org"] [uri "/index.php"] [unique_id "alxlZeyJE89wAff52KVYOQABZQA"]
[Sat Jul 18 23:49:25.998733 2026] [security2:error] [pid 953994:tid 954215] [client 146.75.146.77:17621] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "gertoger.org"] [uri "/index.php"] [unique_id "alxlZeyJE89wAff52KVYOgABZWc"]
[Sat Jul 18 23:49:26.139577 2026] [security2:error] [pid 953994:tid 954218] [client 163.61.1.17:58949] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlZuyJE89wAff52KVYVgAAAWg"]
[Sat Jul 18 23:49:26.141406 2026] [security2:error] [pid 953994:tid 954218] [client 163.61.1.17:58949] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlZuyJE89wAff52KVYVgAAAWg"]
[Sat Jul 18 23:49:26.408549 2026] [security2:error] [pid 953994:tid 954251] [client 138.252.89.100:52245] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlZuyJE89wAff52KVYZgAAAYk"]
[Sat Jul 18 23:49:26.408623 2026] [security2:error] [pid 953994:tid 954251] [client 138.252.89.100:52245] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlZuyJE89wAff52KVYZgAAAYk"]
[Sat Jul 18 23:49:26.526755 2026] [security2:error] [pid 953994:tid 954228] [client 45.133.7.79:40031] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 79.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/modules/mod_simplefileuploadv1.3/elements/admin-footer.php"] [unique_id "alxlZuyJE89wAff52KVYbAAAAXI"]
[Sat Jul 18 23:49:26.579030 2026] [security2:error] [pid 953994:tid 954250] [client 114.119.141.194:32699] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "keyq8.com"] [uri "/collections/all/products/%D9%85%D9%81%D8%A7%D8%AA%D9%8A%D8%AD-%D8%B4%D8%A7%D8%B1%D8%A8-%D8%B4%D9%88%D8%AA%D8%B1"] [unique_id "alxlZuyJE89wAff52KVYbgAAAYg"], referer: https://keyq8.com/collections/all/products/%D9%85%D9%81%D8%A7%D8%AA%D9%8A%D8%AD-%D8%B4%D8%A7%D8%B1%D8%A8-%D8%B4%D9%88%D8%AA%D8%B1
[Sat Jul 18 23:49:26.638304 2026] [security2:error] [pid 953994:tid 954232] [client 45.134.20.139:30183] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 139.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.bod/.ll/ss.php"] [unique_id "alxlZuyJE89wAff52KVYcgAAAXY"]
[Sat Jul 18 23:49:27.198483 2026] [security2:error] [pid 953994:tid 954149] [client 34.74.242.206:1787] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.appelmanimages.com"] [uri "/robots.txt"] [unique_id "alxlZ-yJE89wAff52KVYjgAAASM"]
[Sat Jul 18 23:49:27.198563 2026] [security2:error] [pid 953994:tid 954149] [client 34.74.242.206:1787] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "www.appelmanimages.com"] [uri "/robots.txt"] [unique_id "alxlZ-yJE89wAff52KVYjgAAASM"]
[Sat Jul 18 23:49:27.206623 2026] [security2:error] [pid 953994:tid 954133] [client 45.133.7.54:41659] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/assets/info.php"] [unique_id "alxlZ-yJE89wAff52KVYjwAAARM"]
[Sat Jul 18 23:49:27.302762 2026] [security2:error] [pid 953994:tid 954202] [client 34.74.242.206:1774] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.appelmanimages.com"] [uri "/"] [unique_id "alxlZ-yJE89wAff52KVYmQAAAVg"]
[Sat Jul 18 23:49:27.302855 2026] [security2:error] [pid 953994:tid 954202] [client 34.74.242.206:1774] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "www.appelmanimages.com"] [uri "/"] [unique_id "alxlZ-yJE89wAff52KVYmQAAAVg"]
[Sat Jul 18 23:49:27.375705 2026] [security2:error] [pid 953994:tid 954162] [client 180.252.198.240:60111] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlZ-yJE89wAff52KVYoQAAATA"]
[Sat Jul 18 23:49:27.375962 2026] [security2:error] [pid 953994:tid 954162] [client 180.252.198.240:60111] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlZ-yJE89wAff52KVYoQAAATA"]
[Sat Jul 18 23:49:27.437123 2026] [security2:error] [pid 953994:tid 954032] [remote 64.90.47.163:50460] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.47.90.64.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "elementconstruction.co.uk"] [uri "/wp-login.php"] [unique_id "alxlZ-yJE89wAff52KVYpQABECU"]
[Sat Jul 18 23:49:27.495066 2026] [security2:error] [pid 953994:tid 954159] [client 45.134.20.124:54205] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 124.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/radio.php"] [unique_id "alxlZ-yJE89wAff52KVYqAAAAS0"]
[Sat Jul 18 23:49:27.665656 2026] [security2:error] [pid 953994:tid 954121] [remote 64.90.47.163:50460] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.47.90.64.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "elementconstruction.co.uk"] [uri "/wp-login.php"] [unique_id "alxlZ-yJE89wAff52KVYsQABWn4"], referer: https://elementconstruction.co.uk/wp-login.php
[Sat Jul 18 23:49:27.887444 2026] [security2:error] [pid 953994:tid 954149] [client 45.133.7.83:51843] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "alxlZ-yJE89wAff52KVYwgAAASM"]
[Sat Jul 18 23:49:28.349533 2026] [security2:error] [pid 953994:tid 954233] [client 45.134.20.108:50685] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugin.php"] [unique_id "alxlaOyJE89wAff52KVY3wAAAXc"]
[Sat Jul 18 23:49:28.565578 2026] [security2:error] [pid 953994:tid 954143] [client 45.133.7.60:55687] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 60.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/pomo/item.php"] [unique_id "alxlaOyJE89wAff52KVY7gAAAR0"]
[Sat Jul 18 23:49:29.075124 2026] [security2:error] [pid 953994:tid 954012] [remote 188.138.102.156:42056] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxlaeyJE89wAff52KVZEwABChE"]
[Sat Jul 18 23:49:29.211995 2026] [security2:error] [pid 953994:tid 954174] [client 45.134.20.107:20791] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 107.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/ectoplasm/about.php"] [unique_id "alxlaeyJE89wAff52KVZHwAAATw"]
[Sat Jul 18 23:49:29.246814 2026] [security2:error] [pid 953994:tid 954170] [client 45.133.7.77:49281] ModSecurity: Warning. Pattern match "/1\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1543"] [id "900921"] [msg "temporary TUW-72162 logging rule"] [hostname "nikkidesigns.net"] [uri "/wp-content/1.php%20"] [unique_id "alxlaeyJE89wAff52KVZIAAAATg"]
[Sat Jul 18 23:49:29.246912 2026] [security2:error] [pid 953994:tid 954170] [client 45.133.7.77:49281] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 77.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/1.php%20"] [unique_id "alxlaeyJE89wAff52KVZIAAAATg"]
[Sat Jul 18 23:49:29.277065 2026] [security2:error] [pid 953994:tid 954057] [remote 188.138.102.156:42056] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxlaeyJE89wAff52KVZIgABDD4"], referer: https://mezzacraft.com/wp-login.php
[Sat Jul 18 23:49:29.927927 2026] [security2:error] [pid 953994:tid 954134] [client 45.133.7.105:33325] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/blue/wp-atom.php"] [unique_id "alxlaeyJE89wAff52KVZRQAAARQ"]
[Sat Jul 18 23:49:30.070455 2026] [security2:error] [pid 953994:tid 954181] [client 45.134.20.136:64637] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 136.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/as.php"] [unique_id "alxlauyJE89wAff52KVZTwAAAUM"]
[Sat Jul 18 23:49:30.658351 2026] [security2:error] [pid 953994:tid 954189] [client 45.133.7.80:26643] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "alxlauyJE89wAff52KVZdAAAAUs"]
[Sat Jul 18 23:49:30.933352 2026] [security2:error] [pid 953994:tid 954216] [client 45.134.20.129:58273] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/cc.php"] [unique_id "alxlauyJE89wAff52KVZhQAAAWY"]
[Sat Jul 18 23:49:31.342999 2026] [security2:error] [pid 953994:tid 954139] [client 45.133.7.86:53547] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 86.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/assets/install.php"] [unique_id "alxla-yJE89wAff52KVZogAAARk"]
[Sat Jul 18 23:49:31.790654 2026] [security2:error] [pid 953994:tid 954209] [client 45.134.20.132:49449] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/index.php"] [unique_id "alxla-yJE89wAff52KVZwQAAAV8"]
[Sat Jul 18 23:49:32.027490 2026] [security2:error] [pid 953994:tid 954138] [client 45.133.7.66:36593] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 66.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/acme-challenge/gecko-old.php"] [unique_id "alxlbOyJE89wAff52KVZ0wAAARg"]
[Sat Jul 18 23:49:32.107040 2026] [security2:error] [pid 953994:tid 954185] [client 103.124.110.96:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "msandreaadams.net"] [uri "/index.php"] [unique_id "alxla-yJE89wAff52KVZxAAAAUc"]
[Sat Jul 18 23:49:32.122829 2026] [security2:error] [pid 953994:tid 954205] [client 74.208.214.194:49122] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxlbOyJE89wAff52KVZ2wAAAVs"]
[Sat Jul 18 23:49:32.262431 2026] [security2:error] [pid 953994:tid 954181] [client 188.39.109.162:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "whiteoutcb.com"] [uri "/index.php"] [unique_id "alxlauyJE89wAff52KVZhwAAAUM"]
[Sat Jul 18 23:49:32.502768 2026] [security2:error] [pid 953994:tid 954024] [remote 20.75.217.73:1102] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 73.217.75.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thesoloceos.com"] [uri "/wp-login.php"] [unique_id "alxlbOyJE89wAff52KVZ9QABKR0"]
[Sat Jul 18 23:49:32.654347 2026] [security2:error] [pid 953994:tid 954197] [client 45.134.20.122:21855] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/ab.php"] [unique_id "alxlbOyJE89wAff52KVaCgAAAVM"]
[Sat Jul 18 23:49:32.663680 2026] [security2:error] [pid 953994:tid 954111] [remote 20.75.217.73:1102] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 73.217.75.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thesoloceos.com"] [uri "/wp-login.php"] [unique_id "alxlbOyJE89wAff52KVaDAABH3Q"], referer: https://thesoloceos.com/wp-login.php
[Sat Jul 18 23:49:32.768468 2026] [security2:error] [pid 953994:tid 954177] [client 45.133.7.90:22155] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 90.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/wp-login.php"] [unique_id "alxlbOyJE89wAff52KVaDwAAAT8"]
[Sat Jul 18 23:49:33.454457 2026] [security2:error] [pid 953994:tid 954239] [client 45.133.7.73:48141] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 73.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/images/autoload_classmap.php"] [unique_id "alxlbeyJE89wAff52KVaNQAAAX0"]
[Sat Jul 18 23:49:33.507126 2026] [security2:error] [pid 953994:tid 954185] [client 45.134.20.136:25507] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 136.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/about.php"] [unique_id "alxlbeyJE89wAff52KVaPgAAAUc"]
[Sat Jul 18 23:49:34.133448 2026] [security2:error] [pid 953994:tid 954134] [client 45.133.7.100:44273] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "alxlbuyJE89wAff52KVabAAAARQ"]
[Sat Jul 18 23:49:34.242069 2026] [fcgid:warn] [pid 953994:tid 954165] (70014)End of file found: [client 91.238.181.10:63703] mod_fcgid: can't get data from http client
[Sat Jul 18 23:49:34.370239 2026] [security2:error] [pid 953994:tid 954184] [client 45.134.20.135:32257] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "alxlbuyJE89wAff52KVafwAAAUY"]
[Sat Jul 18 23:49:34.447316 2026] [security2:error] [pid 953994:tid 954223] [client 62.210.111.125:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jenfarley.com"] [uri "/index.php"] [unique_id "alxlbeyJE89wAff52KVaYAAAAW0"], referer: https://store.independenceaustralia.com
[Sat Jul 18 23:49:34.814261 2026] [security2:error] [pid 953994:tid 954151] [client 45.133.7.69:35985] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 69.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "alxlbuyJE89wAff52KVaoQAAASU"]
[Sat Jul 18 23:49:35.150002 2026] [security2:error] [pid 953994:tid 954191] [client 36.83.95.75:65479] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlb-yJE89wAff52KVauQAAAU0"]
[Sat Jul 18 23:49:35.150134 2026] [security2:error] [pid 953994:tid 954191] [client 36.83.95.75:65479] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlb-yJE89wAff52KVauQAAAU0"]
[Sat Jul 18 23:49:35.163518 2026] [security2:error] [pid 953994:tid 954240] [client 50.116.65.227:24592] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxlb-yJE89wAff52KVauwAAAX4"]
[Sat Jul 18 23:49:35.178200 2026] [security2:error] [pid 953994:tid 954229] [client 50.116.65.227:18246] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxlb-yJE89wAff52KVavQAAAXM"]
[Sat Jul 18 23:49:35.223267 2026] [security2:error] [pid 953994:tid 954185] [client 140.248.75.125:48906] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.crmptest4-site.crmpfilms.com"] [uri "/index.php"] [unique_id "alxlbuyJE89wAff52KVagAAAAUc"]
[Sat Jul 18 23:49:35.226211 2026] [security2:error] [pid 953994:tid 954169] [client 140.248.75.125:48914] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.crmptest4-site.crmpfilms.com"] [uri "/index.php"] [unique_id "alxlbuyJE89wAff52KVagQAAATc"]
[Sat Jul 18 23:49:35.229262 2026] [security2:error] [pid 953994:tid 954133] [client 45.134.20.117:61693] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/doc.php"] [unique_id "alxlb-yJE89wAff52KVaxAAAARM"]
[Sat Jul 18 23:49:35.491721 2026] [security2:error] [pid 953994:tid 954239] [client 45.133.7.91:39201] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 91.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/install.php"] [unique_id "alxlb-yJE89wAff52KVa1wAAAX0"]
[Sat Jul 18 23:49:35.892423 2026] [security2:error] [pid 953994:tid 954188] [client 62.210.111.125:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jenfarley.com"] [uri "/index.php"] [unique_id "alxlb-yJE89wAff52KVazAAAAUo"], referer: https://store.independenceaustralia.com
[Sat Jul 18 23:49:36.083731 2026] [security2:error] [pid 953994:tid 954230] [client 45.134.20.119:51819] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "alxlcOyJE89wAff52KVa9AAAAXQ"]
[Sat Jul 18 23:49:36.174048 2026] [security2:error] [pid 953994:tid 954152] [client 45.133.7.81:32569] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 81.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/install.php"] [unique_id "alxlcOyJE89wAff52KVa_AAAASY"]
[Sat Jul 18 23:49:36.223828 2026] [security2:error] [pid 953994:tid 954227] [client 103.160.26.178:52825] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlcOyJE89wAff52KVbBQAAAXE"]
[Sat Jul 18 23:49:36.223915 2026] [security2:error] [pid 953994:tid 954227] [client 103.160.26.178:52825] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlcOyJE89wAff52KVbBQAAAXE"]
[Sat Jul 18 23:49:36.626248 2026] [security2:error] [pid 953994:tid 954164] [client 163.61.1.17:59610] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlcOyJE89wAff52KVbIAAAATI"]
[Sat Jul 18 23:49:36.626362 2026] [security2:error] [pid 953994:tid 954164] [client 163.61.1.17:59610] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlcOyJE89wAff52KVbIAAAATI"]
[Sat Jul 18 23:49:36.854571 2026] [security2:error] [pid 953994:tid 954227] [client 45.133.7.62:53187] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "alxlcOyJE89wAff52KVbMwAAAXE"]
[Sat Jul 18 23:49:36.936055 2026] [security2:error] [pid 953994:tid 954141] [client 45.134.20.130:33539] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 130.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "alxlcOyJE89wAff52KVbNgAAARs"]
[Sat Jul 18 23:49:37.311469 2026] [security2:error] [pid 953994:tid 954210] [client 62.210.111.125:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jenfarley.com"] [uri "/index.php"] [unique_id "alxlcOyJE89wAff52KVbLAAAAWA"], referer: https://store.independenceaustralia.com
[Sat Jul 18 23:49:37.536148 2026] [security2:error] [pid 953994:tid 954250] [client 45.133.7.65:40811] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 65.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/ws.php"] [unique_id "alxlceyJE89wAff52KVbXgAAAYg"]
[Sat Jul 18 23:49:37.790634 2026] [security2:error] [pid 953994:tid 954196] [client 45.134.20.127:22971] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 127.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/mar.php"] [unique_id "alxlceyJE89wAff52KVbcgAAAVI"]
[Sat Jul 18 23:49:37.910594 2026] [security2:error] [pid 953994:tid 954208] [client 180.252.198.240:60593] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlceyJE89wAff52KVbewAAAV4"]
[Sat Jul 18 23:49:37.911046 2026] [security2:error] [pid 953994:tid 954208] [client 180.252.198.240:60593] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlceyJE89wAff52KVbewAAAV4"]
[Sat Jul 18 23:49:38.007521 2026] [security2:error] [pid 953994:tid 954161] [client 138.252.89.100:52749] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlcuyJE89wAff52KVbgwAAAS8"]
[Sat Jul 18 23:49:38.007613 2026] [security2:error] [pid 953994:tid 954161] [client 138.252.89.100:52749] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlcuyJE89wAff52KVbgwAAAS8"]
[Sat Jul 18 23:49:38.215321 2026] [security2:error] [pid 953994:tid 954178] [client 45.133.7.90:51885] ModSecurity: Warning. Pattern match "/1\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1543"] [id "900921"] [msg "temporary TUW-72162 logging rule"] [hostname "nikkidesigns.net"] [uri "/wp-includes/rest-api/1.php"] [unique_id "alxlcuyJE89wAff52KVblAAAAUA"]
[Sat Jul 18 23:49:38.215435 2026] [security2:error] [pid 953994:tid 954178] [client 45.133.7.90:51885] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 90.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/rest-api/1.php"] [unique_id "alxlcuyJE89wAff52KVblAAAAUA"]
[Sat Jul 18 23:49:38.540087 2026] [security2:error] [pid 953994:tid 954201] [client 57.141.18.78:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxlcuyJE89wAff52KVbnwAAAVc"]
[Sat Jul 18 23:49:38.646872 2026] [security2:error] [pid 953994:tid 954234] [client 45.134.20.112:53083] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 112.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "alxlcuyJE89wAff52KVbsQAAAXg"]
[Sat Jul 18 23:49:38.736917 2026] [security2:error] [pid 953994:tid 954176] [client 62.210.111.125:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jenfarley.com"] [uri "/index.php"] [unique_id "alxlcuyJE89wAff52KVbkgAAAT4"], referer: https://store.independenceaustralia.com
[Sat Jul 18 23:49:38.896262 2026] [security2:error] [pid 953994:tid 954161] [client 45.133.7.69:52979] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 69.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "alxlcuyJE89wAff52KVbxAAAAS8"]
[Sat Jul 18 23:49:39.502744 2026] [security2:error] [pid 953994:tid 954220] [client 45.134.20.108:28563] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "alxlc-yJE89wAff52KVb7wAAAWo"]
[Sat Jul 18 23:49:39.575563 2026] [security2:error] [pid 953994:tid 954189] [client 45.133.7.104:27699] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/shop.php"] [unique_id "alxlc-yJE89wAff52KVb9QAAAUs"]
[Sat Jul 18 23:49:40.018408 2026] [security2:error] [pid 953994:tid 954217] [client 139.167.225.146:51176] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxldOyJE89wAff52KVcEAAAAWc"]
[Sat Jul 18 23:49:40.018568 2026] [security2:error] [pid 953994:tid 954217] [client 139.167.225.146:51176] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxldOyJE89wAff52KVcEAAAAWc"]
[Sat Jul 18 23:49:40.256205 2026] [security2:error] [pid 953994:tid 954226] [client 45.133.7.85:36145] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 85.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/pwnd-1/dedi1.php"] [unique_id "alxldOyJE89wAff52KVcIAAAAXA"]
[Sat Jul 18 23:49:40.379190 2026] [security2:error] [pid 953994:tid 954149] [client 45.134.20.123:21797] ModSecurity: Warning. Pattern match "/1\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1543"] [id "900921"] [msg "temporary TUW-72162 logging rule"] [hostname "swafforddetailing.com"] [uri "/1.php"] [unique_id "alxldOyJE89wAff52KVcJQAAASM"]
[Sat Jul 18 23:49:40.379297 2026] [security2:error] [pid 953994:tid 954149] [client 45.134.20.123:21797] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 123.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/1.php"] [unique_id "alxldOyJE89wAff52KVcJQAAASM"]
[Sat Jul 18 23:49:40.677325 2026] [security2:error] [pid 953994:tid 954244] [client 94.132.228.187:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxldOyJE89wAff52KVcHwABgkM"]
[Sat Jul 18 23:49:40.934681 2026] [security2:error] [pid 953994:tid 954169] [client 45.133.7.88:59151] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 88.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/js/widgets/setting.php"] [unique_id "alxldOyJE89wAff52KVcRAAAATc"]
[Sat Jul 18 23:49:41.255849 2026] [security2:error] [pid 953994:tid 954150] [client 45.134.20.127:24241] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 127.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "alxldeyJE89wAff52KVcXgAAASQ"]
[Sat Jul 18 23:49:41.612680 2026] [security2:error] [pid 953994:tid 954243] [client 45.133.7.101:51537] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 101.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "alxldeyJE89wAff52KVcegAAAYE"]
[Sat Jul 18 23:49:42.114988 2026] [security2:error] [pid 953994:tid 954151] [client 45.134.20.129:62283] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "alxlduyJE89wAff52KVcmAAAASU"]
[Sat Jul 18 23:49:42.291466 2026] [security2:error] [pid 953994:tid 954230] [client 45.133.7.78:54939] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 78.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/light/as.php"] [unique_id "alxlduyJE89wAff52KVcnwAAAXQ"]
[Sat Jul 18 23:49:42.970215 2026] [security2:error] [pid 953994:tid 954189] [client 45.134.20.112:43519] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 112.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/js/fm.php"] [unique_id "alxlduyJE89wAff52KVcwgAAAUs"]
[Sat Jul 18 23:49:42.973801 2026] [security2:error] [pid 953994:tid 954200] [client 45.133.7.89:42989] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 89.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/user/header.php"] [unique_id "alxlduyJE89wAff52KVcxAAAAVY"]
[Sat Jul 18 23:49:43.636055 2026] [security2:error] [pid 953994:tid 954051] [remote 31.42.184.154:47542] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxld-yJE89wAff52KVc8wABWDg"]
[Sat Jul 18 23:49:43.653618 2026] [security2:error] [pid 953994:tid 954186] [client 45.133.7.58:63113] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/IXR/about.php"] [unique_id "alxld-yJE89wAff52KVc9QAAAUg"]
[Sat Jul 18 23:49:43.801732 2026] [security2:error] [pid 953994:tid 954049] [remote 157.66.26.183:43832] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 183.26.66.157.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "blaizeaccountingservices.com"] [uri "/wp-login.php"] [unique_id "alxld-yJE89wAff52KVc-wABJjY"]
[Sat Jul 18 23:49:43.829108 2026] [security2:error] [pid 953994:tid 954144] [client 45.134.20.134:33505] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 134.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/images/index.php"] [unique_id "alxld-yJE89wAff52KVc_wAAAR4"]
[Sat Jul 18 23:49:44.192820 2026] [security2:error] [pid 953994:tid 954067] [remote 157.66.26.183:43832] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 183.26.66.157.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "blaizeaccountingservices.com"] [uri "/wp-login.php"] [unique_id "alxleOyJE89wAff52KVdGwABKEg"], referer: https://blaizeaccountingservices.com/wp-login.php
[Sat Jul 18 23:49:44.306711 2026] [ssl:error] [pid 953994:tid 954204] [client 3.233.59.216:58633] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname cpanel.poopscoopuniversity.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:49:44.333841 2026] [security2:error] [pid 953994:tid 954147] [client 45.133.7.61:60877] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-api.php"] [unique_id "alxleOyJE89wAff52KVdIgAAASE"]
[Sat Jul 18 23:49:44.446164 2026] [security2:error] [pid 953994:tid 954188] [client 190.92.174.183:38790] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 183.174.92.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "webmail.topspot.com.pk"] [uri "/xmlrpc.php"] [unique_id "alxleOyJE89wAff52KVdJgAAAUo"]
[Sat Jul 18 23:49:44.446252 2026] [security2:error] [pid 953994:tid 954188] [client 190.92.174.183:38790] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "webmail.topspot.com.pk"] [uri "/xmlrpc.php"] [unique_id "alxleOyJE89wAff52KVdJgAAAUo"]
[Sat Jul 18 23:49:44.609948 2026] [security2:error] [pid 953994:tid 954081] [remote 31.42.184.154:47542] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxleOyJE89wAff52KVdLgABb1Y"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:49:44.623188 2026] [security2:error] [pid 953994:tid 954070] [remote 91.92.241.196:0] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "innovativecleaningsvs.com"] [uri "/.env"] [unique_id "alxleOyJE89wAff52KVdLwABO0s"]
[Sat Jul 18 23:49:44.693850 2026] [security2:error] [pid 953994:tid 954229] [client 45.134.20.127:28207] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 127.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "alxleOyJE89wAff52KVdOgAAAXM"]
[Sat Jul 18 23:49:44.980413 2026] [security2:error] [pid 953994:tid 954194] [client 190.92.174.183:38802] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 183.174.92.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "webmail.topspot.com.pk"] [uri "/xmlrpc.php"] [unique_id "alxleOyJE89wAff52KVdTwAAAVA"]
[Sat Jul 18 23:49:44.980512 2026] [security2:error] [pid 953994:tid 954194] [client 190.92.174.183:38802] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "webmail.topspot.com.pk"] [uri "/xmlrpc.php"] [unique_id "alxleOyJE89wAff52KVdTwAAAVA"]
[Sat Jul 18 23:49:45.013622 2026] [security2:error] [pid 953994:tid 954195] [client 45.133.7.66:55317] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 66.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/install.php"] [unique_id "alxleeyJE89wAff52KVdVAAAAVE"]
[Sat Jul 18 23:49:45.120846 2026] [security2:error] [pid 953994:tid 954074] [remote 31.42.184.154:47546] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxleeyJE89wAff52KVdWQABUk8"]
[Sat Jul 18 23:49:45.120975 2026] [security2:error] [pid 953994:tid 954196] [client 31.42.184.154:47546] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxleeyJE89wAff52KVdWQABUk8"]
[Sat Jul 18 23:49:45.354365 2026] [security2:error] [pid 953994:tid 954150] [client 91.92.241.196:0] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "innovativecleaningsvs.com"] [uri "/.env"] [unique_id "alxleeyJE89wAff52KVdZwAAASQ"]
[Sat Jul 18 23:49:45.462677 2026] [security2:error] [pid 953994:tid 954125] [client 36.83.95.75:49583] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxleeyJE89wAff52KVdbQAAAQs"]
[Sat Jul 18 23:49:45.462815 2026] [security2:error] [pid 953994:tid 954125] [client 36.83.95.75:49583] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxleeyJE89wAff52KVdbQAAAQs"]
[Sat Jul 18 23:49:45.556721 2026] [security2:error] [pid 953994:tid 954131] [client 45.134.20.130:25789] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 130.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/file.php"] [unique_id "alxleeyJE89wAff52KVddwAAARE"]
[Sat Jul 18 23:49:45.704260 2026] [security2:error] [pid 953994:tid 954130] [client 45.133.7.100:25735] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/css.php"] [unique_id "alxleeyJE89wAff52KVdhwAAARA"]
[Sat Jul 18 23:49:45.956174 2026] [security2:error] [pid 953994:tid 954233] [client 190.92.174.183:38818] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 183.174.92.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "webmail.topspot.com.pk"] [uri "/blog/xmlrpc.php"] [unique_id "alxleeyJE89wAff52KVdkgAAAXc"]
[Sat Jul 18 23:49:45.956264 2026] [security2:error] [pid 953994:tid 954233] [client 190.92.174.183:38818] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "webmail.topspot.com.pk"] [uri "/blog/xmlrpc.php"] [unique_id "alxleeyJE89wAff52KVdkgAAAXc"]
[Sat Jul 18 23:49:46.399145 2026] [security2:error] [pid 953994:tid 954171] [client 45.133.7.97:45539] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 97.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/db.php"] [unique_id "alxleuyJE89wAff52KVdrQAAATk"]
[Sat Jul 18 23:49:46.417303 2026] [security2:error] [pid 953994:tid 954231] [client 45.134.20.110:61675] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "alxleuyJE89wAff52KVdrwAAAXU"]
[Sat Jul 18 23:49:46.433302 2026] [security2:error] [pid 953994:tid 954175] [client 190.92.174.183:38820] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 183.174.92.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "webmail.topspot.com.pk"] [uri "/wp/xmlrpc.php"] [unique_id "alxleuyJE89wAff52KVdsAAAAT0"]
[Sat Jul 18 23:49:46.433377 2026] [security2:error] [pid 953994:tid 954175] [client 190.92.174.183:38820] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "webmail.topspot.com.pk"] [uri "/wp/xmlrpc.php"] [unique_id "alxleuyJE89wAff52KVdsAAAAT0"]
[Sat Jul 18 23:49:46.973418 2026] [security2:error] [pid 953994:tid 954153] [client 190.92.174.183:38836] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 183.174.92.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "webmail.topspot.com.pk"] [uri "/wordpress/xmlrpc.php"] [unique_id "alxleuyJE89wAff52KVd1gAAASc"]
[Sat Jul 18 23:49:46.973511 2026] [security2:error] [pid 953994:tid 954153] [client 190.92.174.183:38836] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "webmail.topspot.com.pk"] [uri "/wordpress/xmlrpc.php"] [unique_id "alxleuyJE89wAff52KVd1gAAASc"]
[Sat Jul 18 23:49:46.976115 2026] [security2:error] [pid 953994:tid 954147] [client 103.160.26.178:53320] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxleuyJE89wAff52KVd2AAAASE"]
[Sat Jul 18 23:49:46.976209 2026] [security2:error] [pid 953994:tid 954147] [client 103.160.26.178:53320] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxleuyJE89wAff52KVd2AAAASE"]
[Sat Jul 18 23:49:47.058970 2026] [security2:error] [pid 953994:tid 954145] [client 163.61.1.17:60266] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxle-yJE89wAff52KVd3gAAAR8"]
[Sat Jul 18 23:49:47.060872 2026] [security2:error] [pid 953994:tid 954145] [client 163.61.1.17:60266] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxle-yJE89wAff52KVd3gAAAR8"]
[Sat Jul 18 23:49:47.089079 2026] [security2:error] [pid 953994:tid 954177] [client 45.133.7.101:46955] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 101.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "alxle-yJE89wAff52KVd3wAAAT8"]
[Sat Jul 18 23:49:47.274673 2026] [security2:error] [pid 953994:tid 954188] [client 45.134.20.115:35393] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/fm.php"] [unique_id "alxle-yJE89wAff52KVd6wAAAUo"]
[Sat Jul 18 23:49:47.456868 2026] [security2:error] [pid 953994:tid 954142] [client 190.92.174.183:38850] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 183.174.92.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "webmail.topspot.com.pk"] [uri "/news/xmlrpc.php"] [unique_id "alxle-yJE89wAff52KVd_wAAARw"]
[Sat Jul 18 23:49:47.457005 2026] [security2:error] [pid 953994:tid 954142] [client 190.92.174.183:38850] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "webmail.topspot.com.pk"] [uri "/news/xmlrpc.php"] [unique_id "alxle-yJE89wAff52KVd_wAAARw"]
[Sat Jul 18 23:49:47.597681 2026] [security2:error] [pid 953994:tid 954209] [client 91.92.241.196:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "innovativecleaningsvs.com"] [uri "/index.php"] [unique_id "alxleeyJE89wAff52KVdjQABXw4"]
[Sat Jul 18 23:49:47.771003 2026] [security2:error] [pid 953994:tid 954162] [client 45.133.7.99:35995] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/bypass.php"] [unique_id "alxle-yJE89wAff52KVeEgAAATA"]
[Sat Jul 18 23:49:47.934203 2026] [security2:error] [pid 953994:tid 954239] [client 190.92.174.183:38860] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 183.174.92.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "webmail.topspot.com.pk"] [uri "/main/xmlrpc.php"] [unique_id "alxle-yJE89wAff52KVeHQAAAX0"]
[Sat Jul 18 23:49:47.934291 2026] [security2:error] [pid 953994:tid 954239] [client 190.92.174.183:38860] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "webmail.topspot.com.pk"] [uri "/main/xmlrpc.php"] [unique_id "alxle-yJE89wAff52KVeHQAAAX0"]
[Sat Jul 18 23:49:48.129991 2026] [security2:error] [pid 953994:tid 954137] [client 45.134.20.120:29817] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 120.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/js/widgets/cloud.php"] [unique_id "alxlfOyJE89wAff52KVeKwAAARc"]
[Sat Jul 18 23:49:48.187311 2026] [security2:error] [pid 953994:tid 954216] [client 91.92.241.196:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "innovativecleaningsvs.com"] [uri "/index.php"] [unique_id "alxlfOyJE89wAff52KVeIwAAAWY"]
[Sat Jul 18 23:49:48.233479 2026] [security2:error] [pid 953994:tid 954236] [client 57.141.18.67:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxlfOyJE89wAff52KVeJQAAAXo"]
[Sat Jul 18 23:49:48.406667 2026] [security2:error] [pid 953994:tid 954249] [client 190.92.174.183:38866] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 183.174.92.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "webmail.topspot.com.pk"] [uri "/wp-site/xmlrpc.php"] [unique_id "alxlfOyJE89wAff52KVePQAAAYc"]
[Sat Jul 18 23:49:48.406778 2026] [security2:error] [pid 953994:tid 954249] [client 190.92.174.183:38866] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "webmail.topspot.com.pk"] [uri "/wp-site/xmlrpc.php"] [unique_id "alxlfOyJE89wAff52KVePQAAAYc"]
[Sat Jul 18 23:49:48.454313 2026] [security2:error] [pid 953994:tid 954165] [client 45.133.7.72:20287] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 72.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/images/fm.php7"] [unique_id "alxlfOyJE89wAff52KVePgAAATM"]
[Sat Jul 18 23:49:48.633282 2026] [security2:error] [pid 953994:tid 954031] [remote 91.92.241.196:0] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "innovativecleaningsvs.com"] [uri "/api/.env"] [unique_id "alxlfOyJE89wAff52KVeSgABTSQ"]
[Sat Jul 18 23:49:48.703544 2026] [security2:error] [pid 953994:tid 954012] [remote 49.13.1.223:34298] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.1.13.49.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxlfOyJE89wAff52KVeTgABchE"]
[Sat Jul 18 23:49:48.791656 2026] [security2:error] [pid 953994:tid 954149] [client 180.252.198.240:61077] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlfOyJE89wAff52KVeWQAAASM"]
[Sat Jul 18 23:49:48.791796 2026] [security2:error] [pid 953994:tid 954149] [client 180.252.198.240:61077] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlfOyJE89wAff52KVeWQAAASM"]
[Sat Jul 18 23:49:48.808940 2026] [security2:error] [pid 953994:tid 954087] [remote 68.183.22.192:39404] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 192.22.183.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxlfOyJE89wAff52KVeWgABQVw"]
[Sat Jul 18 23:49:48.880258 2026] [security2:error] [pid 953994:tid 954236] [client 190.92.174.183:38878] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 183.174.92.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "webmail.topspot.com.pk"] [uri "/old/xmlrpc.php"] [unique_id "alxlfOyJE89wAff52KVeYgAAAXo"]
[Sat Jul 18 23:49:48.880344 2026] [security2:error] [pid 953994:tid 954236] [client 190.92.174.183:38878] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "webmail.topspot.com.pk"] [uri "/old/xmlrpc.php"] [unique_id "alxlfOyJE89wAff52KVeYgAAAXo"]
[Sat Jul 18 23:49:48.888892 2026] [security2:error] [pid 953994:tid 954036] [remote 49.13.1.223:34298] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.1.13.49.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxlfOyJE89wAff52KVeZAABYSk"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:49:48.988552 2026] [security2:error] [pid 953994:tid 954249] [client 45.134.20.130:52137] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 130.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/adminfuns.php7"] [unique_id "alxlfOyJE89wAff52KVeaQAAAYc"]
[Sat Jul 18 23:49:48.995848 2026] [security2:error] [pid 953994:tid 954081] [remote 68.183.22.192:39404] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 192.22.183.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxlfOyJE89wAff52KVeaAABIVY"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:49:49.066246 2026] [security2:error] [pid 953994:tid 954177] [client 91.92.241.196:0] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "innovativecleaningsvs.com"] [uri "/api/.env"] [unique_id "alxlfeyJE89wAff52KVebAAAAT8"]
[Sat Jul 18 23:49:49.137978 2026] [security2:error] [pid 953994:tid 954124] [client 45.133.7.56:22235] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 56.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/count.php"] [unique_id "alxlfeyJE89wAff52KVecwAAAQo"]
[Sat Jul 18 23:49:49.361917 2026] [security2:error] [pid 953994:tid 954149] [client 190.92.174.183:38880] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 183.174.92.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "webmail.topspot.com.pk"] [uri "/new/xmlrpc.php"] [unique_id "alxlfeyJE89wAff52KVehQAAASM"]
[Sat Jul 18 23:49:49.362024 2026] [security2:error] [pid 953994:tid 954149] [client 190.92.174.183:38880] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "webmail.topspot.com.pk"] [uri "/new/xmlrpc.php"] [unique_id "alxlfeyJE89wAff52KVehQAAASM"]
[Sat Jul 18 23:49:49.585828 2026] [security2:error] [pid 953994:tid 954183] [client 138.252.89.100:53259] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlfeyJE89wAff52KVekgAAAUU"]
[Sat Jul 18 23:49:49.585927 2026] [security2:error] [pid 953994:tid 954183] [client 138.252.89.100:53259] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlfeyJE89wAff52KVekgAAAUU"]
[Sat Jul 18 23:49:49.682086 2026] [security2:error] [pid 953994:tid 954230] [client 91.92.241.196:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "innovativecleaningsvs.com"] [uri "/index.php"] [unique_id "alxlfeyJE89wAff52KVekQABdGY"]
[Sat Jul 18 23:49:49.822072 2026] [security2:error] [pid 953994:tid 954171] [client 45.133.7.76:23431] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 76.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-error_log.php"] [unique_id "alxlfeyJE89wAff52KVeogAAATk"]
[Sat Jul 18 23:49:49.841404 2026] [security2:error] [pid 953994:tid 954218] [client 45.134.20.120:29835] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 120.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/images/about.php"] [unique_id "alxlfeyJE89wAff52KVepQAAAWg"]
[Sat Jul 18 23:49:50.233089 2026] [security2:error] [pid 953994:tid 954150] [client 91.92.241.196:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "innovativecleaningsvs.com"] [uri "/index.php"] [unique_id "alxlfuyJE89wAff52KVetwAAASQ"]
[Sat Jul 18 23:49:50.326069 2026] [security2:error] [pid 953994:tid 954167] [client 190.92.174.183:38910] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 183.174.92.190.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "webmail.topspot.com.pk"] [uri "/wp-login.php"] [unique_id "alxlfuyJE89wAff52KVeyAAAATU"]
[Sat Jul 18 23:49:50.502047 2026] [security2:error] [pid 953994:tid 954165] [client 45.133.7.79:35583] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 79.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/assets/class_update_plugins.php"] [unique_id "alxlfuyJE89wAff52KVe1QAAATM"]
[Sat Jul 18 23:49:50.505387 2026] [security2:error] [pid 953994:tid 954158] [client 57.141.18.104:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxlfuyJE89wAff52KVexwAAASw"]
[Sat Jul 18 23:49:50.587803 2026] [security2:error] [pid 953994:tid 954156] [client 23.160.60.149:27133] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.keywayconstructionclt.com"] [uri "/index.php"] [unique_id "alxlfuyJE89wAff52KVe0gAAASo"]
[Sat Jul 18 23:49:50.696963 2026] [security2:error] [pid 953994:tid 954228] [client 45.134.20.134:44853] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 134.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/ini.php"] [unique_id "alxlfuyJE89wAff52KVe3QAAAXI"]
[Sat Jul 18 23:49:50.957476 2026] [security2:error] [pid 953994:tid 954150] [client 216.244.66.200:35032] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "allergyantidotes.com"] [uri "/robots.txt"] [unique_id "alxlfuyJE89wAff52KVe-AAAASQ"]
[Sat Jul 18 23:49:50.957584 2026] [security2:error] [pid 953994:tid 954150] [client 216.244.66.200:35032] ModSecurity: Warning. Matched phrase "Dotbot" at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "allergyantidotes.com"] [uri "/robots.txt"] [unique_id "alxlfuyJE89wAff52KVe-AAAASQ"]
[Sat Jul 18 23:49:50.982444 2026] [security2:error] [pid 953994:tid 954193] [client 216.244.66.200:35046] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.allergyantidotes.com"] [uri "/robots.txt"] [unique_id "alxlfuyJE89wAff52KVe_QAAAU8"]
[Sat Jul 18 23:49:50.982533 2026] [security2:error] [pid 953994:tid 954193] [client 216.244.66.200:35046] ModSecurity: Warning. Matched phrase "Dotbot" at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "www.allergyantidotes.com"] [uri "/robots.txt"] [unique_id "alxlfuyJE89wAff52KVe_QAAAU8"]
[Sat Jul 18 23:49:51.196091 2026] [security2:error] [pid 953994:tid 954247] [client 45.133.7.88:24741] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 88.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/network/av.php"] [unique_id "alxlf-yJE89wAff52KVfDgAAAYU"]
[Sat Jul 18 23:49:51.553218 2026] [security2:error] [pid 953994:tid 954205] [client 45.134.20.120:37175] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 120.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/coffee/cloud.php"] [unique_id "alxlf-yJE89wAff52KVfMgAAAVs"]
[Sat Jul 18 23:49:51.575002 2026] [security2:error] [pid 953994:tid 954139] [client 116.196.113.68:59772] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 68.113.196.116.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "recruitinginsight.us"] [uri "/xmlrpc.php"] [unique_id "alxlf-yJE89wAff52KVfLgAAARk"], referer: https://recruitinginsight.us/author/admin_ben/page/3/?et_blog
[Sat Jul 18 23:49:51.575102 2026] [security2:error] [pid 953994:tid 954139] [client 116.196.113.68:59772] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "recruitinginsight.us"] [uri "/xmlrpc.php"] [unique_id "alxlf-yJE89wAff52KVfLgAAARk"], referer: https://recruitinginsight.us/author/admin_ben/page/3/?et_blog
[Sat Jul 18 23:49:51.589120 2026] [security2:error] [pid 953994:tid 954117] [remote 31.42.184.154:37798] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "emsbodystorm.com"] [uri "/wp-login.php"] [unique_id "alxlf-yJE89wAff52KVfNgABP3o"]
[Sat Jul 18 23:49:51.880455 2026] [security2:error] [pid 953994:tid 954239] [client 45.133.7.95:44923] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/templates/beez5/error.php"] [unique_id "alxlf-yJE89wAff52KVfQwAAAX0"]
[Sat Jul 18 23:49:52.265725 2026] [security2:error] [pid 953994:tid 954250] [client 5.102.173.71:34784] ModSecurity: Warning. Matched phrase "Mojeek" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "www.maxenengineering.com"] [uri "/robots.txt"] [unique_id "alxlgOyJE89wAff52KVfXgAAAYg"]
[Sat Jul 18 23:49:52.406794 2026] [security2:error] [pid 953994:tid 954158] [client 45.134.20.126:58355] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 126.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "alxlgOyJE89wAff52KVfaQAAASw"]
[Sat Jul 18 23:49:52.460973 2026] [security2:error] [pid 953994:tid 954152] [client 13.232.206.133:21720] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.206.232.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxlgOyJE89wAff52KVfcAAAASY"]
[Sat Jul 18 23:49:52.461048 2026] [security2:error] [pid 953994:tid 954152] [client 13.232.206.133:21720] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxlgOyJE89wAff52KVfcAAAASY"]
[Sat Jul 18 23:49:52.566302 2026] [security2:error] [pid 953994:tid 954237] [client 45.133.7.67:42007] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/network/admin-footer.php"] [unique_id "alxlgOyJE89wAff52KVfegAAAXs"]
[Sat Jul 18 23:49:52.798114 2026] [security2:error] [pid 953994:tid 954057] [remote 31.42.184.154:37798] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "emsbodystorm.com"] [uri "/wp-login.php"] [unique_id "alxlgOyJE89wAff52KVfkQABIT4"], referer: https://emsbodystorm.com/wp-login.php
[Sat Jul 18 23:49:53.181779 2026] [security2:error] [pid 953994:tid 954127] [client 107.189.14.87:59776] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 87.14.189.107.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.yourenotadummywahealthguideforcaraccidentvictims.com"] [uri "/wp-login.php"] [unique_id "alxlgeyJE89wAff52KVfpQAAAQ0"]
[Sat Jul 18 23:49:53.248828 2026] [security2:error] [pid 953994:tid 954228] [client 45.133.7.66:63613] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 66.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/js/firewall.php7"] [unique_id "alxlgeyJE89wAff52KVfpwAAAXI"]
[Sat Jul 18 23:49:53.277515 2026] [security2:error] [pid 953994:tid 954130] [client 45.134.20.109:41365] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 109.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "alxlgeyJE89wAff52KVfqQAAARA"]
[Sat Jul 18 23:49:53.643666 2026] [security2:error] [pid 953994:tid 954120] [remote 91.142.222.105:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "benbayly.co.nz"] [uri "/wp-login.php"] [unique_id "alxlgeyJE89wAff52KVfwwABQH0"]
[Sat Jul 18 23:49:53.942296 2026] [security2:error] [pid 953994:tid 954197] [client 45.133.7.81:55929] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 81.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "alxlgeyJE89wAff52KVf1wAAAVM"]
[Sat Jul 18 23:49:54.070842 2026] [security2:error] [pid 953994:tid 954149] [client 62.150.67.110:13193] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "ali-alghanim.net"] [uri "/index.php"] [unique_id "alxlgeyJE89wAff52KVfzwAAASM"]
[Sat Jul 18 23:49:54.137153 2026] [security2:error] [pid 953994:tid 954229] [client 45.134.20.132:28175] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/acme-challenge/atomlib.php"] [unique_id "alxlguyJE89wAff52KVf6QAAAXM"]
[Sat Jul 18 23:49:54.246728 2026] [security2:error] [pid 953994:tid 954222] [client 5.102.173.71:0] ModSecurity: Warning. Matched phrase "Mojeek" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "www.maxenengineering.com"] [uri "/maxenengineering/index.php"] [unique_id "alxlgOyJE89wAff52KVfbQAAAWw"]
[Sat Jul 18 23:49:54.261854 2026] [security2:error] [pid 953994:tid 954208] [client 5.102.173.71:34784] ModSecurity: Warning. Matched phrase "Mojeek" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "www.maxenengineering.com"] [uri "/product-tag/concrete-vibrator-pakistan/"] [unique_id "alxlgOyJE89wAff52KVfawAAAV4"]
[Sat Jul 18 23:49:54.630633 2026] [security2:error] [pid 953994:tid 954205] [client 45.133.7.74:31293] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/assets/about.php"] [unique_id "alxlguyJE89wAff52KVgBgAAAVs"]
[Sat Jul 18 23:49:54.923391 2026] [security2:error] [pid 953994:tid 954072] [remote 91.142.222.105:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "benbayly.co.nz"] [uri "/wp-login.php"] [unique_id "alxlguyJE89wAff52KVgFgABT00"], referer: https://benbayly.co.nz/wp-login.php
[Sat Jul 18 23:49:55.004126 2026] [security2:error] [pid 953994:tid 954138] [client 45.134.20.121:41103] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 121.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/js/instaall.php"] [unique_id "alxlg-yJE89wAff52KVgHAAAARg"]
[Sat Jul 18 23:49:55.309529 2026] [security2:error] [pid 953994:tid 954205] [client 45.133.7.91:26927] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 91.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/js/file/incpb.php"] [unique_id "alxlg-yJE89wAff52KVgNwAAAVs"]
[Sat Jul 18 23:49:55.417899 2026] [security2:error] [pid 953994:tid 953996] [remote 113.160.142.119:33430] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "suretybonds-california.com"] [uri "/wp-login.php"] [unique_id "alxlg-yJE89wAff52KVgOgABYQE"]
[Sat Jul 18 23:49:55.864719 2026] [security2:error] [pid 953994:tid 954149] [client 45.134.20.130:41335] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 130.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/function.php"] [unique_id "alxlg-yJE89wAff52KVgTwAAASM"]
[Sat Jul 18 23:49:55.912708 2026] [security2:error] [pid 953994:tid 954005] [remote 113.160.142.119:33430] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "suretybonds-california.com"] [uri "/wp-login.php"] [unique_id "alxlg-yJE89wAff52KVgUQABFgo"], referer: https://suretybonds-california.com/wp-login.php
[Sat Jul 18 23:49:55.994167 2026] [security2:error] [pid 953994:tid 954186] [client 45.133.7.65:42141] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 65.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/images/stories/themes.php"] [unique_id "alxlg-yJE89wAff52KVgWAAAAUg"]
[Sat Jul 18 23:49:56.012877 2026] [security2:error] [pid 953994:tid 954183] [client 74.7.244.47:47114] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "drawingthedog.com"] [uri "/robots.txt"] [unique_id "alxlhOyJE89wAff52KVgXAAAAUU"]
[Sat Jul 18 23:49:56.309149 2026] [security2:error] [pid 953994:tid 954125] [client 36.83.95.75:50078] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlhOyJE89wAff52KVgcQAAAQs"]
[Sat Jul 18 23:49:56.309278 2026] [security2:error] [pid 953994:tid 954125] [client 36.83.95.75:50078] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlhOyJE89wAff52KVgcQAAAQs"]
[Sat Jul 18 23:49:56.342145 2026] [security2:error] [pid 953994:tid 954175] [client 82.156.203.197:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxlhOyJE89wAff52KVgZgABPXc"], referer: https://www.aleishapenny.ca/listing/page/1233?paged=1&view=grid&posts_per_page=12
[Sat Jul 18 23:49:56.386697 2026] [security2:error] [pid 953994:tid 954151] [client 74.7.244.47:0] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "drawingthedog.com"] [uri "/index.php"] [unique_id "alxlhOyJE89wAff52KVgaQAAASU"], referer: http://drawingthedog.com/robots.txt
[Sat Jul 18 23:49:56.386736 2026] [security2:error] [pid 953994:tid 954151] [client 74.7.244.47:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "drawingthedog.com"] [uri "/index.php"] [unique_id "alxlhOyJE89wAff52KVgaQAAASU"], referer: http://drawingthedog.com/robots.txt
[Sat Jul 18 23:49:56.392124 2026] [security2:error] [pid 953994:tid 954232] [client 74.7.244.47:55934] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "drawingthedog.com"] [uri "/robots.txt"] [unique_id "alxlhOyJE89wAff52KVgZAABdgg"], referer: http://drawingthedog.com/robots.txt
[Sat Jul 18 23:49:56.445078 2026] [security2:error] [pid 953994:tid 954128] [client 18.212.127.231:59292] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 231.127.212.18.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxlhOyJE89wAff52KVgeAAAAQ4"], referer: https://curlsnpearlsss.com/es/arroz-con-pollo-puerto-rican-chicken-and-rice/
[Sat Jul 18 23:49:56.676944 2026] [security2:error] [pid 953994:tid 954127] [client 45.133.7.98:43749] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 98.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "alxlhOyJE89wAff52KVgiwAAAQ0"]
[Sat Jul 18 23:49:56.720054 2026] [security2:error] [pid 953994:tid 954146] [client 45.134.20.129:64237] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/plugins.php"] [unique_id "alxlhOyJE89wAff52KVgkgAAASA"]
[Sat Jul 18 23:49:56.757243 2026] [security2:error] [pid 953994:tid 954236] [client 74.7.244.47:0] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxlhOyJE89wAff52KVggQAAAXo"], referer: https://drawingthedog.com/robots.txt
[Sat Jul 18 23:49:56.759000 2026] [security2:error] [pid 953994:tid 954179] [client 74.7.244.47:55946] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "www.drawingthedog.com"] [uri "/robots.txt"] [unique_id "alxlhOyJE89wAff52KVgfgABQR4"], referer: https://drawingthedog.com/robots.txt
[Sat Jul 18 23:49:57.359677 2026] [security2:error] [pid 953994:tid 954216] [client 45.133.7.63:22397] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/firewall.php7"] [unique_id "alxlheyJE89wAff52KVgwQAAAWY"]
[Sat Jul 18 23:49:57.396272 2026] [security2:error] [pid 953994:tid 954160] [client 181.232.231.190:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "liquidationteam.com"] [uri "/index.php"] [unique_id "alxlhOyJE89wAff52KVgnAAAAS4"]
[Sat Jul 18 23:49:57.571857 2026] [security2:error] [pid 953994:tid 954167] [client 103.160.26.178:53827] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlheyJE89wAff52KVg2QAAATU"]
[Sat Jul 18 23:49:57.571962 2026] [security2:error] [pid 953994:tid 954167] [client 103.160.26.178:53827] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlheyJE89wAff52KVg2QAAATU"]
[Sat Jul 18 23:49:57.582675 2026] [security2:error] [pid 953994:tid 954222] [client 45.134.20.133:31089] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/atomlib.php"] [unique_id "alxlheyJE89wAff52KVg3AAAAWw"]
[Sat Jul 18 23:49:57.585133 2026] [security2:error] [pid 953994:tid 954184] [client 163.61.1.17:60791] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlheyJE89wAff52KVg3QAAAUY"]
[Sat Jul 18 23:49:57.585244 2026] [security2:error] [pid 953994:tid 954184] [client 163.61.1.17:60791] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlheyJE89wAff52KVg3QAAAUY"]
[Sat Jul 18 23:49:57.842488 2026] [security2:error] [pid 953994:tid 954209] [client 50.116.65.227:24296] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxlheyJE89wAff52KVg7wAAAV8"]
[Sat Jul 18 23:49:57.859903 2026] [security2:error] [pid 953994:tid 954154] [client 50.116.65.227:31662] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Japan-Transport-Feature-Image.png"] [unique_id "alxlheyJE89wAff52KVg8QAAASg"]
[Sat Jul 18 23:49:58.040889 2026] [security2:error] [pid 953994:tid 954167] [client 45.133.7.62:26921] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/home/O-Simple.php"] [unique_id "alxlhuyJE89wAff52KVhAAAAATU"]
[Sat Jul 18 23:49:58.105877 2026] [security2:error] [pid 953994:tid 954188] [client 180.252.198.240:61543] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlhuyJE89wAff52KVhCAAAAUo"]
[Sat Jul 18 23:49:58.105974 2026] [security2:error] [pid 953994:tid 954188] [client 180.252.198.240:61543] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlhuyJE89wAff52KVhCAAAAUo"]
[Sat Jul 18 23:49:58.457808 2026] [security2:error] [pid 953994:tid 954135] [client 45.134.20.118:21675] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content.php"] [unique_id "alxlhuyJE89wAff52KVhKwAAARU"]
[Sat Jul 18 23:49:58.543256 2026] [security2:error] [pid 953994:tid 954145] [client 54.158.23.200:65304] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 200.23.158.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxlhuyJE89wAff52KVhNgAAAR8"], referer: https://curlsnpearlsss.com/es/arroz-con-pollo-puerto-rican-chicken-and-rice/
[Sat Jul 18 23:49:58.593415 2026] [security2:error] [pid 953994:tid 954104] [remote 41.186.86.12:20083] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxlhuyJE89wAff52KVhOwABUm0"]
[Sat Jul 18 23:49:58.593575 2026] [security2:error] [pid 953994:tid 954196] [client 41.186.86.12:20083] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxlhuyJE89wAff52KVhOwABUm0"]
[Sat Jul 18 23:49:58.724114 2026] [security2:error] [pid 953994:tid 954251] [client 45.133.7.81:46787] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 81.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "alxlhuyJE89wAff52KVhRwAAAYk"]
[Sat Jul 18 23:49:58.992426 2026] [core:error] [pid 953994:tid 954166] [client 185.247.137.163:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:49:58.992443 2026] [core:error] [pid 953994:tid 954166] [client 185.247.137.163:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:49:59.180739 2026] [security2:error] [pid 953994:tid 954222] [client 35.227.39.208:15386] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "schuttfarms.com"] [uri "/"] [unique_id "alxlh-yJE89wAff52KVhagAAAWw"]
[Sat Jul 18 23:49:59.312303 2026] [security2:error] [pid 953994:tid 954218] [client 45.134.20.107:37067] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 107.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/css/chosen.php"] [unique_id "alxlh-yJE89wAff52KVhcgAAAWg"]
[Sat Jul 18 23:49:59.405065 2026] [security2:error] [pid 953994:tid 954148] [client 45.133.7.102:35191] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 102.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/vars-soap.php"] [unique_id "alxlh-yJE89wAff52KVheQAAASI"]
[Sat Jul 18 23:50:00.091727 2026] [security2:error] [pid 953994:tid 954130] [client 45.133.7.95:38463] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/twentytwentytwo/av.php"] [unique_id "alxliOyJE89wAff52KVhqAAAARA"]
[Sat Jul 18 23:50:00.167100 2026] [security2:error] [pid 953994:tid 954216] [client 45.134.20.134:50327] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 134.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "alxliOyJE89wAff52KVhrQAAAWY"]
[Sat Jul 18 23:50:00.199233 2026] [security2:error] [pid 953994:tid 954220] [client 43.157.175.122:57650] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "lifeisbetterlakeside.com"] [uri "/index.php"] [unique_id "alxliOyJE89wAff52KVhoAAAAWo"]
[Sat Jul 18 23:50:00.820181 2026] [security2:error] [pid 953994:tid 954192] [client 45.133.7.55:25175] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 55.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/style.php%20"] [unique_id "alxliOyJE89wAff52KVh0wAAAU4"]
[Sat Jul 18 23:50:01.024473 2026] [security2:error] [pid 953994:tid 954128] [client 45.134.20.125:22749] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 125.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/network/index.php"] [unique_id "alxlieyJE89wAff52KVh5AAAAQ4"]
[Sat Jul 18 23:50:01.136675 2026] [security2:error] [pid 953994:tid 954185] [client 138.252.89.100:53773] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlieyJE89wAff52KVh7QAAAUc"]
[Sat Jul 18 23:50:01.136827 2026] [security2:error] [pid 953994:tid 954185] [client 138.252.89.100:53773] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlieyJE89wAff52KVh7QAAAUc"]
[Sat Jul 18 23:50:01.430470 2026] [security2:error] [pid 953994:tid 954197] [client 5.193.175.36:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "maxcom.net"] [uri "/index.php"] [unique_id "alxliOyJE89wAff52KVhpQAAAVM"]
[Sat Jul 18 23:50:01.567668 2026] [security2:error] [pid 953994:tid 954127] [client 45.133.7.54:21289] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/files.php"] [unique_id "alxlieyJE89wAff52KViBAAAAQ0"]
[Sat Jul 18 23:50:01.886223 2026] [security2:error] [pid 953994:tid 954149] [client 45.134.20.110:34501] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/light/about.php"] [unique_id "alxlieyJE89wAff52KViFwAAASM"]
[Sat Jul 18 23:50:02.253075 2026] [security2:error] [pid 953994:tid 954209] [client 45.133.7.86:25275] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 86.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/av.php"] [unique_id "alxliuyJE89wAff52KViLwAAAV8"]
[Sat Jul 18 23:50:02.410321 2026] [security2:error] [pid 953994:tid 954206] [client 74.7.227.179:54284] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxliuyJE89wAff52KViMAABXHI"], referer: https://tejasenvironmental.com/p=138161
[Sat Jul 18 23:50:02.746285 2026] [security2:error] [pid 953994:tid 954225] [client 45.134.20.118:36711] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/customize.php"] [unique_id "alxliuyJE89wAff52KViWAAAAW8"]
[Sat Jul 18 23:50:02.775133 2026] [security2:error] [pid 953994:tid 954106] [remote 31.42.184.154:42130] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxliuyJE89wAff52KViWQABKW8"]
[Sat Jul 18 23:50:02.775299 2026] [security2:error] [pid 953994:tid 954155] [client 31.42.184.154:42130] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxliuyJE89wAff52KViWQABKW8"]
[Sat Jul 18 23:50:02.936899 2026] [security2:error] [pid 953994:tid 954197] [client 45.133.7.88:22153] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 88.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/about.php"] [unique_id "alxliuyJE89wAff52KViXwAAAVM"]
[Sat Jul 18 23:50:02.963852 2026] [security2:error] [pid 953994:tid 954246] [client 114.119.128.126:53235] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "ancestralidadytrance.space"] [uri "/day-1/"] [unique_id "alxliuyJE89wAff52KViYgAAAYQ"], referer: https://cayote.openmtx.com/KiraHuillet
[Sat Jul 18 23:50:03.285380 2026] [security2:error] [pid 953994:tid 954074] [remote 31.42.184.154:42140] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "walkingandtalking.net"] [uri "/wp-login.php"] [unique_id "alxli-yJE89wAff52KVifAABFk8"]
[Sat Jul 18 23:50:03.300186 2026] [security2:error] [pid 953994:tid 954210] [client 148.153.193.60:60254] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "windowtx.com"] [uri "/"] [unique_id "alxli-yJE89wAff52KVifQAAAWA"]
[Sat Jul 18 23:50:03.341725 2026] [security2:error] [pid 953994:tid 954007] [remote 47.86.33.52:12834] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxli-yJE89wAff52KVifwABLAw"]
[Sat Jul 18 23:50:03.519945 2026] [security2:error] [pid 953994:tid 954033] [remote 31.42.184.154:42140] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "walkingandtalking.net"] [uri "/wp-login.php"] [unique_id "alxli-yJE89wAff52KViiAABiCY"], referer: https://walkingandtalking.net/wp-login.php
[Sat Jul 18 23:50:03.606919 2026] [security2:error] [pid 953994:tid 954135] [client 45.134.20.126:40325] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 126.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/license.php"] [unique_id "alxli-yJE89wAff52KVijAAAARU"]
[Sat Jul 18 23:50:03.928371 2026] [security2:error] [pid 953994:tid 954063] [remote 72.167.132.114:37720] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxli-yJE89wAff52KVipwABT0Q"]
[Sat Jul 18 23:50:03.959826 2026] [security2:error] [pid 953994:tid 954190] [client 45.133.7.94:56577] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 94.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "alxli-yJE89wAff52KViqwAAAUw"]
[Sat Jul 18 23:50:04.141050 2026] [security2:error] [pid 953994:tid 954145] [client 177.86.20.205:18414] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "www.marscafe.com"] [uri "/php/food-safety-dl/download.php"] [unique_id "alxli-yJE89wAff52KViiwAAAR8"]
[Sat Jul 18 23:50:04.199689 2026] [security2:error] [pid 953994:tid 954055] [remote 47.86.33.52:12834] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxljOyJE89wAff52KVivwABITw"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:50:04.273367 2026] [security2:error] [pid 953994:tid 954203] [client 74.7.230.58:0] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "sergnotes.com"] [uri "/robots.txt"] [unique_id "alxljOyJE89wAff52KVixQAAAVk"]
[Sat Jul 18 23:50:04.281724 2026] [security2:error] [pid 953994:tid 954141] [client 74.7.230.58:42824] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "sergnotes.com"] [uri "/robots.txt"] [unique_id "alxljOyJE89wAff52KViwwAAARs"]
[Sat Jul 18 23:50:04.427100 2026] [security2:error] [pid 953994:tid 954227] [client 74.7.230.58:50492] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "sergnotes.com"] [uri "/robots.txt"] [unique_id "alxljOyJE89wAff52KViyQABcXo"], referer: http://sergnotes.com/robots.txt
[Sat Jul 18 23:50:04.446212 2026] [security2:error] [pid 953994:tid 954114] [remote 91.142.222.105:50556] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "secretkeynumerology.com"] [uri "/wp-login.php"] [unique_id "alxljOyJE89wAff52KVizAABKnc"]
[Sat Jul 18 23:50:04.470793 2026] [security2:error] [pid 953994:tid 954206] [client 45.134.20.107:54543] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 107.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/languages/autoload_classmap.php"] [unique_id "alxljOyJE89wAff52KVizwAAAVw"]
[Sat Jul 18 23:50:04.645658 2026] [security2:error] [pid 953994:tid 954191] [client 45.133.7.78:49309] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 78.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/WordPressCore/gecko.php"] [unique_id "alxljOyJE89wAff52KVi2wAAAU0"]
[Sat Jul 18 23:50:05.070798 2026] [security2:error] [pid 953994:tid 954079] [remote 91.142.222.105:50556] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "secretkeynumerology.com"] [uri "/wp-login.php"] [unique_id "alxljeyJE89wAff52KVi_gABZ1Q"], referer: https://secretkeynumerology.com/wp-login.php
[Sat Jul 18 23:50:05.136845 2026] [security2:error] [pid 953994:tid 954051] [remote 72.167.132.114:37720] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxljeyJE89wAff52KVjAAABgzg"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:50:05.258839 2026] [security2:error] [pid 953994:tid 954147] [client 152.173.128.204:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "tiokubito.cl"] [uri "/index.php"] [unique_id "alxljOyJE89wAff52KVi4wABISg"], referer: https://tiokubito.cl/producto/preventa-infinite-studio-dragon-ball-maestro-roshi/
[Sat Jul 18 23:50:05.327655 2026] [security2:error] [pid 953994:tid 954172] [client 45.133.7.91:55189] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 91.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/baxa1.php7"] [unique_id "alxljeyJE89wAff52KVjEQAAATo"]
[Sat Jul 18 23:50:05.338805 2026] [security2:error] [pid 953994:tid 954158] [client 45.134.20.131:45427] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/lock.php"] [unique_id "alxljeyJE89wAff52KVjEgAAASw"]
[Sat Jul 18 23:50:05.495918 2026] [security2:error] [pid 953994:tid 954220] [client 54.90.74.5:50964] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxljeyJE89wAff52KVjCwABajY"]
[Sat Jul 18 23:50:06.007571 2026] [security2:error] [pid 953994:tid 954153] [client 45.133.7.66:24443] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 66.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "alxljuyJE89wAff52KVjOwAAASc"]
[Sat Jul 18 23:50:06.134302 2026] [security2:error] [pid 953994:tid 954226] [client 185.192.69.13:37849] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "tntcatholic.com"] [uri "/000.php"] [unique_id "alxljuyJE89wAff52KVjSQAAAXA"]
[Sat Jul 18 23:50:06.147224 2026] [security2:error] [pid 953994:tid 954243] [client 2404:e801:201e:1f20:6c17:960a:7577:f0a:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "origine.nz"] [uri "/index.php"] [unique_id "alxljeyJE89wAff52KVjGgABgQk"]
[Sat Jul 18 23:50:06.148346 2026] [security2:error] [pid 953994:tid 954129] [client 2404:e801:201e:1f20:6c17:960a:7577:f0a:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "origine.nz"] [uri "/index.php"] [unique_id "alxljeyJE89wAff52KVjGAABDzM"]
[Sat Jul 18 23:50:06.181482 2026] [security2:error] [pid 953994:tid 954139] [client 35.227.39.208:15258] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "schuttfarms.com"] [uri "/"] [unique_id "alxljuyJE89wAff52KVjSgAAARk"]
[Sat Jul 18 23:50:06.193814 2026] [security2:error] [pid 953994:tid 954128] [client 45.134.20.113:52829] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/blue/gold.php"] [unique_id "alxljuyJE89wAff52KVjTQAAAQ4"]
[Sat Jul 18 23:50:06.455866 2026] [security2:error] [pid 953994:tid 954245] [client 185.117.225.128:60730] ModSecurity: Access denied with code 406 (phase 1). Pattern match "python-requests|python-urllib" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "1460"] [id "909111"] [msg "Python UA brute"] [hostname "outlookturf.com"] [uri "/robots.txt"] [unique_id "alxljuyJE89wAff52KVjZQAAAYM"]
[Sat Jul 18 23:50:06.657406 2026] [security2:error] [pid 953994:tid 954145] [client 185.192.69.24:64113] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "tntcatholic.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxljuyJE89wAff52KVjcwAAAR8"]
[Sat Jul 18 23:50:06.691070 2026] [security2:error] [pid 953994:tid 954204] [client 45.133.7.74:49263] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/pwnd/dedi1.php"] [unique_id "alxljuyJE89wAff52KVjdwAAAVo"]
[Sat Jul 18 23:50:07.051055 2026] [security2:error] [pid 953994:tid 954192] [client 45.134.20.111:60959] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/atomlib.php"] [unique_id "alxlj-yJE89wAff52KVjhgAAAU4"]
[Sat Jul 18 23:50:07.059572 2026] [security2:error] [pid 953994:tid 954125] [client 36.83.95.75:50570] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlj-yJE89wAff52KVjhwAAAQs"]
[Sat Jul 18 23:50:07.059685 2026] [security2:error] [pid 953994:tid 954125] [client 36.83.95.75:50570] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlj-yJE89wAff52KVjhwAAAQs"]
[Sat Jul 18 23:50:07.118592 2026] [security2:error] [pid 953994:tid 954180] [client 185.192.69.14:20635] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "tntcatholic.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxlj-yJE89wAff52KVjjwAAAUI"]
[Sat Jul 18 23:50:07.376413 2026] [security2:error] [pid 953994:tid 954153] [client 45.133.7.76:33873] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 76.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "alxlj-yJE89wAff52KVjoAAAASc"]
[Sat Jul 18 23:50:07.603876 2026] [security2:error] [pid 953994:tid 954186] [client 185.192.69.19:28879] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "tntcatholic.com"] [uri "/wp-content/index.php"] [unique_id "alxlj-yJE89wAff52KVjsQAAAUg"]
[Sat Jul 18 23:50:07.911956 2026] [security2:error] [pid 953994:tid 954222] [client 45.134.20.104:48621] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/rest-api/index.php"] [unique_id "alxlj-yJE89wAff52KVjxgAAAWw"]
[Sat Jul 18 23:50:08.021398 2026] [security2:error] [pid 953994:tid 954208] [client 111.221.140.236:7136] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "reosportsboats.com"] [uri "/index.php"] [unique_id "alxljuyJE89wAff52KVjZwAAAV4"]
[Sat Jul 18 23:50:08.061228 2026] [security2:error] [pid 953994:tid 954245] [client 45.133.7.63:56567] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/blog.php"] [unique_id "alxlkOyJE89wAff52KVjywAAAYM"]
[Sat Jul 18 23:50:08.062713 2026] [security2:error] [pid 953994:tid 954198] [client 185.192.69.18:37599] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "tntcatholic.com"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "alxlkOyJE89wAff52KVjzAAAAVQ"]
[Sat Jul 18 23:50:08.209644 2026] [security2:error] [pid 953994:tid 954185] [client 163.61.1.17:61266] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlkOyJE89wAff52KVj1QAAAUc"]
[Sat Jul 18 23:50:08.209792 2026] [security2:error] [pid 953994:tid 954185] [client 163.61.1.17:61266] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlkOyJE89wAff52KVj1QAAAUc"]
[Sat Jul 18 23:50:08.297238 2026] [security2:error] [pid 953994:tid 954202] [client 74.208.214.194:59886] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxlkOyJE89wAff52KVj2AAAAVg"]
[Sat Jul 18 23:50:08.742862 2026] [security2:error] [pid 953994:tid 954208] [client 45.133.7.79:58897] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 79.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/about/install.php"] [unique_id "alxlkOyJE89wAff52KVj-AAAAV4"]
[Sat Jul 18 23:50:08.769397 2026] [security2:error] [pid 953994:tid 954156] [client 45.134.20.135:51159] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/about.php"] [unique_id "alxlkOyJE89wAff52KVj-gAAASo"]
[Sat Jul 18 23:50:09.085548 2026] [security2:error] [pid 953994:tid 954176] [client 180.252.198.240:62065] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlkeyJE89wAff52KVkEAAAAT4"]
[Sat Jul 18 23:50:09.085636 2026] [security2:error] [pid 953994:tid 954176] [client 180.252.198.240:62065] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlkeyJE89wAff52KVkEAAAAT4"]
[Sat Jul 18 23:50:09.220413 2026] [security2:error] [pid 953994:tid 954201] [client 103.160.26.178:54317] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlkeyJE89wAff52KVkFgAAAVc"]
[Sat Jul 18 23:50:09.220525 2026] [security2:error] [pid 953994:tid 954201] [client 103.160.26.178:54317] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlkeyJE89wAff52KVkFgAAAVc"]
[Sat Jul 18 23:50:09.449424 2026] [security2:error] [pid 953994:tid 954228] [client 45.133.7.68:34341] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 68.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/pridmag/bypass.php"] [unique_id "alxlkeyJE89wAff52KVkJgAAAXI"]
[Sat Jul 18 23:50:09.634513 2026] [security2:error] [pid 953994:tid 954198] [client 45.134.20.122:62065] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/wincust.php"] [unique_id "alxlkeyJE89wAff52KVkLwAAAVQ"]
[Sat Jul 18 23:50:09.900576 2026] [security2:error] [pid 953994:tid 954054] [remote 49.13.1.223:41108] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.1.13.49.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "goyalsatyam.com"] [uri "/wp-login.php"] [unique_id "alxlkeyJE89wAff52KVkQgABiDs"]
[Sat Jul 18 23:50:10.086983 2026] [security2:error] [pid 953994:tid 954119] [remote 49.13.1.223:41108] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.1.13.49.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "goyalsatyam.com"] [uri "/wp-login.php"] [unique_id "alxlkuyJE89wAff52KVkVgABSXw"], referer: https://goyalsatyam.com/wp-login.php
[Sat Jul 18 23:50:10.140740 2026] [security2:error] [pid 953994:tid 954169] [client 45.133.7.91:40753] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 91.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/network/chosen.php"] [unique_id "alxlkuyJE89wAff52KVkWAAAATc"]
[Sat Jul 18 23:50:10.491192 2026] [security2:error] [pid 953994:tid 954176] [client 45.134.20.112:46159] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 112.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/light/alfa-rex.php"] [unique_id "alxlkuyJE89wAff52KVkbgAAAT4"]
[Sat Jul 18 23:50:10.840817 2026] [security2:error] [pid 953994:tid 954154] [client 45.133.7.71:34247] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 71.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/images/av.php"] [unique_id "alxlkuyJE89wAff52KVkiAAAASg"]
[Sat Jul 18 23:50:11.346299 2026] [security2:error] [pid 953994:tid 954251] [client 45.134.20.131:32175] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-good.php"] [unique_id "alxlk-yJE89wAff52KVkqwAAAYk"]
[Sat Jul 18 23:50:11.450220 2026] [proxy:error] [pid 953994:tid 954133] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:50:11.450273 2026] [proxy_http:error] [pid 953994:tid 954133] [client 193.47.62.168:57390] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:50:11.450698 2026] [proxy:error] [pid 953994:tid 954133] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:50:11.450729 2026] [proxy_http:error] [pid 953994:tid 954133] [client 193.47.62.168:57390] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:50:11.534259 2026] [security2:error] [pid 953994:tid 954210] [client 45.133.7.89:44911] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 89.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "alxlk-yJE89wAff52KVkugAAAWA"]
[Sat Jul 18 23:50:11.558222 2026] [security2:error] [pid 953994:tid 954097] [remote 216.73.216.174:61074] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 174.216.73.216.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/training-temp"] [unique_id "alxlk-yJE89wAff52KVkvAABOmY"]
[Sat Jul 18 23:50:11.711774 2026] [security2:error] [pid 953994:tid 954071] [remote 54.64.35.240:41214] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.35.64.54.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxlk-yJE89wAff52KVkyQABVkw"]
[Sat Jul 18 23:50:12.111492 2026] [security2:error] [pid 953994:tid 954043] [remote 54.64.35.240:41214] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.35.64.54.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxllOyJE89wAff52KVk6QABezA"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:50:12.213811 2026] [security2:error] [pid 953994:tid 954216] [client 45.134.20.128:29053] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/index.php"] [unique_id "alxllOyJE89wAff52KVk8QAAAWY"]
[Sat Jul 18 23:50:12.214077 2026] [security2:error] [pid 953994:tid 954158] [client 45.133.7.92:55177] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/colour.php"] [unique_id "alxllOyJE89wAff52KVk8gAAASw"]
[Sat Jul 18 23:50:12.709842 2026] [security2:error] [pid 953994:tid 954169] [client 54.85.69.47:34546] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 47.69.85.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxllOyJE89wAff52KVlFAAAATc"], referer: https://curlsnpearlsss.com/es/arroz-con-pollo-puerto-rican-chicken-and-rice/
[Sat Jul 18 23:50:12.725999 2026] [security2:error] [pid 953994:tid 954226] [client 138.252.89.100:54286] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxllOyJE89wAff52KVlFQAAAXA"]
[Sat Jul 18 23:50:12.726076 2026] [security2:error] [pid 953994:tid 954226] [client 138.252.89.100:54286] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxllOyJE89wAff52KVlFQAAAXA"]
[Sat Jul 18 23:50:12.809199 2026] [security2:error] [pid 953994:tid 954055] [remote 103.133.214.160:50500] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.214.133.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxllOyJE89wAff52KVlFgABSDw"]
[Sat Jul 18 23:50:12.898284 2026] [security2:error] [pid 953994:tid 954156] [client 45.133.7.59:22273] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 59.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/elp.php"] [unique_id "alxllOyJE89wAff52KVlIgAAASo"]
[Sat Jul 18 23:50:12.959730 2026] [security2:error] [pid 953994:tid 954197] [client 98.82.181.200:35412] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 200.181.82.98.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxllOyJE89wAff52KVlIwAAAVM"], referer: https://curlsnpearlsss.com/es/arroz-con-pollo-puerto-rican-chicken-and-rice/
[Sat Jul 18 23:50:13.078900 2026] [security2:error] [pid 953994:tid 954155] [client 45.134.20.114:21445] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "alxlleyJE89wAff52KVlKwAAASk"]
[Sat Jul 18 23:50:13.284217 2026] [security2:error] [pid 953994:tid 954102] [remote 103.133.214.160:50500] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 160.214.133.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxlleyJE89wAff52KVlNQABIGs"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:50:13.588798 2026] [security2:error] [pid 953994:tid 954166] [client 45.133.7.60:29745] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 60.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "alxlleyJE89wAff52KVlRgAAATQ"]
[Sat Jul 18 23:50:13.673153 2026] [security2:error] [pid 953994:tid 954196] [client 62.150.67.110:13837] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "ali-alghanim.net"] [uri "/index.php"] [unique_id "alxlleyJE89wAff52KVlPQAAAVI"]
[Sat Jul 18 23:50:13.932848 2026] [security2:error] [pid 953994:tid 954145] [client 45.134.20.110:22225] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "alxlleyJE89wAff52KVlVAAAAR8"]
[Sat Jul 18 23:50:14.292434 2026] [security2:error] [pid 953994:tid 954231] [client 45.133.7.92:24309] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/images/include.php"] [unique_id "alxlluyJE89wAff52KVlcQAAAXU"]
[Sat Jul 18 23:50:14.297847 2026] [security2:error] [pid 953994:tid 954021] [remote 152.228.213.32:46902] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "talknutritionwithlesley.com"] [uri "/wp-login.php"] [unique_id "alxlluyJE89wAff52KVlcAABcho"]
[Sat Jul 18 23:50:14.477287 2026] [security2:error] [pid 953994:tid 954010] [remote 152.228.213.32:46902] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "talknutritionwithlesley.com"] [uri "/wp-login.php"] [unique_id "alxlluyJE89wAff52KVlewABVA8"], referer: https://talknutritionwithlesley.com/wp-login.php
[Sat Jul 18 23:50:14.785425 2026] [security2:error] [pid 953994:tid 954155] [client 45.134.20.127:49431] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 127.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/twentytwentyfour/about.php"] [unique_id "alxlluyJE89wAff52KVljgAAASk"]
[Sat Jul 18 23:50:14.973527 2026] [security2:error] [pid 953994:tid 954221] [client 45.133.7.94:54033] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 94.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/av.php.php"] [unique_id "alxlluyJE89wAff52KVltQAAAWs"]
[Sat Jul 18 23:50:15.322791 2026] [security2:error] [pid 953994:tid 954100] [remote 98.156.100.191:53638] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 191.100.156.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxll-yJE89wAff52KVl0wABFmk"]
[Sat Jul 18 23:50:15.322942 2026] [security2:error] [pid 953994:tid 954136] [client 98.156.100.191:53638] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxll-yJE89wAff52KVl0wABFmk"]
[Sat Jul 18 23:50:15.655552 2026] [security2:error] [pid 953994:tid 954228] [client 45.133.7.99:46463] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/pwnd-1/install.php"] [unique_id "alxll-yJE89wAff52KVmAgAAAXI"]
[Sat Jul 18 23:50:15.697961 2026] [security2:error] [pid 953994:tid 954231] [client 16.145.89.170:32806] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 170.89.145.16.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cryptomeaning.com"] [uri "/wp-cron.php"] [unique_id "alxll-yJE89wAff52KVmCQAAAXU"]
[Sat Jul 18 23:50:16.063987 2026] [security2:error] [pid 953994:tid 954189] [client 45.134.20.123:55297] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 123.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/js/widgets/about.php"] [unique_id "alxlmOyJE89wAff52KVmGgAAAUs"]
[Sat Jul 18 23:50:16.360261 2026] [security2:error] [pid 953994:tid 954233] [client 57.141.18.103:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxlmOyJE89wAff52KVmIgAAAXc"]
[Sat Jul 18 23:50:16.389910 2026] [security2:error] [pid 953994:tid 954247] [client 45.133.7.87:31435] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 87.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "alxlmOyJE89wAff52KVmLgAAAYU"]
[Sat Jul 18 23:50:16.927792 2026] [security2:error] [pid 953994:tid 954212] [client 45.134.20.133:43969] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/fonts/database.php"] [unique_id "alxlmOyJE89wAff52KVmUgAAAWI"]
[Sat Jul 18 23:50:17.073115 2026] [security2:error] [pid 953994:tid 954191] [client 45.133.7.64:22591] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 64.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/upload/bilder/cong.php"] [unique_id "alxlmeyJE89wAff52KVmYwAAAU0"]
[Sat Jul 18 23:50:17.430891 2026] [security2:error] [pid 953994:tid 954153] [client 36.83.95.75:51064] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlmeyJE89wAff52KVmdAAAASc"]
[Sat Jul 18 23:50:17.431567 2026] [security2:error] [pid 953994:tid 954153] [client 36.83.95.75:51064] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlmeyJE89wAff52KVmdAAAASc"]
[Sat Jul 18 23:50:17.754021 2026] [security2:error] [pid 953994:tid 954125] [client 45.133.7.87:38265] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 87.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/blue/pass.php"] [unique_id "alxlmeyJE89wAff52KVmiwAAAQs"]
[Sat Jul 18 23:50:17.785641 2026] [security2:error] [pid 953994:tid 954184] [client 45.134.20.136:60373] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 136.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/ff2.php"] [unique_id "alxlmeyJE89wAff52KVmjAAAAUY"]
[Sat Jul 18 23:50:18.411872 2026] [security2:error] [pid 953994:tid 954193] [client 185.117.225.128:44728] ModSecurity: Access denied with code 406 (phase 1). Pattern match "python-requests|python-urllib" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "1460"] [id "909111"] [msg "Python UA brute"] [hostname "outlookturf.com"] [uri "/robots.txt"] [unique_id "alxlmuyJE89wAff52KVmsQAAAU8"]
[Sat Jul 18 23:50:18.434584 2026] [security2:error] [pid 953994:tid 954179] [client 45.133.7.89:41843] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 89.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "alxlmuyJE89wAff52KVmtAAAAUE"]
[Sat Jul 18 23:50:18.501566 2026] [proxy:error] [pid 953994:tid 954239] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:50:18.501624 2026] [proxy_http:error] [pid 953994:tid 954239] [client 193.47.62.168:52250] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:50:18.502107 2026] [proxy:error] [pid 953994:tid 954239] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:50:18.502133 2026] [proxy_http:error] [pid 953994:tid 954239] [client 193.47.62.168:52250] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:50:18.644169 2026] [security2:error] [pid 953994:tid 954210] [client 45.134.20.104:26853] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "alxlmuyJE89wAff52KVmwQAAAWA"]
[Sat Jul 18 23:50:18.644448 2026] [security2:error] [pid 953994:tid 954177] [client 13.232.206.133:35386] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.206.232.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxlmuyJE89wAff52KVmwgAAAT8"]
[Sat Jul 18 23:50:18.644542 2026] [security2:error] [pid 953994:tid 954177] [client 13.232.206.133:35386] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxlmuyJE89wAff52KVmwgAAAT8"]
[Sat Jul 18 23:50:18.679526 2026] [security2:error] [pid 953994:tid 954124] [client 163.61.1.17:61742] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlmuyJE89wAff52KVmxAAAAQo"]
[Sat Jul 18 23:50:18.679637 2026] [security2:error] [pid 953994:tid 954124] [client 163.61.1.17:61742] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlmuyJE89wAff52KVmxAAAAQo"]
[Sat Jul 18 23:50:18.883434 2026] [security2:error] [pid 953994:tid 954217] [client 103.160.26.178:54833] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlmuyJE89wAff52KVm2wAAAWc"]
[Sat Jul 18 23:50:18.883521 2026] [security2:error] [pid 953994:tid 954217] [client 103.160.26.178:54833] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlmuyJE89wAff52KVm2wAAAWc"]
[Sat Jul 18 23:50:18.932164 2026] [security2:error] [pid 953994:tid 954203] [client 62.150.67.110:14027] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "ali-alghanim.net"] [uri "/index.php"] [unique_id "alxlmuyJE89wAff52KVmxQAAAVk"]
[Sat Jul 18 23:50:19.121267 2026] [security2:error] [pid 953994:tid 954210] [client 45.133.7.64:48713] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 64.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/assets/about5.php"] [unique_id "alxlm-yJE89wAff52KVm7gAAAWA"]
[Sat Jul 18 23:50:19.163319 2026] [security2:error] [pid 953994:tid 954244] [client 185.117.225.128:38476] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "outlookturf.com"] [uri "/index.php"] [unique_id "alxlmuyJE89wAff52KVm3AABgls"]
[Sat Jul 18 23:50:19.457135 2026] [security2:error] [pid 953994:tid 954216] [client 180.252.198.240:62572] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlm-yJE89wAff52KVm_QAAAWY"]
[Sat Jul 18 23:50:19.457250 2026] [security2:error] [pid 953994:tid 954216] [client 180.252.198.240:62572] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlm-yJE89wAff52KVm_QAAAWY"]
[Sat Jul 18 23:50:19.506611 2026] [security2:error] [pid 953994:tid 954197] [client 45.134.20.119:58451] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "655"] [id "900155"] [msg "WP Brute UA block"] [hostname "swafforddetailing.com"] [uri "/wp-admin/plugin.php"] [unique_id "alxlm-yJE89wAff52KVnAAAAAVM"]
[Sat Jul 18 23:50:19.803360 2026] [security2:error] [pid 953994:tid 954129] [client 45.133.7.88:62277] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 88.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/maint/lint-branch.php"] [unique_id "alxlm-yJE89wAff52KVnFwAAAQ8"]
[Sat Jul 18 23:50:20.368119 2026] [security2:error] [pid 953994:tid 954144] [client 45.134.20.105:39011] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "alxlnOyJE89wAff52KVnPwAAAR4"]
[Sat Jul 18 23:50:20.380368 2026] [security2:error] [pid 953994:tid 954209] [client 50.116.65.227:15596] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/South-Africa-Day-4-Feature-Image.jpg"] [unique_id "alxlnOyJE89wAff52KVnQAAAAV8"]
[Sat Jul 18 23:50:20.394868 2026] [security2:error] [pid 953994:tid 954176] [client 50.116.65.227:25180] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/South-Africa-Day-4-Feature-Image.jpg"] [unique_id "alxlnOyJE89wAff52KVnQgAAAT4"]
[Sat Jul 18 23:50:20.478115 2026] [security2:error] [pid 953994:tid 954160] [client 57.141.18.69:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxlnOyJE89wAff52KVnOAAAAS4"]
[Sat Jul 18 23:50:20.482705 2026] [security2:error] [pid 953994:tid 954193] [client 45.133.7.61:28489] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/cong.php"] [unique_id "alxlnOyJE89wAff52KVnUgAAAU8"]
[Sat Jul 18 23:50:21.163665 2026] [security2:error] [pid 953994:tid 954192] [client 45.133.7.65:25271] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 65.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/js/db.php"] [unique_id "alxlneyJE89wAff52KVnfwAAAU4"]
[Sat Jul 18 23:50:21.228140 2026] [security2:error] [pid 953994:tid 954151] [client 45.134.20.105:28917] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/jp.php"] [unique_id "alxlneyJE89wAff52KVniQAAASU"]
[Sat Jul 18 23:50:21.385192 2026] [security2:error] [pid 953994:tid 953998] [remote 102.134.101.35:59002] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 35.101.134.102.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "pscmedicalbilling.com"] [uri "/wp-login.php"] [unique_id "alxlneyJE89wAff52KVnmAABYQM"]
[Sat Jul 18 23:50:21.431322 2026] [security2:error] [pid 953994:tid 954237] [client 57.141.18.88:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxlneyJE89wAff52KVnjAAAAXs"]
[Sat Jul 18 23:50:21.615194 2026] [security2:error] [pid 953994:tid 954132] [client 34.90.254.162:16384] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "mail.qjy.cyq.mybluehost.me"] [uri "/"] [unique_id "alxlneyJE89wAff52KVnpQAAARI"]
[Sat Jul 18 23:50:21.615287 2026] [security2:error] [pid 953994:tid 954132] [client 34.90.254.162:16384] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "mail.qjy.cyq.mybluehost.me"] [uri "/"] [unique_id "alxlneyJE89wAff52KVnpQAAARI"]
[Sat Jul 18 23:50:21.841662 2026] [security2:error] [pid 953994:tid 954045] [remote 102.134.101.35:59002] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 35.101.134.102.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "pscmedicalbilling.com"] [uri "/wp-login.php"] [unique_id "alxlneyJE89wAff52KVnsgABWDI"], referer: https://pscmedicalbilling.com/wp-login.php
[Sat Jul 18 23:50:21.843984 2026] [security2:error] [pid 953994:tid 954251] [client 45.133.7.104:64239] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/buy.php"] [unique_id "alxlneyJE89wAff52KVnswAAAYk"]
[Sat Jul 18 23:50:21.965462 2026] [security2:error] [pid 953994:tid 954217] [client 185.117.225.128:44736] ModSecurity: Access denied with code 406 (phase 1). Pattern match "python-requests|python-urllib" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "1460"] [id "909111"] [msg "Python UA brute"] [hostname "outlookturf.com"] [uri "/robots.txt"] [unique_id "alxlneyJE89wAff52KVntwAAAWc"]
[Sat Jul 18 23:50:22.085261 2026] [security2:error] [pid 953994:tid 954250] [client 45.134.20.121:22137] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 121.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-atom.php"] [unique_id "alxlnuyJE89wAff52KVnvwAAAYg"]
[Sat Jul 18 23:50:22.134947 2026] [ssl:error] [pid 953994:tid 954182] [client 13.219.121.241:5216] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname cpcalendars.aurynwrites.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:50:22.527695 2026] [security2:error] [pid 953994:tid 954178] [client 45.133.7.80:39379] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/ID3/db.php"] [unique_id "alxlnuyJE89wAff52KVn2gAAAUA"]
[Sat Jul 18 23:50:22.665334 2026] [security2:error] [pid 953994:tid 954165] [client 107.161.92.6:37656] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "intelligentengineeringsolutions.com"] [uri "/wp-json/wp/v2/pages/4"] [unique_id "alxlnuyJE89wAff52KVn4wAAATM"]
[Sat Jul 18 23:50:22.674279 2026] [security2:error] [pid 953994:tid 954251] [client 107.161.92.6:37682] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "intelligentengineeringsolutions.com"] [uri "/wp-includes/js/comment-reply.min.js"] [unique_id "alxlnuyJE89wAff52KVn5gAAAYk"]
[Sat Jul 18 23:50:22.674347 2026] [security2:error] [pid 953994:tid 954251] [client 107.161.92.6:37682] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "intelligentengineeringsolutions.com"] [uri "/wp-includes/js/comment-reply.min.js"] [unique_id "alxlnuyJE89wAff52KVn5gAAAYk"]
[Sat Jul 18 23:50:22.939958 2026] [security2:error] [pid 953994:tid 954247] [client 45.134.20.108:50703] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/index.php"] [unique_id "alxlnuyJE89wAff52KVn_AAAAYU"]
[Sat Jul 18 23:50:23.217925 2026] [security2:error] [pid 953994:tid 954150] [client 45.133.7.71:37417] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 71.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/function/install.php"] [unique_id "alxln-yJE89wAff52KVoCwAAASQ"]
[Sat Jul 18 23:50:23.426541 2026] [security2:error] [pid 953994:tid 954224] [client 107.161.92.6:37686] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "intelligentengineeringsolutions.com"] [uri "/wp-content/plugins/smart-slider-3/Public/SmartSlider3/Slider/SliderType/Simple/Assets/dist/ss-simple.min.js"] [unique_id "alxln-yJE89wAff52KVoJQAAAW4"]
[Sat Jul 18 23:50:23.426614 2026] [security2:error] [pid 953994:tid 954224] [client 107.161.92.6:37686] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "intelligentengineeringsolutions.com"] [uri "/wp-content/plugins/smart-slider-3/Public/SmartSlider3/Slider/SliderType/Simple/Assets/dist/ss-simple.min.js"] [unique_id "alxln-yJE89wAff52KVoJQAAAW4"]
[Sat Jul 18 23:50:23.433938 2026] [security2:error] [pid 953994:tid 954208] [client 107.161.92.6:37706] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "intelligentengineeringsolutions.com"] [uri "/wp-content/uploads/2017/06/cropped-IES-Logo-from-INV-rev0a-512wide-x-512tall-32x32.png"] [unique_id "alxln-yJE89wAff52KVoKgAAAV4"]
[Sat Jul 18 23:50:23.433998 2026] [security2:error] [pid 953994:tid 954208] [client 107.161.92.6:37706] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "intelligentengineeringsolutions.com"] [uri "/wp-content/uploads/2017/06/cropped-IES-Logo-from-INV-rev0a-512wide-x-512tall-32x32.png"] [unique_id "alxln-yJE89wAff52KVoKgAAAV4"]
[Sat Jul 18 23:50:23.438566 2026] [security2:error] [pid 953994:tid 954186] [client 107.161.92.6:37730] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "intelligentengineeringsolutions.com"] [uri "/wp-content/uploads/slider2/img-1-FacilityModeling-BIM.png"] [unique_id "alxln-yJE89wAff52KVoLQAAAUg"]
[Sat Jul 18 23:50:23.438628 2026] [security2:error] [pid 953994:tid 954186] [client 107.161.92.6:37730] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "intelligentengineeringsolutions.com"] [uri "/wp-content/uploads/slider2/img-1-FacilityModeling-BIM.png"] [unique_id "alxln-yJE89wAff52KVoLQAAAUg"]
[Sat Jul 18 23:50:23.440939 2026] [security2:error] [pid 953994:tid 954134] [client 107.161.92.6:37732] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "intelligentengineeringsolutions.com"] [uri "/wp-content/uploads/slider2/img-2-FacilityModeling-3DScanning.png"] [unique_id "alxln-yJE89wAff52KVoLwAAARQ"]
[Sat Jul 18 23:50:23.441000 2026] [security2:error] [pid 953994:tid 954134] [client 107.161.92.6:37732] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "intelligentengineeringsolutions.com"] [uri "/wp-content/uploads/slider2/img-2-FacilityModeling-3DScanning.png"] [unique_id "alxln-yJE89wAff52KVoLwAAARQ"]
[Sat Jul 18 23:50:23.488822 2026] [security2:error] [pid 953994:tid 954196] [client 107.161.92.6:37672] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "intelligentengineeringsolutions.com"] [uri "/xmlrpc.php"] [unique_id "alxln-yJE89wAff52KVoKQAAAVI"]
[Sat Jul 18 23:50:23.488921 2026] [security2:error] [pid 953994:tid 954196] [client 107.161.92.6:37672] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "intelligentengineeringsolutions.com"] [uri "/xmlrpc.php"] [unique_id "alxln-yJE89wAff52KVoKQAAAVI"]
[Sat Jul 18 23:50:23.797524 2026] [security2:error] [pid 953994:tid 954147] [client 45.134.20.104:45147] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/up.php"] [unique_id "alxln-yJE89wAff52KVoRgAAASE"]
[Sat Jul 18 23:50:23.902355 2026] [security2:error] [pid 953994:tid 954250] [client 45.133.7.78:64175] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 78.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/tflow/av.php"] [unique_id "alxln-yJE89wAff52KVoZQAAAYg"]
[Sat Jul 18 23:50:24.006194 2026] [security2:error] [pid 953994:tid 954130] [client 107.161.92.6:37748] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "intelligentengineeringsolutions.com"] [uri "/index.php"] [unique_id "alxln-yJE89wAff52KVoMwAAARA"]
[Sat Jul 18 23:50:24.234991 2026] [security2:error] [pid 953994:tid 954176] [client 138.252.89.100:54790] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxloOyJE89wAff52KVocgAAAT4"]
[Sat Jul 18 23:50:24.235068 2026] [security2:error] [pid 953994:tid 954176] [client 138.252.89.100:54790] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxloOyJE89wAff52KVocgAAAT4"]
[Sat Jul 18 23:50:24.241577 2026] [security2:error] [pid 953994:tid 954163] [client 107.161.92.6:37668] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "intelligentengineeringsolutions.com"] [uri "/feed/"] [unique_id "alxloOyJE89wAff52KVocwAAATE"]
[Sat Jul 18 23:50:24.587074 2026] [security2:error] [pid 953994:tid 954244] [client 45.133.7.55:32983] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 55.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "alxloOyJE89wAff52KVokAAAAYI"]
[Sat Jul 18 23:50:24.650869 2026] [security2:error] [pid 953994:tid 954218] [client 45.134.20.112:27955] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 112.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/uploads/bypass.php"] [unique_id "alxloOyJE89wAff52KVolAAAAWg"]
[Sat Jul 18 23:50:24.799796 2026] [security2:error] [pid 953994:tid 954064] [remote 31.42.184.154:54208] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxloOyJE89wAff52KVomwABKUU"]
[Sat Jul 18 23:50:25.040319 2026] [security2:error] [pid 953994:tid 954035] [remote 31.42.184.154:54208] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxloeyJE89wAff52KVotwABSSg"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:50:25.275083 2026] [security2:error] [pid 953994:tid 954237] [client 45.133.7.84:39183] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 84.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/testt.php"] [unique_id "alxloeyJE89wAff52KVozAAAAXs"]
[Sat Jul 18 23:50:25.516390 2026] [security2:error] [pid 953994:tid 954162] [client 45.134.20.131:27891] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/assets/images/admin.php"] [unique_id "alxloeyJE89wAff52KVo9gAAATA"]
[Sat Jul 18 23:50:25.962385 2026] [security2:error] [pid 953994:tid 954148] [client 45.133.7.72:38793] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 72.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/uploads/goods.php"] [unique_id "alxloeyJE89wAff52KVpFwAAASI"]
[Sat Jul 18 23:50:26.370407 2026] [security2:error] [pid 953994:tid 954176] [client 45.134.20.121:32343] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 121.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/index.php"] [unique_id "alxlouyJE89wAff52KVpLAAAAT4"]
[Sat Jul 18 23:50:26.644763 2026] [security2:error] [pid 953994:tid 954138] [client 45.133.7.81:42491] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 81.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/js/sad.php"] [unique_id "alxlouyJE89wAff52KVpUgAAARg"]
[Sat Jul 18 23:50:27.079760 2026] [security2:error] [pid 953994:tid 954129] [client 152.173.128.204:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "tiokubito.cl"] [uri "/index.php"] [unique_id "alxlouyJE89wAff52KVpYgABDz8"], referer: https://tiokubito.cl/producto/preventa-infinite-studio-dragon-ball-maestro-roshi/
[Sat Jul 18 23:50:27.277289 2026] [security2:error] [pid 953994:tid 954138] [client 45.134.20.112:27999] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 112.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/js/wp-login.php"] [unique_id "alxlo-yJE89wAff52KVphQAAARg"]
[Sat Jul 18 23:50:27.337224 2026] [security2:error] [pid 953994:tid 954133] [client 45.133.7.103:37051] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "alxlo-yJE89wAff52KVpjAAAARM"]
[Sat Jul 18 23:50:27.337814 2026] [security2:error] [pid 953994:tid 954192] [client 57.141.18.119:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxlo-yJE89wAff52KVpfwAAAU4"]
[Sat Jul 18 23:50:27.977029 2026] [security2:error] [pid 953994:tid 954220] [client 36.83.95.75:51555] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlo-yJE89wAff52KVptQAAAWo"]
[Sat Jul 18 23:50:27.977128 2026] [security2:error] [pid 953994:tid 954220] [client 36.83.95.75:51555] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlo-yJE89wAff52KVptQAAAWo"]
[Sat Jul 18 23:50:28.023473 2026] [security2:error] [pid 953994:tid 954148] [client 45.133.7.62:64911] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "alxlpOyJE89wAff52KVptgAAASI"]
[Sat Jul 18 23:50:28.133900 2026] [security2:error] [pid 953994:tid 954248] [client 45.134.20.124:38265] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 124.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/simple/function.php"] [unique_id "alxlpOyJE89wAff52KVpxQAAAYY"]
[Sat Jul 18 23:50:28.728304 2026] [security2:error] [pid 953994:tid 954149] [client 45.133.7.101:49471] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 101.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "alxlpOyJE89wAff52KVp8QAAASM"]
[Sat Jul 18 23:50:29.300149 2026] [security2:error] [pid 953994:tid 954177] [client 163.61.1.17:62225] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlpeyJE89wAff52KVqEQAAAT8"]
[Sat Jul 18 23:50:29.300250 2026] [security2:error] [pid 953994:tid 954177] [client 163.61.1.17:62225] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlpeyJE89wAff52KVqEQAAAT8"]
[Sat Jul 18 23:50:29.408293 2026] [security2:error] [pid 953994:tid 954158] [client 45.133.7.56:56523] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 56.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/network.php"] [unique_id "alxlpeyJE89wAff52KVqFQAAASw"]
[Sat Jul 18 23:50:29.414781 2026] [security2:error] [pid 953994:tid 954134] [client 145.239.10.137:52360] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 137.10.239.145.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "lizrichter.com.au"] [uri "/sc.php"] [unique_id "alxlpeyJE89wAff52KVqFgAAARQ"], referer: http://lizrichter.com.au/sc.php
[Sat Jul 18 23:50:29.423082 2026] [security2:error] [pid 953994:tid 954164] [client 45.134.20.116:55109] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 116.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/ext.php"] [unique_id "alxlpeyJE89wAff52KVqFwAAATI"]
[Sat Jul 18 23:50:29.628168 2026] [security2:error] [pid 953994:tid 954189] [client 103.160.26.178:55342] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlpeyJE89wAff52KVqIgAAAUs"]
[Sat Jul 18 23:50:29.628297 2026] [security2:error] [pid 953994:tid 954189] [client 103.160.26.178:55342] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlpeyJE89wAff52KVqIgAAAUs"]
[Sat Jul 18 23:50:29.784619 2026] [security2:error] [pid 953994:tid 954133] [client 180.252.198.240:63053] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlpeyJE89wAff52KVqKQAAARM"]
[Sat Jul 18 23:50:29.784724 2026] [security2:error] [pid 953994:tid 954133] [client 180.252.198.240:63053] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlpeyJE89wAff52KVqKQAAARM"]
[Sat Jul 18 23:50:30.087423 2026] [security2:error] [pid 953994:tid 954146] [client 45.133.7.75:37865] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/blue/alfa.php"] [unique_id "alxlpuyJE89wAff52KVqPQAAASA"]
[Sat Jul 18 23:50:30.286785 2026] [security2:error] [pid 953994:tid 954216] [client 45.134.20.109:27501] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 109.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/delpaths.php"] [unique_id "alxlpuyJE89wAff52KVqSgAAAWY"]
[Sat Jul 18 23:50:30.840696 2026] [security2:error] [pid 953994:tid 954000] [remote 152.228.213.32:53746] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxlpuyJE89wAff52KVqaQABagU"]
[Sat Jul 18 23:50:30.891710 2026] [security2:error] [pid 953994:tid 954190] [client 45.133.7.105:33855] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "alxlpuyJE89wAff52KVqbAAAAUw"]
[Sat Jul 18 23:50:31.056235 2026] [security2:error] [pid 953994:tid 954101] [remote 152.228.213.32:53746] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxlp-yJE89wAff52KVqcwABS2o"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:50:31.145040 2026] [security2:error] [pid 953994:tid 954191] [client 45.134.20.109:64589] ModSecurity: Warning. Pattern match "/1\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1543"] [id "900921"] [msg "temporary TUW-72162 logging rule"] [hostname "swafforddetailing.com"] [uri "/.well-known/pki-validation/1.php"] [unique_id "alxlp-yJE89wAff52KVqegAAAU0"]
[Sat Jul 18 23:50:31.145144 2026] [security2:error] [pid 953994:tid 954191] [client 45.134.20.109:64589] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 109.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/pki-validation/1.php"] [unique_id "alxlp-yJE89wAff52KVqegAAAU0"]
[Sat Jul 18 23:50:31.384275 2026] [security2:error] [pid 953994:tid 954001] [remote 31.42.184.154:33680] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxlp-yJE89wAff52KVqhwABMwY"]
[Sat Jul 18 23:50:31.573556 2026] [security2:error] [pid 953994:tid 954177] [client 45.133.7.57:39099] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 57.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wikindex.php"] [unique_id "alxlp-yJE89wAff52KVqkAAAAT8"]
[Sat Jul 18 23:50:31.669577 2026] [security2:error] [pid 953994:tid 954096] [remote 31.42.184.154:33680] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxlp-yJE89wAff52KVqogABJmU"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:50:32.039690 2026] [security2:error] [pid 953994:tid 954174] [client 85.204.70.112:49576] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.guidehunting.com"] [uri "/.well-known/acme-challenge/"] [unique_id "alxlqOyJE89wAff52KVquAAAATw"]
[Sat Jul 18 23:50:32.056048 2026] [security2:error] [pid 953994:tid 954127] [client 45.134.20.105:28559] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "655"] [id "900155"] [msg "WP Brute UA block"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "alxlqOyJE89wAff52KVqtwAAAQ0"]
[Sat Jul 18 23:50:32.254647 2026] [security2:error] [pid 953994:tid 954147] [client 45.133.7.65:62553] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 65.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/seoo/alfa.php"] [unique_id "alxlqOyJE89wAff52KVqyAAAASE"]
[Sat Jul 18 23:50:32.911430 2026] [security2:error] [pid 953994:tid 954250] [client 45.134.20.120:47721] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 120.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/pki-validation/install.php"] [unique_id "alxlqOyJE89wAff52KVq6AAAAYg"]
[Sat Jul 18 23:50:32.936637 2026] [security2:error] [pid 953994:tid 954158] [client 45.133.7.78:62439] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 78.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "alxlqOyJE89wAff52KVq6gAAASw"]
[Sat Jul 18 23:50:33.211345 2026] [security2:error] [pid 953994:tid 954071] [remote 41.76.213.235:54216] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "jhavoctattoos.com"] [uri "/wp-login.php"] [unique_id "alxlqeyJE89wAff52KVq-QABQ0w"]
[Sat Jul 18 23:50:33.617986 2026] [security2:error] [pid 953994:tid 954244] [client 45.133.7.75:59765] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/css/dist/about.php"] [unique_id "alxlqeyJE89wAff52KVrFQAAAYI"]
[Sat Jul 18 23:50:33.644185 2026] [security2:error] [pid 953994:tid 954172] [client 54.90.74.5:59100] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxlqeyJE89wAff52KVrCQABOgA"]
[Sat Jul 18 23:50:33.714080 2026] [security2:error] [pid 953994:tid 954105] [remote 41.76.213.235:54216] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "jhavoctattoos.com"] [uri "/wp-login.php"] [unique_id "alxlqeyJE89wAff52KVrGQABGm4"], referer: https://jhavoctattoos.com/wp-login.php
[Sat Jul 18 23:50:33.764239 2026] [security2:error] [pid 953994:tid 954242] [client 45.134.20.116:49607] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 116.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/sunrise/admin.php"] [unique_id "alxlqeyJE89wAff52KVrGwAAAYA"]
[Sat Jul 18 23:50:33.877619 2026] [security2:error] [pid 953994:tid 954181] [client 50.116.65.227:49530] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "lifeisbetterlakeside.com"] [uri "/wp-content/uploads/2025/02/IMG_9124.jpeg"] [unique_id "alxlqeyJE89wAff52KVrIgAAAYY"]
[Sat Jul 18 23:50:34.133489 2026] [security2:error] [pid 953994:tid 954016] [remote 182.77.62.24:43518] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.62.77.182.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxlquyJE89wAff52KVrNAABgxU"]
[Sat Jul 18 23:50:34.300135 2026] [security2:error] [pid 953994:tid 954190] [client 45.133.7.105:59769] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/as.php"] [unique_id "alxlquyJE89wAff52KVrPgAAAUw"]
[Sat Jul 18 23:50:34.415798 2026] [security2:error] [pid 953994:tid 954243] [client 85.204.70.112:49576] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "www.guidehunting.com"] [uri "/cgi-bin/"] [unique_id "alxlquyJE89wAff52KVrSAAAAYE"]
[Sat Jul 18 23:50:34.439029 2026] [security2:error] [pid 953994:tid 954007] [remote 98.70.32.248:34630] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.32.70.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "longevityperformanceclinic.com"] [uri "/wp-login.php"] [unique_id "alxlquyJE89wAff52KVrRwABEgw"]
[Sat Jul 18 23:50:34.632349 2026] [security2:error] [pid 953994:tid 954225] [client 45.134.20.133:57729] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/gifclass.php"] [unique_id "alxlquyJE89wAff52KVrWQAAAW8"]
[Sat Jul 18 23:50:34.655131 2026] [security2:error] [pid 953994:tid 954009] [remote 182.77.62.24:43518] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.62.77.182.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxlquyJE89wAff52KVrWwABQg4"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:50:34.839516 2026] [security2:error] [pid 953994:tid 953996] [remote 98.70.32.248:34630] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.32.70.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "longevityperformanceclinic.com"] [uri "/wp-login.php"] [unique_id "alxlquyJE89wAff52KVrZgABIgE"], referer: https://longevityperformanceclinic.com/wp-login.php
[Sat Jul 18 23:50:34.980580 2026] [security2:error] [pid 953994:tid 954174] [client 45.133.7.79:20935] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 79.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/customize/about.php"] [unique_id "alxlquyJE89wAff52KVrcAAAATw"]
[Sat Jul 18 23:50:35.486219 2026] [security2:error] [pid 953994:tid 954246] [client 45.134.20.138:57799] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 138.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/plugin.php"] [unique_id "alxlq-yJE89wAff52KVrgwAAAYQ"]
[Sat Jul 18 23:50:35.537443 2026] [security2:error] [pid 953994:tid 954160] [client 74.208.214.194:48032] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxlq-yJE89wAff52KVrhwAAAS4"]
[Sat Jul 18 23:50:35.660503 2026] [security2:error] [pid 953994:tid 954183] [client 45.133.7.76:30799] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 76.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/js/simi.php"] [unique_id "alxlq-yJE89wAff52KVrjwAAAUU"]
[Sat Jul 18 23:50:35.883950 2026] [security2:error] [pid 953994:tid 954146] [client 138.252.89.100:55313] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlq-yJE89wAff52KVroQAAASA"]
[Sat Jul 18 23:50:35.884072 2026] [security2:error] [pid 953994:tid 954146] [client 138.252.89.100:55313] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlq-yJE89wAff52KVroQAAASA"]
[Sat Jul 18 23:50:36.162194 2026] [security2:error] [pid 953994:tid 954058] [remote 194.164.192.228:53122] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 228.192.164.194.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxlrOyJE89wAff52KVrtwABED8"]
[Sat Jul 18 23:50:36.344283 2026] [security2:error] [pid 953994:tid 954180] [client 45.133.7.71:49509] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 71.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/images/chosen.php"] [unique_id "alxlrOyJE89wAff52KVrxgAAAUI"]
[Sat Jul 18 23:50:36.346046 2026] [security2:error] [pid 953994:tid 954067] [remote 194.164.192.228:53122] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 228.192.164.194.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxlrOyJE89wAff52KVrxQABO0g"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:50:36.351734 2026] [security2:error] [pid 953994:tid 954219] [client 45.134.20.116:36787] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 116.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/twentytwentyfour/bypass.php"] [unique_id "alxlrOyJE89wAff52KVrxwAAAWk"]
[Sat Jul 18 23:50:37.030371 2026] [ssl:error] [pid 953994:tid 954137] [client 98.88.137.2:23673] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname cpanel.uvc.igc.mybluehost.me provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:50:37.034904 2026] [security2:error] [pid 953994:tid 954216] [client 45.133.7.93:24993] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 93.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/gold.php"] [unique_id "alxlreyJE89wAff52KVr8QAAAWY"]
[Sat Jul 18 23:50:37.220229 2026] [security2:error] [pid 953994:tid 954200] [client 45.134.20.120:30241] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 120.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/update-core.php"] [unique_id "alxlreyJE89wAff52KVr_QAAAVY"]
[Sat Jul 18 23:50:37.242539 2026] [security2:error] [pid 953994:tid 954122] [remote 72.167.132.114:42722] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxlreyJE89wAff52KVr_gABcX8"]
[Sat Jul 18 23:50:37.440423 2026] [security2:error] [pid 953994:tid 954188] [client 34.90.191.83:32768] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "www.narv.co"] [uri "/"] [unique_id "alxlreyJE89wAff52KVsDQAAAUo"]
[Sat Jul 18 23:50:37.440506 2026] [security2:error] [pid 953994:tid 954188] [client 34.90.191.83:32768] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "www.narv.co"] [uri "/"] [unique_id "alxlreyJE89wAff52KVsDQAAAUo"]
[Sat Jul 18 23:50:37.723528 2026] [security2:error] [pid 953994:tid 954189] [client 45.133.7.61:29769] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "alxlreyJE89wAff52KVsIQAAAUs"]
[Sat Jul 18 23:50:37.760152 2026] [security2:error] [pid 953994:tid 954004] [remote 72.167.132.114:42722] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxlreyJE89wAff52KVsIwABZwk"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:50:38.080694 2026] [security2:error] [pid 953994:tid 954206] [client 45.134.20.109:57923] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 109.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/blue/about.php"] [unique_id "alxlruyJE89wAff52KVsNQAAAVw"]
[Sat Jul 18 23:50:38.350813 2026] [security2:error] [pid 953994:tid 954159] [client 216.244.66.231:34256] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.thewelloiledlife.com"] [uri "/robots.txt"] [unique_id "alxlruyJE89wAff52KVsQgAAAS0"]
[Sat Jul 18 23:50:38.350911 2026] [security2:error] [pid 953994:tid 954159] [client 216.244.66.231:34256] ModSecurity: Warning. Matched phrase "Dotbot" at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "www.thewelloiledlife.com"] [uri "/robots.txt"] [unique_id "alxlruyJE89wAff52KVsQgAAAS0"]
[Sat Jul 18 23:50:38.405849 2026] [security2:error] [pid 953994:tid 954163] [client 45.133.7.105:47533] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/mu-plugins/index.php"] [unique_id "alxlruyJE89wAff52KVsQwAAATE"]
[Sat Jul 18 23:50:38.627745 2026] [security2:error] [pid 953994:tid 954248] [client 36.83.95.75:52043] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlruyJE89wAff52KVsUAAAAYY"]
[Sat Jul 18 23:50:38.627916 2026] [security2:error] [pid 953994:tid 954248] [client 36.83.95.75:52043] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlruyJE89wAff52KVsUAAAAYY"]
[Sat Jul 18 23:50:38.939389 2026] [security2:error] [pid 953994:tid 954245] [client 45.134.20.109:62593] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 109.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-mail.php"] [unique_id "alxlruyJE89wAff52KVsbwAAAYM"]
[Sat Jul 18 23:50:39.090942 2026] [security2:error] [pid 953994:tid 954163] [client 45.133.7.57:36613] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 57.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "alxlr-yJE89wAff52KVsdgAAATE"]
[Sat Jul 18 23:50:39.202655 2026] [security2:error] [pid 953994:tid 954165] [client 66.249.89.66:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "tiokubito.cl"] [uri "/index.php"] [unique_id "alxlruyJE89wAff52KVscAABM2M"], referer: https://tiokubito.cl/producto/%E3%80%90preventa%E3%80%91chuzhen-studio-escala-1-5-natsu-con-led/
[Sat Jul 18 23:50:39.712413 2026] [security2:error] [pid 953994:tid 954178] [client 163.61.1.17:62705] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlr-yJE89wAff52KVsowAAAUA"]
[Sat Jul 18 23:50:39.712499 2026] [security2:error] [pid 953994:tid 954178] [client 163.61.1.17:62705] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlr-yJE89wAff52KVsowAAAUA"]
[Sat Jul 18 23:50:39.770012 2026] [security2:error] [pid 953994:tid 954165] [client 45.133.7.62:54759] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "alxlr-yJE89wAff52KVspwAAATM"]
[Sat Jul 18 23:50:39.798407 2026] [security2:error] [pid 953994:tid 954174] [client 45.134.20.137:62531] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 137.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/admin.php"] [unique_id "alxlr-yJE89wAff52KVsqAAAATw"]
[Sat Jul 18 23:50:40.605398 2026] [http2:info] [pid 983601:tid 983601] h2_workers: created with min=128 max=192 idle_ms=600000
[Sat Jul 18 23:50:40.624093 2026] [security2:error] [pid 983601:tid 983731] [client 45.133.7.57:49063] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 57.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "alxlsFaztLkF4ZwQhXLW7gAAAIU"]
[Sat Jul 18 23:50:40.687602 2026] [security2:error] [pid 983601:tid 983765] [client 45.134.20.120:59007] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 120.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/defaults.php"] [unique_id "alxlsFaztLkF4ZwQhXLXCAAAAKc"]
[Sat Jul 18 23:50:40.798516 2026] [security2:error] [pid 953994:tid 954200] [client 180.252.198.240:63539] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlsOyJE89wAff52KVsrgAAAVY"]
[Sat Jul 18 23:50:40.798717 2026] [security2:error] [pid 953994:tid 954200] [client 180.252.198.240:63539] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlsOyJE89wAff52KVsrgAAAVY"]
[Sat Jul 18 23:50:40.902065 2026] [security2:error] [pid 983601:tid 983735] [client 103.160.26.178:55856] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlsFaztLkF4ZwQhXLXFAAAAIk"]
[Sat Jul 18 23:50:40.902221 2026] [security2:error] [pid 983601:tid 983735] [client 103.160.26.178:55856] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlsFaztLkF4ZwQhXLXFAAAAIk"]
[Sat Jul 18 23:50:41.305420 2026] [security2:error] [pid 983601:tid 983852] [client 45.133.7.77:56977] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 77.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/chosen.php"] [unique_id "alxlsVaztLkF4ZwQhXLXKgAAAP4"]
[Sat Jul 18 23:50:41.541708 2026] [security2:error] [pid 983601:tid 983758] [client 45.134.20.137:54257] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 137.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/acme-challenge/content.php"] [unique_id "alxlsVaztLkF4ZwQhXLXOgAAAKA"]
[Sat Jul 18 23:50:41.988979 2026] [security2:error] [pid 983601:tid 983771] [client 45.133.7.89:60457] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 89.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/pwnd/autoload_classmap.php"] [unique_id "alxlsVaztLkF4ZwQhXLXVQAAAK0"]
[Sat Jul 18 23:50:42.259849 2026] [ssl:error] [pid 983601:tid 983851] [client 3.233.59.216:27795] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname webmail.yok.mqz.mybluehost.me provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:50:42.405764 2026] [security2:error] [pid 983601:tid 983765] [client 45.134.20.106:36175] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/ALFA_DATA/alfacgiapi/bypass.php"] [unique_id "alxlslaztLkF4ZwQhXLXdgAAAKc"]
[Sat Jul 18 23:50:42.664133 2026] [security2:error] [pid 983601:tid 983675] [remote 31.42.184.154:46824] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxlslaztLkF4ZwQhXLXkQAA9Uk"]
[Sat Jul 18 23:50:42.670112 2026] [security2:error] [pid 983601:tid 983762] [client 45.133.7.103:34025] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "alxlslaztLkF4ZwQhXLXkgAAAKQ"]
[Sat Jul 18 23:50:42.711686 2026] [security2:error] [pid 983601:tid 983763] [client 20.63.100.92:11698] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.100.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "daseighty.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "alxlslaztLkF4ZwQhXLXlQAAAKU"]
[Sat Jul 18 23:50:42.711839 2026] [security2:error] [pid 983601:tid 983763] [client 20.63.100.92:11698] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "daseighty.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "alxlslaztLkF4ZwQhXLXlQAAAKU"]
[Sat Jul 18 23:50:42.960110 2026] [security2:error] [pid 983601:tid 983687] [remote 31.42.184.154:46824] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxlslaztLkF4ZwQhXLXrAAA_lU"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:50:43.262336 2026] [security2:error] [pid 983601:tid 983747] [client 45.134.20.115:48583] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "655"] [id "900155"] [msg "WP Brute UA block"] [hostname "swafforddetailing.com"] [uri "/wp-admin/maint/about.php"] [unique_id "alxls1aztLkF4ZwQhXLX1AAAAJU"]
[Sat Jul 18 23:50:43.363363 2026] [security2:error] [pid 983601:tid 983792] [client 45.133.7.80:37165] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/alam.php"] [unique_id "alxls1aztLkF4ZwQhXLX1wAAAMI"]
[Sat Jul 18 23:50:43.380022 2026] [security2:error] [pid 983601:tid 983756] [client 20.63.100.92:11680] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.100.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "daseighty.net"] [uri "/this_is_a_new_hello_world.php"] [unique_id "alxls1aztLkF4ZwQhXLX2gAAAJ4"]
[Sat Jul 18 23:50:43.380144 2026] [security2:error] [pid 983601:tid 983756] [client 20.63.100.92:11680] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "daseighty.net"] [uri "/this_is_a_new_hello_world.php"] [unique_id "alxls1aztLkF4ZwQhXLX2gAAAJ4"]
[Sat Jul 18 23:50:44.047976 2026] [security2:error] [pid 983601:tid 983790] [client 45.133.7.79:37669] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 79.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/css/adminfusm.php"] [unique_id "alxltFaztLkF4ZwQhXLYFQAAAMA"]
[Sat Jul 18 23:50:44.119595 2026] [security2:error] [pid 983601:tid 983796] [client 45.134.20.132:44201] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/js/about.php"] [unique_id "alxltFaztLkF4ZwQhXLYGQAAAMY"]
[Sat Jul 18 23:50:44.729152 2026] [security2:error] [pid 983601:tid 983771] [client 45.133.7.90:35463] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 90.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "alxltFaztLkF4ZwQhXLYOgAAAK0"]
[Sat Jul 18 23:50:44.975319 2026] [security2:error] [pid 983601:tid 983653] [remote 103.75.185.95:36444] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxltFaztLkF4ZwQhXLYRAAA-DM"]
[Sat Jul 18 23:50:44.975786 2026] [security2:error] [pid 983601:tid 983748] [client 45.134.20.115:63067] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/uploads/2023/05/404.php"] [unique_id "alxltFaztLkF4ZwQhXLYSwAAAJY"]
[Sat Jul 18 23:50:45.079299 2026] [security2:error] [pid 983601:tid 983785] [client 57.141.18.98:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxltFaztLkF4ZwQhXLYQQAAALs"]
[Sat Jul 18 23:50:45.411525 2026] [security2:error] [pid 983601:tid 983851] [client 45.133.7.95:31489] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/raw.php"] [unique_id "alxltVaztLkF4ZwQhXLYdAAAAP0"]
[Sat Jul 18 23:50:45.459373 2026] [security2:error] [pid 983601:tid 983686] [remote 103.75.185.95:36444] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxltVaztLkF4ZwQhXLYdgAArFQ"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:50:45.832041 2026] [security2:error] [pid 983601:tid 983757] [client 45.134.20.127:35265] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 127.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "alxltVaztLkF4ZwQhXLYlgAAAJ8"]
[Sat Jul 18 23:50:46.095391 2026] [security2:error] [pid 983601:tid 983774] [client 45.133.7.101:55807] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 101.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "alxltlaztLkF4ZwQhXLYoQAAALA"]
[Sat Jul 18 23:50:46.332937 2026] [security2:error] [pid 983601:tid 983820] [client 20.63.100.92:12141] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.100.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "daseighty.net"] [uri "/x.php"] [unique_id "alxltlaztLkF4ZwQhXLYqgAAAN4"]
[Sat Jul 18 23:50:46.333027 2026] [security2:error] [pid 983601:tid 983820] [client 20.63.100.92:12141] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "daseighty.net"] [uri "/x.php"] [unique_id "alxltlaztLkF4ZwQhXLYqgAAAN4"]
[Sat Jul 18 23:50:46.693792 2026] [security2:error] [pid 983601:tid 983748] [client 45.134.20.128:27863] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/assets/bypass.php"] [unique_id "alxltlaztLkF4ZwQhXLYyQAAAJY"]
[Sat Jul 18 23:50:46.787846 2026] [security2:error] [pid 983601:tid 983735] [client 45.133.7.70:28231] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/includes/admin.php"] [unique_id "alxltlaztLkF4ZwQhXLYzgAAAIk"]
[Sat Jul 18 23:50:46.992284 2026] [security2:error] [pid 983601:tid 983724] [remote 188.138.102.156:34642] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxltlaztLkF4ZwQhXLY2gAArXo"]
[Sat Jul 18 23:50:46.992427 2026] [security2:error] [pid 983601:tid 983771] [client 188.138.102.156:34642] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxltlaztLkF4ZwQhXLY2gAArXo"]
[Sat Jul 18 23:50:47.477516 2026] [security2:error] [pid 983601:tid 983819] [client 45.133.7.97:58893] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 97.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/customize/chosen.php"] [unique_id "alxlt1aztLkF4ZwQhXLY9AAAAN0"]
[Sat Jul 18 23:50:47.542060 2026] [security2:error] [pid 983601:tid 983797] [client 138.252.89.100:55831] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlt1aztLkF4ZwQhXLY-gAAAMc"]
[Sat Jul 18 23:50:47.542158 2026] [security2:error] [pid 983601:tid 983797] [client 138.252.89.100:55831] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlt1aztLkF4ZwQhXLY-gAAAMc"]
[Sat Jul 18 23:50:47.549979 2026] [security2:error] [pid 983601:tid 983778] [client 45.134.20.133:37117] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/aa.php"] [unique_id "alxlt1aztLkF4ZwQhXLY-wAAALQ"]
[Sat Jul 18 23:50:48.078232 2026] [security2:error] [pid 983601:tid 983811] [client 20.63.100.92:9070] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.100.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "daseighty.net"] [uri "/aa.php"] [unique_id "alxluFaztLkF4ZwQhXLZGQAAANU"]
[Sat Jul 18 23:50:48.078338 2026] [security2:error] [pid 983601:tid 983811] [client 20.63.100.92:9070] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "daseighty.net"] [uri "/aa.php"] [unique_id "alxluFaztLkF4ZwQhXLZGQAAANU"]
[Sat Jul 18 23:50:48.158020 2026] [security2:error] [pid 983601:tid 983820] [client 45.133.7.96:41815] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 96.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/uploads/2021/wp-works.php"] [unique_id "alxluFaztLkF4ZwQhXLZHgAAAN4"]
[Sat Jul 18 23:50:48.405939 2026] [security2:error] [pid 983601:tid 983765] [client 45.134.20.113:47335] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/index2.php"] [unique_id "alxluFaztLkF4ZwQhXLZLAAAAKc"]
[Sat Jul 18 23:50:48.519192 2026] [proxy:error] [pid 983601:tid 983778] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:50:48.519231 2026] [proxy_http:error] [pid 983601:tid 983778] [client 193.47.62.168:42194] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:50:48.519986 2026] [proxy:error] [pid 983601:tid 983778] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:50:48.520015 2026] [proxy_http:error] [pid 983601:tid 983778] [client 193.47.62.168:42194] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:50:48.837239 2026] [security2:error] [pid 983601:tid 983813] [client 45.133.7.65:45607] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 65.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/media-new.php"] [unique_id "alxluFaztLkF4ZwQhXLZQwAAANc"]
[Sat Jul 18 23:50:48.877823 2026] [security2:error] [pid 983601:tid 983654] [remote 205.196.217.58:38688] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.217.196.205.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxluFaztLkF4ZwQhXLZRQAA_TQ"]
[Sat Jul 18 23:50:49.098501 2026] [security2:error] [pid 983601:tid 983651] [remote 205.196.217.58:38688] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.217.196.205.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxluVaztLkF4ZwQhXLZTgAAjzE"], referer: https://mezzacraft.com/wp-login.php
[Sat Jul 18 23:50:49.235993 2026] [security2:error] [pid 983601:tid 983821] [client 36.83.95.75:52528] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxluVaztLkF4ZwQhXLZWgAAAN8"]
[Sat Jul 18 23:50:49.236086 2026] [security2:error] [pid 983601:tid 983821] [client 36.83.95.75:52528] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxluVaztLkF4ZwQhXLZWgAAAN8"]
[Sat Jul 18 23:50:49.264118 2026] [security2:error] [pid 983601:tid 983829] [client 45.134.20.104:44801] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/hello-element/footer.php"] [unique_id "alxluVaztLkF4ZwQhXLZXwAAAOc"]
[Sat Jul 18 23:50:49.516712 2026] [security2:error] [pid 983601:tid 983813] [client 45.133.7.61:60587] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/media-new.php"] [unique_id "alxluVaztLkF4ZwQhXLZdwAAANc"]
[Sat Jul 18 23:50:49.591293 2026] [security2:error] [pid 983601:tid 983643] [remote 31.42.184.154:47974] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "str.cly.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxluVaztLkF4ZwQhXLZfQAArCk"]
[Sat Jul 18 23:50:49.591407 2026] [security2:error] [pid 983601:tid 983770] [client 31.42.184.154:47974] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "str.cly.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxluVaztLkF4ZwQhXLZfQAArCk"]
[Sat Jul 18 23:50:49.654204 2026] [security2:error] [pid 983601:tid 983759] [client 20.63.100.92:11298] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.100.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "daseighty.net"] [uri "/blue.php"] [unique_id "alxluVaztLkF4ZwQhXLZgQAAAKE"]
[Sat Jul 18 23:50:49.654284 2026] [security2:error] [pid 983601:tid 983759] [client 20.63.100.92:11298] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "daseighty.net"] [uri "/blue.php"] [unique_id "alxluVaztLkF4ZwQhXLZgQAAAKE"]
[Sat Jul 18 23:50:50.121259 2026] [security2:error] [pid 983601:tid 983773] [client 45.134.20.137:35087] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 137.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/network/admin.php"] [unique_id "alxlulaztLkF4ZwQhXLZmgAAAK8"]
[Sat Jul 18 23:50:50.196543 2026] [security2:error] [pid 983601:tid 983841] [client 45.133.7.79:25123] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 79.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/js/class_api.php"] [unique_id "alxlulaztLkF4ZwQhXLZngAAAPM"]
[Sat Jul 18 23:50:50.531128 2026] [security2:error] [pid 983601:tid 983820] [client 163.61.1.17:63188] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlulaztLkF4ZwQhXLZrQAAAN4"]
[Sat Jul 18 23:50:50.531235 2026] [security2:error] [pid 983601:tid 983820] [client 163.61.1.17:63188] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlulaztLkF4ZwQhXLZrQAAAN4"]
[Sat Jul 18 23:50:50.782622 2026] [security2:error] [pid 983601:tid 983824] [client 180.252.198.240:64018] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlulaztLkF4ZwQhXLZxgAAAOI"]
[Sat Jul 18 23:50:50.782777 2026] [security2:error] [pid 983601:tid 983824] [client 180.252.198.240:64018] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlulaztLkF4ZwQhXLZxgAAAOI"]
[Sat Jul 18 23:50:50.850424 2026] [security2:error] [pid 983601:tid 983767] [client 103.160.26.178:56358] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlulaztLkF4ZwQhXLZzAAAAKk"]
[Sat Jul 18 23:50:50.850500 2026] [security2:error] [pid 983601:tid 983767] [client 103.160.26.178:56358] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlulaztLkF4ZwQhXLZzAAAAKk"]
[Sat Jul 18 23:50:50.881849 2026] [security2:error] [pid 983601:tid 983762] [client 45.133.7.98:64417] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 98.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/uploads/2021/themes.php"] [unique_id "alxlulaztLkF4ZwQhXLZ0QAAAKQ"]
[Sat Jul 18 23:50:50.986422 2026] [security2:error] [pid 983601:tid 983757] [client 45.134.20.135:27753] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/pki-validation/2index.php"] [unique_id "alxlulaztLkF4ZwQhXLZ3gAAAJ8"]
[Sat Jul 18 23:50:51.057144 2026] [security2:error] [pid 983601:tid 983826] [client 20.63.100.92:12128] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.100.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "daseighty.net"] [uri "/num.php"] [unique_id "alxlu1aztLkF4ZwQhXLZ4AAAAOQ"]
[Sat Jul 18 23:50:51.057228 2026] [security2:error] [pid 983601:tid 983826] [client 20.63.100.92:12128] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "daseighty.net"] [uri "/num.php"] [unique_id "alxlu1aztLkF4ZwQhXLZ4AAAAOQ"]
[Sat Jul 18 23:50:51.564992 2026] [security2:error] [pid 983601:tid 983824] [client 45.133.7.89:40053] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 89.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/admin/install.php"] [unique_id "alxlu1aztLkF4ZwQhXLZ_wAAAOI"]
[Sat Jul 18 23:50:51.842586 2026] [security2:error] [pid 983601:tid 983843] [client 45.134.20.124:26671] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 124.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/languages/plugins.php"] [unique_id "alxlu1aztLkF4ZwQhXLaDQAAAPU"]
[Sat Jul 18 23:50:51.923705 2026] [security2:error] [pid 983601:tid 983756] [client 50.116.65.227:45740] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "learnthissecret.com"] [uri "/index.php"] [unique_id "alxlu1aztLkF4ZwQhXLaAwAAAJ4"]
[Sat Jul 18 23:50:52.066112 2026] [security2:error] [pid 983601:tid 983612] [remote 51.79.215.219:33876] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 219.215.79.51.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.idf.ldc.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxlvFaztLkF4ZwQhXLaJQAAwQo"]
[Sat Jul 18 23:50:52.100126 2026] [security2:error] [pid 983601:tid 983792] [client 23.160.60.184:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "claysharecon.com"] [uri "/index.php"] [unique_id "alxlvFaztLkF4ZwQhXLaJAAAAMI"]
[Sat Jul 18 23:50:52.213459 2026] [security2:error] [pid 983601:tid 983734] [client 217.217.245.230:51093] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.245.217.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxlvFaztLkF4ZwQhXLaNAAAAIg"]
[Sat Jul 18 23:50:52.213617 2026] [security2:error] [pid 983601:tid 983734] [client 217.217.245.230:51093] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxlvFaztLkF4ZwQhXLaNAAAAIg"]
[Sat Jul 18 23:50:52.237324 2026] [security2:error] [pid 983601:tid 983827] [client 50.116.65.227:45754] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "learnthissecret.com"] [uri "/index.php"] [unique_id "alxlu1aztLkF4ZwQhXLaEgAAAOU"]
[Sat Jul 18 23:50:52.246881 2026] [security2:error] [pid 983601:tid 983788] [client 45.133.7.70:54345] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/plugin.php"] [unique_id "alxlvFaztLkF4ZwQhXLaOAAAAL4"]
[Sat Jul 18 23:50:52.411667 2026] [security2:error] [pid 983601:tid 983786] [client 34.210.88.185:58890] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.88.210.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxlvFaztLkF4ZwQhXLaRgAAALw"]
[Sat Jul 18 23:50:52.425573 2026] [security2:error] [pid 983601:tid 983621] [remote 51.79.215.219:33876] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 219.215.79.51.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.idf.ldc.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxlvFaztLkF4ZwQhXLaSgAAnBM"], referer: https://mail.idf.ldc.mybluehost.me/wp-login.php
[Sat Jul 18 23:50:52.557454 2026] [security2:error] [pid 983601:tid 983736] [client 152.42.242.202:61498] ModSecurity: Access denied with code 406 (phase 2). Match of "rx [.](png|jpeg|jpg|tiff|bmp|gif|webp|heif|svg|raw|ico|ppm|pgm|pbm|exr|nef|dng|cr2|orf|arw|pef|sr2|raf|kdc|indd|ai|eps|pdf|psd|tga|hdr|j2k|jpf|jp2|pspimage|cut|icns|webm|bpg|avif|heic|fpx|hdri|hdp|yuv|sgi|xpm|svgz)$" against "REQUEST_FILENAME" required. [file "/opt/mod_security/hg_rules.conf"] [line "842"] [id "900095"] [msg "Bad UA :: Fake Mozilla Agent"] [hostname "thewritinglair.com"] [uri "/"] [unique_id "alxlvFaztLkF4ZwQhXLaUQAAAIo"]
[Sat Jul 18 23:50:52.702838 2026] [security2:error] [pid 983601:tid 983791] [client 45.134.20.122:49833] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/shell.php"] [unique_id "alxlvFaztLkF4ZwQhXLaVAAAAME"]
[Sat Jul 18 23:50:52.927941 2026] [security2:error] [pid 983601:tid 983795] [client 45.133.7.100:59357] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "alxlvFaztLkF4ZwQhXLaYAAAAMU"]
[Sat Jul 18 23:50:53.070772 2026] [security2:error] [pid 983601:tid 983814] [client 16.145.89.170:45688] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 170.89.145.16.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxlvVaztLkF4ZwQhXLacQAAANg"]
[Sat Jul 18 23:50:53.370240 2026] [security2:error] [pid 983601:tid 983635] [remote 60.205.8.163:42884] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 163.8.205.60.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxlvVaztLkF4ZwQhXLaggAAoSE"]
[Sat Jul 18 23:50:53.564494 2026] [security2:error] [pid 983601:tid 983766] [client 45.134.20.118:55509] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/content.php"] [unique_id "alxlvVaztLkF4ZwQhXLawAAAAKg"]
[Sat Jul 18 23:50:53.608605 2026] [security2:error] [pid 983601:tid 983746] [client 45.133.7.97:61445] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 97.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/js/item.php"] [unique_id "alxlvVaztLkF4ZwQhXLaxgAAAJQ"]
[Sat Jul 18 23:50:54.297261 2026] [security2:error] [pid 983601:tid 983852] [client 45.133.7.61:38093] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/pages.php"] [unique_id "alxlvlaztLkF4ZwQhXLa9QAAAP4"]
[Sat Jul 18 23:50:54.418624 2026] [security2:error] [pid 983601:tid 983835] [client 45.134.20.113:64325] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/Text/about.php"] [unique_id "alxlvlaztLkF4ZwQhXLbAwAAAO0"]
[Sat Jul 18 23:50:54.937675 2026] [security2:error] [pid 983601:tid 983759] [client 20.63.100.92:9882] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.100.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "daseighty.net"] [uri "/rh.php"] [unique_id "alxlvlaztLkF4ZwQhXLbLAAAAKE"]
[Sat Jul 18 23:50:54.937781 2026] [security2:error] [pid 983601:tid 983759] [client 20.63.100.92:9882] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "daseighty.net"] [uri "/rh.php"] [unique_id "alxlvlaztLkF4ZwQhXLbLAAAAKE"]
[Sat Jul 18 23:50:54.982605 2026] [security2:error] [pid 983601:tid 983852] [client 45.133.7.97:27465] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 97.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "alxlvlaztLkF4ZwQhXLbMAAAAP4"]
[Sat Jul 18 23:50:55.280052 2026] [security2:error] [pid 983601:tid 983837] [client 45.134.20.122:35125] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/network/atomlib.php"] [unique_id "alxlv1aztLkF4ZwQhXLbSwAAAO8"]
[Sat Jul 18 23:50:55.665844 2026] [security2:error] [pid 983601:tid 983818] [client 45.133.7.83:61093] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/classwithtostring.php%20"] [unique_id "alxlv1aztLkF4ZwQhXLbZAAAANw"]
[Sat Jul 18 23:50:56.027432 2026] [security2:error] [pid 983601:tid 983634] [remote 41.186.86.12:25461] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxlwFaztLkF4ZwQhXLbdwABBCA"]
[Sat Jul 18 23:50:56.135321 2026] [security2:error] [pid 983601:tid 983817] [client 45.134.20.139:42133] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 139.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/install.php"] [unique_id "alxlwFaztLkF4ZwQhXLbhAAAANs"]
[Sat Jul 18 23:50:56.185530 2026] [security2:error] [pid 983601:tid 983685] [remote 31.42.184.154:52468] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxlwFaztLkF4ZwQhXLbigAAqlM"]
[Sat Jul 18 23:50:56.347892 2026] [security2:error] [pid 983601:tid 983833] [client 45.133.7.91:40719] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 91.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/uploads/function.php"] [unique_id "alxlwFaztLkF4ZwQhXLbkwAAAOs"]
[Sat Jul 18 23:50:56.439356 2026] [security2:error] [pid 983601:tid 983753] [client 20.63.100.92:2213] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.100.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "daseighty.net"] [uri "/sh.php"] [unique_id "alxlwFaztLkF4ZwQhXLbnQAAAJs"]
[Sat Jul 18 23:50:56.439429 2026] [security2:error] [pid 983601:tid 983753] [client 20.63.100.92:2213] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "daseighty.net"] [uri "/sh.php"] [unique_id "alxlwFaztLkF4ZwQhXLbnQAAAJs"]
[Sat Jul 18 23:50:56.529030 2026] [security2:error] [pid 983601:tid 983650] [remote 41.186.86.12:25461] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxlwFaztLkF4ZwQhXLbowAAqDA"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:50:57.007843 2026] [security2:error] [pid 983601:tid 983794] [client 45.134.20.129:63375] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/hehe.php"] [unique_id "alxlwFaztLkF4ZwQhXLbzwAAAMQ"]
[Sat Jul 18 23:50:57.029454 2026] [security2:error] [pid 983601:tid 983782] [client 45.133.7.90:49465] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 90.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/assets/js/doc.php"] [unique_id "alxlwVaztLkF4ZwQhXLb0gAAALg"]
[Sat Jul 18 23:50:57.293864 2026] [security2:error] [pid 983601:tid 983712] [remote 31.42.184.154:52468] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxlwVaztLkF4ZwQhXLb8QAA5W4"], referer: https://sesamegreenbeans.com/wp-login.php
[Sat Jul 18 23:50:57.720985 2026] [security2:error] [pid 983601:tid 983803] [client 45.133.7.57:26693] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 57.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/assets/comfunctions.php"] [unique_id "alxlwVaztLkF4ZwQhXLcCwAAAM0"]
[Sat Jul 18 23:50:57.862988 2026] [security2:error] [pid 983601:tid 983809] [client 45.134.20.121:46553] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 121.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "alxlwVaztLkF4ZwQhXLcGAAAANM"]
[Sat Jul 18 23:50:58.374197 2026] [security2:error] [pid 983601:tid 983616] [remote 74.235.96.117:37296] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.235.74.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "arunavabanerjee.com"] [uri "/wp-login.php"] [unique_id "alxlwlaztLkF4ZwQhXLcOQAA-g4"]
[Sat Jul 18 23:50:58.400089 2026] [security2:error] [pid 983601:tid 983765] [client 45.133.7.84:44103] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 84.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "alxlwlaztLkF4ZwQhXLcPQAAAKc"]
[Sat Jul 18 23:50:58.532803 2026] [security2:error] [pid 983601:tid 983602] [remote 217.113.60.80:37008] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.60.113.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxlwlaztLkF4ZwQhXLcQAAAnAA"]
[Sat Jul 18 23:50:58.578945 2026] [security2:error] [pid 983601:tid 983603] [remote 74.235.96.117:37296] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.235.74.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "arunavabanerjee.com"] [uri "/wp-login.php"] [unique_id "alxlwlaztLkF4ZwQhXLcRQAA2wE"], referer: https://arunavabanerjee.com/wp-login.php
[Sat Jul 18 23:50:58.734945 2026] [security2:error] [pid 983601:tid 983836] [client 45.134.20.138:29965] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 138.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/css/slider.php"] [unique_id "alxlwlaztLkF4ZwQhXLcUQAAAO4"]
[Sat Jul 18 23:50:58.762360 2026] [security2:error] [pid 983601:tid 983614] [remote 217.113.60.80:37008] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.60.113.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxlwlaztLkF4ZwQhXLcUwAA4ww"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:50:59.073847 2026] [security2:error] [pid 983601:tid 983846] [client 138.252.89.100:56337] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlw1aztLkF4ZwQhXLcZQAAAPg"]
[Sat Jul 18 23:50:59.073947 2026] [security2:error] [pid 983601:tid 983846] [client 138.252.89.100:56337] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlw1aztLkF4ZwQhXLcZQAAAPg"]
[Sat Jul 18 23:50:59.090738 2026] [security2:error] [pid 983601:tid 983751] [client 45.133.7.76:47905] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 76.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/css/adminfus.php"] [unique_id "alxlw1aztLkF4ZwQhXLcZwAAAJk"]
[Sat Jul 18 23:50:59.595409 2026] [security2:error] [pid 983601:tid 983806] [client 45.134.20.105:30847] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/dir.php"] [unique_id "alxlw1aztLkF4ZwQhXLcigAAANA"]
[Sat Jul 18 23:50:59.625249 2026] [security2:error] [pid 983601:tid 983798] [client 74.7.244.19:48952] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "royalart-lb.com"] [uri "/index.php"] [unique_id "alxlw1aztLkF4ZwQhXLccgAAyCc"]
[Sat Jul 18 23:50:59.776200 2026] [security2:error] [pid 983601:tid 983820] [client 45.133.7.103:38859] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/adminfus.php"] [unique_id "alxlw1aztLkF4ZwQhXLcmQAAAN4"]
[Sat Jul 18 23:51:00.031466 2026] [security2:error] [pid 983601:tid 983779] [client 36.83.95.75:53033] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlxFaztLkF4ZwQhXLcpgAAALU"]
[Sat Jul 18 23:51:00.031556 2026] [security2:error] [pid 983601:tid 983779] [client 36.83.95.75:53033] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlxFaztLkF4ZwQhXLcpgAAALU"]
[Sat Jul 18 23:51:00.387295 2026] [security2:error] [pid 983601:tid 983678] [remote 98.156.100.191:59410] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 191.100.156.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxlxFaztLkF4ZwQhXLcvwAA0Uw"]
[Sat Jul 18 23:51:00.455558 2026] [security2:error] [pid 983601:tid 983789] [client 45.134.20.136:22077] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 136.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/css/atomlib.php"] [unique_id "alxlxFaztLkF4ZwQhXLcwQAAAL8"]
[Sat Jul 18 23:51:00.464427 2026] [security2:error] [pid 983601:tid 983735] [client 45.133.7.58:64099] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/css/litespeed.php"] [unique_id "alxlxFaztLkF4ZwQhXLcxAAAAIk"]
[Sat Jul 18 23:51:00.673511 2026] [security2:error] [pid 983601:tid 983742] [client 23.160.60.193:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "thelastgamestandingexp.com"] [uri "/index.php"] [unique_id "alxlw1aztLkF4ZwQhXLccAAAAJA"]
[Sat Jul 18 23:51:00.756559 2026] [security2:error] [pid 983601:tid 983744] [client 20.63.100.92:2631] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.100.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "daseighty.net"] [uri "/css.php"] [unique_id "alxlxFaztLkF4ZwQhXLc3QAAAJI"]
[Sat Jul 18 23:51:00.756730 2026] [security2:error] [pid 983601:tid 983744] [client 20.63.100.92:2631] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "daseighty.net"] [uri "/css.php"] [unique_id "alxlxFaztLkF4ZwQhXLc3QAAAJI"]
[Sat Jul 18 23:51:01.153917 2026] [security2:error] [pid 983601:tid 983826] [client 45.133.7.65:41335] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 65.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/images/as.php"] [unique_id "alxlxVaztLkF4ZwQhXLc-QAAAOQ"]
[Sat Jul 18 23:51:01.316277 2026] [security2:error] [pid 983601:tid 983742] [client 45.134.20.114:24901] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/style.php"] [unique_id "alxlxVaztLkF4ZwQhXLdBAAAAJA"]
[Sat Jul 18 23:51:01.553216 2026] [security2:error] [pid 983601:tid 983768] [client 103.160.26.178:56867] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlxVaztLkF4ZwQhXLdFgAAAKo"]
[Sat Jul 18 23:51:01.553316 2026] [security2:error] [pid 983601:tid 983768] [client 103.160.26.178:56867] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxlxVaztLkF4ZwQhXLdFgAAAKo"]
[Sat Jul 18 23:51:01.561688 2026] [security2:error] [pid 983601:tid 983776] [client 50.116.65.227:57942] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "lifeisbetterlakeside.com"] [uri "/wp-content/uploads/2024/04/IMG_3272.jpeg"] [unique_id "alxlxVaztLkF4ZwQhXLdFwAAAKQ"]
[Sat Jul 18 23:51:01.823501 2026] [security2:error] [pid 983601:tid 983764] [client 183.81.169.76:43738] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 76.169.81.183.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "jvcmotorsports.com"] [uri "/installer.php"] [unique_id "alxlxVaztLkF4ZwQhXLdJQAAAKY"]
[Sat Jul 18 23:51:01.836045 2026] [security2:error] [pid 983601:tid 983830] [client 45.133.7.99:49355] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "655"] [id "900155"] [msg "WP Brute UA block"] [hostname "nikkidesigns.net"] [uri "/wp-admin/setup-config.php"] [unique_id "alxlxVaztLkF4ZwQhXLdKAAAAOg"]
[Sat Jul 18 23:51:01.991430 2026] [security2:error] [pid 983601:tid 983736] [client 180.252.198.240:64503] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlxVaztLkF4ZwQhXLdMwAAAIo"]
[Sat Jul 18 23:51:01.991554 2026] [security2:error] [pid 983601:tid 983736] [client 180.252.198.240:64503] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxlxVaztLkF4ZwQhXLdMwAAAIo"]
[Sat Jul 18 23:51:02.095248 2026] [security2:error] [pid 983601:tid 983720] [remote 217.182.128.41:36576] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.128.182.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxlxlaztLkF4ZwQhXLdQQAA9XY"]
[Sat Jul 18 23:51:02.151960 2026] [security2:error] [pid 983601:tid 983702] [remote 182.77.62.24:37412] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.62.77.182.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nomorewetsheets.net"] [uri "/wp-login.php"] [unique_id "alxlxlaztLkF4ZwQhXLdRQAAq2Q"]
[Sat Jul 18 23:51:02.176255 2026] [security2:error] [pid 983601:tid 983847] [client 45.134.20.132:53983] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/libraries/phpmailer/updates.php"] [unique_id "alxlxlaztLkF4ZwQhXLdSgAAAPk"]
[Sat Jul 18 23:51:02.297808 2026] [security2:error] [pid 983601:tid 983718] [remote 217.182.128.41:36576] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.128.182.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxlxlaztLkF4ZwQhXLdUAAAjXQ"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:51:02.315800 2026] [security2:error] [pid 983601:tid 983772] [client 97.155.247.51:48084] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "lifeisbetterlakeside.com"] [uri "/index.php"] [unique_id "alxlxlaztLkF4ZwQhXLdQAAArnc"], referer: https://lifeisbetterlakeside.com/hola-bienvenido-to-our-cinco-de-mayo-table/
[Sat Jul 18 23:51:02.383985 2026] [security2:error] [pid 983601:tid 983750] [client 183.81.169.76:43746] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 76.169.81.183.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "jvcmotorsports.com"] [uri "/installer-backup.php"] [unique_id "alxlxlaztLkF4ZwQhXLdXAAAAJg"]
[Sat Jul 18 23:51:02.451020 2026] [security2:error] [pid 983601:tid 983735] [client 20.63.100.92:4806] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.100.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "daseighty.net"] [uri "/thai.php"] [unique_id "alxlxlaztLkF4ZwQhXLdXwAAAIk"]
[Sat Jul 18 23:51:02.451129 2026] [security2:error] [pid 983601:tid 983735] [client 20.63.100.92:4806] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "daseighty.net"] [uri "/thai.php"] [unique_id "alxlxlaztLkF4ZwQhXLdXwAAAIk"]
[Sat Jul 18 23:51:02.520274 2026] [security2:error] [pid 983601:tid 983826] [client 45.133.7.99:43067] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 99.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "alxlxlaztLkF4ZwQhXLdYwAAAOQ"]
[Sat Jul 18 23:51:02.684047 2026] [security2:error] [pid 983601:tid 983724] [remote 182.77.62.24:37412] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.62.77.182.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nomorewetsheets.net"] [uri "/wp-login.php"] [unique_id "alxlxlaztLkF4ZwQhXLdcAAAxno"], referer: https://nomorewetsheets.net/wp-login.php
[Sat Jul 18 23:51:02.840945 2026] [security2:error] [pid 983601:tid 983846] [client 217.217.245.230:11035] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.245.217.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxlxlaztLkF4ZwQhXLddwAAAPg"]
[Sat Jul 18 23:51:02.841043 2026] [security2:error] [pid 983601:tid 983846] [client 217.217.245.230:11035] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxlxlaztLkF4ZwQhXLddwAAAPg"]
[Sat Jul 18 23:51:02.853380 2026] [security2:error] [pid 983601:tid 983619] [remote 220.181.108.104:23951] ModSecurity: Access denied with code 406 (phase 2). Match of "beginsWith %{request_headers.host}" against "TX:1" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "504"] [id "340162"] [rev "302"] [msg "Atomicorp.com WAF Rules: Remote File Injection Attack detected (Unauthorized URL detected as argument)"] [data ",TX:1"] [severity "CRITICAL"] [hostname "www.mollycahill.com"] [uri "/"] [unique_id "alxlxlaztLkF4ZwQhXLdegAA3hE"]
[Sat Jul 18 23:51:02.904058 2026] [security2:error] [pid 983601:tid 983848] [client 50.116.65.227:57956] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "lifeisbetterlakeside.com"] [uri "/wp-content/uploads/2024/04/IMG_3272.jpeg"] [unique_id "alxlxlaztLkF4ZwQhXLdfgAAAPo"]
[Sat Jul 18 23:51:03.038611 2026] [security2:error] [pid 983601:tid 983734] [client 45.134.20.119:28331] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/nf_tracking.php"] [unique_id "alxlx1aztLkF4ZwQhXLdjwAAAIg"]
[Sat Jul 18 23:51:03.201822 2026] [security2:error] [pid 983601:tid 983840] [client 45.133.7.61:62831] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/cong.php"] [unique_id "alxlx1aztLkF4ZwQhXLdnAAAAPI"]
[Sat Jul 18 23:51:03.225299 2026] [security2:error] [pid 983601:tid 983759] [client 17.246.15.48:55104] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.vfcthomasville.org"] [uri "/index.php"] [unique_id "alxlx1aztLkF4ZwQhXLdmgAAoSA"]
[Sat Jul 18 23:51:03.239240 2026] [security2:error] [pid 983601:tid 983785] [client 216.244.66.194:43582] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "marketingonetoone.net"] [uri "/services/field-maintenance/promotions/"] [unique_id "alxlx1aztLkF4ZwQhXLdoQAAALs"]
[Sat Jul 18 23:51:03.239357 2026] [security2:error] [pid 983601:tid 983785] [client 216.244.66.194:43582] ModSecurity: Warning. Matched phrase "Dotbot" at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "marketingonetoone.net"] [uri "/services/field-maintenance/promotions/"] [unique_id "alxlx1aztLkF4ZwQhXLdoQAAALs"]
[Sat Jul 18 23:51:03.358548 2026] [security2:error] [pid 983601:tid 983780] [client 183.81.169.76:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jvcmotorsports.com"] [uri "/index.php"] [unique_id "alxlx1aztLkF4ZwQhXLdmAAAALY"]
[Sat Jul 18 23:51:03.577364 2026] [security2:error] [pid 983601:tid 983641] [remote 91.142.222.105:53270] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "website-5ab144f7.uritems.net"] [uri "/wp-login.php"] [unique_id "alxlx1aztLkF4ZwQhXLdswAA9yc"]
[Sat Jul 18 23:51:03.865025 2026] [security2:error] [pid 983601:tid 983656] [remote 47.86.33.52:51118] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxlx1aztLkF4ZwQhXLdxAAAzzY"]
[Sat Jul 18 23:51:03.895004 2026] [security2:error] [pid 983601:tid 983735] [client 45.133.7.67:52639] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "alxlx1aztLkF4ZwQhXLdyQAAAIk"]
[Sat Jul 18 23:51:03.901199 2026] [security2:error] [pid 983601:tid 983661] [remote 111.225.214.186:46922] ModSecurity: Access denied with code 406 (phase 2). Match of "beginsWith %{request_headers.host}" against "TX:1" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "504"] [id "340162"] [rev "302"] [msg "Atomicorp.com WAF Rules: Remote File Injection Attack detected (Unauthorized URL detected as argument)"] [data ",TX:1"] [severity "CRITICAL"] [hostname "www.mollycahill.com"] [uri "/"] [unique_id "alxlx1aztLkF4ZwQhXLdzQAApzs"]
[Sat Jul 18 23:51:03.911855 2026] [security2:error] [pid 983601:tid 983815] [client 45.134.20.135:54715] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/about.php7"] [unique_id "alxlx1aztLkF4ZwQhXLd0QAAANk"]
[Sat Jul 18 23:51:04.167541 2026] [security2:error] [pid 983601:tid 983787] [client 183.81.169.76:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jvcmotorsports.com"] [uri "/index.php"] [unique_id "alxlx1aztLkF4ZwQhXLd1gAAAL0"]
[Sat Jul 18 23:51:04.169608 2026] [security2:error] [pid 983601:tid 983855] [client 163.61.1.17:63669] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlyFaztLkF4ZwQhXLd5wAAAQE"]
[Sat Jul 18 23:51:04.169698 2026] [security2:error] [pid 983601:tid 983855] [client 163.61.1.17:63669] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlyFaztLkF4ZwQhXLd5wAAAQE"]
[Sat Jul 18 23:51:04.481056 2026] [security2:error] [pid 983601:tid 983665] [remote 91.142.222.105:53270] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "website-5ab144f7.uritems.net"] [uri "/wp-login.php"] [unique_id "alxlyFaztLkF4ZwQhXLd_gAAqT8"], referer: https://website-5ab144f7.uritems.net/wp-login.php
[Sat Jul 18 23:51:04.581308 2026] [security2:error] [pid 983601:tid 983826] [client 45.133.7.55:34029] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 55.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/pwnd/adminfus.php"] [unique_id "alxlyFaztLkF4ZwQhXLeCgAAAOQ"]
[Sat Jul 18 23:51:04.657002 2026] [security2:error] [pid 983601:tid 983684] [remote 98.156.100.191:59410] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 191.100.156.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxlyFaztLkF4ZwQhXLeDgAAvVI"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:51:04.751687 2026] [security2:error] [pid 983601:tid 983774] [client 183.81.169.76:49134] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 76.169.81.183.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "jvcmotorsports.com"] [uri "/wordpress/wp-admin/install.php"] [unique_id "alxlyFaztLkF4ZwQhXLeEwAAALA"]
[Sat Jul 18 23:51:04.751780 2026] [security2:error] [pid 983601:tid 983807] [client 183.81.169.76:49126] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 76.169.81.183.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "jvcmotorsports.com"] [uri "/wp-admin/install.php"] [unique_id "alxlyFaztLkF4ZwQhXLeFAAAANE"]
[Sat Jul 18 23:51:04.770975 2026] [security2:error] [pid 983601:tid 983777] [client 45.134.20.111:64053] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/filefuns.php"] [unique_id "alxlyFaztLkF4ZwQhXLeFgAAALM"]
[Sat Jul 18 23:51:05.263265 2026] [security2:error] [pid 983601:tid 983759] [client 45.133.7.58:25587] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "alxlyVaztLkF4ZwQhXLeMwAAAKE"]
[Sat Jul 18 23:51:05.627948 2026] [security2:error] [pid 983601:tid 983820] [client 45.134.20.117:48269] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/pki-validation/class_api.php"] [unique_id "alxlyVaztLkF4ZwQhXLeUAAAAN4"]
[Sat Jul 18 23:51:05.635558 2026] [security2:error] [pid 983601:tid 983775] [client 216.73.217.60:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "jodiraye.com"] [uri "/index.php"] [unique_id "alxlyFaztLkF4ZwQhXLd7AAAsUw"]
[Sat Jul 18 23:51:05.954920 2026] [security2:error] [pid 983601:tid 983825] [client 45.133.7.70:50341] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/css/install.php"] [unique_id "alxlyVaztLkF4ZwQhXLeaQAAAOM"]
[Sat Jul 18 23:51:06.124296 2026] [security2:error] [pid 983601:tid 983743] [client 116.179.32.196:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxlyVaztLkF4ZwQhXLeaAAAAJE"]
[Sat Jul 18 23:51:06.479794 2026] [security2:error] [pid 983601:tid 983751] [client 45.134.20.139:49585] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 139.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/l.php"] [unique_id "alxlylaztLkF4ZwQhXLejwAAAJk"]
[Sat Jul 18 23:51:06.515916 2026] [security2:error] [pid 983601:tid 983605] [remote 111.225.214.140:36152] ModSecurity: Access denied with code 406 (phase 2). Match of "beginsWith %{request_headers.host}" against "TX:1" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "504"] [id "340162"] [rev "302"] [msg "Atomicorp.com WAF Rules: Remote File Injection Attack detected (Unauthorized URL detected as argument)"] [data ",TX:1"] [severity "CRITICAL"] [hostname "www.mollycahill.com"] [uri "/"] [unique_id "alxlylaztLkF4ZwQhXLekgAAvAM"]
[Sat Jul 18 23:51:06.648288 2026] [security2:error] [pid 983601:tid 983771] [client 45.133.7.77:39395] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 77.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/assets/av.php"] [unique_id "alxlylaztLkF4ZwQhXLengAAAK0"]
[Sat Jul 18 23:51:06.739941 2026] [security2:error] [pid 983601:tid 983816] [client 103.163.98.191:50646] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.guidehunting.com"] [uri "/index.php"] [unique_id "alxlylaztLkF4ZwQhXLeigAAANo"]
[Sat Jul 18 23:51:06.740286 2026] [security2:error] [pid 983601:tid 983770] [client 74.7.227.179:35388] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxlylaztLkF4ZwQhXLemwAArBE"], referer: https://tejasenvironmental.com/p=1617908
[Sat Jul 18 23:51:06.921622 2026] [security2:error] [pid 983601:tid 983627] [remote 47.86.33.52:51118] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxlylaztLkF4ZwQhXLepwAAhRk"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:51:07.332111 2026] [security2:error] [pid 983601:tid 983802] [client 45.134.20.118:61263] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/repeater.php"] [unique_id "alxly1aztLkF4ZwQhXLe0AAAAMw"]
[Sat Jul 18 23:51:07.332185 2026] [security2:error] [pid 983601:tid 983754] [client 45.133.7.60:45549] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 60.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/autoload_classmap/about.php"] [unique_id "alxly1aztLkF4ZwQhXLe0QAAAJw"]
[Sat Jul 18 23:51:07.443892 2026] [security2:error] [pid 983601:tid 983776] [client 57.141.18.29:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxly1aztLkF4ZwQhXLexgAAALI"]
[Sat Jul 18 23:51:08.020944 2026] [security2:error] [pid 983601:tid 983751] [client 45.133.7.67:30091] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-configs.php"] [unique_id "alxlzFaztLkF4ZwQhXLe-AAAAJk"]
[Sat Jul 18 23:51:08.191334 2026] [security2:error] [pid 983601:tid 983854] [client 45.134.20.110:26471] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/wso.php"] [unique_id "alxlzFaztLkF4ZwQhXLfCQAAAQA"]
[Sat Jul 18 23:51:08.249929 2026] [security2:error] [pid 983601:tid 983853] [client 20.63.100.92:11848] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.100.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "daseighty.net"] [uri "/filei.php"] [unique_id "alxlzFaztLkF4ZwQhXLfDgAAAP8"]
[Sat Jul 18 23:51:08.250002 2026] [security2:error] [pid 983601:tid 983853] [client 20.63.100.92:11848] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "daseighty.net"] [uri "/filei.php"] [unique_id "alxlzFaztLkF4ZwQhXLfDgAAAP8"]
[Sat Jul 18 23:51:08.524439 2026] [security2:error] [pid 983601:tid 983761] [client 57.141.18.98:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxlzFaztLkF4ZwQhXLfFAAAAKM"]
[Sat Jul 18 23:51:08.679236 2026] [security2:error] [pid 983601:tid 983732] [client 103.163.98.191:50646] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.guidehunting.com"] [uri "/index.php"] [unique_id "alxlzFaztLkF4ZwQhXLfFwAAAIY"]
[Sat Jul 18 23:51:08.708072 2026] [security2:error] [pid 983601:tid 983841] [client 45.133.7.100:20389] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "alxlzFaztLkF4ZwQhXLfMwAAAPM"]
[Sat Jul 18 23:51:09.058205 2026] [security2:error] [pid 983601:tid 983791] [client 45.134.20.120:52895] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 120.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "alxlzVaztLkF4ZwQhXLfRgAAAME"]
[Sat Jul 18 23:51:09.350190 2026] [security2:error] [pid 983601:tid 983781] [client 20.63.100.92:11999] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.100.63.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "daseighty.net"] [uri "/v2.php"] [unique_id "alxlzVaztLkF4ZwQhXLfVQAAALc"]
[Sat Jul 18 23:51:09.350291 2026] [security2:error] [pid 983601:tid 983781] [client 20.63.100.92:11999] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "daseighty.net"] [uri "/v2.php"] [unique_id "alxlzVaztLkF4ZwQhXLfVQAAALc"]
[Sat Jul 18 23:51:09.396368 2026] [security2:error] [pid 983601:tid 983822] [client 45.133.7.79:24345] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 79.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/js/widgets/bless2.php"] [unique_id "alxlzVaztLkF4ZwQhXLfVwAAAOA"]
[Sat Jul 18 23:51:09.516145 2026] [security2:error] [pid 983601:tid 983852] [client 34.91.36.231:24576] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "cpanel.oohlovely.com"] [uri "/"] [unique_id "alxlzVaztLkF4ZwQhXLfXgAAAP4"]
[Sat Jul 18 23:51:09.516228 2026] [security2:error] [pid 983601:tid 983852] [client 34.91.36.231:24576] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "cpanel.oohlovely.com"] [uri "/"] [unique_id "alxlzVaztLkF4ZwQhXLfXgAAAP4"]
[Sat Jul 18 23:51:09.713092 2026] [security2:error] [pid 983601:tid 983773] [client 103.163.98.191:50646] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.guidehunting.com"] [uri "/index.php"] [unique_id "alxlzVaztLkF4ZwQhXLfWAAAAK8"]
[Sat Jul 18 23:51:09.747577 2026] [security2:error] [pid 983601:tid 983794] [client 116.179.33.207:50237] ModSecurity: Access denied with code 406 (phase 2). Match of "beginsWith %{request_headers.host}" against "TX:1" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "504"] [id "340162"] [rev "302"] [msg "Atomicorp.com WAF Rules: Remote File Injection Attack detected (Unauthorized URL detected as argument)"] [data ",TX:1"] [severity "CRITICAL"] [hostname "www.mollycahill.com"] [uri "/"] [unique_id "alxlzVaztLkF4ZwQhXLfbAAAAMQ"]
[Sat Jul 18 23:51:09.909998 2026] [security2:error] [pid 983601:tid 983744] [client 45.134.20.118:63619] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/contacts.php"] [unique_id "alxlzVaztLkF4ZwQhXLffQAAAJI"]
[Sat Jul 18 23:51:10.078991 2026] [security2:error] [pid 983601:tid 983748] [client 45.133.7.69:53963] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 69.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/network/about.php"] [unique_id "alxlzlaztLkF4ZwQhXLfjAAAAJY"]
[Sat Jul 18 23:51:10.106105 2026] [security2:error] [pid 983601:tid 983848] [client 119.249.100.51:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxlzVaztLkF4ZwQhXLfhAAAAPo"]
[Sat Jul 18 23:51:10.498738 2026] [security2:error] [pid 983601:tid 983832] [client 36.83.95.75:53530] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlzlaztLkF4ZwQhXLfpwAAAOo"]
[Sat Jul 18 23:51:10.498867 2026] [security2:error] [pid 983601:tid 983832] [client 36.83.95.75:53530] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxlzlaztLkF4ZwQhXLfpwAAAOo"]
[Sat Jul 18 23:51:10.505920 2026] [security2:error] [pid 983601:tid 983790] [client 185.132.186.33:50813] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 33.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/bless.php"] [unique_id "alxlzlaztLkF4ZwQhXLfpgAAAMA"]
[Sat Jul 18 23:51:10.643384 2026] [security2:error] [pid 983601:tid 983731] [client 138.252.89.100:56852] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlzlaztLkF4ZwQhXLfsgAAAIU"]
[Sat Jul 18 23:51:10.643467 2026] [security2:error] [pid 983601:tid 983731] [client 138.252.89.100:56852] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxlzlaztLkF4ZwQhXLfsgAAAIU"]
[Sat Jul 18 23:51:10.758900 2026] [security2:error] [pid 983601:tid 983843] [client 45.133.7.80:39477] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/item.php"] [unique_id "alxlzlaztLkF4ZwQhXLfuAAAAPU"]
[Sat Jul 18 23:51:10.769193 2026] [security2:error] [pid 983601:tid 983802] [client 45.134.20.112:60109] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 112.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wsa.php"] [unique_id "alxlzlaztLkF4ZwQhXLfuQAAAMw"]
[Sat Jul 18 23:51:10.848932 2026] [security2:error] [pid 983601:tid 983791] [client 103.163.98.191:50646] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.guidehunting.com"] [uri "/index.php"] [unique_id "alxlzlaztLkF4ZwQhXLfrAAAAME"]
[Sat Jul 18 23:51:11.316041 2026] [security2:error] [pid 983601:tid 983825] [client 163.61.1.17:64146] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlz1aztLkF4ZwQhXLf4AAAAOM"]
[Sat Jul 18 23:51:11.319867 2026] [security2:error] [pid 983601:tid 983825] [client 163.61.1.17:64146] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxlz1aztLkF4ZwQhXLf4AAAAOM"]
[Sat Jul 18 23:51:11.376367 2026] [security2:error] [pid 983601:tid 983732] [client 51.68.111.212:29731] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "mochawavepublishing.com"] [uri "/robots.txt"] [unique_id "alxlz1aztLkF4ZwQhXLf4gAAAIY"]
[Sat Jul 18 23:51:11.376474 2026] [security2:error] [pid 983601:tid 983732] [client 51.68.111.212:29731] ModSecurity: Warning. Matched phrase "MJ12bot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "mochawavepublishing.com"] [uri "/robots.txt"] [unique_id "alxlz1aztLkF4ZwQhXLf4gAAAIY"]
[Sat Jul 18 23:51:11.410135 2026] [security2:error] [pid 983601:tid 983814] [client 185.132.186.39:38553] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 39.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/O-Simple.php"] [unique_id "alxlz1aztLkF4ZwQhXLf5AAAANg"]
[Sat Jul 18 23:51:11.444845 2026] [security2:error] [pid 983601:tid 983788] [client 45.133.7.93:52391] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 93.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "alxlz1aztLkF4ZwQhXLf7QAAAL4"]
[Sat Jul 18 23:51:11.621979 2026] [security2:error] [pid 983601:tid 983753] [client 45.134.20.108:42241] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "alxlz1aztLkF4ZwQhXLf_wAAAJs"]
[Sat Jul 18 23:51:11.871362 2026] [security2:error] [pid 983601:tid 983840] [client 103.163.98.191:50646] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.guidehunting.com"] [uri "/index.php"] [unique_id "alxlz1aztLkF4ZwQhXLf-wAAAPI"]
[Sat Jul 18 23:51:12.001125 2026] [security2:error] [pid 983601:tid 983824] [client 18.141.144.104:34204] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.144.141.18.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxlz1aztLkF4ZwQhXLgEgAAAOI"]
[Sat Jul 18 23:51:12.001237 2026] [security2:error] [pid 983601:tid 983824] [client 18.141.144.104:34204] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxlz1aztLkF4ZwQhXLgEgAAAOI"]
[Sat Jul 18 23:51:12.123923 2026] [security2:error] [pid 983601:tid 983760] [client 45.133.7.74:49253] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 74.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/.well-known/acme-challenge/mah.php"] [unique_id "alxl0FaztLkF4ZwQhXLgGgAAAKI"]
[Sat Jul 18 23:51:12.248356 2026] [security2:error] [pid 983601:tid 983793] [client 38.154.136.182:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.secretkeynumerology.com"] [uri "/index.php"] [unique_id "alxlzlaztLkF4ZwQhXLfowAAAMM"]
[Sat Jul 18 23:51:12.274593 2026] [security2:error] [pid 983601:tid 983635] [remote 209.42.18.223:58540] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.18.42.209.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxl0FaztLkF4ZwQhXLgJAAA0iE"]
[Sat Jul 18 23:51:12.313806 2026] [security2:error] [pid 983601:tid 983852] [client 185.132.186.27:36323] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/lock360.php"] [unique_id "alxl0FaztLkF4ZwQhXLgKAAAAP4"]
[Sat Jul 18 23:51:12.478768 2026] [security2:error] [pid 983601:tid 983768] [client 45.134.20.129:50177] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/firewall.php7"] [unique_id "alxl0FaztLkF4ZwQhXLgOAAAAKo"]
[Sat Jul 18 23:51:12.616318 2026] [security2:error] [pid 983601:tid 983790] [client 47.128.112.152:10942] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "detroitcsc.com"] [uri "/robots.txt"] [unique_id "alxl0FaztLkF4ZwQhXLgRwAAAMA"]
[Sat Jul 18 23:51:12.650101 2026] [security2:error] [pid 983601:tid 983670] [remote 209.42.18.223:58540] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.18.42.209.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxl0FaztLkF4ZwQhXLgSQAA8UQ"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:51:12.809345 2026] [security2:error] [pid 983601:tid 983739] [client 45.133.7.62:29727] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/ID3/shell.php"] [unique_id "alxl0FaztLkF4ZwQhXLgWAAAAI0"]
[Sat Jul 18 23:51:12.901413 2026] [security2:error] [pid 983601:tid 983842] [client 180.252.198.240:64982] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxl0FaztLkF4ZwQhXLgYwAAAPQ"]
[Sat Jul 18 23:51:12.901522 2026] [security2:error] [pid 983601:tid 983842] [client 180.252.198.240:64982] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxl0FaztLkF4ZwQhXLgYwAAAPQ"]
[Sat Jul 18 23:51:12.904564 2026] [security2:error] [pid 983601:tid 983804] [client 103.163.98.191:50646] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.guidehunting.com"] [uri "/index.php"] [unique_id "alxl0FaztLkF4ZwQhXLgRgAAAM4"]
[Sat Jul 18 23:51:12.904743 2026] [security2:error] [pid 983601:tid 983818] [client 213.180.203.251:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.savilerowtravel.com"] [uri "/index.php"] [unique_id "alxl0FaztLkF4ZwQhXLgTQAAANw"]
[Sat Jul 18 23:51:13.102645 2026] [security2:error] [pid 983601:tid 983789] [client 57.141.18.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxl0FaztLkF4ZwQhXLgYgAAAL8"]
[Sat Jul 18 23:51:13.118492 2026] [security2:error] [pid 983601:tid 983775] [client 103.160.26.178:57376] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxl0VaztLkF4ZwQhXLgdwAAALE"]
[Sat Jul 18 23:51:13.118579 2026] [security2:error] [pid 983601:tid 983775] [client 103.160.26.178:57376] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxl0VaztLkF4ZwQhXLgdwAAALE"]
[Sat Jul 18 23:51:13.159045 2026] [security2:error] [pid 983601:tid 983757] [client 193.176.29.13:14764] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "50.116.65.229"] [uri "/onvif/device_service"] [unique_id "alxl0VaztLkF4ZwQhXLgewAAAJ8"]
[Sat Jul 18 23:51:13.220931 2026] [security2:error] [pid 983601:tid 983791] [client 185.132.186.8:48731] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 8.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/zwso.php"] [unique_id "alxl0VaztLkF4ZwQhXLghAAAAME"]
[Sat Jul 18 23:51:13.342644 2026] [security2:error] [pid 983601:tid 983753] [client 45.134.20.112:51579] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 112.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "alxl0VaztLkF4ZwQhXLgiwAAAJs"]
[Sat Jul 18 23:51:13.491170 2026] [security2:error] [pid 983601:tid 983858] [client 45.133.7.55:62553] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 55.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "alxl0VaztLkF4ZwQhXLgkgAAAQQ"]
[Sat Jul 18 23:51:13.508597 2026] [security2:error] [pid 983601:tid 983681] [remote 31.42.184.154:43744] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "massagelacey.com"] [uri "/wp-login.php"] [unique_id "alxl0VaztLkF4ZwQhXLglQAAvk8"]
[Sat Jul 18 23:51:13.850560 2026] [security2:error] [pid 983601:tid 983808] [client 14.224.227.113:51493] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxl0VaztLkF4ZwQhXLgrQAAANI"]
[Sat Jul 18 23:51:13.907345 2026] [security2:error] [pid 983601:tid 983760] [client 14.251.3.155:51494] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxl0VaztLkF4ZwQhXLgsQAAAKI"]
[Sat Jul 18 23:51:14.027586 2026] [security2:error] [pid 983601:tid 983750] [client 103.163.98.191:50646] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.guidehunting.com"] [uri "/index.php"] [unique_id "alxl0VaztLkF4ZwQhXLgpQAAAJg"]
[Sat Jul 18 23:51:14.114391 2026] [security2:error] [pid 983601:tid 983765] [client 185.132.186.33:37657] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 33.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/chosen.php"] [unique_id "alxl0laztLkF4ZwQhXLgxQAAAKc"]
[Sat Jul 18 23:51:14.116903 2026] [security2:error] [pid 983601:tid 983696] [remote 152.228.213.32:43128] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxl0laztLkF4ZwQhXLgwwAA014"]
[Sat Jul 18 23:51:14.147404 2026] [security2:error] [pid 983601:tid 983709] [remote 31.42.184.154:43744] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "massagelacey.com"] [uri "/wp-login.php"] [unique_id "alxl0laztLkF4ZwQhXLgxgABBGs"], referer: https://massagelacey.com/wp-login.php
[Sat Jul 18 23:51:14.181958 2026] [security2:error] [pid 983601:tid 983796] [client 45.133.7.90:36233] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 90.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/ms-users.php"] [unique_id "alxl0laztLkF4ZwQhXLgzwAAAMY"]
[Sat Jul 18 23:51:14.206112 2026] [security2:error] [pid 983601:tid 983762] [client 45.134.20.126:54771] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 126.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/uploads/content.php"] [unique_id "alxl0laztLkF4ZwQhXLg0QAAAKQ"]
[Sat Jul 18 23:51:14.610020 2026] [security2:error] [pid 983601:tid 983608] [remote 152.228.213.32:43128] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxl0laztLkF4ZwQhXLg5wAAwQY"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:51:14.863370 2026] [security2:error] [pid 983601:tid 983844] [client 45.133.7.57:22501] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 57.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/js/cc.php"] [unique_id "alxl0laztLkF4ZwQhXLg-wAAAPY"]
[Sat Jul 18 23:51:15.019330 2026] [security2:error] [pid 983601:tid 983754] [client 185.132.186.47:25549] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 47.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/about.php"] [unique_id "alxl01aztLkF4ZwQhXLhEAAAAJw"]
[Sat Jul 18 23:51:15.063763 2026] [security2:error] [pid 983601:tid 983738] [client 45.134.20.123:36557] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 123.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/lv.php"] [unique_id "alxl01aztLkF4ZwQhXLhFQAAAIw"]
[Sat Jul 18 23:51:15.156633 2026] [security2:error] [pid 983601:tid 983756] [client 111.225.214.195:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "omenana.com"] [uri "/index.php"] [unique_id "alxl0laztLkF4ZwQhXLhDQAAAJ4"]
[Sat Jul 18 23:51:15.556071 2026] [security2:error] [pid 983601:tid 983827] [client 191.241.200.250:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "healthylifegourmet.org"] [uri "/index.php"] [unique_id "alxl01aztLkF4ZwQhXLhIgAAAOU"]
[Sat Jul 18 23:51:15.603645 2026] [security2:error] [pid 983601:tid 983738] [client 45.133.7.77:23651] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 77.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "alxl01aztLkF4ZwQhXLhNwAAAIw"]
[Sat Jul 18 23:51:15.920997 2026] [security2:error] [pid 983601:tid 983748] [client 45.134.20.119:55485] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/images/js1.php"] [unique_id "alxl01aztLkF4ZwQhXLhRwAAAJY"]
[Sat Jul 18 23:51:15.923056 2026] [security2:error] [pid 983601:tid 983836] [client 185.132.186.28:59039] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 28.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/admin.php"] [unique_id "alxl01aztLkF4ZwQhXLhRgAAAO4"]
[Sat Jul 18 23:51:16.265411 2026] [security2:error] [pid 983601:tid 983784] [client 46.110.96.34:6692] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "wpad.tsctanks.com"] [uri "/wpad.dat"] [unique_id "alxl1FaztLkF4ZwQhXLhXQAAALo"]
[Sat Jul 18 23:51:16.284982 2026] [security2:error] [pid 983601:tid 983785] [client 45.133.7.105:22975] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "alxl1FaztLkF4ZwQhXLhYQAAALs"]
[Sat Jul 18 23:51:16.433955 2026] [security2:error] [pid 983601:tid 983768] [client 74.208.214.194:46174] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxl1FaztLkF4ZwQhXLhbAAAAKo"]
[Sat Jul 18 23:51:16.786189 2026] [security2:error] [pid 983601:tid 983755] [client 45.134.20.133:33875] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/maint/file.php"] [unique_id "alxl1FaztLkF4ZwQhXLhkAAAAJ0"]
[Sat Jul 18 23:51:16.833124 2026] [security2:error] [pid 983601:tid 983788] [client 185.132.186.30:32827] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 30.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/mah.php"] [unique_id "alxl1FaztLkF4ZwQhXLhkQAAAL4"]
[Sat Jul 18 23:51:16.907965 2026] [security2:error] [pid 983601:tid 983812] [client 157.52.92.38:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "idigress.studio"] [uri "/index.php"] [unique_id "alxl0VaztLkF4ZwQhXLgegAAANY"]
[Sat Jul 18 23:51:16.965798 2026] [security2:error] [pid 983601:tid 983778] [client 157.52.92.38:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "idigress.studio"] [uri "/index.php"] [unique_id "alxl0VaztLkF4ZwQhXLgeQAAALQ"]
[Sat Jul 18 23:51:16.973854 2026] [security2:error] [pid 983601:tid 983811] [client 45.133.7.83:39977] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/css/file.php"] [unique_id "alxl1FaztLkF4ZwQhXLhmAAAANU"]
[Sat Jul 18 23:51:17.640582 2026] [security2:error] [pid 983601:tid 983786] [client 45.134.20.108:60697] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/acme-challenge/file.php"] [unique_id "alxl1VaztLkF4ZwQhXLhwwAAALw"]
[Sat Jul 18 23:51:17.651920 2026] [security2:error] [pid 983601:tid 983747] [client 45.133.7.78:22049] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 78.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/classic-editor/alam.php"] [unique_id "alxl1VaztLkF4ZwQhXLhxAAAAJU"]
[Sat Jul 18 23:51:17.752733 2026] [security2:error] [pid 983601:tid 983790] [client 185.132.186.6:59705] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 6.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/.wp/wso.php"] [unique_id "alxl1VaztLkF4ZwQhXLhywAAAMA"]
[Sat Jul 18 23:51:18.374687 2026] [security2:error] [pid 983601:tid 983803] [client 45.133.7.73:42605] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 73.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wordpress/wp-admin/includes/admin-filters.php"] [unique_id "alxl1laztLkF4ZwQhXLh5wAAAM0"]
[Sat Jul 18 23:51:18.500040 2026] [security2:error] [pid 983601:tid 983786] [client 45.134.20.137:53129] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 137.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "alxl1laztLkF4ZwQhXLh8wAAALw"]
[Sat Jul 18 23:51:18.660888 2026] [security2:error] [pid 983601:tid 983858] [client 185.132.186.28:55623] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 28.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/core.php"] [unique_id "alxl1laztLkF4ZwQhXLh-gAAAQQ"]
[Sat Jul 18 23:51:19.074287 2026] [security2:error] [pid 983601:tid 983756] [client 45.133.7.71:60193] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 71.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/assets/content.php"] [unique_id "alxl11aztLkF4ZwQhXLiEQAAAJ4"]
[Sat Jul 18 23:51:19.079294 2026] [security2:error] [pid 983601:tid 983789] [client 91.92.41.115:63577] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/___proxy_subdomain_cpanel/.env"] [unique_id "alxl11aztLkF4ZwQhXLiEwAAAL8"]
[Sat Jul 18 23:51:19.354008 2026] [security2:error] [pid 983601:tid 983827] [client 45.134.20.106:65423] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "alxl11aztLkF4ZwQhXLiKAAAAOU"]
[Sat Jul 18 23:51:19.578403 2026] [security2:error] [pid 983601:tid 983857] [client 185.132.186.52:33903] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/robots.php"] [unique_id "alxl11aztLkF4ZwQhXLiOQAAAQM"]
[Sat Jul 18 23:51:19.756432 2026] [security2:error] [pid 983601:tid 983800] [client 45.133.7.81:29717] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 81.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/fm.php%20"] [unique_id "alxl11aztLkF4ZwQhXLiQwAAAMo"]
[Sat Jul 18 23:51:19.957316 2026] [security2:error] [pid 983601:tid 983611] [remote 164.92.211.134:38112] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 134.211.92.164.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "dienerranch.com"] [uri "/wp-login.php"] [unique_id "alxl11aztLkF4ZwQhXLiTAAA_wk"]
[Sat Jul 18 23:51:20.117897 2026] [security2:error] [pid 983601:tid 983715] [remote 164.92.211.134:38112] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 134.211.92.164.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "dienerranch.com"] [uri "/wp-login.php"] [unique_id "alxl2FaztLkF4ZwQhXLiVAAA33E"], referer: https://dienerranch.com/wp-login.php
[Sat Jul 18 23:51:20.208618 2026] [security2:error] [pid 983601:tid 983765] [client 45.134.20.133:36141] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "alxl2FaztLkF4ZwQhXLiYQAAAKc"]
[Sat Jul 18 23:51:20.271945 2026] [security2:error] [pid 983601:tid 983759] [client 113.174.238.4:53395] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "www.marscafe.com"] [uri "/php/costing1-dl/download.php"] [unique_id "alxl2FaztLkF4ZwQhXLiYgAAAKE"]
[Sat Jul 18 23:51:20.409391 2026] [security2:error] [pid 983601:tid 983602] [remote 131.72.236.158:50196] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 158.236.72.131.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxl2FaztLkF4ZwQhXLicAAArQA"]
[Sat Jul 18 23:51:20.441364 2026] [security2:error] [pid 983601:tid 983841] [client 45.133.7.76:47079] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 76.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/goods.php"] [unique_id "alxl2FaztLkF4ZwQhXLiegAAAPM"]
[Sat Jul 18 23:51:20.489850 2026] [security2:error] [pid 983601:tid 983767] [client 185.132.186.34:64139] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 34.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/inputs.php"] [unique_id "alxl2FaztLkF4ZwQhXLiewAAAKk"]
[Sat Jul 18 23:51:20.945828 2026] [security2:error] [pid 983601:tid 983780] [client 36.83.95.75:54029] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxl2FaztLkF4ZwQhXLiqwAAALY"]
[Sat Jul 18 23:51:20.945934 2026] [security2:error] [pid 983601:tid 983780] [client 36.83.95.75:54029] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxl2FaztLkF4ZwQhXLiqwAAALY"]
[Sat Jul 18 23:51:21.073475 2026] [security2:error] [pid 983601:tid 983771] [client 45.134.20.138:40231] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 138.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/theme-editor.php"] [unique_id "alxl2VaztLkF4ZwQhXLisAAAAK0"]
[Sat Jul 18 23:51:21.133517 2026] [security2:error] [pid 983601:tid 983792] [client 45.133.7.63:32057] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/wp-2019.php"] [unique_id "alxl2VaztLkF4ZwQhXLisQAAAMI"]
[Sat Jul 18 23:51:21.311103 2026] [security2:error] [pid 983601:tid 983804] [client 18.139.208.24:41540] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.208.139.18.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxl2VaztLkF4ZwQhXLivAAAAM4"]
[Sat Jul 18 23:51:21.399440 2026] [security2:error] [pid 983601:tid 983789] [client 185.132.186.19:20745] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 19.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/mini.php"] [unique_id "alxl2VaztLkF4ZwQhXLiwAAAAL8"]
[Sat Jul 18 23:51:21.725471 2026] [security2:error] [pid 983601:tid 983745] [client 114.119.133.14:22009] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.rvprintfactory.com"] [uri "/product/framed-canvas-float-mount"] [unique_id "alxl2VaztLkF4ZwQhXLi1gAAAJM"], referer: https://www.rvprintfactory.com/product/framed-canvas-float-mount
[Sat Jul 18 23:51:21.817269 2026] [security2:error] [pid 983601:tid 983743] [client 45.133.7.95:37009] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "alxl2VaztLkF4ZwQhXLi3wAAAJE"]
[Sat Jul 18 23:51:21.926382 2026] [security2:error] [pid 983601:tid 983759] [client 45.134.20.105:39041] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/blue/abc.php"] [unique_id "alxl2VaztLkF4ZwQhXLi5gAAAKE"]
[Sat Jul 18 23:51:21.991676 2026] [security2:error] [pid 983601:tid 983791] [client 163.61.1.17:64634] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxl2VaztLkF4ZwQhXLi6wAAAME"]
[Sat Jul 18 23:51:21.991802 2026] [security2:error] [pid 983601:tid 983791] [client 163.61.1.17:64634] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxl2VaztLkF4ZwQhXLi6wAAAME"]
[Sat Jul 18 23:51:22.257576 2026] [security2:error] [pid 983601:tid 983841] [client 47.130.151.169:43942] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 169.151.130.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxl2laztLkF4ZwQhXLi_gAAAPM"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:51:22.319717 2026] [security2:error] [pid 983601:tid 983844] [client 138.252.89.100:57392] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxl2laztLkF4ZwQhXLjBAAAAPY"]
[Sat Jul 18 23:51:22.319885 2026] [security2:error] [pid 983601:tid 983844] [client 138.252.89.100:57392] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxl2laztLkF4ZwQhXLjBAAAAPY"]
[Sat Jul 18 23:51:22.333476 2026] [security2:error] [pid 983601:tid 983768] [client 185.132.186.4:61383] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 4.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/goods.php"] [unique_id "alxl2laztLkF4ZwQhXLjAwAAAKo"]
[Sat Jul 18 23:51:22.504232 2026] [security2:error] [pid 983601:tid 983742] [client 45.133.7.100:22691] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/assets/images/cloud.php"] [unique_id "alxl2laztLkF4ZwQhXLjCwAAAJA"]
[Sat Jul 18 23:51:22.680636 2026] [security2:error] [pid 983601:tid 983692] [remote 131.72.236.158:50196] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 158.236.72.131.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxl2laztLkF4ZwQhXLjGQAA8Vo"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:51:22.781819 2026] [security2:error] [pid 983601:tid 983782] [client 45.134.20.107:51839] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 107.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/maint/wonder.php"] [unique_id "alxl2laztLkF4ZwQhXLjIQAAALg"]
[Sat Jul 18 23:51:22.853910 2026] [security2:error] [pid 983601:tid 983858] [client 103.160.26.178:57879] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxl2laztLkF4ZwQhXLjKwAAAQQ"]
[Sat Jul 18 23:51:22.854031 2026] [security2:error] [pid 983601:tid 983858] [client 103.160.26.178:57879] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxl2laztLkF4ZwQhXLjKwAAAQQ"]
[Sat Jul 18 23:51:23.186448 2026] [security2:error] [pid 983601:tid 983826] [client 45.133.7.61:41233] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/log.php"] [unique_id "alxl21aztLkF4ZwQhXLjPAAAAOQ"]
[Sat Jul 18 23:51:23.224847 2026] [security2:error] [pid 983601:tid 983814] [client 185.132.186.52:33127] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/file5.php"] [unique_id "alxl21aztLkF4ZwQhXLjPQAAANg"]
[Sat Jul 18 23:51:23.290663 2026] [security2:error] [pid 983601:tid 983843] [client 47.128.110.4:57000] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "marketingonetoone.net"] [uri "/robots.txt"] [unique_id "alxl21aztLkF4ZwQhXLjPwAAAPU"]
[Sat Jul 18 23:51:23.638629 2026] [security2:error] [pid 983601:tid 983853] [client 45.134.20.113:34377] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/twentytwentyfour/wonder.php"] [unique_id "alxl21aztLkF4ZwQhXLjXQAAAP8"]
[Sat Jul 18 23:51:23.688600 2026] [security2:error] [pid 983601:tid 983858] [client 5.193.175.36:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "maxcom.net"] [uri "/index.php"] [unique_id "alxl21aztLkF4ZwQhXLjWAAAAQQ"]
[Sat Jul 18 23:51:23.870612 2026] [security2:error] [pid 983601:tid 983845] [client 45.133.7.91:25211] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 91.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "alxl21aztLkF4ZwQhXLjagAAAPc"]
[Sat Jul 18 23:51:24.122375 2026] [security2:error] [pid 983601:tid 983768] [client 185.132.186.6:35707] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 6.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/ahax.php"] [unique_id "alxl3FaztLkF4ZwQhXLjeQAAAKo"]
[Sat Jul 18 23:51:24.440493 2026] [security2:error] [pid 983601:tid 983847] [client 180.252.198.240:65464] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxl3FaztLkF4ZwQhXLjiQAAAPk"]
[Sat Jul 18 23:51:24.441712 2026] [security2:error] [pid 983601:tid 983847] [client 180.252.198.240:65464] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxl3FaztLkF4ZwQhXLjiQAAAPk"]
[Sat Jul 18 23:51:24.491985 2026] [security2:error] [pid 983601:tid 983735] [client 45.134.20.139:58613] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 139.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/fix/as.php"] [unique_id "alxl3FaztLkF4ZwQhXLjjgAAAIk"]
[Sat Jul 18 23:51:24.563067 2026] [security2:error] [pid 983601:tid 983841] [client 45.133.7.66:65407] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 66.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "alxl3FaztLkF4ZwQhXLjkgAAAPM"]
[Sat Jul 18 23:51:25.034011 2026] [security2:error] [pid 983601:tid 983789] [client 185.132.186.37:49991] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 37.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/f35.php"] [unique_id "alxl3VaztLkF4ZwQhXLjrwAAAL8"]
[Sat Jul 18 23:51:25.334700 2026] [security2:error] [pid 983601:tid 983757] [client 45.133.7.90:44563] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 90.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/aw.php"] [unique_id "alxl3VaztLkF4ZwQhXLjxwAAAJ8"]
[Sat Jul 18 23:51:25.350543 2026] [security2:error] [pid 983601:tid 983825] [client 45.134.20.113:53021] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/tox.php"] [unique_id "alxl3VaztLkF4ZwQhXLjygAAAOM"]
[Sat Jul 18 23:51:25.877212 2026] [security2:error] [pid 983601:tid 983623] [remote 152.228.213.32:41358] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mobilesurvsolutions.com"] [uri "/wp-login.php"] [unique_id "alxl3VaztLkF4ZwQhXLj9QAAmxU"]
[Sat Jul 18 23:51:25.954167 2026] [security2:error] [pid 983601:tid 983796] [client 185.132.186.39:34869] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 39.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/simple.php"] [unique_id "alxl3VaztLkF4ZwQhXLkCgAAAMY"]
[Sat Jul 18 23:51:26.038643 2026] [security2:error] [pid 983601:tid 983752] [client 45.133.7.54:40935] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 54.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/update/gely.php"] [unique_id "alxl3laztLkF4ZwQhXLkEwAAAJo"]
[Sat Jul 18 23:51:26.069896 2026] [security2:error] [pid 983601:tid 983635] [remote 152.228.213.32:41358] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mobilesurvsolutions.com"] [uri "/wp-login.php"] [unique_id "alxl3laztLkF4ZwQhXLkFAAAmSE"], referer: https://mobilesurvsolutions.com/wp-login.php
[Sat Jul 18 23:51:26.207031 2026] [security2:error] [pid 983601:tid 983831] [client 45.134.20.139:43421] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 139.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/languages/index.php"] [unique_id "alxl3laztLkF4ZwQhXLkIgAAAOk"]
[Sat Jul 18 23:51:26.263011 2026] [security2:error] [pid 983601:tid 983844] [client 20.226.66.230:60997] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "alxl3laztLkF4ZwQhXLkLQAAAPY"]
[Sat Jul 18 23:51:26.263154 2026] [security2:error] [pid 983601:tid 983844] [client 20.226.66.230:60997] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "alxl3laztLkF4ZwQhXLkLQAAAPY"]
[Sat Jul 18 23:51:26.376572 2026] [security2:error] [pid 983601:tid 983651] [remote 57.141.18.88:55054] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 88.18.141.57.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/product/5322015"] [unique_id "alxl3laztLkF4ZwQhXLkMwAA9zE"]
[Sat Jul 18 23:51:26.582392 2026] [security2:error] [pid 983601:tid 983771] [client 20.226.66.230:28674] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/this_is_a_new_hello_world.php"] [unique_id "alxl3laztLkF4ZwQhXLkRgAAAK0"]
[Sat Jul 18 23:51:26.582497 2026] [security2:error] [pid 983601:tid 983771] [client 20.226.66.230:28674] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/this_is_a_new_hello_world.php"] [unique_id "alxl3laztLkF4ZwQhXLkRgAAAK0"]
[Sat Jul 18 23:51:26.731406 2026] [security2:error] [pid 983601:tid 983835] [client 45.133.7.95:45245] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/uploads/c99shell.php"] [unique_id "alxl3laztLkF4ZwQhXLkTgAAAO0"]
[Sat Jul 18 23:51:26.857885 2026] [security2:error] [pid 983601:tid 983827] [client 185.132.186.24:64113] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/amax.php"] [unique_id "alxl3laztLkF4ZwQhXLkVgAAAOU"]
[Sat Jul 18 23:51:26.904110 2026] [security2:error] [pid 983601:tid 983802] [client 20.226.66.230:28681] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/x.php"] [unique_id "alxl3laztLkF4ZwQhXLkWQAAAMw"]
[Sat Jul 18 23:51:26.904226 2026] [security2:error] [pid 983601:tid 983802] [client 20.226.66.230:28681] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/x.php"] [unique_id "alxl3laztLkF4ZwQhXLkWQAAAMw"]
[Sat Jul 18 23:51:27.065187 2026] [security2:error] [pid 983601:tid 983737] [client 45.134.20.110:36861] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/js/dist/default.php"] [unique_id "alxl31aztLkF4ZwQhXLkaAAAAIs"]
[Sat Jul 18 23:51:27.120035 2026] [security2:error] [pid 983601:tid 983646] [remote 45.157.54.14:61373] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "taskidsvirginia.com"] [uri "/xmlrpc.php"] [unique_id "alxl31aztLkF4ZwQhXLkcAAAiCw"]
[Sat Jul 18 23:51:27.120241 2026] [security2:error] [pid 983601:tid 983734] [client 45.157.54.14:61373] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "taskidsvirginia.com"] [uri "/xmlrpc.php"] [unique_id "alxl31aztLkF4ZwQhXLkcAAAiCw"]
[Sat Jul 18 23:51:27.222317 2026] [security2:error] [pid 983601:tid 983771] [client 20.226.66.230:60999] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/mgrr.php"] [unique_id "alxl31aztLkF4ZwQhXLkewAAAK0"]
[Sat Jul 18 23:51:27.222430 2026] [security2:error] [pid 983601:tid 983771] [client 20.226.66.230:60999] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/mgrr.php"] [unique_id "alxl31aztLkF4ZwQhXLkewAAAK0"]
[Sat Jul 18 23:51:27.434092 2026] [security2:error] [pid 983601:tid 983857] [client 45.133.7.83:60717] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/pridmag/admin-footer.php"] [unique_id "alxl31aztLkF4ZwQhXLkjwAAAQM"]
[Sat Jul 18 23:51:27.456399 2026] [security2:error] [pid 983601:tid 983672] [remote 217.182.128.41:32920] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.128.182.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxl31aztLkF4ZwQhXLkkAAA60Y"]
[Sat Jul 18 23:51:27.541911 2026] [security2:error] [pid 983601:tid 983789] [client 20.226.66.230:28717] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/stdin.php"] [unique_id "alxl31aztLkF4ZwQhXLknQAAAL8"]
[Sat Jul 18 23:51:27.542008 2026] [security2:error] [pid 983601:tid 983789] [client 20.226.66.230:28717] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/stdin.php"] [unique_id "alxl31aztLkF4ZwQhXLknQAAAL8"]
[Sat Jul 18 23:51:27.686013 2026] [security2:error] [pid 983601:tid 983699] [remote 217.182.128.41:32920] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.128.182.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxl31aztLkF4ZwQhXLkpAAA0WE"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:51:27.768233 2026] [security2:error] [pid 983601:tid 983734] [client 185.132.186.25:56097] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/update/f35.php"] [unique_id "alxl31aztLkF4ZwQhXLkqQAAAIg"]
[Sat Jul 18 23:51:27.865908 2026] [fcgid:warn] [pid 983601:tid 983769] (70014)End of file found: [client 159.89.12.166:52118] mod_fcgid: can't get data from http client
[Sat Jul 18 23:51:27.867152 2026] [security2:error] [pid 983601:tid 983731] [client 20.226.66.230:28686] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/BDKR28.php"] [unique_id "alxl31aztLkF4ZwQhXLkuAAAAIU"]
[Sat Jul 18 23:51:27.867247 2026] [security2:error] [pid 983601:tid 983731] [client 20.226.66.230:28686] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/BDKR28.php"] [unique_id "alxl31aztLkF4ZwQhXLkuAAAAIU"]
[Sat Jul 18 23:51:27.922349 2026] [security2:error] [pid 983601:tid 983809] [client 45.134.20.136:54773] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 136.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/tfileman.php"] [unique_id "alxl31aztLkF4ZwQhXLkuQAAANM"]
[Sat Jul 18 23:51:28.116377 2026] [security2:error] [pid 983601:tid 983792] [client 45.133.7.78:48219] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 78.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/uploads/lala.php"] [unique_id "alxl4FaztLkF4ZwQhXLkwAAAAMI"]
[Sat Jul 18 23:51:28.205777 2026] [security2:error] [pid 983601:tid 983791] [client 20.226.66.230:61019] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/001.php"] [unique_id "alxl4FaztLkF4ZwQhXLkxQAAAME"]
[Sat Jul 18 23:51:28.205903 2026] [security2:error] [pid 983601:tid 983791] [client 20.226.66.230:61019] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/001.php"] [unique_id "alxl4FaztLkF4ZwQhXLkxQAAAME"]
[Sat Jul 18 23:51:28.249293 2026] [security2:error] [pid 983601:tid 983751] [client 3.109.49.224:49118] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.49.109.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxl4FaztLkF4ZwQhXLkxgAAAJk"]
[Sat Jul 18 23:51:28.546454 2026] [security2:error] [pid 983601:tid 983790] [client 20.226.66.230:28703] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/dZ3wP5.php"] [unique_id "alxl4FaztLkF4ZwQhXLk3QAAAMA"]
[Sat Jul 18 23:51:28.546578 2026] [security2:error] [pid 983601:tid 983790] [client 20.226.66.230:28703] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/dZ3wP5.php"] [unique_id "alxl4FaztLkF4ZwQhXLk3QAAAMA"]
[Sat Jul 18 23:51:28.682125 2026] [security2:error] [pid 983601:tid 983760] [client 185.132.186.48:59865] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 48.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/hello.php"] [unique_id "alxl4FaztLkF4ZwQhXLk6gAAAKI"]
[Sat Jul 18 23:51:28.783942 2026] [security2:error] [pid 983601:tid 983812] [client 45.134.20.134:61461] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 134.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/tiny.php"] [unique_id "alxl4FaztLkF4ZwQhXLk8AAAANY"]
[Sat Jul 18 23:51:28.805954 2026] [security2:error] [pid 983601:tid 983761] [client 45.133.7.94:32851] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 94.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/IXR/db.php"] [unique_id "alxl4FaztLkF4ZwQhXLk8gAAAKM"]
[Sat Jul 18 23:51:28.886349 2026] [security2:error] [pid 983601:tid 983791] [client 20.226.66.230:61025] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/yup.php"] [unique_id "alxl4FaztLkF4ZwQhXLk-QAAAME"]
[Sat Jul 18 23:51:28.886439 2026] [security2:error] [pid 983601:tid 983791] [client 20.226.66.230:61025] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/yup.php"] [unique_id "alxl4FaztLkF4ZwQhXLk-QAAAME"]
[Sat Jul 18 23:51:29.219483 2026] [security2:error] [pid 983601:tid 983774] [client 13.232.206.133:46100] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.206.232.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxl4VaztLkF4ZwQhXLlFAAAALA"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:51:29.220875 2026] [security2:error] [pid 983601:tid 983827] [client 20.226.66.230:28693] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/ts.php"] [unique_id "alxl4VaztLkF4ZwQhXLlFQAAAOU"]
[Sat Jul 18 23:51:29.220987 2026] [security2:error] [pid 983601:tid 983827] [client 20.226.66.230:28693] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/ts.php"] [unique_id "alxl4VaztLkF4ZwQhXLlFQAAAOU"]
[Sat Jul 18 23:51:29.403575 2026] [security2:error] [pid 983601:tid 983631] [remote 47.86.33.52:7694] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxl4VaztLkF4ZwQhXLlHgAA2h0"]
[Sat Jul 18 23:51:29.489845 2026] [security2:error] [pid 983601:tid 983836] [client 45.133.7.77:49679] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 77.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/css/install.php"] [unique_id "alxl4VaztLkF4ZwQhXLlKgAAAO4"]
[Sat Jul 18 23:51:29.535574 2026] [security2:error] [pid 983601:tid 983754] [client 20.226.66.230:28673] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/X.php"] [unique_id "alxl4VaztLkF4ZwQhXLlNQAAAJw"]
[Sat Jul 18 23:51:29.535682 2026] [security2:error] [pid 983601:tid 983754] [client 20.226.66.230:28673] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/X.php"] [unique_id "alxl4VaztLkF4ZwQhXLlNQAAAJw"]
[Sat Jul 18 23:51:29.597028 2026] [security2:error] [pid 983601:tid 983792] [client 185.132.186.18:43867] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 18.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/maint/bootstrap.php"] [unique_id "alxl4VaztLkF4ZwQhXLlOgAAAMI"]
[Sat Jul 18 23:51:29.646556 2026] [security2:error] [pid 983601:tid 983789] [client 45.134.20.129:60275] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/js/widgets/autoload_classmap.php"] [unique_id "alxl4VaztLkF4ZwQhXLlPQAAAL8"]
[Sat Jul 18 23:51:29.855412 2026] [security2:error] [pid 983601:tid 983827] [client 20.226.66.230:61030] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/1polka.php"] [unique_id "alxl4VaztLkF4ZwQhXLlSQAAAOU"]
[Sat Jul 18 23:51:29.855494 2026] [security2:error] [pid 983601:tid 983827] [client 20.226.66.230:61030] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/1polka.php"] [unique_id "alxl4VaztLkF4ZwQhXLlSQAAAOU"]
[Sat Jul 18 23:51:29.961948 2026] [security2:error] [pid 983601:tid 983649] [remote 152.228.213.32:41368] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxl4VaztLkF4ZwQhXLlUAAAxi8"]
[Sat Jul 18 23:51:30.146445 2026] [security2:error] [pid 983601:tid 983670] [remote 152.228.213.32:41368] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxl4laztLkF4ZwQhXLlYAAA8kQ"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:51:30.168847 2026] [security2:error] [pid 983601:tid 983757] [client 51.68.236.94:10487] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "sixpackminer.org"] [uri "/robots.txt"] [unique_id "alxl4laztLkF4ZwQhXLlYgAAAJ8"]
[Sat Jul 18 23:51:30.168965 2026] [security2:error] [pid 983601:tid 983757] [client 51.68.236.94:10487] ModSecurity: Warning. Matched phrase "MJ12bot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "sixpackminer.org"] [uri "/robots.txt"] [unique_id "alxl4laztLkF4ZwQhXLlYgAAAJ8"]
[Sat Jul 18 23:51:30.172033 2026] [security2:error] [pid 983601:tid 983736] [client 45.133.7.93:36351] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 93.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/plugins/wp-theme-editor/include.php%20"] [unique_id "alxl4laztLkF4ZwQhXLlYwAAAIo"]
[Sat Jul 18 23:51:30.183971 2026] [security2:error] [pid 983601:tid 983791] [client 20.226.66.230:61045] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/gec.php"] [unique_id "alxl4laztLkF4ZwQhXLlZgAAAME"]
[Sat Jul 18 23:51:30.184054 2026] [security2:error] [pid 983601:tid 983791] [client 20.226.66.230:61045] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/gec.php"] [unique_id "alxl4laztLkF4ZwQhXLlZgAAAME"]
[Sat Jul 18 23:51:30.513628 2026] [security2:error] [pid 983601:tid 983842] [client 45.134.20.105:20681] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/themes.php"] [unique_id "alxl4laztLkF4ZwQhXLlfQAAAPQ"]
[Sat Jul 18 23:51:30.517976 2026] [security2:error] [pid 983601:tid 983835] [client 20.226.66.230:61034] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/sky.php"] [unique_id "alxl4laztLkF4ZwQhXLlfgAAAO0"]
[Sat Jul 18 23:51:30.518092 2026] [security2:error] [pid 983601:tid 983835] [client 20.226.66.230:61034] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/sky.php"] [unique_id "alxl4laztLkF4ZwQhXLlfgAAAO0"]
[Sat Jul 18 23:51:30.529369 2026] [security2:error] [pid 983601:tid 983762] [client 185.132.186.5:46569] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/themes/zMousse/otuz1.php"] [unique_id "alxl4laztLkF4ZwQhXLlewAAAKQ"]
[Sat Jul 18 23:51:30.839875 2026] [security2:error] [pid 983601:tid 983854] [client 20.226.66.230:61004] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/fffm.php"] [unique_id "alxl4laztLkF4ZwQhXLljwAAAQA"]
[Sat Jul 18 23:51:30.839974 2026] [security2:error] [pid 983601:tid 983854] [client 20.226.66.230:61004] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/fffm.php"] [unique_id "alxl4laztLkF4ZwQhXLljwAAAQA"]
[Sat Jul 18 23:51:30.862280 2026] [security2:error] [pid 983601:tid 983846] [client 45.133.7.96:48791] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 96.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/top.php"] [unique_id "alxl4laztLkF4ZwQhXLlkQAAAPg"]
[Sat Jul 18 23:51:31.163872 2026] [security2:error] [pid 983601:tid 983767] [client 20.226.66.230:61052] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/sixxis.php"] [unique_id "alxl41aztLkF4ZwQhXLlqwAAAKk"]
[Sat Jul 18 23:51:31.163969 2026] [security2:error] [pid 983601:tid 983767] [client 20.226.66.230:61052] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/sixxis.php"] [unique_id "alxl41aztLkF4ZwQhXLlqwAAAKk"]
[Sat Jul 18 23:51:31.218085 2026] [security2:error] [pid 983601:tid 983775] [client 57.141.18.69:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "querenciapartners.com"] [uri "/index.php"] [unique_id "alxl4VaztLkF4ZwQhXLlQwAAALE"]
[Sat Jul 18 23:51:31.370298 2026] [security2:error] [pid 983601:tid 983819] [client 45.134.20.136:28771] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 136.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-themes.php"] [unique_id "alxl41aztLkF4ZwQhXLlsgAAAN0"]
[Sat Jul 18 23:51:31.439124 2026] [security2:error] [pid 983601:tid 983838] [client 185.132.186.14:46739] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/edit-wolf.php"] [unique_id "alxl41aztLkF4ZwQhXLltwAAAPA"]
[Sat Jul 18 23:51:31.478166 2026] [access_compat:error] [pid 983601:tid 983750] [client 159.89.12.166:52164] AH01797: client denied by server configuration: /home1/zanjanfr/public_html/terrapro/server-status
[Sat Jul 18 23:51:31.478559 2026] [security2:error] [pid 983601:tid 983816] [client 20.226.66.230:61053] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/yj09.php"] [unique_id "alxl41aztLkF4ZwQhXLluwAAANo"]
[Sat Jul 18 23:51:31.478658 2026] [security2:error] [pid 983601:tid 983816] [client 20.226.66.230:61053] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/yj09.php"] [unique_id "alxl41aztLkF4ZwQhXLluwAAANo"]
[Sat Jul 18 23:51:31.559532 2026] [security2:error] [pid 983601:tid 983731] [client 45.133.7.81:29379] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 81.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/css/dist/install.php"] [unique_id "alxl41aztLkF4ZwQhXLlwQAAAIU"]
[Sat Jul 18 23:51:31.802894 2026] [security2:error] [pid 983601:tid 983755] [client 20.226.66.230:28684] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/f900.php"] [unique_id "alxl41aztLkF4ZwQhXLl1wAAAJ0"]
[Sat Jul 18 23:51:31.803013 2026] [security2:error] [pid 983601:tid 983755] [client 20.226.66.230:28684] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/f900.php"] [unique_id "alxl41aztLkF4ZwQhXLl1wAAAJ0"]
[Sat Jul 18 23:51:32.017054 2026] [security2:error] [pid 983601:tid 983696] [remote 47.86.33.52:7694] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxl5FaztLkF4ZwQhXLl3AAAhl4"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:51:32.019674 2026] [security2:error] [pid 983601:tid 983712] [remote 41.76.213.235:42520] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxl5FaztLkF4ZwQhXLl3QAAkW4"]
[Sat Jul 18 23:51:32.028873 2026] [security2:error] [pid 983601:tid 983752] [client 36.83.95.75:54540] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxl5FaztLkF4ZwQhXLl3wAAAJo"]
[Sat Jul 18 23:51:32.028979 2026] [security2:error] [pid 983601:tid 983752] [client 36.83.95.75:54540] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxl5FaztLkF4ZwQhXLl3wAAAJo"]
[Sat Jul 18 23:51:32.119155 2026] [security2:error] [pid 983601:tid 983848] [client 20.226.66.230:61021] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/ups.php"] [unique_id "alxl5FaztLkF4ZwQhXLl6AAAAPo"]
[Sat Jul 18 23:51:32.119247 2026] [security2:error] [pid 983601:tid 983848] [client 20.226.66.230:61021] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/ups.php"] [unique_id "alxl5FaztLkF4ZwQhXLl6AAAAPo"]
[Sat Jul 18 23:51:32.227700 2026] [security2:error] [pid 983601:tid 983855] [client 45.134.20.119:56959] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "alxl5FaztLkF4ZwQhXLl8AAAAQE"]
[Sat Jul 18 23:51:32.243059 2026] [security2:error] [pid 983601:tid 983737] [client 45.133.7.85:59187] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 85.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "alxl5FaztLkF4ZwQhXLl8QAAAIs"]
[Sat Jul 18 23:51:32.359683 2026] [security2:error] [pid 983601:tid 983731] [client 185.132.186.20:49751] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 20.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/plugins/ubh/up.php"] [unique_id "alxl5FaztLkF4ZwQhXLl9wAAAIU"]
[Sat Jul 18 23:51:32.436430 2026] [security2:error] [pid 983601:tid 983851] [client 20.226.66.230:28721] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/k.php"] [unique_id "alxl5FaztLkF4ZwQhXLl-gAAAP0"]
[Sat Jul 18 23:51:32.436511 2026] [security2:error] [pid 983601:tid 983851] [client 20.226.66.230:28721] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/k.php"] [unique_id "alxl5FaztLkF4ZwQhXLl-gAAAP0"]
[Sat Jul 18 23:51:32.527416 2026] [security2:error] [pid 983601:tid 983702] [remote 41.76.213.235:42520] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxl5FaztLkF4ZwQhXLmCAAAkmQ"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:51:32.633808 2026] [security2:error] [pid 983601:tid 983775] [client 163.61.1.17:65120] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxl5FaztLkF4ZwQhXLmEQAAALE"]
[Sat Jul 18 23:51:32.633944 2026] [security2:error] [pid 983601:tid 983775] [client 163.61.1.17:65120] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxl5FaztLkF4ZwQhXLmEQAAALE"]
[Sat Jul 18 23:51:32.766831 2026] [security2:error] [pid 983601:tid 983752] [client 20.226.66.230:28713] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/k2.php"] [unique_id "alxl5FaztLkF4ZwQhXLmGQAAAJo"]
[Sat Jul 18 23:51:32.766966 2026] [security2:error] [pid 983601:tid 983752] [client 20.226.66.230:28713] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/k2.php"] [unique_id "alxl5FaztLkF4ZwQhXLmGQAAAJo"]
[Sat Jul 18 23:51:32.926524 2026] [security2:error] [pid 983601:tid 983819] [client 45.133.7.83:43749] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 83.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/adminfusm.php"] [unique_id "alxl5FaztLkF4ZwQhXLmIAAAAN0"]
[Sat Jul 18 23:51:33.084597 2026] [security2:error] [pid 983601:tid 983774] [client 45.134.20.134:51817] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 134.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/erinyani/asasx.php"] [unique_id "alxl5VaztLkF4ZwQhXLmJgAAALA"]
[Sat Jul 18 23:51:33.093565 2026] [security2:error] [pid 983601:tid 983830] [client 20.226.66.230:28714] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/w.php"] [unique_id "alxl5VaztLkF4ZwQhXLmJwAAAOg"]
[Sat Jul 18 23:51:33.093664 2026] [security2:error] [pid 983601:tid 983830] [client 20.226.66.230:28714] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/w.php"] [unique_id "alxl5VaztLkF4ZwQhXLmJwAAAOg"]
[Sat Jul 18 23:51:33.271887 2026] [security2:error] [pid 983601:tid 983852] [client 185.132.186.44:24061] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/images/bootstrap.php"] [unique_id "alxl5VaztLkF4ZwQhXLmMwAAAP4"]
[Sat Jul 18 23:51:33.443642 2026] [security2:error] [pid 983601:tid 983857] [client 20.226.66.230:61016] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/fpwch.php"] [unique_id "alxl5VaztLkF4ZwQhXLmRAAAAQM"]
[Sat Jul 18 23:51:33.443734 2026] [security2:error] [pid 983601:tid 983857] [client 20.226.66.230:61016] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/fpwch.php"] [unique_id "alxl5VaztLkF4ZwQhXLmRAAAAQM"]
[Sat Jul 18 23:51:33.498219 2026] [security2:error] [pid 983601:tid 983805] [client 103.160.26.178:58381] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxl5VaztLkF4ZwQhXLmTAAAAM8"]
[Sat Jul 18 23:51:33.498311 2026] [security2:error] [pid 983601:tid 983805] [client 103.160.26.178:58381] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxl5VaztLkF4ZwQhXLmTAAAAM8"]
[Sat Jul 18 23:51:33.608063 2026] [security2:error] [pid 983601:tid 983773] [client 45.133.7.95:63963] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/click.php"] [unique_id "alxl5VaztLkF4ZwQhXLmXAAAAK8"]
[Sat Jul 18 23:51:33.771400 2026] [security2:error] [pid 983601:tid 983753] [client 20.226.66.230:29130] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/w2025.php"] [unique_id "alxl5VaztLkF4ZwQhXLmZAAAAJs"]
[Sat Jul 18 23:51:33.771497 2026] [security2:error] [pid 983601:tid 983753] [client 20.226.66.230:29130] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/w2025.php"] [unique_id "alxl5VaztLkF4ZwQhXLmZAAAAJs"]
[Sat Jul 18 23:51:33.816085 2026] [security2:error] [pid 983601:tid 983763] [client 180.252.198.240:49546] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxl5VaztLkF4ZwQhXLmcAAAAKU"]
[Sat Jul 18 23:51:33.816175 2026] [security2:error] [pid 983601:tid 983763] [client 180.252.198.240:49546] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxl5VaztLkF4ZwQhXLmcAAAAKU"]
[Sat Jul 18 23:51:33.850407 2026] [security2:error] [pid 983601:tid 983743] [client 138.252.89.100:57913] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxl5VaztLkF4ZwQhXLmdAAAAJE"]
[Sat Jul 18 23:51:33.851201 2026] [security2:error] [pid 983601:tid 983743] [client 138.252.89.100:57913] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxl5VaztLkF4ZwQhXLmdAAAAJE"]
[Sat Jul 18 23:51:33.939589 2026] [security2:error] [pid 983601:tid 983748] [client 158.51.126.91:36716] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "cpanel.genesismedicalbilling.com"] [uri "/.env.production"] [unique_id "alxl5VaztLkF4ZwQhXLmewAAAJY"]
[Sat Jul 18 23:51:33.939622 2026] [security2:error] [pid 983601:tid 983757] [client 45.134.20.125:54263] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 125.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/mariju.php"] [unique_id "alxl5VaztLkF4ZwQhXLmegAAAJ8"]
[Sat Jul 18 23:51:34.098044 2026] [security2:error] [pid 983601:tid 983818] [client 20.226.66.230:61051] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/scxy.php"] [unique_id "alxl5laztLkF4ZwQhXLmhQAAANw"]
[Sat Jul 18 23:51:34.098146 2026] [security2:error] [pid 983601:tid 983818] [client 20.226.66.230:61051] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/scxy.php"] [unique_id "alxl5laztLkF4ZwQhXLmhQAAANw"]
[Sat Jul 18 23:51:34.112606 2026] [security2:error] [pid 983601:tid 983603] [remote 45.157.54.14:13507] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "taskidsvirginia.com"] [uri "/xmlrpc.php"] [unique_id "alxl5laztLkF4ZwQhXLmhwAAoAE"]
[Sat Jul 18 23:51:34.112774 2026] [security2:error] [pid 983601:tid 983758] [client 45.157.54.14:13507] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "taskidsvirginia.com"] [uri "/xmlrpc.php"] [unique_id "alxl5laztLkF4ZwQhXLmhwAAoAE"]
[Sat Jul 18 23:51:34.163172 2026] [security2:error] [pid 983601:tid 983819] [client 185.132.186.39:46295] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 39.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/images/upload.php"] [unique_id "alxl5laztLkF4ZwQhXLmkAAAAN0"]
[Sat Jul 18 23:51:34.287372 2026] [security2:error] [pid 983601:tid 983753] [client 45.133.7.84:32587] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 84.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/template-less.php"] [unique_id "alxl5laztLkF4ZwQhXLmogAAAJs"]
[Sat Jul 18 23:51:34.321663 2026] [security2:error] [pid 983601:tid 983824] [client 3.64.55.230:40016] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.55.64.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxl5laztLkF4ZwQhXLmpwAAAOI"]
[Sat Jul 18 23:51:34.321791 2026] [security2:error] [pid 983601:tid 983824] [client 3.64.55.230:40016] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxl5laztLkF4ZwQhXLmpwAAAOI"]
[Sat Jul 18 23:51:34.415602 2026] [security2:error] [pid 983601:tid 983823] [client 20.226.66.230:61032] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/FWAZ.php"] [unique_id "alxl5laztLkF4ZwQhXLmrQAAAOE"]
[Sat Jul 18 23:51:34.415696 2026] [security2:error] [pid 983601:tid 983823] [client 20.226.66.230:61032] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/FWAZ.php"] [unique_id "alxl5laztLkF4ZwQhXLmrQAAAOE"]
[Sat Jul 18 23:51:34.739025 2026] [security2:error] [pid 983601:tid 983853] [client 20.226.66.230:28718] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/qterm.php"] [unique_id "alxl5laztLkF4ZwQhXLmxAAAAP8"]
[Sat Jul 18 23:51:34.739137 2026] [security2:error] [pid 983601:tid 983853] [client 20.226.66.230:28718] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/qterm.php"] [unique_id "alxl5laztLkF4ZwQhXLmxAAAAP8"]
[Sat Jul 18 23:51:34.774501 2026] [security2:error] [pid 983601:tid 983752] [client 217.217.245.230:16675] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.245.217.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxl5laztLkF4ZwQhXLmyAAAAJo"]
[Sat Jul 18 23:51:34.774633 2026] [security2:error] [pid 983601:tid 983752] [client 217.217.245.230:16675] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxl5laztLkF4ZwQhXLmyAAAAJo"]
[Sat Jul 18 23:51:34.793312 2026] [security2:error] [pid 983601:tid 983789] [client 45.134.20.130:30555] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 130.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/waf_defender.php"] [unique_id "alxl5laztLkF4ZwQhXLmyQAAAL8"]
[Sat Jul 18 23:51:34.970052 2026] [security2:error] [pid 983601:tid 983828] [client 45.133.7.63:51223] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 63.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "alxl5laztLkF4ZwQhXLmzwAAAOY"]
[Sat Jul 18 23:51:35.063506 2026] [security2:error] [pid 983601:tid 983774] [client 20.226.66.230:28679] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/blurbs.php"] [unique_id "alxl51aztLkF4ZwQhXLm1wAAALA"]
[Sat Jul 18 23:51:35.063611 2026] [security2:error] [pid 983601:tid 983774] [client 20.226.66.230:28679] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/blurbs.php"] [unique_id "alxl51aztLkF4ZwQhXLm1wAAALA"]
[Sat Jul 18 23:51:35.098919 2026] [security2:error] [pid 983601:tid 983812] [client 185.132.186.35:48221] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 35.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/plugins/seoplugins/db.php"] [unique_id "alxl51aztLkF4ZwQhXLm1AAAANY"]
[Sat Jul 18 23:51:35.186998 2026] [security2:error] [pid 983601:tid 983646] [remote 117.0.21.154:60220] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxl51aztLkF4ZwQhXLm5QAA4Cw"]
[Sat Jul 18 23:51:35.351872 2026] [security2:error] [pid 983601:tid 983795] [client 57.141.18.10:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxl51aztLkF4ZwQhXLm4QAAAMU"]
[Sat Jul 18 23:51:35.389344 2026] [security2:error] [pid 983601:tid 983769] [client 20.226.66.230:61050] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/v543.php"] [unique_id "alxl51aztLkF4ZwQhXLm8gAAAKs"]
[Sat Jul 18 23:51:35.389446 2026] [security2:error] [pid 983601:tid 983769] [client 20.226.66.230:61050] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/v543.php"] [unique_id "alxl51aztLkF4ZwQhXLm8gAAAKs"]
[Sat Jul 18 23:51:35.653647 2026] [security2:error] [pid 983601:tid 983732] [client 45.133.7.70:25167] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 70.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/abcd.php"] [unique_id "alxl51aztLkF4ZwQhXLnBQAAAIY"]
[Sat Jul 18 23:51:35.656653 2026] [security2:error] [pid 983601:tid 983735] [client 45.134.20.139:29067] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 139.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/maint/cong.php"] [unique_id "alxl51aztLkF4ZwQhXLnBgAAAIk"]
[Sat Jul 18 23:51:35.658277 2026] [security2:error] [pid 983601:tid 983667] [remote 117.0.21.154:60220] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxl51aztLkF4ZwQhXLnAwAA8kE"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:51:35.704941 2026] [security2:error] [pid 983601:tid 983787] [client 20.226.66.230:60994] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/w3lls.php"] [unique_id "alxl51aztLkF4ZwQhXLnCwAAAL0"]
[Sat Jul 18 23:51:35.705019 2026] [security2:error] [pid 983601:tid 983787] [client 20.226.66.230:60994] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/w3lls.php"] [unique_id "alxl51aztLkF4ZwQhXLnCwAAAL0"]
[Sat Jul 18 23:51:35.997764 2026] [security2:error] [pid 983601:tid 983770] [client 185.132.186.38:32131] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 38.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/themes/pridmag/db.php"] [unique_id "alxl51aztLkF4ZwQhXLnIwAAAKw"]
[Sat Jul 18 23:51:36.022943 2026] [security2:error] [pid 983601:tid 983734] [client 20.226.66.230:61055] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-ws68.php"] [unique_id "alxl6FaztLkF4ZwQhXLnJgAAAIg"]
[Sat Jul 18 23:51:36.023039 2026] [security2:error] [pid 983601:tid 983734] [client 20.226.66.230:61055] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-ws68.php"] [unique_id "alxl6FaztLkF4ZwQhXLnJgAAAIg"]
[Sat Jul 18 23:51:36.345273 2026] [security2:error] [pid 983601:tid 983816] [client 20.226.66.230:61041] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/xyn.php"] [unique_id "alxl6FaztLkF4ZwQhXLnPQAAANo"]
[Sat Jul 18 23:51:36.345367 2026] [security2:error] [pid 983601:tid 983816] [client 20.226.66.230:61041] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/xyn.php"] [unique_id "alxl6FaztLkF4ZwQhXLnPQAAANo"]
[Sat Jul 18 23:51:36.346346 2026] [security2:error] [pid 983601:tid 983842] [client 45.133.7.79:56623] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 79.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/colors/blue/admin-footer.php"] [unique_id "alxl6FaztLkF4ZwQhXLnPgAAAPQ"]
[Sat Jul 18 23:51:36.518863 2026] [security2:error] [pid 983601:tid 983733] [client 45.134.20.118:50697] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/av.php"] [unique_id "alxl6FaztLkF4ZwQhXLnSgAAAIc"]
[Sat Jul 18 23:51:36.568208 2026] [security2:error] [pid 983601:tid 983611] [remote 188.138.102.156:40116] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "rpv.ekr.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxl6FaztLkF4ZwQhXLnTgAApgk"]
[Sat Jul 18 23:51:36.670553 2026] [security2:error] [pid 983601:tid 983734] [client 20.226.66.230:29140] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/green3.php"] [unique_id "alxl6FaztLkF4ZwQhXLnUwAAAIg"]
[Sat Jul 18 23:51:36.670659 2026] [security2:error] [pid 983601:tid 983734] [client 20.226.66.230:29140] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/green3.php"] [unique_id "alxl6FaztLkF4ZwQhXLnUwAAAIg"]
[Sat Jul 18 23:51:36.744726 2026] [security2:error] [pid 983601:tid 983798] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxl6FaztLkF4ZwQhXLnSwAAAMg"]
[Sat Jul 18 23:51:36.765847 2026] [security2:error] [pid 983601:tid 983703] [remote 188.138.102.156:40116] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "rpv.ekr.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxl6FaztLkF4ZwQhXLnYwAAz2U"], referer: https://rpv.ekr.mybluehost.me/wp-login.php
[Sat Jul 18 23:51:36.787584 2026] [security2:error] [pid 983601:tid 983827] [client 20.230.87.222:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 222.87.230.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.yidaiyi.org"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "alxl6FaztLkF4ZwQhXLnZAAAAOU"]
[Sat Jul 18 23:51:36.787713 2026] [security2:error] [pid 983601:tid 983827] [client 20.230.87.222:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.yidaiyi.org"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "alxl6FaztLkF4ZwQhXLnZAAAAOU"]
[Sat Jul 18 23:51:36.898336 2026] [security2:error] [pid 983601:tid 983797] [client 185.132.186.49:37631] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 49.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/plugins/linkpreview/db.php"] [unique_id "alxl6FaztLkF4ZwQhXLncQAAAMc"]
[Sat Jul 18 23:51:36.985669 2026] [security2:error] [pid 983601:tid 983778] [client 20.226.66.230:29164] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/ccc.php"] [unique_id "alxl6FaztLkF4ZwQhXLndAAAALQ"]
[Sat Jul 18 23:51:36.985779 2026] [security2:error] [pid 983601:tid 983778] [client 20.226.66.230:29164] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/ccc.php"] [unique_id "alxl6FaztLkF4ZwQhXLndAAAALQ"]
[Sat Jul 18 23:51:37.308616 2026] [security2:error] [pid 983601:tid 983770] [client 20.226.66.230:28702] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/get.php"] [unique_id "alxl6VaztLkF4ZwQhXLnlAAAAKw"]
[Sat Jul 18 23:51:37.308729 2026] [security2:error] [pid 983601:tid 983770] [client 20.226.66.230:28702] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/get.php"] [unique_id "alxl6VaztLkF4ZwQhXLnlAAAAKw"]
[Sat Jul 18 23:51:37.366587 2026] [security2:error] [pid 983601:tid 983740] [client 45.133.7.87:33603] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 87.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/twentytwentytwo/bypass.php"] [unique_id "alxl6VaztLkF4ZwQhXLnmQAAAI4"]
[Sat Jul 18 23:51:37.374966 2026] [security2:error] [pid 983601:tid 983808] [client 45.134.20.118:39893] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/glex.php"] [unique_id "alxl6VaztLkF4ZwQhXLnmwAAANI"]
[Sat Jul 18 23:51:37.609600 2026] [security2:error] [pid 983601:tid 983809] [client 91.92.41.115:64808] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^0$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "96"] [id "392301"] [rev "7"] [msg "Atomicorp.com WAF Rules: Request Containing Content, but Missing Content-Type header"] [severity "NOTICE"] [tag "no_ar"] [hostname "cpanel.kdg.jiv.mybluehost.me"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alxl6VaztLkF4ZwQhXLnrAAAANM"]
[Sat Jul 18 23:51:37.629667 2026] [security2:error] [pid 983601:tid 983741] [client 20.226.66.230:28709] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/images.php"] [unique_id "alxl6VaztLkF4ZwQhXLnrQAAAI8"]
[Sat Jul 18 23:51:37.629790 2026] [security2:error] [pid 983601:tid 983741] [client 20.226.66.230:28709] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/images.php"] [unique_id "alxl6VaztLkF4ZwQhXLnrQAAAI8"]
[Sat Jul 18 23:51:37.668215 2026] [security2:error] [pid 983601:tid 983624] [remote 113.160.142.119:54170] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "oohlovely.com"] [uri "/wp-login.php"] [unique_id "alxl6VaztLkF4ZwQhXLnsQAA_BY"]
[Sat Jul 18 23:51:37.877404 2026] [security2:error] [pid 983601:tid 983847] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxl6VaztLkF4ZwQhXLnsgAAAPk"]
[Sat Jul 18 23:51:37.950814 2026] [security2:error] [pid 983601:tid 983833] [client 20.226.66.230:60998] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/alls.php"] [unique_id "alxl6VaztLkF4ZwQhXLn0QAAAOs"]
[Sat Jul 18 23:51:37.950928 2026] [security2:error] [pid 983601:tid 983833] [client 20.226.66.230:60998] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/alls.php"] [unique_id "alxl6VaztLkF4ZwQhXLn0QAAAOs"]
[Sat Jul 18 23:51:38.051228 2026] [security2:error] [pid 983601:tid 983852] [client 45.133.7.67:39087] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-admin/css/elementskit.php"] [unique_id "alxl6laztLkF4ZwQhXLn1AAAAP4"]
[Sat Jul 18 23:51:38.175328 2026] [security2:error] [pid 983601:tid 983637] [remote 113.160.142.119:54170] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "oohlovely.com"] [uri "/wp-login.php"] [unique_id "alxl6laztLkF4ZwQhXLn2wAAniM"], referer: https://oohlovely.com/wp-login.php
[Sat Jul 18 23:51:38.230299 2026] [security2:error] [pid 983601:tid 983773] [client 45.134.20.104:37841] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/autoload_classmap.php"] [unique_id "alxl6laztLkF4ZwQhXLn3QAAAK8"]
[Sat Jul 18 23:51:38.265109 2026] [security2:error] [pid 983601:tid 983807] [client 185.132.186.18:59539] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 18.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/udd.php"] [unique_id "alxl6laztLkF4ZwQhXLn4QAAANE"]
[Sat Jul 18 23:51:38.269152 2026] [security2:error] [pid 983601:tid 983733] [client 54.90.74.5:35648] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxl6VaztLkF4ZwQhXLnqAAA1AE"]
[Sat Jul 18 23:51:38.269181 2026] [security2:error] [pid 983601:tid 983733] [client 54.90.74.5:35648] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxl6VaztLkF4ZwQhXLnqAAA1AE"]
[Sat Jul 18 23:51:38.271095 2026] [security2:error] [pid 983601:tid 983732] [client 20.226.66.230:28682] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/coffexium.php"] [unique_id "alxl6laztLkF4ZwQhXLn4gAAAIY"]
[Sat Jul 18 23:51:38.271187 2026] [security2:error] [pid 983601:tid 983732] [client 20.226.66.230:28682] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/coffexium.php"] [unique_id "alxl6laztLkF4ZwQhXLn4gAAAIY"]
[Sat Jul 18 23:51:38.375159 2026] [security2:error] [pid 983601:tid 983850] [client 74.208.214.194:46040] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxl6laztLkF4ZwQhXLn8gAAAPw"]
[Sat Jul 18 23:51:38.477807 2026] [security2:error] [pid 983601:tid 983838] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxl6laztLkF4ZwQhXLn5gAAAPA"]
[Sat Jul 18 23:51:38.573707 2026] [security2:error] [pid 983601:tid 983836] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxl6laztLkF4ZwQhXLn8wAAAO4"]
[Sat Jul 18 23:51:38.607528 2026] [security2:error] [pid 983601:tid 983851] [client 20.226.66.230:28707] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/red.php"] [unique_id "alxl6laztLkF4ZwQhXLoAwAAAP0"]
[Sat Jul 18 23:51:38.607605 2026] [security2:error] [pid 983601:tid 983851] [client 20.226.66.230:28707] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/red.php"] [unique_id "alxl6laztLkF4ZwQhXLoAwAAAP0"]
[Sat Jul 18 23:51:38.731320 2026] [security2:error] [pid 983601:tid 983744] [client 45.133.7.58:27521] ModSecurity: Warning. Pattern match "/1\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1543"] [id "900921"] [msg "temporary TUW-72162 logging rule"] [hostname "nikkidesigns.net"] [uri "/js/1.php7"] [unique_id "alxl6laztLkF4ZwQhXLoDwAAAJI"]
[Sat Jul 18 23:51:38.731442 2026] [security2:error] [pid 983601:tid 983744] [client 45.133.7.58:27521] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 58.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/js/1.php7"] [unique_id "alxl6laztLkF4ZwQhXLoDwAAAJI"]
[Sat Jul 18 23:51:38.942681 2026] [security2:error] [pid 983601:tid 983754] [client 20.226.66.230:28704] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-includes/sodium_compat/"] [unique_id "alxl6laztLkF4ZwQhXLoIgAAAJw"]
[Sat Jul 18 23:51:39.084810 2026] [security2:error] [pid 983601:tid 983751] [client 45.134.20.122:57379] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "alxl61aztLkF4ZwQhXLoJwAAAJk"]
[Sat Jul 18 23:51:39.152136 2026] [security2:error] [pid 983601:tid 983807] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxl6laztLkF4ZwQhXLoIQAAANE"]
[Sat Jul 18 23:51:39.161805 2026] [security2:error] [pid 983601:tid 983762] [client 185.132.186.28:59637] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 28.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "alxl61aztLkF4ZwQhXLoKwAAAKQ"]
[Sat Jul 18 23:51:39.376238 2026] [security2:error] [pid 983601:tid 983709] [remote 54.90.74.5:35660] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.74.90.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "jndsupport.com"] [uri "/wp-login.php"] [unique_id "alxl61aztLkF4ZwQhXLoMQAAlGs"]
[Sat Jul 18 23:51:39.410062 2026] [security2:error] [pid 983601:tid 983784] [client 45.133.7.92:54869] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 92.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes/twentytwentyfour/install.php"] [unique_id "alxl61aztLkF4ZwQhXLoNgAAALo"]
[Sat Jul 18 23:51:39.460961 2026] [security2:error] [pid 983601:tid 983769] [client 20.226.66.230:61006] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-includes/sodium_compat/"] [unique_id "alxl61aztLkF4ZwQhXLoNwAAAKs"]
[Sat Jul 18 23:51:39.618770 2026] [lsapi:warn] [pid 983601:tid 983659] [remote 57.141.18.65:26958] [host oldracelimited.com] Backend log: PHP Warning:  Undefined array key "host" in /home2/oldracel/public_html/oldracelimited/wp-content/plugins/bluehost-wordpress-plugin/inc/YoastAI.php on line 54\n
[Sat Jul 18 23:51:39.621781 2026] [lsapi:warn] [pid 983601:tid 983659] [remote 57.141.18.65:26958] [host oldracelimited.com] Backend log: PHP Warning:  Undefined array key "host" in /home2/oldracel/public_html/oldracelimited/wp-content/plugins/bluehost-wordpress-plugin/inc/YoastAI.php on line 54\n
[Sat Jul 18 23:51:39.624076 2026] [security2:error] [pid 983601:tid 983773] [client 20.226.66.230:28704] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-admin/css/colors/coffee/wp-adochan.php"] [unique_id "alxl61aztLkF4ZwQhXLoTQAAAK8"]
[Sat Jul 18 23:51:39.624158 2026] [security2:error] [pid 983601:tid 983773] [client 20.226.66.230:28704] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-admin/css/colors/coffee/wp-adochan.php"] [unique_id "alxl61aztLkF4ZwQhXLoTQAAAK8"]
[Sat Jul 18 23:51:39.696267 2026] [security2:error] [pid 983601:tid 983781] [client 159.89.12.166:60090] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "www.adventure-studio.zanjan-fromer.com"] [uri "/.env"] [unique_id "alxl61aztLkF4ZwQhXLoVgAAALc"]
[Sat Jul 18 23:51:39.937954 2026] [security2:error] [pid 983601:tid 983852] [client 45.134.20.111:31161] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/acme-challenge/about.php"] [unique_id "alxl61aztLkF4ZwQhXLoaQAAAP4"]
[Sat Jul 18 23:51:39.940145 2026] [security2:error] [pid 983601:tid 983807] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxl61aztLkF4ZwQhXLoWgAAANE"]
[Sat Jul 18 23:51:39.948759 2026] [security2:error] [pid 983601:tid 983777] [client 20.226.66.230:28698] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-includes/Text/"] [unique_id "alxl61aztLkF4ZwQhXLoawAAALM"]
[Sat Jul 18 23:51:40.056421 2026] [security2:error] [pid 983601:tid 983800] [client 185.132.186.25:40355] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/plugins/pwnd-1/pwnd.php"] [unique_id "alxl7FaztLkF4ZwQhXLobwAAAMo"]
[Sat Jul 18 23:51:40.099355 2026] [security2:error] [pid 983601:tid 983767] [client 45.133.7.68:50589] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 68.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/assets/min.php"] [unique_id "alxl7FaztLkF4ZwQhXLocwAAAKk"]
[Sat Jul 18 23:51:40.122577 2026] [security2:error] [pid 983601:tid 983825] [client 20.226.66.230:61006] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-includes/Text/"] [unique_id "alxl7FaztLkF4ZwQhXLodAAAAOM"]
[Sat Jul 18 23:51:40.289566 2026] [access_compat:error] [pid 983601:tid 983713] [remote 54.90.74.5:35732] AH01797: client denied by server configuration: proxy:https://127.0.0.1:8443/server-status
[Sat Jul 18 23:51:40.289813 2026] [security2:error] [pid 983601:tid 983734] [client 20.226.66.230:28698] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/footer.php"] [unique_id "alxl7FaztLkF4ZwQhXLohwAAAIg"]
[Sat Jul 18 23:51:40.289919 2026] [security2:error] [pid 983601:tid 983734] [client 20.226.66.230:28698] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/footer.php"] [unique_id "alxl7FaztLkF4ZwQhXLohwAAAIg"]
[Sat Jul 18 23:51:40.438842 2026] [security2:error] [pid 983601:tid 983849] [client 54.90.74.5:35690] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxl7FaztLkF4ZwQhXLodQAA-2c"]
[Sat Jul 18 23:51:40.438868 2026] [security2:error] [pid 983601:tid 983849] [client 54.90.74.5:35690] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxl7FaztLkF4ZwQhXLodQAA-2c"]
[Sat Jul 18 23:51:40.618961 2026] [security2:error] [pid 983601:tid 983819] [client 20.226.66.230:29126] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-content/uploads/"] [unique_id "alxl7FaztLkF4ZwQhXLonAAAAN0"]
[Sat Jul 18 23:51:40.651855 2026] [security2:error] [pid 983601:tid 983833] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxl7FaztLkF4ZwQhXLolAAAAOs"]
[Sat Jul 18 23:51:40.782608 2026] [security2:error] [pid 983601:tid 983748] [client 45.133.7.93:24831] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 93.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/wp-conflg.php"] [unique_id "alxl7FaztLkF4ZwQhXLopwAAAJY"]
[Sat Jul 18 23:51:40.794979 2026] [security2:error] [pid 983601:tid 983817] [client 45.134.20.109:27673] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 109.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/twentytwentyfour/system_cache.php"] [unique_id "alxl7FaztLkF4ZwQhXLoqAAAANs"]
[Sat Jul 18 23:51:40.813017 2026] [authz_core:error] [pid 983601:tid 983840] [client 20.226.66.230:61006] AH01630: client denied by server configuration: /home4/katsklar/public_html/wp-content/uploads/wpcf7_uploads/
[Sat Jul 18 23:51:40.813562 2026] [security2:error] [pid 983601:tid 983840] [client 20.226.66.230:61006] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-content/uploads/"] [unique_id "alxl7FaztLkF4ZwQhXLopgAAAPI"]
[Sat Jul 18 23:51:40.853405 2026] [security2:error] [pid 983601:tid 983757] [client 50.116.65.227:44428] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "oldracelimited.com"] [uri "/index.php"] [unique_id "alxl7FaztLkF4ZwQhXLogwAAAJ8"]
[Sat Jul 18 23:51:40.963499 2026] [security2:error] [pid 983601:tid 983815] [client 185.132.186.23:25891] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 23.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/css/colors/midnight/admin.php"] [unique_id "alxl7FaztLkF4ZwQhXLotQAAANk"]
[Sat Jul 18 23:51:40.994657 2026] [security2:error] [pid 983601:tid 983756] [client 20.226.66.230:29126] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-content/index.php"] [unique_id "alxl7FaztLkF4ZwQhXLougAAAJ4"]
[Sat Jul 18 23:51:40.994760 2026] [security2:error] [pid 983601:tid 983756] [client 20.226.66.230:29126] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-content/index.php"] [unique_id "alxl7FaztLkF4ZwQhXLougAAAJ4"]
[Sat Jul 18 23:51:41.143968 2026] [security2:error] [pid 983601:tid 983834] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxl7FaztLkF4ZwQhXLotAAAAOw"]
[Sat Jul 18 23:51:41.238265 2026] [security2:error] [pid 983601:tid 983844] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxl7VaztLkF4ZwQhXLowgAAAPY"]
[Sat Jul 18 23:51:41.341463 2026] [security2:error] [pid 983601:tid 983785] [client 20.226.66.230:61007] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/admin.php"] [unique_id "alxl7VaztLkF4ZwQhXLo0QAAALs"]
[Sat Jul 18 23:51:41.341569 2026] [security2:error] [pid 983601:tid 983785] [client 20.226.66.230:61007] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/admin.php"] [unique_id "alxl7VaztLkF4ZwQhXLo0QAAALs"]
[Sat Jul 18 23:51:41.353009 2026] [security2:error] [pid 983601:tid 983846] [client 20.230.87.222:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 222.87.230.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.yidaiyi.org"] [uri "/this_is_a_new_hello_world.php"] [unique_id "alxl7VaztLkF4ZwQhXLo0gAAAPg"]
[Sat Jul 18 23:51:41.353097 2026] [security2:error] [pid 983601:tid 983846] [client 20.230.87.222:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.yidaiyi.org"] [uri "/this_is_a_new_hello_world.php"] [unique_id "alxl7VaztLkF4ZwQhXLo0gAAAPg"]
[Sat Jul 18 23:51:41.435203 2026] [security2:error] [pid 983601:tid 983753] [client 50.116.65.227:44438] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "oldracelimited.com"] [uri "/index.php"] [unique_id "alxl7FaztLkF4ZwQhXLoqgAAAJs"]
[Sat Jul 18 23:51:41.518596 2026] [security2:error] [pid 983601:tid 983853] [client 45.133.7.55:28235] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 55.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/backup/autoload_classmap.php"] [unique_id "alxl7VaztLkF4ZwQhXLo4QAAAP8"]
[Sat Jul 18 23:51:41.651929 2026] [security2:error] [pid 983601:tid 983761] [client 45.134.20.139:41441] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 139.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/sky-pro/js.php"] [unique_id "alxl7VaztLkF4ZwQhXLo8wAAAKM"]
[Sat Jul 18 23:51:41.671821 2026] [security2:error] [pid 983601:tid 983823] [client 20.226.66.230:28722] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/177.php"] [unique_id "alxl7VaztLkF4ZwQhXLo9wAAAOE"]
[Sat Jul 18 23:51:41.671943 2026] [security2:error] [pid 983601:tid 983823] [client 20.226.66.230:28722] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/177.php"] [unique_id "alxl7VaztLkF4ZwQhXLo9wAAAOE"]
[Sat Jul 18 23:51:41.692259 2026] [security2:error] [pid 983601:tid 983760] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxl7VaztLkF4ZwQhXLo3wAAAKI"]
[Sat Jul 18 23:51:41.871675 2026] [security2:error] [pid 983601:tid 983812] [client 185.132.186.30:39115] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 30.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/kill.php"] [unique_id "alxl7VaztLkF4ZwQhXLpAQAAANY"]
[Sat Jul 18 23:51:42.073343 2026] [security2:error] [pid 983601:tid 983825] [client 20.226.66.230:29143] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/199.php"] [unique_id "alxl7laztLkF4ZwQhXLpDwAAAOM"]
[Sat Jul 18 23:51:42.073426 2026] [security2:error] [pid 983601:tid 983825] [client 20.226.66.230:29143] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/199.php"] [unique_id "alxl7laztLkF4ZwQhXLpDwAAAOM"]
[Sat Jul 18 23:51:42.160122 2026] [security2:error] [pid 983601:tid 983807] [client 36.83.95.75:55037] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxl7laztLkF4ZwQhXLpFAAAANE"]
[Sat Jul 18 23:51:42.160217 2026] [security2:error] [pid 983601:tid 983807] [client 36.83.95.75:55037] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxl7laztLkF4ZwQhXLpFAAAANE"]
[Sat Jul 18 23:51:42.205781 2026] [security2:error] [pid 983601:tid 983745] [client 45.133.7.84:52283] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 84.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/uploads/uploads.php"] [unique_id "alxl7laztLkF4ZwQhXLpFwAAAJM"]
[Sat Jul 18 23:51:42.402717 2026] [security2:error] [pid 983601:tid 983808] [client 13.232.206.133:39710] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.206.232.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxl7laztLkF4ZwQhXLpHwAAANI"]
[Sat Jul 18 23:51:42.442363 2026] [security2:error] [pid 983601:tid 983793] [client 20.226.66.230:61014] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/file52.php"] [unique_id "alxl7laztLkF4ZwQhXLpIQAAAMM"]
[Sat Jul 18 23:51:42.442457 2026] [security2:error] [pid 983601:tid 983793] [client 20.226.66.230:61014] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/file52.php"] [unique_id "alxl7laztLkF4ZwQhXLpIQAAAMM"]
[Sat Jul 18 23:51:42.504771 2026] [security2:error] [pid 983601:tid 983844] [client 45.134.20.105:30051] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "alxl7laztLkF4ZwQhXLpJAAAAPY"]
[Sat Jul 18 23:51:42.632571 2026] [security2:error] [pid 983601:tid 983815] [client 104.196.104.214:58818] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "talknutritionwithlesley.com"] [uri "/wp-json/batch/v1"] [unique_id "alxl7laztLkF4ZwQhXLpKwAAANk"]
[Sat Jul 18 23:51:42.786103 2026] [security2:error] [pid 983601:tid 983826] [client 185.132.186.36:34991] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 36.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "alxl7laztLkF4ZwQhXLpPQAAAOQ"]
[Sat Jul 18 23:51:42.850113 2026] [security2:error] [pid 983601:tid 983853] [client 20.226.66.230:29159] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/geck.php"] [unique_id "alxl7laztLkF4ZwQhXLpRAAAAP8"]
[Sat Jul 18 23:51:42.850188 2026] [security2:error] [pid 983601:tid 983853] [client 20.226.66.230:29159] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/geck.php"] [unique_id "alxl7laztLkF4ZwQhXLpRAAAAP8"]
[Sat Jul 18 23:51:42.871979 2026] [security2:error] [pid 983601:tid 983788] [client 163.61.1.17:49222] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxl7laztLkF4ZwQhXLpSgAAAL4"]
[Sat Jul 18 23:51:42.872087 2026] [security2:error] [pid 983601:tid 983788] [client 163.61.1.17:49222] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxl7laztLkF4ZwQhXLpSgAAAL4"]
[Sat Jul 18 23:51:42.886477 2026] [security2:error] [pid 983601:tid 983747] [client 45.133.7.72:46887] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 72.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/file.php"] [unique_id "alxl7laztLkF4ZwQhXLpTAAAAJU"]
[Sat Jul 18 23:51:43.010083 2026] [security2:error] [pid 983601:tid 983852] [client 104.196.104.214:58818] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "talknutritionwithlesley.com"] [uri "/"] [unique_id "alxl71aztLkF4ZwQhXLpTgAAAP4"]
[Sat Jul 18 23:51:43.234455 2026] [security2:error] [pid 983601:tid 983814] [client 20.226.66.230:29139] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/biufile.php"] [unique_id "alxl71aztLkF4ZwQhXLpZgAAANg"]
[Sat Jul 18 23:51:43.234566 2026] [security2:error] [pid 983601:tid 983814] [client 20.226.66.230:29139] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/biufile.php"] [unique_id "alxl71aztLkF4ZwQhXLpZgAAANg"]
[Sat Jul 18 23:51:43.361114 2026] [security2:error] [pid 983601:tid 983757] [client 45.134.20.107:50149] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 107.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/pridmag/waf_defender.php"] [unique_id "alxl71aztLkF4ZwQhXLpbwAAAJ8"]
[Sat Jul 18 23:51:43.506132 2026] [security2:error] [pid 983601:tid 983644] [remote 41.76.213.235:43056] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "str.cly.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxl71aztLkF4ZwQhXLpcQAA4io"]
[Sat Jul 18 23:51:43.555914 2026] [security2:error] [pid 983601:tid 983761] [client 20.226.66.230:61049] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/mosty.php"] [unique_id "alxl71aztLkF4ZwQhXLpdAAAAKM"]
[Sat Jul 18 23:51:43.555999 2026] [security2:error] [pid 983601:tid 983761] [client 20.226.66.230:61049] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/mosty.php"] [unique_id "alxl71aztLkF4ZwQhXLpdAAAAKM"]
[Sat Jul 18 23:51:43.556802 2026] [security2:error] [pid 983601:tid 983737] [client 13.232.206.133:39716] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.206.232.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxl71aztLkF4ZwQhXLpdQAAAIs"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:51:43.569168 2026] [security2:error] [pid 983601:tid 983772] [client 45.133.7.72:59995] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 72.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-content/themes.php"] [unique_id "alxl71aztLkF4ZwQhXLpdwAAAK4"]
[Sat Jul 18 23:51:43.685325 2026] [security2:error] [pid 983601:tid 983771] [client 185.132.186.25:37401] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "alxl71aztLkF4ZwQhXLpgAAAAK0"]
[Sat Jul 18 23:51:44.020005 2026] [security2:error] [pid 983601:tid 983821] [client 103.160.26.178:58879] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxl8FaztLkF4ZwQhXLpmgAAAN8"]
[Sat Jul 18 23:51:44.020099 2026] [security2:error] [pid 983601:tid 983821] [client 103.160.26.178:58879] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxl8FaztLkF4ZwQhXLpmgAAAN8"]
[Sat Jul 18 23:51:44.033876 2026] [security2:error] [pid 983601:tid 983708] [remote 41.76.213.235:43056] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 235.213.76.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "str.cly.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxl8FaztLkF4ZwQhXLpmwAAp2o"], referer: https://str.cly.mybluehost.me/wp-login.php
[Sat Jul 18 23:51:44.183054 2026] [security2:error] [pid 983601:tid 983735] [client 180.252.198.240:50039] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxl8FaztLkF4ZwQhXLppAAAAIk"]
[Sat Jul 18 23:51:44.184628 2026] [security2:error] [pid 983601:tid 983735] [client 180.252.198.240:50039] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxl8FaztLkF4ZwQhXLppAAAAIk"]
[Sat Jul 18 23:51:44.220279 2026] [security2:error] [pid 983601:tid 983747] [client 45.134.20.121:37001] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 121.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/theme.php"] [unique_id "alxl8FaztLkF4ZwQhXLpqAAAAJU"]
[Sat Jul 18 23:51:44.248206 2026] [security2:error] [pid 983601:tid 983737] [client 45.133.7.61:40355] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "alxl8FaztLkF4ZwQhXLprgAAAIs"]
[Sat Jul 18 23:51:44.596637 2026] [security2:error] [pid 983601:tid 983749] [client 185.132.186.51:38019] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 51.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/plugins/core-plugin/include.php"] [unique_id "alxl8FaztLkF4ZwQhXLpxAAAAJc"]
[Sat Jul 18 23:51:44.672461 2026] [security2:error] [pid 983601:tid 983678] [remote 54.90.74.5:35760] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "jndsupport.com"] [uri "/.env"] [unique_id "alxl8FaztLkF4ZwQhXLpzgAA60w"]
[Sat Jul 18 23:51:44.737548 2026] [security2:error] [pid 983601:tid 983842] [client 20.226.66.230:28687] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/dejavu.php"] [unique_id "alxl8FaztLkF4ZwQhXLp1AAAAPQ"]
[Sat Jul 18 23:51:44.737640 2026] [security2:error] [pid 983601:tid 983842] [client 20.226.66.230:28687] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/dejavu.php"] [unique_id "alxl8FaztLkF4ZwQhXLp1AAAAPQ"]
[Sat Jul 18 23:51:44.871276 2026] [security2:error] [pid 983601:tid 983616] [remote 31.42.184.154:37356] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxl8FaztLkF4ZwQhXLp2gAAtQ4"]
[Sat Jul 18 23:51:44.871452 2026] [security2:error] [pid 983601:tid 983779] [client 31.42.184.154:37356] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxl8FaztLkF4ZwQhXLp2gAAtQ4"]
[Sat Jul 18 23:51:45.073970 2026] [security2:error] [pid 983601:tid 983764] [client 45.134.20.116:57329] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 116.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/twentytwentytwo/waf_defender.php"] [unique_id "alxl8VaztLkF4ZwQhXLp5QAAAKY"]
[Sat Jul 18 23:51:45.110158 2026] [security2:error] [pid 983601:tid 983755] [client 20.226.66.230:61020] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/aaf.php"] [unique_id "alxl8VaztLkF4ZwQhXLp7QAAAJ0"]
[Sat Jul 18 23:51:45.110245 2026] [security2:error] [pid 983601:tid 983755] [client 20.226.66.230:61020] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/aaf.php"] [unique_id "alxl8VaztLkF4ZwQhXLp7QAAAJ0"]
[Sat Jul 18 23:51:45.278668 2026] [security2:error] [pid 983601:tid 983763] [client 45.133.7.100:56487] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/load.php"] [unique_id "alxl8VaztLkF4ZwQhXLp-AAAAKU"]
[Sat Jul 18 23:51:45.375789 2026] [security2:error] [pid 983601:tid 983743] [client 217.217.245.230:58077] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.245.217.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxl8VaztLkF4ZwQhXLp_gAAAJE"]
[Sat Jul 18 23:51:45.375910 2026] [security2:error] [pid 983601:tid 983743] [client 217.217.245.230:58077] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxl8VaztLkF4ZwQhXLp_gAAAJE"]
[Sat Jul 18 23:51:45.458045 2026] [security2:error] [pid 983601:tid 983822] [client 20.226.66.230:61012] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/ha.php"] [unique_id "alxl8VaztLkF4ZwQhXLqBQAAAOA"]
[Sat Jul 18 23:51:45.458136 2026] [security2:error] [pid 983601:tid 983822] [client 20.226.66.230:61012] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/ha.php"] [unique_id "alxl8VaztLkF4ZwQhXLqBQAAAOA"]
[Sat Jul 18 23:51:45.463944 2026] [security2:error] [pid 983601:tid 983807] [client 138.252.89.100:58451] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxl8VaztLkF4ZwQhXLqBgAAANE"]
[Sat Jul 18 23:51:45.464035 2026] [security2:error] [pid 983601:tid 983807] [client 138.252.89.100:58451] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxl8VaztLkF4ZwQhXLqBgAAANE"]
[Sat Jul 18 23:51:45.487619 2026] [security2:error] [pid 983601:tid 983855] [client 185.132.186.36:38953] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 36.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/plugins/envato-css.php"] [unique_id "alxl8VaztLkF4ZwQhXLqCwAAAQE"]
[Sat Jul 18 23:51:45.774565 2026] [security2:error] [pid 983601:tid 983778] [client 20.226.66.230:28729] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/hur.php"] [unique_id "alxl8VaztLkF4ZwQhXLqIgAAALQ"]
[Sat Jul 18 23:51:45.774688 2026] [security2:error] [pid 983601:tid 983778] [client 20.226.66.230:28729] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/hur.php"] [unique_id "alxl8VaztLkF4ZwQhXLqIgAAALQ"]
[Sat Jul 18 23:51:45.928481 2026] [security2:error] [pid 983601:tid 983829] [client 45.134.20.124:37741] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 124.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/coffee/index.php"] [unique_id "alxl8VaztLkF4ZwQhXLqMwAAAOc"]
[Sat Jul 18 23:51:45.966009 2026] [security2:error] [pid 983601:tid 983749] [client 45.133.7.62:33089] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 62.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "alxl8VaztLkF4ZwQhXLqNAAAAJc"]
[Sat Jul 18 23:51:46.052142 2026] [security2:error] [pid 983601:tid 983623] [remote 45.119.213.111:57812] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.213.119.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxl8laztLkF4ZwQhXLqOgAA3RU"]
[Sat Jul 18 23:51:46.053519 2026] [security2:error] [pid 983601:tid 983834] [client 104.196.104.214:58818] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "talknutritionwithlesley.com"] [uri "/index.php"] [unique_id "alxl8VaztLkF4ZwQhXLp-QAAAOw"], referer: http://talknutritionwithlesley.com/wp-json/batch/v1
[Sat Jul 18 23:51:46.107616 2026] [security2:error] [pid 983601:tid 983812] [client 20.226.66.230:28699] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/h02ugyh.php"] [unique_id "alxl8laztLkF4ZwQhXLqPQAAANY"]
[Sat Jul 18 23:51:46.107707 2026] [security2:error] [pid 983601:tid 983812] [client 20.226.66.230:28699] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/h02ugyh.php"] [unique_id "alxl8laztLkF4ZwQhXLqPQAAANY"]
[Sat Jul 18 23:51:46.390134 2026] [security2:error] [pid 983601:tid 983798] [client 185.132.186.14:44531] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/classwithtostring.php"] [unique_id "alxl8laztLkF4ZwQhXLqTgAAAMg"]
[Sat Jul 18 23:51:46.450415 2026] [security2:error] [pid 983601:tid 983750] [client 20.226.66.230:60995] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/155.php"] [unique_id "alxl8laztLkF4ZwQhXLqVQAAAJg"]
[Sat Jul 18 23:51:46.450540 2026] [security2:error] [pid 983601:tid 983750] [client 20.226.66.230:60995] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/155.php"] [unique_id "alxl8laztLkF4ZwQhXLqVQAAAJg"]
[Sat Jul 18 23:51:46.500922 2026] [security2:error] [pid 983601:tid 983720] [remote 45.119.213.111:57812] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.213.119.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxl8laztLkF4ZwQhXLqWAAA_3Y"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:51:46.646216 2026] [security2:error] [pid 983601:tid 983829] [client 45.133.7.71:44429] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 71.7.133.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "nikkidesigns.net"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "alxl8laztLkF4ZwQhXLqYwAAAOc"]
[Sat Jul 18 23:51:46.766167 2026] [security2:error] [pid 983601:tid 983822] [client 20.226.66.230:61054] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/pp.php"] [unique_id "alxl8laztLkF4ZwQhXLqbAAAAOA"]
[Sat Jul 18 23:51:46.766291 2026] [security2:error] [pid 983601:tid 983822] [client 20.226.66.230:61054] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/pp.php"] [unique_id "alxl8laztLkF4ZwQhXLqbAAAAOA"]
[Sat Jul 18 23:51:46.787659 2026] [security2:error] [pid 983601:tid 983799] [client 45.134.20.133:64805] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/Simple.php"] [unique_id "alxl8laztLkF4ZwQhXLqcgAAAMk"]
[Sat Jul 18 23:51:47.090211 2026] [security2:error] [pid 983601:tid 983670] [remote 182.77.62.24:37140] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.62.77.182.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxl81aztLkF4ZwQhXLqhQAApEQ"]
[Sat Jul 18 23:51:47.133857 2026] [security2:error] [pid 983601:tid 983786] [client 20.226.66.230:61046] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/ops.php"] [unique_id "alxl81aztLkF4ZwQhXLqiAAAALw"]
[Sat Jul 18 23:51:47.133964 2026] [security2:error] [pid 983601:tid 983786] [client 20.226.66.230:61046] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/ops.php"] [unique_id "alxl81aztLkF4ZwQhXLqiAAAALw"]
[Sat Jul 18 23:51:47.136782 2026] [security2:error] [pid 983601:tid 983798] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxl8laztLkF4ZwQhXLqfwAAAMg"]
[Sat Jul 18 23:51:47.338046 2026] [security2:error] [pid 983601:tid 983773] [client 45.133.7.97:59835] ModSecurity: Access denied with connection close (phase 1). Pattern match "c99\\\\.php|r57shell\\\\.php|r57\\\\.php|c99\\\\.txt" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1164"] [id "900010"] [rev "1"] [msg "c99 variant "] [severity "CRITICAL"] [hostname "nikkidesigns.net"] [uri "/images/c99.php"] [unique_id "alxl81aztLkF4ZwQhXLqnAAAAK8"]
[Sat Jul 18 23:51:47.419125 2026] [security2:error] [pid 983601:tid 983734] [client 171.245.26.255:49708] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxl81aztLkF4ZwQhXLqnwAAAIg"]
[Sat Jul 18 23:51:47.464182 2026] [security2:error] [pid 983601:tid 983805] [client 20.226.66.230:28773] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/ingfo.php"] [unique_id "alxl81aztLkF4ZwQhXLqoAAAAM8"]
[Sat Jul 18 23:51:47.464258 2026] [security2:error] [pid 983601:tid 983805] [client 20.226.66.230:28773] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/ingfo.php"] [unique_id "alxl81aztLkF4ZwQhXLqoAAAAM8"]
[Sat Jul 18 23:51:47.630607 2026] [security2:error] [pid 983601:tid 983669] [remote 182.77.62.24:37140] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.62.77.182.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxl81aztLkF4ZwQhXLqrAAA3EM"], referer: https://sesamegreenbeans.com/wp-login.php
[Sat Jul 18 23:51:47.647273 2026] [security2:error] [pid 983601:tid 983782] [client 45.134.20.104:29023] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "alxl81aztLkF4ZwQhXLqrQAAALg"]
[Sat Jul 18 23:51:47.781496 2026] [security2:error] [pid 983601:tid 983809] [client 20.226.66.230:61046] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/error_log.php"] [unique_id "alxl81aztLkF4ZwQhXLqtwAAANM"]
[Sat Jul 18 23:51:47.781607 2026] [security2:error] [pid 983601:tid 983809] [client 20.226.66.230:61046] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/error_log.php"] [unique_id "alxl81aztLkF4ZwQhXLqtwAAANM"]
[Sat Jul 18 23:51:47.790403 2026] [security2:error] [pid 983601:tid 983732] [client 185.132.186.12:63911] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/index/function.php"] [unique_id "alxl81aztLkF4ZwQhXLqtgAAAIY"]
[Sat Jul 18 23:51:47.928870 2026] [security2:error] [pid 983601:tid 983737] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxl81aztLkF4ZwQhXLqtAAAAIs"]
[Sat Jul 18 23:51:48.015599 2026] [security2:error] [pid 983601:tid 983822] [client 45.133.7.89:35067] ModSecurity: Access denied with connection close (phase 1). Pattern match "c99\\\\.php|r57shell\\\\.php|r57\\\\.php|c99\\\\.txt" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1164"] [id "900010"] [rev "1"] [msg "c99 variant "] [severity "CRITICAL"] [hostname "nikkidesigns.net"] [uri "/images/c99.php"] [unique_id "alxl9FaztLkF4ZwQhXLqyQAAAOA"]
[Sat Jul 18 23:51:48.130315 2026] [security2:error] [pid 983601:tid 983812] [client 20.226.66.230:28696] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/test10.php"] [unique_id "alxl9FaztLkF4ZwQhXLqzwAAANY"]
[Sat Jul 18 23:51:48.130411 2026] [security2:error] [pid 983601:tid 983812] [client 20.226.66.230:28696] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/test10.php"] [unique_id "alxl9FaztLkF4ZwQhXLqzwAAANY"]
[Sat Jul 18 23:51:48.146589 2026] [security2:error] [pid 983601:tid 983658] [remote 20.153.140.50:51594] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxl9FaztLkF4ZwQhXLq0QAA-zg"]
[Sat Jul 18 23:51:48.473388 2026] [security2:error] [pid 983601:tid 983741] [client 20.226.66.230:29173] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/koala.php"] [unique_id "alxl9FaztLkF4ZwQhXLq6gAAAI8"]
[Sat Jul 18 23:51:48.473481 2026] [security2:error] [pid 983601:tid 983741] [client 20.226.66.230:29173] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/koala.php"] [unique_id "alxl9FaztLkF4ZwQhXLq6gAAAI8"]
[Sat Jul 18 23:51:48.500463 2026] [security2:error] [pid 983601:tid 983854] [client 45.134.20.126:48021] ModSecurity: Warning. Pattern match "/1\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1543"] [id "900921"] [msg "temporary TUW-72162 logging rule"] [hostname "swafforddetailing.com"] [uri "/wp-admin/1.php"] [unique_id "alxl9FaztLkF4ZwQhXLq7wAAAQA"]
[Sat Jul 18 23:51:48.500551 2026] [security2:error] [pid 983601:tid 983854] [client 45.134.20.126:48021] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 126.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/1.php"] [unique_id "alxl9FaztLkF4ZwQhXLq7wAAAQA"]
[Sat Jul 18 23:51:48.620435 2026] [security2:error] [pid 983601:tid 983690] [remote 20.153.140.50:51594] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxl9FaztLkF4ZwQhXLq9AAAo1g"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:51:48.693714 2026] [security2:error] [pid 983601:tid 983814] [client 185.132.186.36:33253] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 36.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/tinyfilemanager.php"] [unique_id "alxl9FaztLkF4ZwQhXLq-wAAANg"]
[Sat Jul 18 23:51:48.696922 2026] [security2:error] [pid 983601:tid 983830] [client 45.133.7.94:58401] ModSecurity: Access denied with connection close (phase 1). Pattern match "c99\\\\.php|r57shell\\\\.php|r57\\\\.php|c99\\\\.txt" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1164"] [id "900010"] [rev "1"] [msg "c99 variant "] [severity "CRITICAL"] [hostname "nikkidesigns.net"] [uri "/images/c99.php"] [unique_id "alxl9FaztLkF4ZwQhXLq_QAAAOg"]
[Sat Jul 18 23:51:48.789235 2026] [security2:error] [pid 983601:tid 983827] [client 20.226.66.230:61048] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/mac.php"] [unique_id "alxl9FaztLkF4ZwQhXLrAwAAAOU"]
[Sat Jul 18 23:51:48.789331 2026] [security2:error] [pid 983601:tid 983827] [client 20.226.66.230:61048] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/mac.php"] [unique_id "alxl9FaztLkF4ZwQhXLrAwAAAOU"]
[Sat Jul 18 23:51:49.108710 2026] [security2:error] [pid 983601:tid 983709] [remote 154.61.75.100:41360] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "terrapro.marketing"] [uri "/wp-login.php"] [unique_id "alxl9VaztLkF4ZwQhXLrFQAA1Ws"]
[Sat Jul 18 23:51:49.112938 2026] [security2:error] [pid 983601:tid 983766] [client 20.226.66.230:28712] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wefile.php"] [unique_id "alxl9VaztLkF4ZwQhXLrFgAAAKg"]
[Sat Jul 18 23:51:49.113011 2026] [security2:error] [pid 983601:tid 983766] [client 20.226.66.230:28712] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wefile.php"] [unique_id "alxl9VaztLkF4ZwQhXLrFgAAAKg"]
[Sat Jul 18 23:51:49.210642 2026] [security2:error] [pid 983601:tid 983858] [client 20.230.87.222:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 222.87.230.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.yidaiyi.org"] [uri "/wp-admin/images/wp-login.php"] [unique_id "alxl9VaztLkF4ZwQhXLrGAAAAQQ"]
[Sat Jul 18 23:51:49.210775 2026] [security2:error] [pid 983601:tid 983858] [client 20.230.87.222:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.yidaiyi.org"] [uri "/wp-admin/images/wp-login.php"] [unique_id "alxl9VaztLkF4ZwQhXLrGAAAAQQ"]
[Sat Jul 18 23:51:49.380400 2026] [security2:error] [pid 983601:tid 983732] [client 45.133.7.59:44671] ModSecurity: Access denied with connection close (phase 1). Pattern match "c99\\\\.php|r57shell\\\\.php|r57\\\\.php|c99\\\\.txt" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1164"] [id "900010"] [rev "1"] [msg "c99 variant "] [severity "CRITICAL"] [hostname "nikkidesigns.net"] [uri "/images/c99.php"] [unique_id "alxl9VaztLkF4ZwQhXLrJgAAAIY"]
[Sat Jul 18 23:51:49.409624 2026] [security2:error] [pid 983601:tid 983820] [client 45.134.20.137:31833] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 137.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "alxl9VaztLkF4ZwQhXLrIQAAAN4"]
[Sat Jul 18 23:51:49.439031 2026] [security2:error] [pid 983601:tid 983777] [client 20.226.66.230:61026] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "alxl9VaztLkF4ZwQhXLrLgAAALM"]
[Sat Jul 18 23:51:49.591144 2026] [security2:error] [pid 983601:tid 983831] [client 185.132.186.24:47305] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/js/bas.php"] [unique_id "alxl9VaztLkF4ZwQhXLrNwAAAOk"]
[Sat Jul 18 23:51:49.816896 2026] [security2:error] [pid 983601:tid 983713] [remote 20.153.140.50:40258] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tadlarsen.com"] [uri "/wp-login.php"] [unique_id "alxl9VaztLkF4ZwQhXLrQgAAtG8"]
[Sat Jul 18 23:51:49.919163 2026] [security2:error] [pid 983601:tid 983817] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxl9VaztLkF4ZwQhXLrPwAAANs"]
[Sat Jul 18 23:51:49.954347 2026] [security2:error] [pid 983601:tid 983819] [client 20.226.66.230:28688] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "alxl9VaztLkF4ZwQhXLrSwAAAN0"]
[Sat Jul 18 23:51:50.115628 2026] [security2:error] [pid 983601:tid 983845] [client 20.226.66.230:61026] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-admin/js/"] [unique_id "alxl9laztLkF4ZwQhXLrZQAAAPc"]
[Sat Jul 18 23:51:50.241420 2026] [security2:error] [pid 983601:tid 983676] [remote 20.153.140.50:40258] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "tadlarsen.com"] [uri "/wp-login.php"] [unique_id "alxl9laztLkF4ZwQhXLraAAAzEo"], referer: https://tadlarsen.com/wp-login.php
[Sat Jul 18 23:51:50.267055 2026] [security2:error] [pid 983601:tid 983837] [client 45.134.20.112:42667] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 112.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/wp-conflg.php"] [unique_id "alxl9laztLkF4ZwQhXLrawAAAO8"]
[Sat Jul 18 23:51:50.453047 2026] [security2:error] [pid 983601:tid 983798] [client 20.226.66.230:28688] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-admin/js/"] [unique_id "alxl9laztLkF4ZwQhXLrbAAAAMg"]
[Sat Jul 18 23:51:50.505853 2026] [security2:error] [pid 983601:tid 983778] [client 185.132.186.42:65233] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 42.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/.well-known/pki-validation/moon.php"] [unique_id "alxl9laztLkF4ZwQhXLrdgAAALQ"]
[Sat Jul 18 23:51:50.641743 2026] [security2:error] [pid 983601:tid 983813] [client 159.89.12.166:49548] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.12.89.159.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.adventure-studio.zanjan-fromer.com"] [uri "/php/login.php"] [unique_id "alxl9laztLkF4ZwQhXLrfgAAANc"]
[Sat Jul 18 23:51:50.773423 2026] [security2:error] [pid 983601:tid 983732] [client 20.226.66.230:61026] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/makeasmtp.php"] [unique_id "alxl9laztLkF4ZwQhXLriwAAAIY"]
[Sat Jul 18 23:51:50.773550 2026] [security2:error] [pid 983601:tid 983732] [client 20.226.66.230:61026] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/makeasmtp.php"] [unique_id "alxl9laztLkF4ZwQhXLriwAAAIY"]
[Sat Jul 18 23:51:50.984188 2026] [security2:error] [pid 983601:tid 983652] [remote 152.53.111.131:60950] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.111.53.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mobilesurvsolutions.com"] [uri "/wp-login.php"] [unique_id "alxl9laztLkF4ZwQhXLrlwAAojI"]
[Sat Jul 18 23:51:51.002633 2026] [security2:error] [pid 983601:tid 983635] [remote 31.42.184.154:49948] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxl91aztLkF4ZwQhXLrmgAA-SE"]
[Sat Jul 18 23:51:51.089061 2026] [security2:error] [pid 983601:tid 983848] [client 20.226.66.230:29123] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/2P.php"] [unique_id "alxl91aztLkF4ZwQhXLrpAAAAPo"]
[Sat Jul 18 23:51:51.089144 2026] [security2:error] [pid 983601:tid 983848] [client 20.226.66.230:29123] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/2P.php"] [unique_id "alxl91aztLkF4ZwQhXLrpAAAAPo"]
[Sat Jul 18 23:51:51.124740 2026] [security2:error] [pid 983601:tid 983811] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxl9laztLkF4ZwQhXLrlAAAANU"]
[Sat Jul 18 23:51:51.133070 2026] [security2:error] [pid 983601:tid 983856] [client 45.134.20.113:34265] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/classwithtostring.php"] [unique_id "alxl91aztLkF4ZwQhXLrqgAAAQI"]
[Sat Jul 18 23:51:51.210007 2026] [security2:error] [pid 983601:tid 983655] [remote 152.53.111.131:60950] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.111.53.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mobilesurvsolutions.com"] [uri "/wp-login.php"] [unique_id "alxl91aztLkF4ZwQhXLrrgAApTU"], referer: https://mobilesurvsolutions.com/wp-login.php
[Sat Jul 18 23:51:51.239343 2026] [security2:error] [pid 983601:tid 983614] [remote 31.42.184.154:49948] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxl91aztLkF4ZwQhXLrsAAAoAw"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:51:51.295580 2026] [security2:error] [pid 983601:tid 983661] [remote 199.189.225.167:28299] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.225.189.199.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mourgroup.com"] [uri "/wp-login.php"] [unique_id "alxl91aztLkF4ZwQhXLrsQAA1js"]
[Sat Jul 18 23:51:51.399913 2026] [security2:error] [pid 983601:tid 983789] [client 185.132.186.12:24053] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/file.php"] [unique_id "alxl91aztLkF4ZwQhXLrvwAAAL8"]
[Sat Jul 18 23:51:51.405235 2026] [security2:error] [pid 983601:tid 983817] [client 20.226.66.230:29127] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/.well-known/about.php"] [unique_id "alxl91aztLkF4ZwQhXLrwQAAANs"]
[Sat Jul 18 23:51:51.405351 2026] [security2:error] [pid 983601:tid 983817] [client 20.226.66.230:29127] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/.well-known/about.php"] [unique_id "alxl91aztLkF4ZwQhXLrwQAAANs"]
[Sat Jul 18 23:51:51.441930 2026] [security2:error] [pid 983601:tid 983792] [client 159.89.12.166:49560] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.12.89.159.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.adventure-studio.zanjan-fromer.com"] [uri "/info.php"] [unique_id "alxl91aztLkF4ZwQhXLrxgAAAMI"]
[Sat Jul 18 23:51:51.500866 2026] [security2:error] [pid 983601:tid 983674] [remote 199.189.225.167:28299] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.225.189.199.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mourgroup.com"] [uri "/wp-login.php"] [unique_id "alxl91aztLkF4ZwQhXLrywABBEg"], referer: https://mourgroup.com/wp-login.php
[Sat Jul 18 23:51:51.730363 2026] [security2:error] [pid 983601:tid 983805] [client 20.226.66.230:61010] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "alxl91aztLkF4ZwQhXLr3AAAAM8"]
[Sat Jul 18 23:51:51.730469 2026] [security2:error] [pid 983601:tid 983805] [client 20.226.66.230:61010] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "alxl91aztLkF4ZwQhXLr3AAAAM8"]
[Sat Jul 18 23:51:51.989801 2026] [security2:error] [pid 983601:tid 983749] [client 45.134.20.114:39609] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/css/av.php"] [unique_id "alxl91aztLkF4ZwQhXLr7gAAAJc"]
[Sat Jul 18 23:51:52.031392 2026] [security2:error] [pid 983601:tid 983662] [remote 54.90.74.5:54434] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.backup$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1279"] [id "390588"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .backup)"] [severity "CRITICAL"] [hostname "jndsupport.com"] [uri "/.env.backup"] [unique_id "alxl-FaztLkF4ZwQhXLr8QAAvjw"]
[Sat Jul 18 23:51:52.055295 2026] [security2:error] [pid 983601:tid 983835] [client 20.226.66.230:61027] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/system_log.php"] [unique_id "alxl-FaztLkF4ZwQhXLr8wAAAO0"]
[Sat Jul 18 23:51:52.055403 2026] [security2:error] [pid 983601:tid 983835] [client 20.226.66.230:61027] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/system_log.php"] [unique_id "alxl-FaztLkF4ZwQhXLr8wAAAO0"]
[Sat Jul 18 23:51:52.301906 2026] [security2:error] [pid 983601:tid 983822] [client 185.132.186.52:52581] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/js/index.php"] [unique_id "alxl-FaztLkF4ZwQhXLsBgAAAOA"]
[Sat Jul 18 23:51:52.376335 2026] [security2:error] [pid 983601:tid 983805] [client 20.226.66.230:29180] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-admin/css/"] [unique_id "alxl-FaztLkF4ZwQhXLsCAAAAM8"]
[Sat Jul 18 23:51:52.706397 2026] [security2:error] [pid 983601:tid 983837] [client 36.83.95.75:55535] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxl-FaztLkF4ZwQhXLsKQAAAO8"]
[Sat Jul 18 23:51:52.706551 2026] [security2:error] [pid 983601:tid 983837] [client 36.83.95.75:55535] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxl-FaztLkF4ZwQhXLsKQAAAO8"]
[Sat Jul 18 23:51:52.726274 2026] [security2:error] [pid 983601:tid 983759] [client 20.226.66.230:28688] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-admin/css/"] [unique_id "alxl-FaztLkF4ZwQhXLsFAAAAKE"]
[Sat Jul 18 23:51:52.752776 2026] [security2:error] [pid 983601:tid 983697] [remote 54.90.74.5:54450] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\.bak|\\\\.bak\\\\.php)$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1260"] [id "390582"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that nclude .bak)"] [severity "CRITICAL"] [hostname "jndsupport.com"] [uri "/.env.bak"] [unique_id "alxl-FaztLkF4ZwQhXLsLQAAvF8"]
[Sat Jul 18 23:51:52.844200 2026] [security2:error] [pid 983601:tid 983849] [client 45.134.20.123:62067] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 123.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/images/waf_defender.php"] [unique_id "alxl-FaztLkF4ZwQhXLsNAAAAPs"]
[Sat Jul 18 23:51:52.892896 2026] [security2:error] [pid 983601:tid 983847] [client 20.226.66.230:29180] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "alxl-FaztLkF4ZwQhXLsOAAAAPk"]
[Sat Jul 18 23:51:53.106379 2026] [security2:error] [pid 983601:tid 983778] [client 20.226.66.230:28688] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "alxl-VaztLkF4ZwQhXLsQAAAALQ"]
[Sat Jul 18 23:51:53.200397 2026] [security2:error] [pid 983601:tid 983850] [client 185.132.186.30:65045] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 30.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/upgrade/item.php"] [unique_id "alxl-VaztLkF4ZwQhXLsSgAAAPw"]
[Sat Jul 18 23:51:53.264924 2026] [security2:error] [pid 983601:tid 983747] [client 20.226.66.230:29180] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/crgio.php"] [unique_id "alxl-VaztLkF4ZwQhXLsTQAAAJU"]
[Sat Jul 18 23:51:53.265016 2026] [security2:error] [pid 983601:tid 983747] [client 20.226.66.230:29180] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/crgio.php"] [unique_id "alxl-VaztLkF4ZwQhXLsTQAAAJU"]
[Sat Jul 18 23:51:53.586538 2026] [security2:error] [pid 983601:tid 983777] [client 180.252.198.240:50509] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxl-VaztLkF4ZwQhXLsYwAAALM"]
[Sat Jul 18 23:51:53.586705 2026] [security2:error] [pid 983601:tid 983777] [client 180.252.198.240:50509] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxl-VaztLkF4ZwQhXLsYwAAALM"]
[Sat Jul 18 23:51:53.594486 2026] [security2:error] [pid 983601:tid 983818] [client 20.226.66.230:29149] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/pucci.php"] [unique_id "alxl-VaztLkF4ZwQhXLsZgAAANw"]
[Sat Jul 18 23:51:53.594594 2026] [security2:error] [pid 983601:tid 983818] [client 20.226.66.230:29149] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/pucci.php"] [unique_id "alxl-VaztLkF4ZwQhXLsZgAAANw"]
[Sat Jul 18 23:51:53.701424 2026] [security2:error] [pid 983601:tid 983794] [client 45.134.20.109:23547] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 109.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "alxl-VaztLkF4ZwQhXLsbgAAAMQ"]
[Sat Jul 18 23:51:53.777318 2026] [security2:error] [pid 983601:tid 983693] [remote 103.173.227.188:50222] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 188.227.173.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxl-VaztLkF4ZwQhXLscgAA7Vs"]
[Sat Jul 18 23:51:53.784383 2026] [security2:error] [pid 983601:tid 983848] [client 163.61.1.17:49717] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.1.61.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxl-VaztLkF4ZwQhXLseQAAAPo"]
[Sat Jul 18 23:51:53.785963 2026] [security2:error] [pid 983601:tid 983848] [client 163.61.1.17:49717] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "ghivs.com"] [uri "/xmlrpc.php"] [unique_id "alxl-VaztLkF4ZwQhXLseQAAAPo"]
[Sat Jul 18 23:51:53.800054 2026] [security2:error] [pid 983601:tid 983820] [client 152.32.172.212:53440] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "box5936.bluehost.com"] [uri "/index.cgi"] [unique_id "alxl-VaztLkF4ZwQhXLscQAAAN4"]
[Sat Jul 18 23:51:53.915109 2026] [security2:error] [pid 983601:tid 983776] [client 20.226.66.230:28706] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-includes/blocks/details/"] [unique_id "alxl-VaztLkF4ZwQhXLsgwAAALI"]
[Sat Jul 18 23:51:54.031855 2026] [security2:error] [pid 983601:tid 983846] [client 20.230.87.222:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 222.87.230.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.yidaiyi.org"] [uri "/wp-content/themes/astra/inc/network.php"] [unique_id "alxl-laztLkF4ZwQhXLshwAAAPg"]
[Sat Jul 18 23:51:54.031966 2026] [security2:error] [pid 983601:tid 983846] [client 20.230.87.222:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.yidaiyi.org"] [uri "/wp-content/themes/astra/inc/network.php"] [unique_id "alxl-laztLkF4ZwQhXLshwAAAPg"]
[Sat Jul 18 23:51:54.089149 2026] [security2:error] [pid 983601:tid 983790] [client 20.226.66.230:28688] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-includes/blocks/details/"] [unique_id "alxl-laztLkF4ZwQhXLsjQAAAMA"]
[Sat Jul 18 23:51:54.093209 2026] [security2:error] [pid 983601:tid 983815] [client 185.132.186.45:45235] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 45.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/buy.php"] [unique_id "alxl-laztLkF4ZwQhXLsjgAAANk"]
[Sat Jul 18 23:51:54.216717 2026] [security2:error] [pid 983601:tid 983616] [remote 103.173.227.188:50222] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 188.227.173.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxl-laztLkF4ZwQhXLsmgAAsw4"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:51:54.259387 2026] [security2:error] [pid 983601:tid 983748] [client 20.226.66.230:28706] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-includes/blocks/audio/"] [unique_id "alxl-laztLkF4ZwQhXLspAAAAJY"]
[Sat Jul 18 23:51:54.434194 2026] [security2:error] [pid 983601:tid 983769] [client 20.226.66.230:28688] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-includes/blocks/audio/"] [unique_id "alxl-laztLkF4ZwQhXLssAAAAKs"]
[Sat Jul 18 23:51:54.484007 2026] [security2:error] [pid 983601:tid 983727] [remote 103.255.134.61:58208] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.134.255.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "idigress.studio"] [uri "/wp-login.php"] [unique_id "alxl-laztLkF4ZwQhXLstQAApn0"]
[Sat Jul 18 23:51:54.553586 2026] [security2:error] [pid 983601:tid 983747] [client 45.134.20.135:58471] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/small.php"] [unique_id "alxl-laztLkF4ZwQhXLsvQAAAJU"]
[Sat Jul 18 23:51:54.591660 2026] [security2:error] [pid 983601:tid 983800] [client 20.226.66.230:28706] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-temp.php"] [unique_id "alxl-laztLkF4ZwQhXLswAAAAMo"]
[Sat Jul 18 23:51:54.591791 2026] [security2:error] [pid 983601:tid 983800] [client 20.226.66.230:28706] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-temp.php"] [unique_id "alxl-laztLkF4ZwQhXLswAAAAMo"]
[Sat Jul 18 23:51:54.713698 2026] [fcgid:warn] [pid 983601:tid 983745] (70014)End of file found: [client 152.32.172.212:56288] mod_fcgid: can't get data from http client
[Sat Jul 18 23:51:54.805936 2026] [security2:error] [pid 983601:tid 983776] [client 103.160.26.178:59375] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxl-laztLkF4ZwQhXLszQAAALI"]
[Sat Jul 18 23:51:54.806073 2026] [security2:error] [pid 983601:tid 983776] [client 103.160.26.178:59375] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxl-laztLkF4ZwQhXLszQAAALI"]
[Sat Jul 18 23:51:54.931509 2026] [security2:error] [pid 983601:tid 983761] [client 20.226.66.230:61015] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-admin/js/index.php"] [unique_id "alxl-laztLkF4ZwQhXLs4gAAAKM"]
[Sat Jul 18 23:51:54.931621 2026] [security2:error] [pid 983601:tid 983761] [client 20.226.66.230:61015] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-admin/js/index.php"] [unique_id "alxl-laztLkF4ZwQhXLs4gAAAKM"]
[Sat Jul 18 23:51:54.986580 2026] [security2:error] [pid 983601:tid 983814] [client 185.132.186.24:51473] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/languages/wp-conflg.php"] [unique_id "alxl-laztLkF4ZwQhXLs5wAAANg"]
[Sat Jul 18 23:51:55.101444 2026] [fcgid:warn] [pid 983601:tid 983764] (70014)End of file found: [client 152.32.172.212:56338] mod_fcgid: can't get data from http client
[Sat Jul 18 23:51:55.104997 2026] [security2:error] [pid 983601:tid 983613] [remote 103.255.134.61:58208] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.134.255.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "idigress.studio"] [uri "/wp-login.php"] [unique_id "alxl-1aztLkF4ZwQhXLs6AAAlAs"], referer: https://idigress.studio/wp-login.php
[Sat Jul 18 23:51:55.260340 2026] [security2:error] [pid 983601:tid 983770] [client 20.226.66.230:61018] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/puc.php"] [unique_id "alxl-1aztLkF4ZwQhXLs-gAAAKw"]
[Sat Jul 18 23:51:55.260441 2026] [security2:error] [pid 983601:tid 983770] [client 20.226.66.230:61018] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/puc.php"] [unique_id "alxl-1aztLkF4ZwQhXLs-gAAAKw"]
[Sat Jul 18 23:51:55.352164 2026] [lsapi:warn] [pid 983601:tid 983604] [remote 54.87.216.213:0] [host ali-alghanim.com] Backend log: PHP Warning:  getimagesize(https://aasgroup.online/wp-content/uploads/2021/09/1291810.jpg): Failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden\r\n in /home2/aasgroup/public_html/alialghanim/wp-content/plugins/litespeed-cache/src/media.cls.php on line 860\n, referer: https://www.ali-alghanim.net/
[Sat Jul 18 23:51:55.355018 2026] [lsapi:warn] [pid 983601:tid 983632] [remote 54.87.216.213:0] [host ali-alghanim.com] Backend log: PHP Warning:  getimagesize(https://aasgroup.online/wp-content/uploads/2021/09/1291810.jpg): Failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden\r\n in /home2/aasgroup/public_html/alialghanim/wp-content/plugins/litespeed-cache/src/media.cls.php on line 860\n, referer: https://www.ali-alghanim.net/
[Sat Jul 18 23:51:55.359179 2026] [lsapi:warn] [pid 983601:tid 983728] [remote 54.87.216.213:0] [host ali-alghanim.com] Backend log: PHP Warning:  getimagesize(https://aasgroup.online/wp-content/uploads/2021/09/1291810.jpg): Failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden\r\n in /home2/aasgroup/public_html/alialghanim/wp-content/plugins/litespeed-cache/src/media.cls.php on line 860\n, referer: https://www.ali-alghanim.net/
[Sat Jul 18 23:51:55.412718 2026] [security2:error] [pid 983601:tid 983858] [client 45.134.20.135:61501] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "alxl-1aztLkF4ZwQhXLtDQAAAQQ"]
[Sat Jul 18 23:51:55.449801 2026] [lsapi:warn] [pid 983601:tid 983722] [remote 54.87.216.213:0] [host ali-alghanim.com] Backend log: PHP Warning:  getimagesize(https://aasgroup.online/wp-content/uploads/2021/09/1291810.jpg): Failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden\r\n in /home2/aasgroup/public_html/alialghanim/wp-content/plugins/litespeed-cache/src/media.cls.php on line 860\n, referer: https://www.ali-alghanim.net/
[Sat Jul 18 23:51:55.455248 2026] [lsapi:warn] [pid 983601:tid 983609] [remote 54.87.216.213:0] [host ali-alghanim.com] Backend log: PHP Warning:  getimagesize(https://aasgroup.online/wp-content/uploads/2021/09/1291810.jpg): Failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden\r\n in /home2/aasgroup/public_html/alialghanim/wp-content/plugins/litespeed-cache/src/media.cls.php on line 860\n, referer: https://www.ali-alghanim.net/
[Sat Jul 18 23:51:55.484672 2026] [fcgid:warn] [pid 983601:tid 983856] (70014)End of file found: [client 152.32.172.212:56388] mod_fcgid: can't get data from http client
[Sat Jul 18 23:51:55.647736 2026] [security2:error] [pid 983601:tid 983741] [client 20.226.66.230:61040] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/dx.php"] [unique_id "alxl-1aztLkF4ZwQhXLtGwAAAI8"]
[Sat Jul 18 23:51:55.647842 2026] [security2:error] [pid 983601:tid 983741] [client 20.226.66.230:61040] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/dx.php"] [unique_id "alxl-1aztLkF4ZwQhXLtGwAAAI8"]
[Sat Jul 18 23:51:55.873138 2026] [security2:error] [pid 983601:tid 983724] [remote 54.90.74.5:54464] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.old$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1263"] [id "390583"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .old)"] [severity "CRITICAL"] [hostname "jndsupport.com"] [uri "/.env.old"] [unique_id "alxl-1aztLkF4ZwQhXLtLQAA_Xo"]
[Sat Jul 18 23:51:55.890186 2026] [security2:error] [pid 983601:tid 983818] [client 185.132.186.10:26555] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/themes/classwithtostring.php"] [unique_id "alxl-1aztLkF4ZwQhXLtLwAAANw"]
[Sat Jul 18 23:51:55.893256 2026] [lsapi:warn] [pid 983601:tid 983627] [remote 98.81.131.105:0] [host ali-alghanim.com] Backend log: PHP Warning:  getimagesize(https://aasgroup.online/wp-content/uploads/2021/09/1291810.jpg): Failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden\r\n in /home2/aasgroup/public_html/alialghanim/wp-content/plugins/litespeed-cache/src/media.cls.php on line 860\n, referer: https://www.ali-alghanim.net/
[Sat Jul 18 23:51:55.921459 2026] [lsapi:warn] [pid 983601:tid 983610] [remote 98.81.131.105:0] [host ali-alghanim.com] Backend log: PHP Warning:  getimagesize(https://aasgroup.online/wp-content/uploads/2021/09/1291810.jpg): Failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden\r\n in /home2/aasgroup/public_html/alialghanim/wp-content/plugins/litespeed-cache/src/media.cls.php on line 860\n, referer: https://www.ali-alghanim.net/
[Sat Jul 18 23:51:56.007967 2026] [security2:error] [pid 983601:tid 983824] [client 20.226.66.230:60992] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-includes/Requests/"] [unique_id "alxl_FaztLkF4ZwQhXLtOwAAAOI"]
[Sat Jul 18 23:51:56.171567 2026] [security2:error] [pid 983601:tid 983846] [client 23.160.60.14:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "kingsafety.ca"] [uri "/index.php"] [unique_id "alxl-laztLkF4ZwQhXLswwAAAPg"]
[Sat Jul 18 23:51:56.204769 2026] [security2:error] [pid 983601:tid 983843] [client 20.226.66.230:28688] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-includes/Requests/"] [unique_id "alxl_FaztLkF4ZwQhXLtRAAAAPU"]
[Sat Jul 18 23:51:56.229051 2026] [lsapi:warn] [pid 983601:tid 983614] [remote 98.81.131.105:0] [host ali-alghanim.com] Backend log: PHP Warning:  getimagesize(https://aasgroup.online/wp-content/uploads/2021/09/1291810.jpg): Failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden\r\n in /home2/aasgroup/public_html/alialghanim/wp-content/plugins/litespeed-cache/src/media.cls.php on line 860\n, referer: https://www.ali-alghanim.net/
[Sat Jul 18 23:51:56.236136 2026] [lsapi:warn] [pid 983601:tid 983685] [remote 98.81.131.105:0] [host ali-alghanim.com] Backend log: PHP Warning:  getimagesize(https://aasgroup.online/wp-content/uploads/2021/09/1291810.jpg): Failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden\r\n in /home2/aasgroup/public_html/alialghanim/wp-content/plugins/litespeed-cache/src/media.cls.php on line 860\n, referer: https://www.ali-alghanim.net/
[Sat Jul 18 23:51:56.249526 2026] [autoindex:error] [pid 983601:tid 983746] [client 45.133.7.56:0] AH01276: Cannot serve directory /home4/nikkides/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:51:56.253630 2026] [lsapi:warn] [pid 983601:tid 983661] [remote 98.81.131.105:0] [host ali-alghanim.com] Backend log: PHP Warning:  getimagesize(https://aasgroup.online/wp-content/uploads/2021/09/1291810.jpg): Failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden\r\n in /home2/aasgroup/public_html/alialghanim/wp-content/plugins/litespeed-cache/src/media.cls.php on line 860\n, referer: https://www.ali-alghanim.net/
[Sat Jul 18 23:51:56.269416 2026] [security2:error] [pid 983601:tid 983809] [client 45.134.20.138:63603] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 138.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/NewFile.php"] [unique_id "alxl_FaztLkF4ZwQhXLtUwAAANM"]
[Sat Jul 18 23:51:56.362081 2026] [security2:error] [pid 983601:tid 983784] [client 20.226.66.230:60992] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/bthil.php"] [unique_id "alxl_FaztLkF4ZwQhXLtWgAAALo"]
[Sat Jul 18 23:51:56.362175 2026] [security2:error] [pid 983601:tid 983784] [client 20.226.66.230:60992] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/bthil.php"] [unique_id "alxl_FaztLkF4ZwQhXLtWgAAALo"]
[Sat Jul 18 23:51:56.491846 2026] [security2:error] [pid 983601:tid 983853] [client 50.116.65.227:14132] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Jin-Wee-Feature-Image.jpg"] [unique_id "alxl_FaztLkF4ZwQhXLtZQAAAP8"]
[Sat Jul 18 23:51:56.504456 2026] [security2:error] [pid 983601:tid 983807] [client 50.116.65.227:17614] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/Jin-Wee-Feature-Image.jpg"] [unique_id "alxl_FaztLkF4ZwQhXLtaAAAANE"]
[Sat Jul 18 23:51:56.623654 2026] [security2:error] [pid 983601:tid 983658] [remote 103.75.185.95:42886] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxl_FaztLkF4ZwQhXLtbwAA1Tg"]
[Sat Jul 18 23:51:56.693851 2026] [security2:error] [pid 983601:tid 983827] [client 20.226.66.230:28710] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/7.php"] [unique_id "alxl_FaztLkF4ZwQhXLteQAAAOU"]
[Sat Jul 18 23:51:56.693937 2026] [security2:error] [pid 983601:tid 983827] [client 20.226.66.230:28710] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/7.php"] [unique_id "alxl_FaztLkF4ZwQhXLteQAAAOU"]
[Sat Jul 18 23:51:56.752177 2026] [lsapi:warn] [pid 983601:tid 983626] [remote 54.87.216.213:0] [host ali-alghanim.com] Backend log: PHP Warning:  getimagesize(https://aasgroup.online/wp-content/uploads/2021/09/1291810.jpg): Failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden\r\n in /home2/aasgroup/public_html/alialghanim/wp-content/plugins/litespeed-cache/src/media.cls.php on line 860\n
[Sat Jul 18 23:51:56.793228 2026] [security2:error] [pid 983601:tid 983828] [client 185.132.186.29:62405] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 29.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/plugins/elementor/wp-wjvngrh.php"] [unique_id "alxl_FaztLkF4ZwQhXLtgwAAAOY"]
[Sat Jul 18 23:51:56.866512 2026] [lsapi:warn] [pid 983601:tid 983634] [remote 54.87.216.213:0] [host ali-alghanim.com] Backend log: PHP Warning:  getimagesize(https://aasgroup.online/wp-content/uploads/2021/09/1291810.jpg): Failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden\r\n in /home2/aasgroup/public_html/alialghanim/wp-content/plugins/litespeed-cache/src/media.cls.php on line 860\n
[Sat Jul 18 23:51:56.868254 2026] [lsapi:warn] [pid 983601:tid 983675] [remote 54.87.216.213:0] [host ali-alghanim.com] Backend log: PHP Warning:  getimagesize(https://aasgroup.online/wp-content/uploads/2021/09/1291810.jpg): Failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden\r\n in /home2/aasgroup/public_html/alialghanim/wp-content/plugins/litespeed-cache/src/media.cls.php on line 860\n
[Sat Jul 18 23:51:56.895870 2026] [lsapi:warn] [pid 983601:tid 983662] [remote 54.87.216.213:0] [host ali-alghanim.com] Backend log: PHP Warning:  getimagesize(https://aasgroup.online/wp-content/uploads/2021/09/1291810.jpg): Failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden\r\n in /home2/aasgroup/public_html/alialghanim/wp-content/plugins/litespeed-cache/src/media.cls.php on line 860\n
[Sat Jul 18 23:51:56.928711 2026] [security2:error] [pid 983601:tid 983706] [remote 72.167.132.114:39586] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxl_FaztLkF4ZwQhXLtiwAAz2g"]
[Sat Jul 18 23:51:57.006574 2026] [security2:error] [pid 983601:tid 983825] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxl_FaztLkF4ZwQhXLthAAAAOM"]
[Sat Jul 18 23:51:57.011715 2026] [security2:error] [pid 983601:tid 983731] [client 20.226.66.230:61042] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/8.php"] [unique_id "alxl_VaztLkF4ZwQhXLtkwAAAIU"]
[Sat Jul 18 23:51:57.011803 2026] [security2:error] [pid 983601:tid 983731] [client 20.226.66.230:61042] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/8.php"] [unique_id "alxl_VaztLkF4ZwQhXLtkwAAAIU"]
[Sat Jul 18 23:51:57.110692 2026] [security2:error] [pid 983601:tid 983701] [remote 103.75.185.95:42886] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxl_VaztLkF4ZwQhXLtnAABAGM"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:51:57.123879 2026] [security2:error] [pid 983601:tid 983853] [client 45.134.20.139:31275] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 139.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/uploads/index.php"] [unique_id "alxl_VaztLkF4ZwQhXLtnQAAAP8"]
[Sat Jul 18 23:51:57.237868 2026] [security2:error] [pid 983601:tid 983814] [client 34.172.185.49:26184] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "adambergeron.com"] [uri "/"] [unique_id "alxl_VaztLkF4ZwQhXLtogAAANg"]
[Sat Jul 18 23:51:57.330429 2026] [security2:error] [pid 983601:tid 983769] [client 20.226.66.230:28728] ModSecurity: Warning. Pattern match "/1\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1543"] [id "900921"] [msg "temporary TUW-72162 logging rule"] [hostname "mail.friendlyspreadsheet.com"] [uri "/1.php"] [unique_id "alxl_VaztLkF4ZwQhXLtrAAAAKs"]
[Sat Jul 18 23:51:57.330515 2026] [security2:error] [pid 983601:tid 983769] [client 20.226.66.230:28728] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/1.php"] [unique_id "alxl_VaztLkF4ZwQhXLtrAAAAKs"]
[Sat Jul 18 23:51:57.330587 2026] [security2:error] [pid 983601:tid 983769] [client 20.226.66.230:28728] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/1.php"] [unique_id "alxl_VaztLkF4ZwQhXLtrAAAAKs"]
[Sat Jul 18 23:51:57.334956 2026] [lsapi:warn] [pid 983601:tid 983646] [remote 98.81.131.105:0] [host ali-alghanim.com] Backend log: PHP Warning:  getimagesize(https://aasgroup.online/wp-content/uploads/2021/09/1291810.jpg): Failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden\r\n in /home2/aasgroup/public_html/alialghanim/wp-content/plugins/litespeed-cache/src/media.cls.php on line 860\n
[Sat Jul 18 23:51:57.335304 2026] [security2:error] [pid 983601:tid 983820] [client 138.252.89.100:58988] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxl_VaztLkF4ZwQhXLtrQAAAN4"]
[Sat Jul 18 23:51:57.335410 2026] [security2:error] [pid 983601:tid 983820] [client 138.252.89.100:58988] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxl_VaztLkF4ZwQhXLtrQAAAN4"]
[Sat Jul 18 23:51:57.347062 2026] [lsapi:warn] [pid 983601:tid 983688] [remote 54.87.216.213:0] [host ali-alghanim.com] Backend log: PHP Warning:  getimagesize(https://aasgroup.online/wp-content/uploads/2021/09/1291810.jpg): Failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden\r\n in /home2/aasgroup/public_html/alialghanim/wp-content/plugins/litespeed-cache/src/media.cls.php on line 860\n
[Sat Jul 18 23:51:57.354404 2026] [lsapi:warn] [pid 983601:tid 983668] [remote 98.81.131.105:0] [host ali-alghanim.com] Backend log: PHP Warning:  getimagesize(https://aasgroup.online/wp-content/uploads/2021/09/1291810.jpg): Failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden\r\n in /home2/aasgroup/public_html/alialghanim/wp-content/plugins/litespeed-cache/src/media.cls.php on line 860\n
[Sat Jul 18 23:51:57.533608 2026] [security2:error] [pid 983601:tid 983792] [client 216.244.66.226:41352] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.mezzacraft.com"] [uri "/robots.txt"] [unique_id "alxl_VaztLkF4ZwQhXLt5QAAAMI"]
[Sat Jul 18 23:51:57.533727 2026] [security2:error] [pid 983601:tid 983792] [client 216.244.66.226:41352] ModSecurity: Warning. Matched phrase "Dotbot" at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "www.mezzacraft.com"] [uri "/robots.txt"] [unique_id "alxl_VaztLkF4ZwQhXLt5QAAAMI"]
[Sat Jul 18 23:51:57.675948 2026] [security2:error] [pid 983601:tid 983761] [client 20.226.66.230:61023] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/100.php"] [unique_id "alxl_VaztLkF4ZwQhXLt9gAAAKM"]
[Sat Jul 18 23:51:57.676060 2026] [security2:error] [pid 983601:tid 983761] [client 20.226.66.230:61023] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/100.php"] [unique_id "alxl_VaztLkF4ZwQhXLt9gAAAKM"]
[Sat Jul 18 23:51:57.687934 2026] [security2:error] [pid 983601:tid 983857] [client 185.132.186.36:49455] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 36.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/IXR/fix.php7"] [unique_id "alxl_VaztLkF4ZwQhXLt-AAAAQM"]
[Sat Jul 18 23:51:57.834235 2026] [lsapi:warn] [pid 983601:tid 983620] [remote 98.81.131.105:0] [host ali-alghanim.com] Backend log: PHP Warning:  getimagesize(https://aasgroup.online/wp-content/uploads/2021/09/1291810.jpg): Failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden\r\n in /home2/aasgroup/public_html/alialghanim/wp-content/plugins/litespeed-cache/src/media.cls.php on line 860\n
[Sat Jul 18 23:51:57.881459 2026] [lsapi:warn] [pid 983601:tid 983694] [remote 98.81.131.105:0] [host ali-alghanim.com] Backend log: PHP Warning:  getimagesize(https://aasgroup.online/wp-content/uploads/2021/09/1291810.jpg): Failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden\r\n in /home2/aasgroup/public_html/alialghanim/wp-content/plugins/litespeed-cache/src/media.cls.php on line 860\n
[Sat Jul 18 23:51:57.892174 2026] [lsapi:warn] [pid 983601:tid 983702] [remote 98.81.131.105:0] [host ali-alghanim.com] Backend log: PHP Warning:  getimagesize(https://aasgroup.online/wp-content/uploads/2021/09/1291810.jpg): Failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden\r\n in /home2/aasgroup/public_html/alialghanim/wp-content/plugins/litespeed-cache/src/media.cls.php on line 860\n
[Sat Jul 18 23:51:57.905715 2026] [security2:error] [pid 983601:tid 983749] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxl_VaztLkF4ZwQhXLt9AAAAJc"]
[Sat Jul 18 23:51:57.967108 2026] [security2:error] [pid 983601:tid 983748] [client 57.141.18.94:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxl_VaztLkF4ZwQhXLt9wAAAJY"]
[Sat Jul 18 23:51:57.976450 2026] [security2:error] [pid 983601:tid 983853] [client 45.134.20.116:60609] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 116.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/error.php"] [unique_id "alxl_VaztLkF4ZwQhXLuGAAAAP8"]
[Sat Jul 18 23:51:58.044566 2026] [security2:error] [pid 983601:tid 983805] [client 20.226.66.230:28732] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/about.php"] [unique_id "alxl_laztLkF4ZwQhXLuHgAAAM8"]
[Sat Jul 18 23:51:58.044665 2026] [security2:error] [pid 983601:tid 983805] [client 20.226.66.230:28732] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/about.php"] [unique_id "alxl_laztLkF4ZwQhXLuHgAAAM8"]
[Sat Jul 18 23:51:58.134823 2026] [security2:error] [pid 983601:tid 983610] [remote 154.61.75.100:41368] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "terrapro.marketing"] [uri "/wp-login.php"] [unique_id "alxl_laztLkF4ZwQhXLuIAAA8Qg"], referer: https://terrapro.marketing/wp-login.php
[Sat Jul 18 23:51:58.306443 2026] [security2:error] [pid 983601:tid 983673] [remote 31.42.184.154:47992] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxl_laztLkF4ZwQhXLuNAAA1Uc"]
[Sat Jul 18 23:51:58.420935 2026] [security2:error] [pid 983601:tid 983770] [client 20.226.66.230:28701] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/admin.php"] [unique_id "alxl_laztLkF4ZwQhXLuPQAAAKw"]
[Sat Jul 18 23:51:58.421043 2026] [security2:error] [pid 983601:tid 983770] [client 20.226.66.230:28701] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/admin.php"] [unique_id "alxl_laztLkF4ZwQhXLuPQAAAKw"]
[Sat Jul 18 23:51:58.535441 2026] [security2:error] [pid 983601:tid 983721] [remote 31.42.184.154:47992] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxl_laztLkF4ZwQhXLuRQAA9Xc"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:51:58.578732 2026] [security2:error] [pid 983601:tid 983792] [client 185.132.186.28:25071] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 28.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "alxl_laztLkF4ZwQhXLuSQAAAMI"]
[Sat Jul 18 23:51:58.739450 2026] [security2:error] [pid 983601:tid 983731] [client 20.226.66.230:28692] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/edit.php"] [unique_id "alxl_laztLkF4ZwQhXLuTgAAAIU"]
[Sat Jul 18 23:51:58.739583 2026] [security2:error] [pid 983601:tid 983731] [client 20.226.66.230:28692] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/edit.php"] [unique_id "alxl_laztLkF4ZwQhXLuTgAAAIU"]
[Sat Jul 18 23:51:58.833323 2026] [security2:error] [pid 983601:tid 983835] [client 45.134.20.116:20771] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 116.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/pwnd/admin-footer.php"] [unique_id "alxl_laztLkF4ZwQhXLuVAAAAO0"]
[Sat Jul 18 23:51:59.082656 2026] [security2:error] [pid 983601:tid 983811] [client 20.226.66.230:61017] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-content/admin.php"] [unique_id "alxl_1aztLkF4ZwQhXLuawAAANU"]
[Sat Jul 18 23:51:59.082821 2026] [security2:error] [pid 983601:tid 983811] [client 20.226.66.230:61017] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-content/admin.php"] [unique_id "alxl_1aztLkF4ZwQhXLuawAAANU"]
[Sat Jul 18 23:51:59.116780 2026] [security2:error] [pid 983601:tid 983755] [client 201.246.131.182:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "xp-design.co"] [uri "/index.php"] [unique_id "alxl_laztLkF4ZwQhXLuVgAAAJ0"]
[Sat Jul 18 23:51:59.177919 2026] [security2:error] [pid 983601:tid 983797] [client 139.167.225.146:59964] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxl_1aztLkF4ZwQhXLucwAAAMc"]
[Sat Jul 18 23:51:59.178065 2026] [security2:error] [pid 983601:tid 983797] [client 139.167.225.146:59964] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxl_1aztLkF4ZwQhXLucwAAAMc"]
[Sat Jul 18 23:51:59.250326 2026] [security2:error] [pid 983601:tid 983774] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxl_1aztLkF4ZwQhXLuZgAAALA"]
[Sat Jul 18 23:51:59.431992 2026] [security2:error] [pid 983601:tid 983731] [client 20.226.66.230:28694] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/ss.php"] [unique_id "alxl_1aztLkF4ZwQhXLuhwAAAIU"]
[Sat Jul 18 23:51:59.432095 2026] [security2:error] [pid 983601:tid 983731] [client 20.226.66.230:28694] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/ss.php"] [unique_id "alxl_1aztLkF4ZwQhXLuhwAAAIU"]
[Sat Jul 18 23:51:59.444994 2026] [security2:error] [pid 983601:tid 983831] [client 159.89.12.166:47174] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.body.requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1604"] [id "900941"] [msg "Invalid nested WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.body.requests.requests.path=///"] [hostname "www.adventure-studio.zanjan-fromer.com"] [uri "/"] [unique_id "alxl_1aztLkF4ZwQhXLuiAAAAOk"]
[Sat Jul 18 23:51:59.477630 2026] [security2:error] [pid 983601:tid 983740] [client 185.132.186.35:54741] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 35.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/admin/function.php"] [unique_id "alxl_1aztLkF4ZwQhXLujAAAAI4"]
[Sat Jul 18 23:51:59.594887 2026] [security2:error] [pid 983601:tid 983686] [remote 91.142.222.105:49228] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxl_1aztLkF4ZwQhXLukwAAmVQ"]
[Sat Jul 18 23:51:59.692073 2026] [security2:error] [pid 983601:tid 983846] [client 45.134.20.134:31461] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 134.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "alxl_1aztLkF4ZwQhXLunQAAAPg"]
[Sat Jul 18 23:51:59.771165 2026] [security2:error] [pid 983601:tid 983758] [client 20.226.66.230:61029] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/inputs.php"] [unique_id "alxl_1aztLkF4ZwQhXLupwAAAKA"]
[Sat Jul 18 23:51:59.771327 2026] [security2:error] [pid 983601:tid 983758] [client 20.226.66.230:61029] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/inputs.php"] [unique_id "alxl_1aztLkF4ZwQhXLupwAAAKA"]
[Sat Jul 18 23:51:59.817686 2026] [security2:error] [pid 983601:tid 983693] [remote 134.209.147.209:45162] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 209.147.209.134.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "rrf.lcd.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxl_1aztLkF4ZwQhXLuqAAAz1s"]
[Sat Jul 18 23:51:59.817860 2026] [security2:error] [pid 983601:tid 983805] [client 134.209.147.209:45162] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "rrf.lcd.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxl_1aztLkF4ZwQhXLuqAAAz1s"]
[Sat Jul 18 23:51:59.841085 2026] [proxy:error] [pid 983601:tid 983785] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:51:59.841155 2026] [proxy_http:error] [pid 983601:tid 983785] [client 193.47.62.168:38370] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:51:59.841758 2026] [proxy:error] [pid 983601:tid 983785] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:51:59.841785 2026] [proxy_http:error] [pid 983601:tid 983785] [client 193.47.62.168:38370] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:51:59.852307 2026] [security2:error] [pid 983601:tid 983748] [client 34.172.185.49:12466] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "adambergeron.com"] [uri "/wp-json/batch/v1"] [unique_id "alxl_1aztLkF4ZwQhXLurQAAAJY"]
[Sat Jul 18 23:51:59.935040 2026] [security2:error] [pid 983601:tid 983833] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxl_1aztLkF4ZwQhXLuowAAAOs"]
[Sat Jul 18 23:52:00.096923 2026] [security2:error] [pid 983601:tid 983821] [client 20.226.66.230:28751] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/av.php"] [unique_id "alxmAFaztLkF4ZwQhXLuvAAAAN8"]
[Sat Jul 18 23:52:00.097020 2026] [security2:error] [pid 983601:tid 983821] [client 20.226.66.230:28751] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/av.php"] [unique_id "alxmAFaztLkF4ZwQhXLuvAAAAN8"]
[Sat Jul 18 23:52:00.372374 2026] [security2:error] [pid 983601:tid 983741] [client 185.132.186.28:61315] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 28.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "alxmAFaztLkF4ZwQhXLuygAAAI8"]
[Sat Jul 18 23:52:00.473835 2026] [security2:error] [pid 983601:tid 983789] [client 20.226.66.230:61047] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/classwithtostring.php"] [unique_id "alxmAFaztLkF4ZwQhXLu3wAAAL8"]
[Sat Jul 18 23:52:00.473954 2026] [security2:error] [pid 983601:tid 983789] [client 20.226.66.230:61047] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/classwithtostring.php"] [unique_id "alxmAFaztLkF4ZwQhXLu3wAAAL8"]
[Sat Jul 18 23:52:00.543096 2026] [security2:error] [pid 983601:tid 983833] [client 185.247.137.79:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "alaraycreative.com"] [uri "/index.php"] [unique_id "alxmAFaztLkF4ZwQhXLu4AAAAOs"]
[Sat Jul 18 23:52:00.543096 2026] [security2:error] [pid 983601:tid 983739] [client 185.247.137.83:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "www.alaraycreative.com"] [uri "/index.php"] [unique_id "alxmAFaztLkF4ZwQhXLu3gAAAI0"]
[Sat Jul 18 23:52:00.546475 2026] [security2:error] [pid 983601:tid 983732] [client 45.134.20.120:25097] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 120.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/languages/themes/index.php"] [unique_id "alxmAFaztLkF4ZwQhXLu6AAAAIY"]
[Sat Jul 18 23:52:00.773409 2026] [security2:error] [pid 983601:tid 983811] [client 34.172.185.49:12466] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "adambergeron.com"] [uri "/"] [unique_id "alxmAFaztLkF4ZwQhXLu8gAAANU"]
[Sat Jul 18 23:52:00.847377 2026] [security2:error] [pid 983601:tid 983774] [client 159.89.12.166:47184] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.body.requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1604"] [id "900941"] [msg "Invalid nested WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.body.requests.requests.path=///"] [hostname "www.adventure-studio.zanjan-fromer.com"] [uri "/"] [unique_id "alxmAFaztLkF4ZwQhXLu-QAAALA"]
[Sat Jul 18 23:52:00.852591 2026] [security2:error] [pid 983601:tid 983779] [client 20.226.66.230:28733] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-content/themes/index.php"] [unique_id "alxmAFaztLkF4ZwQhXLu-gAAALU"]
[Sat Jul 18 23:52:00.852709 2026] [security2:error] [pid 983601:tid 983779] [client 20.226.66.230:28733] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-content/themes/index.php"] [unique_id "alxmAFaztLkF4ZwQhXLu-gAAALU"]
[Sat Jul 18 23:52:01.208996 2026] [security2:error] [pid 983601:tid 983767] [client 20.226.66.230:61043] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-blog.php"] [unique_id "alxmAVaztLkF4ZwQhXLvFwAAAKk"]
[Sat Jul 18 23:52:01.209091 2026] [security2:error] [pid 983601:tid 983767] [client 20.226.66.230:61043] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-blog.php"] [unique_id "alxmAVaztLkF4ZwQhXLvFwAAAKk"]
[Sat Jul 18 23:52:01.218628 2026] [security2:error] [pid 983601:tid 983744] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmAVaztLkF4ZwQhXLvCwAAAJI"]
[Sat Jul 18 23:52:01.268829 2026] [security2:error] [pid 983601:tid 983822] [client 185.132.186.12:56397] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "alxmAVaztLkF4ZwQhXLvGAAAAOA"]
[Sat Jul 18 23:52:01.375181 2026] [security2:error] [pid 983601:tid 983649] [remote 31.42.184.154:60676] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.pju.xqs.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxmAVaztLkF4ZwQhXLvGgAAiy8"]
[Sat Jul 18 23:52:01.375386 2026] [security2:error] [pid 983601:tid 983737] [client 31.42.184.154:60676] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "mail.pju.xqs.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxmAVaztLkF4ZwQhXLvGgAAiy8"]
[Sat Jul 18 23:52:01.406263 2026] [security2:error] [pid 983601:tid 983811] [client 45.134.20.133:28387] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-files.php"] [unique_id "alxmAVaztLkF4ZwQhXLvHAAAANU"]
[Sat Jul 18 23:52:01.455427 2026] [security2:error] [pid 983601:tid 983827] [client 159.89.12.166:47192] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "www.adventure-studio.zanjan-fromer.com"] [uri "/wp-json/batch/v1"] [unique_id "alxmAVaztLkF4ZwQhXLvIQAAAOU"]
[Sat Jul 18 23:52:01.561158 2026] [security2:error] [pid 983601:tid 983839] [client 20.226.66.230:28708] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-includes/js/jquery/"] [unique_id "alxmAVaztLkF4ZwQhXLvMwAAAPE"]
[Sat Jul 18 23:52:01.808535 2026] [security2:error] [pid 983601:tid 983603] [remote 91.142.222.105:49228] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxmAVaztLkF4ZwQhXLvRQAA0QE"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:52:02.071925 2026] [security2:error] [pid 983601:tid 983733] [client 20.226.66.230:28692] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-includes/js/jquery/"] [unique_id "alxmAlaztLkF4ZwQhXLvVwAAAIc"]
[Sat Jul 18 23:52:02.124120 2026] [security2:error] [pid 983601:tid 983784] [client 20.230.87.222:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 222.87.230.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.yidaiyi.org"] [uri "/shell.php"] [unique_id "alxmAlaztLkF4ZwQhXLvXQAAALo"]
[Sat Jul 18 23:52:02.124200 2026] [security2:error] [pid 983601:tid 983784] [client 20.230.87.222:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.yidaiyi.org"] [uri "/shell.php"] [unique_id "alxmAlaztLkF4ZwQhXLvXQAAALo"]
[Sat Jul 18 23:52:02.174261 2026] [security2:error] [pid 983601:tid 983820] [client 185.132.186.26:22793] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 26.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "alxmAlaztLkF4ZwQhXLvZQAAAN4"]
[Sat Jul 18 23:52:02.230201 2026] [security2:error] [pid 983601:tid 983743] [client 20.226.66.230:28708] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-content/admin.php"] [unique_id "alxmAlaztLkF4ZwQhXLvZwAAAJE"]
[Sat Jul 18 23:52:02.230302 2026] [security2:error] [pid 983601:tid 983743] [client 20.226.66.230:28708] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-content/admin.php"] [unique_id "alxmAlaztLkF4ZwQhXLvZwAAAJE"]
[Sat Jul 18 23:52:02.275957 2026] [security2:error] [pid 983601:tid 983747] [client 45.134.20.138:36769] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 138.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/functions.php"] [unique_id "alxmAlaztLkF4ZwQhXLvaAAAAJU"]
[Sat Jul 18 23:52:02.561541 2026] [security2:error] [pid 983601:tid 983834] [client 20.226.66.230:29152] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/adminfuns.php"] [unique_id "alxmAlaztLkF4ZwQhXLvdQAAAOw"]
[Sat Jul 18 23:52:02.561703 2026] [security2:error] [pid 983601:tid 983834] [client 20.226.66.230:29152] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/adminfuns.php"] [unique_id "alxmAlaztLkF4ZwQhXLvdQAAAOw"]
[Sat Jul 18 23:52:02.611447 2026] [security2:error] [pid 983601:tid 983800] [client 159.89.12.166:47194] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "www.adventure-studio.zanjan-fromer.com"] [uri "/wp-json/batch/v1"] [unique_id "alxmAlaztLkF4ZwQhXLvegAAAMo"]
[Sat Jul 18 23:52:02.945520 2026] [security2:error] [pid 983601:tid 983830] [client 20.226.66.230:61002] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/goods.php"] [unique_id "alxmAlaztLkF4ZwQhXLvlAAAAOg"]
[Sat Jul 18 23:52:02.945620 2026] [security2:error] [pid 983601:tid 983830] [client 20.226.66.230:61002] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/goods.php"] [unique_id "alxmAlaztLkF4ZwQhXLvlAAAAOg"]
[Sat Jul 18 23:52:02.999549 2026] [security2:error] [pid 983601:tid 983683] [remote 54.90.74.5:48460] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.74.90.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "jndsupport.com"] [uri "/wp-config.php"] [unique_id "alxmAlaztLkF4ZwQhXLvlwAA3lE"]
[Sat Jul 18 23:52:03.108627 2026] [security2:error] [pid 983601:tid 983752] [client 185.132.186.41:44525] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "alxmA1aztLkF4ZwQhXLvnwAAAJo"]
[Sat Jul 18 23:52:03.132172 2026] [security2:error] [pid 983601:tid 983750] [client 45.134.20.116:48087] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 116.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "alxmA1aztLkF4ZwQhXLvpQAAAJg"]
[Sat Jul 18 23:52:03.290701 2026] [security2:error] [pid 983601:tid 983781] [client 20.226.66.230:29153] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/ms-edit.php"] [unique_id "alxmA1aztLkF4ZwQhXLvtQAAALc"]
[Sat Jul 18 23:52:03.290802 2026] [security2:error] [pid 983601:tid 983781] [client 20.226.66.230:29153] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/ms-edit.php"] [unique_id "alxmA1aztLkF4ZwQhXLvtQAAALc"]
[Sat Jul 18 23:52:03.338556 2026] [security2:error] [pid 983601:tid 983823] [client 36.83.95.75:56045] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmA1aztLkF4ZwQhXLvtgAAAOE"]
[Sat Jul 18 23:52:03.338651 2026] [security2:error] [pid 983601:tid 983823] [client 36.83.95.75:56045] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmA1aztLkF4ZwQhXLvtgAAAOE"]
[Sat Jul 18 23:52:03.637270 2026] [security2:error] [pid 983601:tid 983715] [remote 54.90.74.5:48464] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-config\\\\.php(?:\\\\W[a-z]*|bak)" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "300"] [id "900256"] [msg "Wp-Config Backup/edit file request"] [hostname "jndsupport.com"] [uri "/wp-config.php.bak"] [unique_id "alxmA1aztLkF4ZwQhXLvyAAAiHE"]
[Sat Jul 18 23:52:03.692195 2026] [security2:error] [pid 983601:tid 983751] [client 20.226.66.230:29142] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/222.php"] [unique_id "alxmA1aztLkF4ZwQhXLvzQAAAJk"]
[Sat Jul 18 23:52:03.692291 2026] [security2:error] [pid 983601:tid 983751] [client 20.226.66.230:29142] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/222.php"] [unique_id "alxmA1aztLkF4ZwQhXLvzQAAAJk"]
[Sat Jul 18 23:52:03.988927 2026] [security2:error] [pid 983601:tid 983767] [client 45.134.20.111:21383] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "alxmA1aztLkF4ZwQhXLv3gAAAKk"]
[Sat Jul 18 23:52:04.056964 2026] [security2:error] [pid 983601:tid 983841] [client 20.226.66.230:29136] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/cgi-bin/index.php"] [unique_id "alxmBFaztLkF4ZwQhXLv5wAAAPM"]
[Sat Jul 18 23:52:04.057115 2026] [security2:error] [pid 983601:tid 983841] [client 20.226.66.230:29136] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/cgi-bin/index.php"] [unique_id "alxmBFaztLkF4ZwQhXLv5wAAAPM"]
[Sat Jul 18 23:52:04.063143 2026] [security2:error] [pid 983601:tid 983744] [client 185.132.186.18:54381] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 18.186.132.185.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "alxmBFaztLkF4ZwQhXLv4AAAAJI"]
[Sat Jul 18 23:52:04.277505 2026] [security2:error] [pid 983601:tid 983621] [remote 54.90.74.5:48474] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-config\\\\.php(?:\\\\W[a-z]*|bak)" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "300"] [id "900256"] [msg "Wp-Config Backup/edit file request"] [hostname "jndsupport.com"] [uri "/wp-config.php.old"] [unique_id "alxmBFaztLkF4ZwQhXLv9QAA4RM"]
[Sat Jul 18 23:52:04.412798 2026] [fcgid:warn] [pid 983601:tid 983804] (70014)End of file found: [client 152.32.172.212:55244] mod_fcgid: can't get data from http client
[Sat Jul 18 23:52:04.429686 2026] [security2:error] [pid 983601:tid 983846] [client 20.226.66.230:28675] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-includes/css/dist/"] [unique_id "alxmBFaztLkF4ZwQhXLwAQAAAPg"]
[Sat Jul 18 23:52:04.686956 2026] [security2:error] [pid 983601:tid 983838] [client 20.226.66.230:28692] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-includes/css/dist/"] [unique_id "alxmBFaztLkF4ZwQhXLwEgAAAPA"]
[Sat Jul 18 23:52:04.717040 2026] [security2:error] [pid 983601:tid 983725] [remote 31.42.184.154:60680] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.rvprintfactory.com"] [uri "/wp-login.php"] [unique_id "alxmBFaztLkF4ZwQhXLwHAAA3ns"]
[Sat Jul 18 23:52:04.766383 2026] [security2:error] [pid 983601:tid 983615] [remote 31.42.184.154:60682] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "vyx.sbv.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxmBFaztLkF4ZwQhXLwHwAA6w0"]
[Sat Jul 18 23:52:04.766528 2026] [security2:error] [pid 983601:tid 983833] [client 31.42.184.154:60682] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "vyx.sbv.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxmBFaztLkF4ZwQhXLwHwAA6w0"]
[Sat Jul 18 23:52:04.783956 2026] [security2:error] [pid 983601:tid 983802] [client 180.252.198.240:51022] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmBFaztLkF4ZwQhXLwIQAAAMw"]
[Sat Jul 18 23:52:04.784075 2026] [security2:error] [pid 983601:tid 983802] [client 180.252.198.240:51022] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmBFaztLkF4ZwQhXLwIQAAAMw"]
[Sat Jul 18 23:52:04.794510 2026] [security2:error] [pid 983601:tid 983607] [remote 209.42.21.221:45408] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 221.21.42.209.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "adirondackengineering.com"] [uri "/wp-login.php"] [unique_id "alxmBFaztLkF4ZwQhXLwIAAAjwU"]
[Sat Jul 18 23:52:04.845212 2026] [security2:error] [pid 983601:tid 983738] [client 20.226.66.230:28675] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/BDKR28WP.php"] [unique_id "alxmBFaztLkF4ZwQhXLwJAAAAIw"]
[Sat Jul 18 23:52:04.845262 2026] [security2:error] [pid 983601:tid 983788] [client 45.134.20.137:46331] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 137.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/aks.php"] [unique_id "alxmBFaztLkF4ZwQhXLwIwAAAL4"]
[Sat Jul 18 23:52:04.845304 2026] [security2:error] [pid 983601:tid 983738] [client 20.226.66.230:28675] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/BDKR28WP.php"] [unique_id "alxmBFaztLkF4ZwQhXLwJAAAAIw"]
[Sat Jul 18 23:52:04.976252 2026] [security2:error] [pid 983601:tid 983668] [remote 209.42.21.221:45408] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 221.21.42.209.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "adirondackengineering.com"] [uri "/wp-login.php"] [unique_id "alxmBFaztLkF4ZwQhXLwNwAA7EI"], referer: https://adirondackengineering.com/wp-login.php
[Sat Jul 18 23:52:04.976935 2026] [security2:error] [pid 983601:tid 983825] [client 185.132.186.16:41103] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 16.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/files/index.php"] [unique_id "alxmBFaztLkF4ZwQhXLwNgAAAOM"]
[Sat Jul 18 23:52:05.115882 2026] [security2:error] [pid 983601:tid 983720] [remote 31.42.184.154:60680] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.rvprintfactory.com"] [uri "/wp-login.php"] [unique_id "alxmBVaztLkF4ZwQhXLwRgAA8nY"], referer: https://www.rvprintfactory.com/wp-login.php
[Sat Jul 18 23:52:05.281094 2026] [security2:error] [pid 983601:tid 983764] [client 20.226.66.230:28746] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-includes/l10n/"] [unique_id "alxmBVaztLkF4ZwQhXLwUgAAAKY"]
[Sat Jul 18 23:52:05.424009 2026] [security2:error] [pid 983601:tid 983786] [client 103.160.26.178:59887] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmBVaztLkF4ZwQhXLwVgAAALw"]
[Sat Jul 18 23:52:05.424100 2026] [security2:error] [pid 983601:tid 983786] [client 103.160.26.178:59887] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmBVaztLkF4ZwQhXLwVgAAALw"]
[Sat Jul 18 23:52:05.458426 2026] [authz_core:error] [pid 983601:tid 983830] [client 20.226.66.230:28692] AH01630: client denied by server configuration: /home4/katsklar/public_html/wp-includes/l10n/error_log
[Sat Jul 18 23:52:05.460073 2026] [security2:error] [pid 983601:tid 983830] [client 20.226.66.230:28692] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-includes/l10n/"] [unique_id "alxmBVaztLkF4ZwQhXLwVwAAAOg"]
[Sat Jul 18 23:52:05.617390 2026] [security2:error] [pid 983601:tid 983774] [client 20.226.66.230:28746] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-content/uploads/"] [unique_id "alxmBVaztLkF4ZwQhXLwbAAAALA"]
[Sat Jul 18 23:52:05.714640 2026] [security2:error] [pid 983601:tid 983761] [client 45.134.20.123:62163] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 123.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/litespeed.php"] [unique_id "alxmBVaztLkF4ZwQhXLwcgAAAKM"]
[Sat Jul 18 23:52:05.813254 2026] [authz_core:error] [pid 983601:tid 983780] [client 20.226.66.230:28692] AH01630: client denied by server configuration: /home4/katsklar/public_html/wp-content/uploads/wpcf7_uploads/
[Sat Jul 18 23:52:05.813798 2026] [security2:error] [pid 983601:tid 983780] [client 20.226.66.230:28692] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-content/uploads/"] [unique_id "alxmBVaztLkF4ZwQhXLwdwAAALY"]
[Sat Jul 18 23:52:05.887691 2026] [security2:error] [pid 983601:tid 983739] [client 185.132.186.43:24053] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 43.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "alxmBVaztLkF4ZwQhXLwigAAAI0"]
[Sat Jul 18 23:52:05.971200 2026] [security2:error] [pid 983601:tid 983807] [client 20.226.66.230:28746] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp.php"] [unique_id "alxmBVaztLkF4ZwQhXLwlAAAANE"]
[Sat Jul 18 23:52:05.971341 2026] [security2:error] [pid 983601:tid 983807] [client 20.226.66.230:28746] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp.php"] [unique_id "alxmBVaztLkF4ZwQhXLwlAAAANE"]
[Sat Jul 18 23:52:06.094836 2026] [security2:error] [pid 983601:tid 983826] [client 147.135.209.14:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "timespans.org"] [uri "/index.php"] [unique_id "alxmBFaztLkF4ZwQhXLwKQAAAOQ"]
[Sat Jul 18 23:52:06.270934 2026] [security2:error] [pid 983601:tid 983664] [remote 54.90.74.5:42178] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-config\\\\.php(?:\\\\W[a-z]*|bak)" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "300"] [id "900256"] [msg "Wp-Config Backup/edit file request"] [hostname "jndsupport.com"] [uri "/wp-config.php.txt"] [unique_id "alxmBlaztLkF4ZwQhXLwtQAApT4"]
[Sat Jul 18 23:52:06.334201 2026] [security2:error] [pid 983601:tid 983782] [client 20.226.66.230:29168] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/abcd.php"] [unique_id "alxmBlaztLkF4ZwQhXLwugAAALg"]
[Sat Jul 18 23:52:06.334328 2026] [security2:error] [pid 983601:tid 983782] [client 20.226.66.230:29168] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/abcd.php"] [unique_id "alxmBlaztLkF4ZwQhXLwugAAALg"]
[Sat Jul 18 23:52:06.570118 2026] [security2:error] [pid 983601:tid 983823] [client 45.134.20.126:34367] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 126.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/img/about.php"] [unique_id "alxmBlaztLkF4ZwQhXLwzAAAAOE"]
[Sat Jul 18 23:52:06.669406 2026] [security2:error] [pid 983601:tid 983838] [client 20.226.66.230:29181] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/a1.php"] [unique_id "alxmBlaztLkF4ZwQhXLw2AAAAPA"]
[Sat Jul 18 23:52:06.669510 2026] [security2:error] [pid 983601:tid 983838] [client 20.226.66.230:29181] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/a1.php"] [unique_id "alxmBlaztLkF4ZwQhXLw2AAAAPA"]
[Sat Jul 18 23:52:06.803680 2026] [security2:error] [pid 983601:tid 983753] [client 185.132.186.7:56125] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 7.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/inc.php"] [unique_id "alxmBlaztLkF4ZwQhXLw4wAAAJs"]
[Sat Jul 18 23:52:07.061941 2026] [security2:error] [pid 983601:tid 983821] [client 20.226.66.230:29141] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "alxmB1aztLkF4ZwQhXLw9AAAAN8"]
[Sat Jul 18 23:52:07.062049 2026] [security2:error] [pid 983601:tid 983821] [client 20.226.66.230:29141] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "alxmB1aztLkF4ZwQhXLw9AAAAN8"]
[Sat Jul 18 23:52:07.363590 2026] [security2:error] [pid 983601:tid 983813] [client 139.167.225.146:60825] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxmB1aztLkF4ZwQhXLxDgAAANc"]
[Sat Jul 18 23:52:07.363704 2026] [security2:error] [pid 983601:tid 983813] [client 139.167.225.146:60825] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxmB1aztLkF4ZwQhXLxDgAAANc"]
[Sat Jul 18 23:52:07.417194 2026] [security2:error] [pid 983601:tid 983759] [client 20.226.66.230:61022] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/cgi-bin/admin.php"] [unique_id "alxmB1aztLkF4ZwQhXLxEgAAAKE"]
[Sat Jul 18 23:52:07.417287 2026] [security2:error] [pid 983601:tid 983759] [client 20.226.66.230:61022] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/cgi-bin/admin.php"] [unique_id "alxmB1aztLkF4ZwQhXLxEgAAAKE"]
[Sat Jul 18 23:52:07.425863 2026] [security2:error] [pid 983601:tid 983840] [client 45.134.20.136:28215] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 136.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/class-feed-index.php"] [unique_id "alxmB1aztLkF4ZwQhXLxFAAAAPI"]
[Sat Jul 18 23:52:07.462837 2026] [security2:error] [pid 983601:tid 983764] [client 74.7.227.179:57366] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxmB1aztLkF4ZwQhXLxCAAApjw"], referer: https://tejasenvironmental.com/p=346696
[Sat Jul 18 23:52:07.712631 2026] [security2:error] [pid 983601:tid 983810] [client 185.132.186.13:51361] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/index.php"] [unique_id "alxmB1aztLkF4ZwQhXLxJgAAANQ"]
[Sat Jul 18 23:52:07.752656 2026] [security2:error] [pid 983601:tid 983857] [client 20.226.66.230:28735] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/gettest.php"] [unique_id "alxmB1aztLkF4ZwQhXLxKgAAAQM"]
[Sat Jul 18 23:52:07.752771 2026] [security2:error] [pid 983601:tid 983857] [client 20.226.66.230:28735] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/gettest.php"] [unique_id "alxmB1aztLkF4ZwQhXLxKgAAAQM"]
[Sat Jul 18 23:52:07.800561 2026] [security2:error] [pid 983601:tid 983703] [remote 54.90.74.5:42184] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-config\\\\.php(?:\\\\W[a-z]*|bak)" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "300"] [id "900256"] [msg "Wp-Config Backup/edit file request"] [hostname "jndsupport.com"] [uri "/wp-config.php.save"] [unique_id "alxmB1aztLkF4ZwQhXLxLQAAtGU"]
[Sat Jul 18 23:52:08.129843 2026] [security2:error] [pid 983601:tid 983772] [client 20.226.66.230:29174] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-content/"] [unique_id "alxmCFaztLkF4ZwQhXLxQQAAAK4"]
[Sat Jul 18 23:52:08.283234 2026] [security2:error] [pid 983601:tid 983848] [client 45.134.20.117:63343] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wpn.php"] [unique_id "alxmCFaztLkF4ZwQhXLxSwAAAPo"]
[Sat Jul 18 23:52:08.607199 2026] [security2:error] [pid 983601:tid 983737] [client 185.132.186.45:63927] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 45.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/filemanager.php"] [unique_id "alxmCFaztLkF4ZwQhXLxXQAAAIs"]
[Sat Jul 18 23:52:08.813707 2026] [security2:error] [pid 983601:tid 983851] [client 20.226.66.230:28692] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-content/index.php"] [unique_id "alxmCFaztLkF4ZwQhXLxTAAAAP0"]
[Sat Jul 18 23:52:08.970285 2026] [security2:error] [pid 983601:tid 983817] [client 20.226.66.230:29174] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/simple.php"] [unique_id "alxmCFaztLkF4ZwQhXLxdgAAANs"]
[Sat Jul 18 23:52:08.970380 2026] [security2:error] [pid 983601:tid 983817] [client 20.226.66.230:29174] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/simple.php"] [unique_id "alxmCFaztLkF4ZwQhXLxdgAAANs"]
[Sat Jul 18 23:52:09.074231 2026] [security2:error] [pid 983601:tid 983718] [remote 54.90.74.5:42200] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-config\\\\.php(?:\\\\W[a-z]*|bak)" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "300"] [id "900256"] [msg "Wp-Config Backup/edit file request"] [hostname "jndsupport.com"] [uri "/wp-config.php~"] [unique_id "alxmCVaztLkF4ZwQhXLxfAAAunQ"]
[Sat Jul 18 23:52:09.137616 2026] [security2:error] [pid 983601:tid 983748] [client 45.134.20.119:54077] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/classwithtostring.php"] [unique_id "alxmCVaztLkF4ZwQhXLxhQAAAJY"]
[Sat Jul 18 23:52:09.186504 2026] [security2:error] [pid 983601:tid 983745] [client 138.252.89.100:59519] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmCVaztLkF4ZwQhXLxiAAAAJM"]
[Sat Jul 18 23:52:09.186576 2026] [security2:error] [pid 983601:tid 983745] [client 138.252.89.100:59519] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmCVaztLkF4ZwQhXLxiAAAAJM"]
[Sat Jul 18 23:52:09.308408 2026] [security2:error] [pid 983601:tid 983808] [client 20.226.66.230:61037] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/xxx.php"] [unique_id "alxmCVaztLkF4ZwQhXLxkQAAANI"]
[Sat Jul 18 23:52:09.308493 2026] [security2:error] [pid 983601:tid 983808] [client 20.226.66.230:61037] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/xxx.php"] [unique_id "alxmCVaztLkF4ZwQhXLxkQAAANI"]
[Sat Jul 18 23:52:09.571333 2026] [security2:error] [pid 983601:tid 983742] [client 185.132.186.40:20773] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 40.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/cgi-bin/bypass.php"] [unique_id "alxmCVaztLkF4ZwQhXLxoQAAAJA"]
[Sat Jul 18 23:52:09.642158 2026] [security2:error] [pid 983601:tid 983826] [client 20.226.66.230:61039] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/hypo.php"] [unique_id "alxmCVaztLkF4ZwQhXLxpgAAAOQ"]
[Sat Jul 18 23:52:09.642239 2026] [security2:error] [pid 983601:tid 983826] [client 20.226.66.230:61039] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/hypo.php"] [unique_id "alxmCVaztLkF4ZwQhXLxpgAAAOQ"]
[Sat Jul 18 23:52:09.809794 2026] [security2:error] [pid 983601:tid 983852] [client 4.194.24.143:18276] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/nine2code.php"] [unique_id "alxmCVaztLkF4ZwQhXLxsAAAAP4"]
[Sat Jul 18 23:52:09.965947 2026] [security2:error] [pid 983601:tid 983782] [client 20.226.66.230:29175] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "alxmCVaztLkF4ZwQhXLxuAAAALg"]
[Sat Jul 18 23:52:09.990933 2026] [security2:error] [pid 983601:tid 983781] [client 45.134.20.138:33215] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 138.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/acme-challenge/iR7SzrsOUEP.php"] [unique_id "alxmCVaztLkF4ZwQhXLxugAAALc"]
[Sat Jul 18 23:52:10.198323 2026] [security2:error] [pid 983601:tid 983785] [client 20.226.66.230:28692] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "alxmClaztLkF4ZwQhXLxxgAAALs"]
[Sat Jul 18 23:52:10.351523 2026] [security2:error] [pid 983601:tid 983821] [client 4.194.24.143:18081] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/num.php"] [unique_id "alxmClaztLkF4ZwQhXLx0gAAAN8"]
[Sat Jul 18 23:52:10.356486 2026] [security2:error] [pid 983601:tid 983756] [client 20.226.66.230:29175] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/chosen.php"] [unique_id "alxmClaztLkF4ZwQhXLx0wAAAJ4"]
[Sat Jul 18 23:52:10.356570 2026] [security2:error] [pid 983601:tid 983756] [client 20.226.66.230:29175] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/chosen.php"] [unique_id "alxmClaztLkF4ZwQhXLx0wAAAJ4"]
[Sat Jul 18 23:52:10.466979 2026] [security2:error] [pid 983601:tid 983811] [client 185.132.186.33:61665] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 33.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/.well-known/pki-validation/admin.php"] [unique_id "alxmClaztLkF4ZwQhXLx3wAAANU"]
[Sat Jul 18 23:52:10.692526 2026] [security2:error] [pid 983601:tid 983747] [client 20.226.66.230:61006] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-includes/block-bindings/"] [unique_id "alxmClaztLkF4ZwQhXLx8QAAAJU"]
[Sat Jul 18 23:52:10.846948 2026] [security2:error] [pid 983601:tid 983800] [client 45.134.20.117:40393] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "alxmClaztLkF4ZwQhXLx_gAAAMo"]
[Sat Jul 18 23:52:10.869443 2026] [authz_core:error] [pid 983601:tid 983823] [client 20.226.66.230:28692] AH01630: client denied by server configuration: /home4/katsklar/public_html/wp-includes/block-bindings/error_log
[Sat Jul 18 23:52:10.870075 2026] [security2:error] [pid 983601:tid 983823] [client 20.226.66.230:28692] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "mail.friendlyspreadsheet.com"] [uri "/wp-includes/block-bindings/"] [unique_id "alxmClaztLkF4ZwQhXLyAQAAAOE"]
[Sat Jul 18 23:52:10.944053 2026] [security2:error] [pid 983601:tid 983807] [client 4.194.24.143:31212] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/odf7udtspqtpxzyxmw2rccdefault.php"] [unique_id "alxmClaztLkF4ZwQhXLyCwAAANE"]
[Sat Jul 18 23:52:11.034645 2026] [security2:error] [pid 983601:tid 983794] [client 20.226.66.230:61006] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.66.226.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.friendlyspreadsheet.com"] [uri "/als.php"] [unique_id "alxmC1aztLkF4ZwQhXLyDwAAAMQ"]
[Sat Jul 18 23:52:11.034723 2026] [security2:error] [pid 983601:tid 983794] [client 20.226.66.230:61006] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "mail.friendlyspreadsheet.com"] [uri "/als.php"] [unique_id "alxmC1aztLkF4ZwQhXLyDwAAAMQ"]
[Sat Jul 18 23:52:11.404178 2026] [security2:error] [pid 983601:tid 983815] [client 185.132.186.21:58159] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 21.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "alxmC1aztLkF4ZwQhXLyJwAAANk"]
[Sat Jul 18 23:52:11.498964 2026] [security2:error] [pid 983601:tid 983784] [client 4.194.24.143:31203] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/option.php"] [unique_id "alxmC1aztLkF4ZwQhXLyMQAAALo"]
[Sat Jul 18 23:52:11.701416 2026] [security2:error] [pid 983601:tid 983787] [client 45.134.20.125:30709] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 125.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/twentytwentyfour/functions.php"] [unique_id "alxmC1aztLkF4ZwQhXLyRAAAAL0"]
[Sat Jul 18 23:52:12.074190 2026] [security2:error] [pid 983601:tid 983739] [client 4.194.24.143:18244] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/p.php"] [unique_id "alxmDFaztLkF4ZwQhXLyXQAAAI0"]
[Sat Jul 18 23:52:12.311967 2026] [security2:error] [pid 983601:tid 983819] [client 185.132.186.26:30961] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 26.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/js/index.php"] [unique_id "alxmDFaztLkF4ZwQhXLybAAAAN0"]
[Sat Jul 18 23:52:12.559918 2026] [security2:error] [pid 983601:tid 983779] [client 45.134.20.110:35765] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/db.php"] [unique_id "alxmDFaztLkF4ZwQhXLyiQAAALU"]
[Sat Jul 18 23:52:12.617187 2026] [security2:error] [pid 983601:tid 983799] [client 4.194.24.143:31179] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/past.php"] [unique_id "alxmDFaztLkF4ZwQhXLyiwAAAMk"]
[Sat Jul 18 23:52:13.191197 2026] [security2:error] [pid 983601:tid 983846] [client 4.194.24.143:18071] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/php.php"] [unique_id "alxmDVaztLkF4ZwQhXLyuQAAAPg"]
[Sat Jul 18 23:52:13.222421 2026] [security2:error] [pid 983601:tid 983743] [client 185.132.186.32:53275] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "alxmDVaztLkF4ZwQhXLyugAAAJE"]
[Sat Jul 18 23:52:13.330036 2026] [security2:error] [pid 983601:tid 983745] [client 54.90.74.5:42212] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmDVaztLkF4ZwQhXLysQAAk3Y"]
[Sat Jul 18 23:52:13.424729 2026] [security2:error] [pid 983601:tid 983790] [client 45.134.20.127:23839] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 127.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "alxmDVaztLkF4ZwQhXLyywAAAMA"]
[Sat Jul 18 23:52:13.772333 2026] [security2:error] [pid 983601:tid 983787] [client 4.194.24.143:18062] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/php8.php"] [unique_id "alxmDVaztLkF4ZwQhXLy5AAAAL0"]
[Sat Jul 18 23:52:13.881117 2026] [security2:error] [pid 983601:tid 983828] [client 36.83.95.75:56541] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmDVaztLkF4ZwQhXLy5wAAAOY"]
[Sat Jul 18 23:52:13.881252 2026] [security2:error] [pid 983601:tid 983828] [client 36.83.95.75:56541] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmDVaztLkF4ZwQhXLy5wAAAOY"]
[Sat Jul 18 23:52:14.118988 2026] [security2:error] [pid 983601:tid 983751] [client 185.132.186.29:44813] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 29.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/function.php"] [unique_id "alxmDlaztLkF4ZwQhXLy-gAAAJk"]
[Sat Jul 18 23:52:14.279798 2026] [security2:error] [pid 983601:tid 983737] [client 45.134.20.129:64615] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "alxmDlaztLkF4ZwQhXLzCAAAAIs"]
[Sat Jul 18 23:52:14.352485 2026] [security2:error] [pid 983601:tid 983782] [client 185.231.154.128:58158] ModSecurity: Access denied with code 406 (phase 1). IPmatchFromFile: "185.231.154.128" matched at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1090"] [id "999022"] [msg "Blacklisted IP Address for POST data StopForumSpam List"] [hostname "blog.danwolfe.us"] [uri "/wp-comments-post.php"] [unique_id "alxmDlaztLkF4ZwQhXLzCgAAALg"], referer: https://blog.danwolfe.us/on-the-closure-of-valley-forge-military-academy/
[Sat Jul 18 23:52:14.352630 2026] [security2:error] [pid 983601:tid 983782] [client 185.231.154.128:58158] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "406"] [hostname "blog.danwolfe.us"] [uri "/wp-comments-post.php"] [unique_id "alxmDlaztLkF4ZwQhXLzCgAAALg"], referer: https://blog.danwolfe.us/on-the-closure-of-valley-forge-military-academy/
[Sat Jul 18 23:52:14.353775 2026] [security2:error] [pid 983601:tid 983742] [client 4.194.24.143:18241] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/phpinfo.php"] [unique_id "alxmDlaztLkF4ZwQhXLzCwAAAJA"]
[Sat Jul 18 23:52:14.541681 2026] [ssl:error] [pid 983601:tid 983752] [client 13.219.121.241:2746] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname cpcalendars.maa.hws.mybluehost.me provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:52:14.763789 2026] [security2:error] [pid 983601:tid 983849] [client 180.252.198.240:51638] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmDlaztLkF4ZwQhXLzJAAAAPs"]
[Sat Jul 18 23:52:14.763925 2026] [security2:error] [pid 983601:tid 983849] [client 180.252.198.240:51638] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmDlaztLkF4ZwQhXLzJAAAAPs"]
[Sat Jul 18 23:52:14.787362 2026] [security2:error] [pid 983601:tid 983809] [client 24.201.115.215:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxmDlaztLkF4ZwQhXLzDwAA00g"]
[Sat Jul 18 23:52:15.016314 2026] [security2:error] [pid 983601:tid 983684] [remote 72.167.132.114:48110] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "kpb.qlr.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxmD1aztLkF4ZwQhXLzNQAA9lI"]
[Sat Jul 18 23:52:15.055862 2026] [security2:error] [pid 983601:tid 983796] [client 185.132.186.22:60293] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 22.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "alxmD1aztLkF4ZwQhXLzNwAAAMY"]
[Sat Jul 18 23:52:15.135494 2026] [security2:error] [pid 983601:tid 983823] [client 45.134.20.111:34791] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "alxmD1aztLkF4ZwQhXLzQAAAAOE"]
[Sat Jul 18 23:52:15.318406 2026] [security2:error] [pid 983601:tid 983637] [remote 217.182.128.41:44642] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.128.182.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxmD1aztLkF4ZwQhXLzTAAA6CM"]
[Sat Jul 18 23:52:15.318622 2026] [security2:error] [pid 983601:tid 983830] [client 217.182.128.41:44642] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxmD1aztLkF4ZwQhXLzTAAA6CM"]
[Sat Jul 18 23:52:15.441806 2026] [security2:error] [pid 983601:tid 983740] [client 54.90.74.5:42224] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmD1aztLkF4ZwQhXLzRwAAjhk"]
[Sat Jul 18 23:52:15.638699 2026] [security2:error] [pid 983601:tid 983817] [client 4.194.24.143:18050] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/post.php"] [unique_id "alxmD1aztLkF4ZwQhXLzaAAAANs"]
[Sat Jul 18 23:52:15.946023 2026] [security2:error] [pid 983601:tid 983732] [client 185.132.186.34:21559] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 34.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-signup.php"] [unique_id "alxmD1aztLkF4ZwQhXLzfAAAAIY"]
[Sat Jul 18 23:52:15.990607 2026] [security2:error] [pid 983601:tid 983731] [client 45.134.20.116:43035] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 116.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "alxmD1aztLkF4ZwQhXLzfQAAAIU"]
[Sat Jul 18 23:52:16.121051 2026] [security2:error] [pid 983601:tid 983764] [client 103.160.26.178:60404] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmEFaztLkF4ZwQhXLzhgAAAKY"]
[Sat Jul 18 23:52:16.121163 2026] [security2:error] [pid 983601:tid 983764] [client 103.160.26.178:60404] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmEFaztLkF4ZwQhXLzhgAAAKY"]
[Sat Jul 18 23:52:16.143626 2026] [security2:error] [pid 983601:tid 983818] [client 189.6.8.107:22067] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.keywayconstructionclt.com"] [uri "/index.php"] [unique_id "alxmEFaztLkF4ZwQhXLzgAAAANw"]
[Sat Jul 18 23:52:16.182048 2026] [security2:error] [pid 983601:tid 983789] [client 4.194.24.143:23180] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/public/assets/design_1/css/parts/course_cards/grid_card_1.min.php"] [unique_id "alxmEFaztLkF4ZwQhXLzkQAAAL8"]
[Sat Jul 18 23:52:16.803844 2026] [security2:error] [pid 983601:tid 983795] [client 4.194.24.143:18053] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/public/css.php"] [unique_id "alxmEFaztLkF4ZwQhXLztwAAAMU"]
[Sat Jul 18 23:52:16.844354 2026] [security2:error] [pid 983601:tid 983845] [client 45.134.20.114:58579] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "alxmEFaztLkF4ZwQhXLzuAAAAPc"]
[Sat Jul 18 23:52:16.850460 2026] [security2:error] [pid 983601:tid 983852] [client 185.132.186.26:54065] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 26.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/network/network.php"] [unique_id "alxmEFaztLkF4ZwQhXLzuQAAAP4"]
[Sat Jul 18 23:52:16.911064 2026] [security2:error] [pid 983601:tid 983696] [remote 54.90.74.5:38326] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.74.90.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "jndsupport.com"] [uri "/sites/default/settings.php"] [unique_id "alxmEFaztLkF4ZwQhXLzvAAApV4"]
[Sat Jul 18 23:52:17.344963 2026] [security2:error] [pid 983601:tid 983837] [client 4.194.24.143:23188] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/r.php"] [unique_id "alxmEVaztLkF4ZwQhXLz2QAAAO8"]
[Sat Jul 18 23:52:17.398480 2026] [security2:error] [pid 983601:tid 983676] [remote 54.90.74.5:38336] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.74.90.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "jndsupport.com"] [uri "/sites/default/settings.local.php"] [unique_id "alxmEVaztLkF4ZwQhXLz2gAAzko"]
[Sat Jul 18 23:52:17.697319 2026] [security2:error] [pid 983601:tid 983763] [client 45.134.20.122:35385] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/tinyfilemanager/tinyfilemanager.php"] [unique_id "alxmEVaztLkF4ZwQhXLz8gAAAKU"]
[Sat Jul 18 23:52:17.729908 2026] [security2:error] [pid 983601:tid 983726] [remote 47.86.33.52:48580] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/wp-login.php"] [unique_id "alxmEVaztLkF4ZwQhXLz8wAAo3w"]
[Sat Jul 18 23:52:17.815696 2026] [security2:error] [pid 983601:tid 983778] [client 185.132.186.22:62885] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 22.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/admin/upload/css.php"] [unique_id "alxmEVaztLkF4ZwQhXL0AQAAALQ"]
[Sat Jul 18 23:52:17.922419 2026] [security2:error] [pid 983601:tid 983757] [client 4.194.24.143:18267] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/radio.php"] [unique_id "alxmEVaztLkF4ZwQhXL0CQAAAJ8"]
[Sat Jul 18 23:52:18.498574 2026] [security2:error] [pid 983601:tid 983834] [client 4.194.24.143:23213] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/randkeyword.php7"] [unique_id "alxmElaztLkF4ZwQhXL0MwAAAOw"]
[Sat Jul 18 23:52:18.505732 2026] [security2:error] [pid 983601:tid 983808] [client 114.119.159.75:45333] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "avatrip.co"] [uri "/avatar"] [unique_id "alxmElaztLkF4ZwQhXL0NQAAANI"], referer: https://avatrip.co/avatar
[Sat Jul 18 23:52:18.550252 2026] [security2:error] [pid 983601:tid 983777] [client 45.134.20.106:27341] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "655"] [id "900155"] [msg "WP Brute UA block"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/light/colors.min.php"] [unique_id "alxmElaztLkF4ZwQhXL0OwAAALM"]
[Sat Jul 18 23:52:18.573757 2026] [security2:error] [pid 983601:tid 983694] [remote 47.86.33.52:48580] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/wp-login.php"] [unique_id "alxmElaztLkF4ZwQhXL0PgAAzFw"], referer: https://muafaces.org/wp-login.php
[Sat Jul 18 23:52:18.707838 2026] [security2:error] [pid 983601:tid 983793] [client 185.132.186.16:42223] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 16.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-blog.php"] [unique_id "alxmElaztLkF4ZwQhXL0RQAAAMM"]
[Sat Jul 18 23:52:18.899786 2026] [security2:error] [pid 983601:tid 983723] [remote 47.86.33.52:48594] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bruceledewitz.com"] [uri "/wp-login.php"] [unique_id "alxmElaztLkF4ZwQhXL0VAAA83k"]
[Sat Jul 18 23:52:19.053319 2026] [security2:error] [pid 983601:tid 983858] [client 4.194.24.143:18262] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/readme.php"] [unique_id "alxmE1aztLkF4ZwQhXL0YwAAAQQ"]
[Sat Jul 18 23:52:19.320278 2026] [security2:error] [pid 983601:tid 983636] [remote 54.90.74.5:38350] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.74.90.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "jndsupport.com"] [uri "/configuration.php"] [unique_id "alxmE1aztLkF4ZwQhXL0dgAAzCI"]
[Sat Jul 18 23:52:19.408369 2026] [security2:error] [pid 983601:tid 983741] [client 45.134.20.105:32833] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "alxmE1aztLkF4ZwQhXL0fwAAAI8"]
[Sat Jul 18 23:52:19.597194 2026] [security2:error] [pid 983601:tid 983811] [client 4.194.24.143:18259] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/reze.php"] [unique_id "alxmE1aztLkF4ZwQhXL0jQAAANU"]
[Sat Jul 18 23:52:19.599329 2026] [security2:error] [pid 983601:tid 983762] [client 185.132.186.39:31469] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 39.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/file.php"] [unique_id "alxmE1aztLkF4ZwQhXL0jwAAAKQ"]
[Sat Jul 18 23:52:19.643063 2026] [security2:error] [pid 983601:tid 983644] [remote 152.228.213.32:46768] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxmE1aztLkF4ZwQhXL0kAAAsCo"]
[Sat Jul 18 23:52:19.750202 2026] [security2:error] [pid 983601:tid 983637] [remote 47.86.33.52:48594] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bruceledewitz.com"] [uri "/wp-login.php"] [unique_id "alxmE1aztLkF4ZwQhXL0lgAA1iM"], referer: https://bruceledewitz.com/wp-login.php
[Sat Jul 18 23:52:19.764517 2026] [security2:error] [pid 983601:tid 983770] [client 139.167.225.146:61503] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxmE1aztLkF4ZwQhXL0mgAAAKw"]
[Sat Jul 18 23:52:19.764627 2026] [security2:error] [pid 983601:tid 983770] [client 139.167.225.146:61503] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxmE1aztLkF4ZwQhXL0mgAAAKw"]
[Sat Jul 18 23:52:19.838710 2026] [security2:error] [pid 983601:tid 983704] [remote 152.228.213.32:46768] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxmE1aztLkF4ZwQhXL0pQAAmGY"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:52:19.895827 2026] [security2:error] [pid 983601:tid 983715] [remote 217.113.60.80:53718] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.60.113.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "rcq.nst.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxmE1aztLkF4ZwQhXL0qgAAk3E"]
[Sat Jul 18 23:52:19.896060 2026] [security2:error] [pid 983601:tid 983745] [client 217.113.60.80:53718] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "rcq.nst.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxmE1aztLkF4ZwQhXL0qgAAk3E"]
[Sat Jul 18 23:52:19.948000 2026] [autoindex:error] [pid 983601:tid 983846] [client 45.133.7.67:0] AH01276: Cannot serve directory /home4/nikkides/public_html/.well-known/acme-challenge/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:52:20.150492 2026] [security2:error] [pid 983601:tid 983793] [client 4.194.24.143:34207] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/rh.php"] [unique_id "alxmFFaztLkF4ZwQhXL0sgAAAMM"]
[Sat Jul 18 23:52:20.264211 2026] [security2:error] [pid 983601:tid 983820] [client 45.134.20.127:42323] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 127.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "alxmFFaztLkF4ZwQhXL0tgAAAN4"]
[Sat Jul 18 23:52:20.325791 2026] [security2:error] [pid 983601:tid 983781] [client 195.161.41.115:54632] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.41.161.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "areitoproducciones.com"] [uri "/xmlrpc.php"] [unique_id "alxmFFaztLkF4ZwQhXL0vQAAALc"]
[Sat Jul 18 23:52:20.325904 2026] [security2:error] [pid 983601:tid 983781] [client 195.161.41.115:54632] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "areitoproducciones.com"] [uri "/xmlrpc.php"] [unique_id "alxmFFaztLkF4ZwQhXL0vQAAALc"]
[Sat Jul 18 23:52:20.499369 2026] [security2:error] [pid 983601:tid 983827] [client 185.132.186.10:26619] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "alxmFFaztLkF4ZwQhXL0ywAAAOU"]
[Sat Jul 18 23:52:20.674949 2026] [security2:error] [pid 983601:tid 983678] [remote 54.90.74.5:38358] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.74.90.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "jndsupport.com"] [uri "/configuration.php.bak"] [unique_id "alxmFFaztLkF4ZwQhXL00wAAskw"]
[Sat Jul 18 23:52:20.725101 2026] [security2:error] [pid 983601:tid 983839] [client 4.194.24.143:42222] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/rip.php"] [unique_id "alxmFFaztLkF4ZwQhXL02QAAAPE"]
[Sat Jul 18 23:52:20.889079 2026] [security2:error] [pid 983601:tid 983749] [client 195.161.41.115:54646] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.41.161.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "areitoproducciones.com"] [uri "/xmlrpc.php"] [unique_id "alxmFFaztLkF4ZwQhXL04QAAAJc"]
[Sat Jul 18 23:52:20.889149 2026] [security2:error] [pid 983601:tid 983749] [client 195.161.41.115:54646] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "areitoproducciones.com"] [uri "/xmlrpc.php"] [unique_id "alxmFFaztLkF4ZwQhXL04QAAAJc"]
[Sat Jul 18 23:52:20.978404 2026] [security2:error] [pid 983601:tid 983832] [client 138.252.89.100:60067] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmFFaztLkF4ZwQhXL06gAAAOo"]
[Sat Jul 18 23:52:20.978498 2026] [security2:error] [pid 983601:tid 983832] [client 138.252.89.100:60067] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmFFaztLkF4ZwQhXL06gAAAOo"]
[Sat Jul 18 23:52:21.124848 2026] [security2:error] [pid 983601:tid 983815] [client 45.134.20.119:36799] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "alxmFVaztLkF4ZwQhXL07gAAANk"]
[Sat Jul 18 23:52:21.270020 2026] [security2:error] [pid 983601:tid 983847] [client 14.224.227.113:52520] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxmFVaztLkF4ZwQhXL0-AAAAPk"]
[Sat Jul 18 23:52:21.295135 2026] [security2:error] [pid 983601:tid 983811] [client 4.194.24.143:31219] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/root.php"] [unique_id "alxmFVaztLkF4ZwQhXL0-QAAANU"]
[Sat Jul 18 23:52:21.402866 2026] [security2:error] [pid 983601:tid 983757] [client 185.132.186.33:61925] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 33.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "alxmFVaztLkF4ZwQhXL1AgAAAJ8"]
[Sat Jul 18 23:52:21.534699 2026] [security2:error] [pid 983601:tid 983812] [client 74.208.214.194:45662] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxmFVaztLkF4ZwQhXL1EQAAANY"]
[Sat Jul 18 23:52:21.841520 2026] [security2:error] [pid 983601:tid 983798] [client 4.194.24.143:18098] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/s.php"] [unique_id "alxmFVaztLkF4ZwQhXL1IgAAAMg"]
[Sat Jul 18 23:52:21.986610 2026] [security2:error] [pid 983601:tid 983840] [client 45.134.20.128:37847] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "alxmFVaztLkF4ZwQhXL1NQAAAPI"]
[Sat Jul 18 23:52:22.301022 2026] [security2:error] [pid 983601:tid 983791] [client 185.132.186.38:33959] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 38.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-l0gin.php"] [unique_id "alxmFlaztLkF4ZwQhXL1PwAAAME"]
[Sat Jul 18 23:52:22.403574 2026] [security2:error] [pid 983601:tid 983804] [client 4.194.24.143:23217] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/sang.php"] [unique_id "alxmFlaztLkF4ZwQhXL1RgAAAM4"]
[Sat Jul 18 23:52:22.615475 2026] [security2:error] [pid 983601:tid 983823] [client 20.230.87.222:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 222.87.230.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.yidaiyi.org"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "alxmFlaztLkF4ZwQhXL1UAAAAOE"]
[Sat Jul 18 23:52:22.615552 2026] [security2:error] [pid 983601:tid 983823] [client 20.230.87.222:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.yidaiyi.org"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "alxmFlaztLkF4ZwQhXL1UAAAAOE"]
[Sat Jul 18 23:52:22.843232 2026] [security2:error] [pid 983601:tid 983744] [client 45.134.20.121:49119] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 121.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/Text/options.php"] [unique_id "alxmFlaztLkF4ZwQhXL1YAAAAJI"]
[Sat Jul 18 23:52:22.953481 2026] [security2:error] [pid 983601:tid 983846] [client 4.194.24.143:23201] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/scxy.php"] [unique_id "alxmFlaztLkF4ZwQhXL1aAAAAPg"]
[Sat Jul 18 23:52:23.219680 2026] [security2:error] [pid 983601:tid 983785] [client 185.132.186.46:56691] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 46.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "alxmF1aztLkF4ZwQhXL1eAAAALs"]
[Sat Jul 18 23:52:23.258540 2026] [security2:error] [pid 983601:tid 983653] [remote 41.186.86.12:31618] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "kpb.qlr.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxmF1aztLkF4ZwQhXL1fQAAizM"]
[Sat Jul 18 23:52:23.520883 2026] [security2:error] [pid 983601:tid 983842] [client 4.194.24.143:23203] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/sd.php"] [unique_id "alxmF1aztLkF4ZwQhXL1jgAAAPQ"]
[Sat Jul 18 23:52:23.710086 2026] [security2:error] [pid 983601:tid 983738] [client 45.134.20.115:57935] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/acme-challenge/wp-load.php"] [unique_id "alxmF1aztLkF4ZwQhXL1nQAAAIw"]
[Sat Jul 18 23:52:23.750050 2026] [security2:error] [pid 983601:tid 983649] [remote 41.186.86.12:31618] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "kpb.qlr.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxmF1aztLkF4ZwQhXL1oAAAui8"], referer: https://kpb.qlr.mybluehost.me/wp-login.php
[Sat Jul 18 23:52:24.064356 2026] [security2:error] [pid 983601:tid 983840] [client 4.194.24.143:18055] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/sf.php"] [unique_id "alxmGFaztLkF4ZwQhXL1ugAAAPI"]
[Sat Jul 18 23:52:24.124896 2026] [security2:error] [pid 983601:tid 983856] [client 185.132.186.16:58633] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 16.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/new.php"] [unique_id "alxmGFaztLkF4ZwQhXL1vwAAAQI"]
[Sat Jul 18 23:52:24.409930 2026] [security2:error] [pid 983601:tid 983733] [client 36.83.95.75:57050] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmGFaztLkF4ZwQhXL1yAAAAIc"]
[Sat Jul 18 23:52:24.410032 2026] [security2:error] [pid 983601:tid 983733] [client 36.83.95.75:57050] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmGFaztLkF4ZwQhXL1yAAAAIc"]
[Sat Jul 18 23:52:24.568535 2026] [security2:error] [pid 983601:tid 983752] [client 45.134.20.127:62159] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 127.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/upgrade/cc.php"] [unique_id "alxmGFaztLkF4ZwQhXL11wAAAJo"]
[Sat Jul 18 23:52:24.605473 2026] [security2:error] [pid 983601:tid 983818] [client 4.194.24.143:42210] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/shell.php"] [unique_id "alxmGFaztLkF4ZwQhXL12wAAANw"]
[Sat Jul 18 23:52:24.936998 2026] [security2:error] [pid 983601:tid 983791] [client 50.116.65.227:55318] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "learnthissecret.com"] [uri "/index.php"] [unique_id "alxmGFaztLkF4ZwQhXL14wAAAME"]
[Sat Jul 18 23:52:25.016302 2026] [security2:error] [pid 983601:tid 983762] [client 185.132.186.27:34819] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/plugins/pwnd-1/admin.php"] [unique_id "alxmGVaztLkF4ZwQhXL1_wAAAKQ"]
[Sat Jul 18 23:52:25.046351 2026] [security2:error] [pid 983601:tid 983724] [remote 68.178.160.25:54986] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "secretkeynumerology.com"] [uri "/wp-login.php"] [unique_id "alxmGVaztLkF4ZwQhXL2AAAAwno"]
[Sat Jul 18 23:52:25.106442 2026] [security2:error] [pid 983601:tid 983776] [client 180.252.198.240:52236] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmGVaztLkF4ZwQhXL2CAAAALI"]
[Sat Jul 18 23:52:25.106655 2026] [security2:error] [pid 983601:tid 983776] [client 180.252.198.240:52236] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmGVaztLkF4ZwQhXL2CAAAALI"]
[Sat Jul 18 23:52:25.157382 2026] [security2:error] [pid 983601:tid 983840] [client 34.172.185.49:27108] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "adastra.love"] [uri "/wp-json/batch/v1"] [unique_id "alxmGVaztLkF4ZwQhXL2DgAAAPI"]
[Sat Jul 18 23:52:25.219250 2026] [security2:error] [pid 983601:tid 983740] [client 50.116.65.227:55334] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "learnthissecret.com"] [uri "/index.php"] [unique_id "alxmGFaztLkF4ZwQhXL1-QAAAI4"]
[Sat Jul 18 23:52:25.339581 2026] [security2:error] [pid 983601:tid 983839] [client 4.194.24.143:42231] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/sid3.php"] [unique_id "alxmGVaztLkF4ZwQhXL2FwAAAPE"]
[Sat Jul 18 23:52:25.431063 2026] [security2:error] [pid 983601:tid 983808] [client 45.134.20.124:26053] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 124.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/aahana/worksec.php"] [unique_id "alxmGVaztLkF4ZwQhXL2GgAAANI"]
[Sat Jul 18 23:52:25.456397 2026] [security2:error] [pid 983601:tid 983621] [remote 68.178.160.25:54986] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "secretkeynumerology.com"] [uri "/wp-login.php"] [unique_id "alxmGVaztLkF4ZwQhXL2GwAA2xM"], referer: https://secretkeynumerology.com/wp-login.php
[Sat Jul 18 23:52:25.651692 2026] [security2:error] [pid 983601:tid 983804] [client 34.172.185.49:27108] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "adastra.love"] [uri "/"] [unique_id "alxmGVaztLkF4ZwQhXL2KQAAAM4"]
[Sat Jul 18 23:52:25.880630 2026] [security2:error] [pid 983601:tid 983852] [client 4.194.24.143:23231] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/simple.php"] [unique_id "alxmGVaztLkF4ZwQhXL2OAAAAP4"]
[Sat Jul 18 23:52:25.906871 2026] [security2:error] [pid 983601:tid 983831] [client 185.132.186.21:42981] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 21.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/defaults.php"] [unique_id "alxmGVaztLkF4ZwQhXL2OQAAAOk"]
[Sat Jul 18 23:52:25.956127 2026] [security2:error] [pid 983601:tid 983687] [remote 54.90.74.5:38368] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.74.90.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "jndsupport.com"] [uri "/app/etc/env.php"] [unique_id "alxmGVaztLkF4ZwQhXL2QQAA_VU"]
[Sat Jul 18 23:52:26.337554 2026] [security2:error] [pid 983601:tid 983760] [client 45.134.20.123:56771] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 123.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "alxmGlaztLkF4ZwQhXL2WwAAAKI"]
[Sat Jul 18 23:52:26.575521 2026] [security2:error] [pid 983601:tid 983807] [client 4.194.24.143:18253] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/sitemap.php"] [unique_id "alxmGlaztLkF4ZwQhXL2aAAAANE"]
[Sat Jul 18 23:52:26.774010 2026] [security2:error] [pid 983601:tid 983768] [client 103.160.26.178:60914] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmGlaztLkF4ZwQhXL2dwAAAKo"]
[Sat Jul 18 23:52:26.774086 2026] [security2:error] [pid 983601:tid 983768] [client 103.160.26.178:60914] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmGlaztLkF4ZwQhXL2dwAAAKo"]
[Sat Jul 18 23:52:26.807895 2026] [security2:error] [pid 983601:tid 983824] [client 185.132.186.14:29029] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/images/DJP9.php"] [unique_id "alxmGlaztLkF4ZwQhXL2fQAAAOI"]
[Sat Jul 18 23:52:27.042924 2026] [proxy:error] [pid 983601:tid 983770] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:52:27.042958 2026] [proxy_http:error] [pid 983601:tid 983770] [client 78.17.70.17:47910] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:52:27.043434 2026] [proxy:error] [pid 983601:tid 983770] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:52:27.043465 2026] [proxy_http:error] [pid 983601:tid 983770] [client 78.17.70.17:47910] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:52:27.117195 2026] [security2:error] [pid 983601:tid 983843] [client 4.194.24.143:23211] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/size.php"] [unique_id "alxmG1aztLkF4ZwQhXL2kQAAAPU"]
[Sat Jul 18 23:52:27.191079 2026] [security2:error] [pid 983601:tid 983856] [client 45.134.20.126:23243] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 126.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/includes/class_api.php"] [unique_id "alxmG1aztLkF4ZwQhXL2ngAAAQI"]
[Sat Jul 18 23:52:27.629323 2026] [security2:error] [pid 983601:tid 983743] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmG1aztLkF4ZwQhXL2rAAAAJE"]
[Sat Jul 18 23:52:27.673308 2026] [security2:error] [pid 983601:tid 983800] [client 4.194.24.143:42227] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/sm.php"] [unique_id "alxmG1aztLkF4ZwQhXL2uwAAAMo"]
[Sat Jul 18 23:52:27.707350 2026] [security2:error] [pid 983601:tid 983832] [client 185.132.186.34:62791] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 34.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/customize/index.php"] [unique_id "alxmG1aztLkF4ZwQhXL2wAAAAOo"]
[Sat Jul 18 23:52:28.048377 2026] [security2:error] [pid 983601:tid 983826] [client 45.134.20.105:47263] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/plugins/content/apismtp/apismtp.php"] [unique_id "alxmHFaztLkF4ZwQhXL20AAAAOQ"]
[Sat Jul 18 23:52:28.217001 2026] [security2:error] [pid 983601:tid 983829] [client 4.194.24.143:31228] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/sql.php"] [unique_id "alxmHFaztLkF4ZwQhXL24QAAAOc"]
[Sat Jul 18 23:52:28.324087 2026] [security2:error] [pid 983601:tid 983647] [remote 68.178.160.25:47792] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/wp-login.php"] [unique_id "alxmHFaztLkF4ZwQhXL26wAAtC0"]
[Sat Jul 18 23:52:28.607021 2026] [security2:error] [pid 983601:tid 983751] [client 185.132.186.46:37911] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 46.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/shell20211028.php"] [unique_id "alxmHFaztLkF4ZwQhXL29AAAAJk"]
[Sat Jul 18 23:52:28.766866 2026] [security2:error] [pid 983601:tid 983636] [remote 68.178.160.25:47792] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "ghivs.com"] [uri "/wp-login.php"] [unique_id "alxmHFaztLkF4ZwQhXL3CgAArSI"], referer: https://ghivs.com/wp-login.php
[Sat Jul 18 23:52:28.788943 2026] [security2:error] [pid 983601:tid 983841] [client 4.194.24.143:23216] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/ss.php"] [unique_id "alxmHFaztLkF4ZwQhXL3DwAAAPM"]
[Sat Jul 18 23:52:28.900264 2026] [security2:error] [pid 983601:tid 983758] [client 45.134.20.129:53675] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/includes/class-core-upgrader-first.php"] [unique_id "alxmHFaztLkF4ZwQhXL3GAAAAKA"]
[Sat Jul 18 23:52:28.902828 2026] [security2:error] [pid 983601:tid 983844] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmHFaztLkF4ZwQhXL3AwAAAPY"]
[Sat Jul 18 23:52:28.985829 2026] [security2:error] [pid 983601:tid 983782] [client 20.230.87.222:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 222.87.230.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.yidaiyi.org"] [uri "/.well-knownold/inputs.php"] [unique_id "alxmHFaztLkF4ZwQhXL3GwAAALg"]
[Sat Jul 18 23:52:28.985922 2026] [security2:error] [pid 983601:tid 983782] [client 20.230.87.222:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.yidaiyi.org"] [uri "/.well-knownold/inputs.php"] [unique_id "alxmHFaztLkF4ZwQhXL3GwAAALg"]
[Sat Jul 18 23:52:29.080684 2026] [proxy:error] [pid 983601:tid 983733] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:52:29.080745 2026] [proxy_http:error] [pid 983601:tid 983733] [client 78.17.70.17:47920] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:52:29.081214 2026] [proxy:error] [pid 983601:tid 983733] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:52:29.081241 2026] [proxy_http:error] [pid 983601:tid 983733] [client 78.17.70.17:47920] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:52:29.337934 2026] [security2:error] [pid 983601:tid 983851] [client 4.194.24.143:18261] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/stats.php"] [unique_id "alxmHVaztLkF4ZwQhXL3MQAAAP0"]
[Sat Jul 18 23:52:29.478018 2026] [security2:error] [pid 983601:tid 983845] [client 195.161.41.115:44832] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.41.161.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "areitoproducciones.com"] [uri "/blog/xmlrpc.php"] [unique_id "alxmHVaztLkF4ZwQhXL3OQAAAPc"]
[Sat Jul 18 23:52:29.478118 2026] [security2:error] [pid 983601:tid 983845] [client 195.161.41.115:44832] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "areitoproducciones.com"] [uri "/blog/xmlrpc.php"] [unique_id "alxmHVaztLkF4ZwQhXL3OQAAAPc"]
[Sat Jul 18 23:52:29.499243 2026] [security2:error] [pid 983601:tid 983801] [client 185.132.186.30:42479] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 30.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/natural.php"] [unique_id "alxmHVaztLkF4ZwQhXL3PAAAAMs"]
[Sat Jul 18 23:52:29.759969 2026] [security2:error] [pid 983601:tid 983739] [client 45.134.20.108:28377] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/wp-css.php"] [unique_id "alxmHVaztLkF4ZwQhXL3TQAAAI0"]
[Sat Jul 18 23:52:29.896996 2026] [security2:error] [pid 983601:tid 983738] [client 4.194.24.143:42228] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/sump1.php"] [unique_id "alxmHVaztLkF4ZwQhXL3VgAAAIw"]
[Sat Jul 18 23:52:30.054526 2026] [security2:error] [pid 983601:tid 983778] [client 195.161.41.115:44842] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.41.161.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "areitoproducciones.com"] [uri "/wordpress/xmlrpc.php"] [unique_id "alxmHlaztLkF4ZwQhXL3XAAAALQ"]
[Sat Jul 18 23:52:30.054637 2026] [security2:error] [pid 983601:tid 983778] [client 195.161.41.115:44842] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "areitoproducciones.com"] [uri "/wordpress/xmlrpc.php"] [unique_id "alxmHlaztLkF4ZwQhXL3XAAAALQ"]
[Sat Jul 18 23:52:30.385160 2026] [security2:error] [pid 983601:tid 983769] [client 34.172.185.49:27108] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "adastra.love"] [uri "/index.php"] [unique_id "alxmG1aztLkF4ZwQhXL2uAAAAKs"], referer: http://adastra.love/wp-json/batch/v1
[Sat Jul 18 23:52:30.401303 2026] [security2:error] [pid 983601:tid 983829] [client 185.132.186.7:57565] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 7.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/item.php"] [unique_id "alxmHlaztLkF4ZwQhXL3eQAAAOc"]
[Sat Jul 18 23:52:30.472939 2026] [security2:error] [pid 983601:tid 983822] [client 4.194.24.143:18066] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/system.php"] [unique_id "alxmHlaztLkF4ZwQhXL3fQAAAOA"]
[Sat Jul 18 23:52:30.619097 2026] [security2:error] [pid 983601:tid 983790] [client 195.161.41.115:44852] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.41.161.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "areitoproducciones.com"] [uri "/news/xmlrpc.php"] [unique_id "alxmHlaztLkF4ZwQhXL3hQAAAMA"]
[Sat Jul 18 23:52:30.619190 2026] [security2:error] [pid 983601:tid 983790] [client 195.161.41.115:44852] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "areitoproducciones.com"] [uri "/news/xmlrpc.php"] [unique_id "alxmHlaztLkF4ZwQhXL3hQAAAMA"]
[Sat Jul 18 23:52:30.622520 2026] [security2:error] [pid 983601:tid 983796] [client 45.134.20.139:50487] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 139.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/IXR/goto.php"] [unique_id "alxmHlaztLkF4ZwQhXL3hwAAAMY"]
[Sat Jul 18 23:52:31.017915 2026] [security2:error] [pid 983601:tid 983821] [client 4.194.24.143:18067] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/system/03n1hob7p03r2npdefault.php"] [unique_id "alxmH1aztLkF4ZwQhXL3mwAAAN8"]
[Sat Jul 18 23:52:31.179906 2026] [security2:error] [pid 983601:tid 983740] [client 195.161.41.115:44862] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.41.161.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "areitoproducciones.com"] [uri "/main/xmlrpc.php"] [unique_id "alxmH1aztLkF4ZwQhXL3pAAAAI4"]
[Sat Jul 18 23:52:31.179990 2026] [security2:error] [pid 983601:tid 983740] [client 195.161.41.115:44862] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "areitoproducciones.com"] [uri "/main/xmlrpc.php"] [unique_id "alxmH1aztLkF4ZwQhXL3pAAAAI4"]
[Sat Jul 18 23:52:31.331444 2026] [security2:error] [pid 983601:tid 983807] [client 185.132.186.15:57753] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 15.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/function/function.php"] [unique_id "alxmH1aztLkF4ZwQhXL3sQAAANE"]
[Sat Jul 18 23:52:31.461839 2026] [security2:error] [pid 983601:tid 983758] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmH1aztLkF4ZwQhXL3rwAAAKA"]
[Sat Jul 18 23:52:31.479329 2026] [security2:error] [pid 983601:tid 983798] [client 45.134.20.122:44643] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/blue/xboom.php"] [unique_id "alxmH1aztLkF4ZwQhXL3yQAAAMg"]
[Sat Jul 18 23:52:31.591812 2026] [security2:error] [pid 983601:tid 983739] [client 4.194.24.143:42209] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/system/cj5ha2rah8lyiqqdefault.php"] [unique_id "alxmH1aztLkF4ZwQhXL3zwAAAI0"]
[Sat Jul 18 23:52:31.739336 2026] [security2:error] [pid 983601:tid 983817] [client 195.161.41.115:44868] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.41.161.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "areitoproducciones.com"] [uri "/cms/xmlrpc.php"] [unique_id "alxmH1aztLkF4ZwQhXL32QAAANs"]
[Sat Jul 18 23:52:31.739418 2026] [security2:error] [pid 983601:tid 983817] [client 195.161.41.115:44868] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "areitoproducciones.com"] [uri "/cms/xmlrpc.php"] [unique_id "alxmH1aztLkF4ZwQhXL32QAAANs"]
[Sat Jul 18 23:52:31.943818 2026] [security2:error] [pid 983601:tid 983720] [remote 72.167.132.114:46178] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxmH1aztLkF4ZwQhXL38gAAqnY"]
[Sat Jul 18 23:52:31.992615 2026] [proxy:error] [pid 983601:tid 983839] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:52:31.992719 2026] [proxy_http:error] [pid 983601:tid 983839] [client 78.17.70.17:6104] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:52:31.993963 2026] [proxy:error] [pid 983601:tid 983839] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:52:31.994018 2026] [proxy_http:error] [pid 983601:tid 983839] [client 78.17.70.17:6104] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:52:32.165356 2026] [security2:error] [pid 983601:tid 983738] [client 4.194.24.143:28056] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/system_log.php"] [unique_id "alxmIFaztLkF4ZwQhXL3_wAAAIw"]
[Sat Jul 18 23:52:32.232931 2026] [security2:error] [pid 983601:tid 983765] [client 185.132.186.48:57817] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 48.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "alxmIFaztLkF4ZwQhXL4BAAAAKc"]
[Sat Jul 18 23:52:32.274704 2026] [security2:error] [pid 983601:tid 983842] [client 57.141.18.2:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxmIFaztLkF4ZwQhXL3-QAAAPQ"]
[Sat Jul 18 23:52:32.299396 2026] [security2:error] [pid 983601:tid 983737] [client 195.161.41.115:44870] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.41.161.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "areitoproducciones.com"] [uri "/wpsite/xmlrpc.php"] [unique_id "alxmIFaztLkF4ZwQhXL4CgAAAIs"]
[Sat Jul 18 23:52:32.299481 2026] [security2:error] [pid 983601:tid 983737] [client 195.161.41.115:44870] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "areitoproducciones.com"] [uri "/wpsite/xmlrpc.php"] [unique_id "alxmIFaztLkF4ZwQhXL4CgAAAIs"]
[Sat Jul 18 23:52:32.335672 2026] [security2:error] [pid 983601:tid 983792] [client 45.134.20.112:26259] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 112.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/kadence/functions.php"] [unique_id "alxmIFaztLkF4ZwQhXL4DgAAAMI"]
[Sat Jul 18 23:52:32.715396 2026] [security2:error] [pid 983601:tid 983852] [client 4.194.24.143:17914] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/t.php"] [unique_id "alxmIFaztLkF4ZwQhXL4LAAAAP4"]
[Sat Jul 18 23:52:32.717914 2026] [security2:error] [pid 983601:tid 983769] [client 138.252.89.100:60739] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmIFaztLkF4ZwQhXL4LQAAAKs"]
[Sat Jul 18 23:52:32.718015 2026] [security2:error] [pid 983601:tid 983769] [client 138.252.89.100:60739] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmIFaztLkF4ZwQhXL4LQAAAKs"]
[Sat Jul 18 23:52:32.863765 2026] [security2:error] [pid 983601:tid 983805] [client 195.161.41.115:44886] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.41.161.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "areitoproducciones.com"] [uri "/old/xmlrpc.php"] [unique_id "alxmIFaztLkF4ZwQhXL4PAAAAM8"]
[Sat Jul 18 23:52:32.863878 2026] [security2:error] [pid 983601:tid 983805] [client 195.161.41.115:44886] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "areitoproducciones.com"] [uri "/old/xmlrpc.php"] [unique_id "alxmIFaztLkF4ZwQhXL4PAAAAM8"]
[Sat Jul 18 23:52:33.166251 2026] [security2:error] [pid 983601:tid 983858] [client 185.132.186.16:60537] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 16.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/images/admin.php"] [unique_id "alxmIVaztLkF4ZwQhXL4UQAAAQQ"]
[Sat Jul 18 23:52:33.200913 2026] [security2:error] [pid 983601:tid 983790] [client 45.134.20.121:53221] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 121.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/Sanskrit.php"] [unique_id "alxmIVaztLkF4ZwQhXL4UwAAAMA"]
[Sat Jul 18 23:52:33.240004 2026] [security2:error] [pid 983601:tid 983812] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmIVaztLkF4ZwQhXL4SwAAANY"]
[Sat Jul 18 23:52:33.260180 2026] [security2:error] [pid 983601:tid 983849] [client 4.194.24.143:25752] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/term.php"] [unique_id "alxmIVaztLkF4ZwQhXL4WwAAAPs"]
[Sat Jul 18 23:52:33.424900 2026] [security2:error] [pid 983601:tid 983835] [client 195.161.41.115:44896] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.41.161.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "areitoproducciones.com"] [uri "/new/xmlrpc.php"] [unique_id "alxmIVaztLkF4ZwQhXL4ZQAAAO0"]
[Sat Jul 18 23:52:33.424987 2026] [security2:error] [pid 983601:tid 983835] [client 195.161.41.115:44896] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "areitoproducciones.com"] [uri "/new/xmlrpc.php"] [unique_id "alxmIVaztLkF4ZwQhXL4ZQAAAO0"]
[Sat Jul 18 23:52:33.761029 2026] [security2:error] [pid 983601:tid 983822] [client 47.128.16.96:21010] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "locketsandcharms.com"] [uri "/robots.txt"] [unique_id "alxmIVaztLkF4ZwQhXL4fQAAAOA"]
[Sat Jul 18 23:52:33.863005 2026] [security2:error] [pid 983601:tid 983837] [client 4.194.24.143:42176] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/test.php"] [unique_id "alxmIVaztLkF4ZwQhXL4hwAAAO8"]
[Sat Jul 18 23:52:34.057671 2026] [security2:error] [pid 983601:tid 983770] [client 45.134.20.131:23447] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-fmfile.php"] [unique_id "alxmIlaztLkF4ZwQhXL4nwAAAKw"]
[Sat Jul 18 23:52:34.078691 2026] [security2:error] [pid 983601:tid 983786] [client 185.132.186.9:45987] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "alxmIlaztLkF4ZwQhXL4oAAAALw"]
[Sat Jul 18 23:52:34.230464 2026] [security2:error] [pid 983601:tid 983681] [remote 31.42.184.154:36154] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "fiq.jjc.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxmIlaztLkF4ZwQhXL4sAABA08"]
[Sat Jul 18 23:52:34.404518 2026] [security2:error] [pid 983601:tid 983787] [client 4.194.24.143:28091] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/test1.php"] [unique_id "alxmIlaztLkF4ZwQhXL4vAAAAL0"]
[Sat Jul 18 23:52:34.557954 2026] [security2:error] [pid 983601:tid 983672] [remote 72.167.132.114:46178] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.132.167.72.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxmIlaztLkF4ZwQhXL4yQAAkUY"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:52:34.575109 2026] [security2:error] [pid 983601:tid 983699] [remote 31.42.184.154:36154] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "fiq.jjc.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxmIlaztLkF4ZwQhXL4zQAA-mE"], referer: https://fiq.jjc.mybluehost.me/wp-login.php
[Sat Jul 18 23:52:34.911517 2026] [security2:error] [pid 983601:tid 983838] [client 45.134.20.137:58335] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 137.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.trash7309/index.php"] [unique_id "alxmIlaztLkF4ZwQhXL45QAAAPA"]
[Sat Jul 18 23:52:34.952911 2026] [security2:error] [pid 983601:tid 983794] [client 4.194.24.143:31207] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/tfm.php"] [unique_id "alxmIlaztLkF4ZwQhXL46QAAAMQ"]
[Sat Jul 18 23:52:34.968902 2026] [security2:error] [pid 983601:tid 983801] [client 185.132.186.14:22559] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/about/function.php"] [unique_id "alxmIlaztLkF4ZwQhXL46gAAAMs"]
[Sat Jul 18 23:52:35.143833 2026] [security2:error] [pid 983601:tid 983844] [client 34.90.238.78:16384] ModSecurity: Access denied with code 406 (phase 1). Match of "rx ^/llms.txt" against "REQUEST_URI" required. [file "/opt/mod_security/hg_rules.conf"] [line "588"] [id "999814"] [msg "Misbehaving AI Crawler"] [hostname "steadfastwolfproductions.com"] [uri "/"] [unique_id "alxmI1aztLkF4ZwQhXL5AgAAAPY"]
[Sat Jul 18 23:52:35.143931 2026] [security2:error] [pid 983601:tid 983844] [client 34.90.238.78:16384] ModSecurity: Warning. Matched phrase "Scrapy" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "steadfastwolfproductions.com"] [uri "/"] [unique_id "alxmI1aztLkF4ZwQhXL5AgAAAPY"]
[Sat Jul 18 23:52:35.213065 2026] [security2:error] [pid 983601:tid 983821] [client 36.83.95.75:57551] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmI1aztLkF4ZwQhXL5BQAAAN8"]
[Sat Jul 18 23:52:35.213226 2026] [security2:error] [pid 983601:tid 983821] [client 36.83.95.75:57551] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmI1aztLkF4ZwQhXL5BQAAAN8"]
[Sat Jul 18 23:52:35.240377 2026] [security2:error] [pid 983601:tid 983824] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmI1aztLkF4ZwQhXL49AAAAOI"]
[Sat Jul 18 23:52:35.504791 2026] [security2:error] [pid 983601:tid 983815] [client 4.194.24.143:42191] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/thebe.php"] [unique_id "alxmI1aztLkF4ZwQhXL5FQAAANk"]
[Sat Jul 18 23:52:35.766678 2026] [security2:error] [pid 983601:tid 983834] [client 45.134.20.104:64039] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/revslider/includes/external/page/index.php"] [unique_id "alxmI1aztLkF4ZwQhXL5KwAAAOw"]
[Sat Jul 18 23:52:35.864289 2026] [security2:error] [pid 983601:tid 983774] [client 185.132.186.29:43171] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 29.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "alxmI1aztLkF4ZwQhXL5MwAAALA"]
[Sat Jul 18 23:52:35.973449 2026] [security2:error] [pid 983601:tid 983825] [client 195.161.41.115:44906] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.41.161.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "areitoproducciones.com"] [uri "/wp-login.php"] [unique_id "alxmI1aztLkF4ZwQhXL5OgAAAOM"], referer: https://areitoproducciones.com/wp-admin/
[Sat Jul 18 23:52:36.100314 2026] [security2:error] [pid 983601:tid 983784] [client 4.194.24.143:18101] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/themes.php"] [unique_id "alxmJFaztLkF4ZwQhXL5QgAAALo"]
[Sat Jul 18 23:52:36.352059 2026] [security2:error] [pid 983601:tid 983811] [client 216.244.66.226:34498] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "allandbeckson.com"] [uri "/robots.txt"] [unique_id "alxmJFaztLkF4ZwQhXL5XAAAANU"]
[Sat Jul 18 23:52:36.352225 2026] [security2:error] [pid 983601:tid 983811] [client 216.244.66.226:34498] ModSecurity: Warning. Matched phrase "Dotbot" at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "allandbeckson.com"] [uri "/robots.txt"] [unique_id "alxmJFaztLkF4ZwQhXL5XAAAANU"]
[Sat Jul 18 23:52:36.532421 2026] [security2:error] [pid 983601:tid 983827] [client 195.161.41.115:44920] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.41.161.195.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "areitoproducciones.com"] [uri "/wp-login.php"] [unique_id "alxmJFaztLkF4ZwQhXL5aAAAAOU"]
[Sat Jul 18 23:52:36.635794 2026] [security2:error] [pid 983601:tid 983849] [client 45.134.20.129:33599] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/ioxi/ioxi/dropdown.php"] [unique_id "alxmJFaztLkF4ZwQhXL5cQAAAPs"]
[Sat Jul 18 23:52:36.645573 2026] [security2:error] [pid 983601:tid 983843] [client 4.194.24.143:17877] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/tiny.php"] [unique_id "alxmJFaztLkF4ZwQhXL5cwAAAPU"]
[Sat Jul 18 23:52:36.670477 2026] [security2:error] [pid 983601:tid 983832] [client 180.252.198.240:52748] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmJFaztLkF4ZwQhXL5eQAAAOo"]
[Sat Jul 18 23:52:36.670590 2026] [security2:error] [pid 983601:tid 983832] [client 180.252.198.240:52748] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmJFaztLkF4ZwQhXL5eQAAAOo"]
[Sat Jul 18 23:52:36.758514 2026] [security2:error] [pid 983601:tid 983759] [client 185.132.186.39:46813] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 39.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "alxmJFaztLkF4ZwQhXL5fQAAAKE"]
[Sat Jul 18 23:52:37.239134 2026] [security2:error] [pid 983601:tid 983783] [client 4.194.24.143:17891] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "genesismbs.com"] [uri "/tmp/byp.php"] [unique_id "alxmJVaztLkF4ZwQhXL5nQAAALk"]
[Sat Jul 18 23:52:37.493807 2026] [security2:error] [pid 983601:tid 983762] [client 45.134.20.120:39741] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 120.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/memberfuns.php"] [unique_id "alxmJVaztLkF4ZwQhXL5rgAAAKQ"]
[Sat Jul 18 23:52:37.575977 2026] [security2:error] [pid 983601:tid 983829] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmJVaztLkF4ZwQhXL5pgAAAOc"]
[Sat Jul 18 23:52:37.662708 2026] [security2:error] [pid 983601:tid 983826] [client 185.132.186.17:45407] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "alxmJVaztLkF4ZwQhXL5twAAAOQ"]
[Sat Jul 18 23:52:37.971710 2026] [security2:error] [pid 983601:tid 983768] [client 13.206.204.243:34216] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "155"] [id "900406"] [msg "wp-login POST logging"] [data "200"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxmJVaztLkF4ZwQhXL5qAAAAKo"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:52:38.353633 2026] [security2:error] [pid 983601:tid 983779] [client 45.134.20.108:31683] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/infos.php"] [unique_id "alxmJlaztLkF4ZwQhXL56gAAALU"]
[Sat Jul 18 23:52:38.401921 2026] [security2:error] [pid 983601:tid 983785] [client 103.160.26.178:61444] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmJlaztLkF4ZwQhXL57AAAALs"]
[Sat Jul 18 23:52:38.402036 2026] [security2:error] [pid 983601:tid 983785] [client 103.160.26.178:61444] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmJlaztLkF4ZwQhXL57AAAALs"]
[Sat Jul 18 23:52:38.556500 2026] [security2:error] [pid 983601:tid 983763] [client 42.116.177.73:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.mezzacraft.com"] [uri "/index.php"] [unique_id "alxmJFaztLkF4ZwQhXL5hQAAAKU"]
[Sat Jul 18 23:52:38.557128 2026] [security2:error] [pid 983601:tid 983769] [client 185.132.186.48:56947] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 48.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/languages/404.php"] [unique_id "alxmJlaztLkF4ZwQhXL57wAAAKs"]
[Sat Jul 18 23:52:38.825014 2026] [security2:error] [pid 983601:tid 983815] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmJlaztLkF4ZwQhXL5-AAAANk"]
[Sat Jul 18 23:52:39.217289 2026] [security2:error] [pid 983601:tid 983838] [client 45.134.20.115:44483] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/modules/file.php"] [unique_id "alxmJ1aztLkF4ZwQhXL6HAAAAPA"]
[Sat Jul 18 23:52:39.456423 2026] [security2:error] [pid 983601:tid 983831] [client 185.132.186.37:55973] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 37.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/update/403.php"] [unique_id "alxmJ1aztLkF4ZwQhXL6MQAAAOk"]
[Sat Jul 18 23:52:39.993906 2026] [proxy:error] [pid 983601:tid 983760] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:52:39.993977 2026] [proxy_http:error] [pid 983601:tid 983760] [client 193.47.62.168:35554] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:52:39.994502 2026] [proxy:error] [pid 983601:tid 983760] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:52:39.994527 2026] [proxy_http:error] [pid 983601:tid 983760] [client 193.47.62.168:35554] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:52:40.089164 2026] [security2:error] [pid 983601:tid 983739] [client 45.134.20.117:50811] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/x.php"] [unique_id "alxmKFaztLkF4ZwQhXL6WgAAAI0"]
[Sat Jul 18 23:52:40.122080 2026] [security2:error] [pid 983601:tid 983822] [client 74.208.214.194:51670] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxmKFaztLkF4ZwQhXL6WwAAAOA"]
[Sat Jul 18 23:52:40.315173 2026] [security2:error] [pid 983601:tid 983631] [remote 47.128.99.30:28588] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "adambergeron.com"] [uri "/www-estrelabet-2024-01-24-id-38923.pdf"] [unique_id "alxmKFaztLkF4ZwQhXL6ZwAA5h0"]
[Sat Jul 18 23:52:40.352835 2026] [security2:error] [pid 983601:tid 983784] [client 185.132.186.10:26787] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/default.php"] [unique_id "alxmKFaztLkF4ZwQhXL6agAAALo"]
[Sat Jul 18 23:52:40.574088 2026] [security2:error] [pid 983601:tid 983761] [client 139.167.225.146:62747] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxmKFaztLkF4ZwQhXL6fgAAAKM"]
[Sat Jul 18 23:52:40.574200 2026] [security2:error] [pid 983601:tid 983761] [client 139.167.225.146:62747] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxmKFaztLkF4ZwQhXL6fgAAAKM"]
[Sat Jul 18 23:52:40.659054 2026] [security2:error] [pid 983601:tid 983802] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmKFaztLkF4ZwQhXL6dwAAAMw"]
[Sat Jul 18 23:52:40.788174 2026] [security2:error] [pid 983601:tid 983713] [remote 104.131.116.82:54528] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.116.131.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thestudioatfruitland.com"] [uri "/wp-login.php"] [unique_id "alxmKFaztLkF4ZwQhXL6jAAAtm8"]
[Sat Jul 18 23:52:40.946496 2026] [security2:error] [pid 983601:tid 983726] [remote 104.131.116.82:54528] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 82.116.131.104.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thestudioatfruitland.com"] [uri "/wp-login.php"] [unique_id "alxmKFaztLkF4ZwQhXL6mgAA7Xw"], referer: https://thestudioatfruitland.com/wp-login.php
[Sat Jul 18 23:52:40.949241 2026] [security2:error] [pid 983601:tid 983812] [client 45.134.20.126:64829] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 126.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/wp.php"] [unique_id "alxmKFaztLkF4ZwQhXL6mwAAANY"]
[Sat Jul 18 23:52:41.084391 2026] [security2:error] [pid 983601:tid 983630] [remote 98.70.32.248:50556] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.32.70.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.walkingandtalking.net"] [uri "/wp-login.php"] [unique_id "alxmKVaztLkF4ZwQhXL6ngAAtBw"]
[Sat Jul 18 23:52:41.197989 2026] [security2:error] [pid 983601:tid 983817] [client 20.230.87.222:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 222.87.230.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.yidaiyi.org"] [uri "/wp-content/plugins/seoplugins/mar.php"] [unique_id "alxmKVaztLkF4ZwQhXL6qQAAANs"]
[Sat Jul 18 23:52:41.198091 2026] [security2:error] [pid 983601:tid 983817] [client 20.230.87.222:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.yidaiyi.org"] [uri "/wp-content/plugins/seoplugins/mar.php"] [unique_id "alxmKVaztLkF4ZwQhXL6qQAAANs"]
[Sat Jul 18 23:52:41.248309 2026] [security2:error] [pid 983601:tid 983857] [client 185.132.186.35:26579] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 35.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/assets/info.php"] [unique_id "alxmKVaztLkF4ZwQhXL6rAAAAQM"]
[Sat Jul 18 23:52:41.397289 2026] [security2:error] [pid 983601:tid 983722] [remote 54.90.74.5:35390] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "web.config"] [severity "CRITICAL"] [hostname "jndsupport.com"] [uri "/web.config"] [unique_id "alxmKVaztLkF4ZwQhXL6ugAAmng"]
[Sat Jul 18 23:52:41.803148 2026] [security2:error] [pid 983601:tid 983820] [client 45.134.20.107:22237] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 107.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/options-writing.php"] [unique_id "alxmKVaztLkF4ZwQhXL61wAAAN4"]
[Sat Jul 18 23:52:42.071650 2026] [security2:error] [pid 983601:tid 983808] [client 3.109.49.224:45030] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.49.109.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxmKlaztLkF4ZwQhXL66gAAANI"]
[Sat Jul 18 23:52:42.150715 2026] [security2:error] [pid 983601:tid 983801] [client 185.132.186.46:25159] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 46.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/class.api.php"] [unique_id "alxmKlaztLkF4ZwQhXL67gAAAMs"]
[Sat Jul 18 23:52:42.584702 2026] [security2:error] [pid 983601:tid 983811] [client 4.194.24.143:42205] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/nine2code.php"] [unique_id "alxmKlaztLkF4ZwQhXL7CwAAANU"]
[Sat Jul 18 23:52:42.662897 2026] [security2:error] [pid 983601:tid 983748] [client 45.134.20.135:32351] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/options-reading.php"] [unique_id "alxmKlaztLkF4ZwQhXL7DwAAAJY"]
[Sat Jul 18 23:52:43.047154 2026] [security2:error] [pid 983601:tid 983850] [client 185.132.186.19:49087] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 19.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "alxmK1aztLkF4ZwQhXL7LAAAAPw"]
[Sat Jul 18 23:52:43.077063 2026] [security2:error] [pid 983601:tid 983844] [client 3.109.49.224:45034] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.49.109.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxmK1aztLkF4ZwQhXL7LgAAAPY"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:52:43.129498 2026] [security2:error] [pid 983601:tid 983802] [client 4.194.24.143:31198] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/num.php"] [unique_id "alxmK1aztLkF4ZwQhXL7NwAAAMw"]
[Sat Jul 18 23:52:43.313465 2026] [security2:error] [pid 983601:tid 983728] [remote 54.90.74.5:35402] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "web.config"] [severity "CRITICAL"] [hostname "jndsupport.com"] [uri "/Web.config"] [unique_id "alxmK1aztLkF4ZwQhXL7QAAApX4"]
[Sat Jul 18 23:52:43.515999 2026] [security2:error] [pid 983601:tid 983857] [client 45.134.20.106:32941] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wsad.php"] [unique_id "alxmK1aztLkF4ZwQhXL7UgAAAQM"]
[Sat Jul 18 23:52:43.670565 2026] [security2:error] [pid 983601:tid 983767] [client 4.194.24.143:28068] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/odf7udtspqtpxzyxmw2rccdefault.php"] [unique_id "alxmK1aztLkF4ZwQhXL7WwAAAKk"]
[Sat Jul 18 23:52:43.946416 2026] [security2:error] [pid 983601:tid 983831] [client 185.132.186.13:59801] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/chosen.php"] [unique_id "alxmK1aztLkF4ZwQhXL7aQAAAOk"]
[Sat Jul 18 23:52:44.213254 2026] [security2:error] [pid 983601:tid 983739] [client 4.194.24.143:28092] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/option.php"] [unique_id "alxmLFaztLkF4ZwQhXL7fQAAAI0"]
[Sat Jul 18 23:52:44.389765 2026] [security2:error] [pid 983601:tid 983764] [client 45.134.20.135:43443] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/nation.php"] [unique_id "alxmLFaztLkF4ZwQhXL7iAAAAKY"]
[Sat Jul 18 23:52:44.466653 2026] [security2:error] [pid 983601:tid 983858] [client 138.252.89.100:61264] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmLFaztLkF4ZwQhXL7jQAAAQQ"]
[Sat Jul 18 23:52:44.466773 2026] [security2:error] [pid 983601:tid 983858] [client 138.252.89.100:61264] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmLFaztLkF4ZwQhXL7jQAAAQQ"]
[Sat Jul 18 23:52:44.752508 2026] [security2:error] [pid 983601:tid 983822] [client 4.194.24.143:17881] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/p.php"] [unique_id "alxmLFaztLkF4ZwQhXL7oQAAAOA"]
[Sat Jul 18 23:52:44.841562 2026] [security2:error] [pid 983601:tid 983850] [client 185.132.186.12:65093] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/autoload_classmap/bypass.php"] [unique_id "alxmLFaztLkF4ZwQhXL7pAAAAPw"]
[Sat Jul 18 23:52:45.033345 2026] [security2:error] [pid 983601:tid 983788] [client 47.128.27.178:50180] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "avatrip.co"] [uri "/robots.txt"] [unique_id "alxmLVaztLkF4ZwQhXL7tgAAAL4"]
[Sat Jul 18 23:52:45.246804 2026] [security2:error] [pid 983601:tid 983809] [client 45.134.20.132:26321] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "alxmLVaztLkF4ZwQhXL7xQAAANM"]
[Sat Jul 18 23:52:45.305240 2026] [security2:error] [pid 983601:tid 983858] [client 4.194.24.143:42203] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/past.php"] [unique_id "alxmLVaztLkF4ZwQhXL7yAAAAQQ"]
[Sat Jul 18 23:52:45.741328 2026] [security2:error] [pid 983601:tid 983734] [client 185.132.186.8:59145] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 8.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/dropdown.php"] [unique_id "alxmLVaztLkF4ZwQhXL76QAAAIg"]
[Sat Jul 18 23:52:45.848379 2026] [security2:error] [pid 983601:tid 983847] [client 4.194.24.143:28055] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/php.php"] [unique_id "alxmLVaztLkF4ZwQhXL77AAAAPk"]
[Sat Jul 18 23:52:45.900070 2026] [security2:error] [pid 983601:tid 983818] [client 36.83.95.75:58058] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmLVaztLkF4ZwQhXL77wAAANw"]
[Sat Jul 18 23:52:45.900225 2026] [security2:error] [pid 983601:tid 983818] [client 36.83.95.75:58058] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmLVaztLkF4ZwQhXL77wAAANw"]
[Sat Jul 18 23:52:46.102238 2026] [security2:error] [pid 983601:tid 983766] [client 45.134.20.122:39725] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "alxmLlaztLkF4ZwQhXL8AQAAAKg"]
[Sat Jul 18 23:52:46.390444 2026] [security2:error] [pid 983601:tid 983800] [client 4.194.24.143:25755] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/php8.php"] [unique_id "alxmLlaztLkF4ZwQhXL8EgAAAMo"]
[Sat Jul 18 23:52:46.394287 2026] [security2:error] [pid 983601:tid 983774] [client 180.252.198.240:53235] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmLlaztLkF4ZwQhXL8EwAAALA"]
[Sat Jul 18 23:52:46.394409 2026] [security2:error] [pid 983601:tid 983774] [client 180.252.198.240:53235] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmLlaztLkF4ZwQhXL8EwAAALA"]
[Sat Jul 18 23:52:46.529761 2026] [security2:error] [pid 983601:tid 983635] [remote 31.42.184.154:44478] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxmLlaztLkF4ZwQhXL8GQAAjSE"]
[Sat Jul 18 23:52:46.529885 2026] [security2:error] [pid 983601:tid 983739] [client 31.42.184.154:44478] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxmLlaztLkF4ZwQhXL8GQAAjSE"]
[Sat Jul 18 23:52:46.634116 2026] [security2:error] [pid 983601:tid 983795] [client 185.132.186.18:65307] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 18.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/images/admin.php"] [unique_id "alxmLlaztLkF4ZwQhXL8IwAAAMU"]
[Sat Jul 18 23:52:46.934552 2026] [security2:error] [pid 983601:tid 983826] [client 4.194.24.143:25735] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/phpinfo.php"] [unique_id "alxmLlaztLkF4ZwQhXL8QgAAAOQ"]
[Sat Jul 18 23:52:46.962799 2026] [security2:error] [pid 983601:tid 983782] [client 45.134.20.117:41269] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "alxmLlaztLkF4ZwQhXL8RgAAALg"]
[Sat Jul 18 23:52:47.542402 2026] [security2:error] [pid 983601:tid 983767] [client 185.132.186.25:52883] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/db.php"] [unique_id "alxmL1aztLkF4ZwQhXL8aAAAAKk"]
[Sat Jul 18 23:52:47.646641 2026] [security2:error] [pid 983601:tid 983733] [client 216.73.163.117:39015] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.163.73.216.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.amandathiem.com"] [uri "/wp-login.php"] [unique_id "alxmL1aztLkF4ZwQhXL8igAAAIc"]
[Sat Jul 18 23:52:47.682563 2026] [security2:error] [pid 983601:tid 983749] [client 4.194.24.143:31175] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/post.php"] [unique_id "alxmL1aztLkF4ZwQhXL8jwAAAJc"]
[Sat Jul 18 23:52:47.816836 2026] [security2:error] [pid 983601:tid 983841] [client 45.134.20.115:35141] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/autoload_classmap/wso.php"] [unique_id "alxmL1aztLkF4ZwQhXL8qAAAAPM"]
[Sat Jul 18 23:52:47.871155 2026] [security2:error] [pid 983601:tid 983789] [client 20.127.125.129:47035] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.125.127.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpanel.technicalseohouse.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "alxmL1aztLkF4ZwQhXL8rQAAAL8"]
[Sat Jul 18 23:52:47.871263 2026] [security2:error] [pid 983601:tid 983789] [client 20.127.125.129:47035] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpanel.technicalseohouse.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "alxmL1aztLkF4ZwQhXL8rQAAAL8"]
[Sat Jul 18 23:52:48.234500 2026] [security2:error] [pid 983601:tid 983754] [client 4.194.24.143:42239] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/public/assets/design_1/css/parts/course_cards/grid_card_1.min.php"] [unique_id "alxmMFaztLkF4ZwQhXL80wAAAJw"]
[Sat Jul 18 23:52:48.437742 2026] [security2:error] [pid 983601:tid 983800] [client 185.132.186.17:65185] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/.well-known/pki-validation/mariju.php"] [unique_id "alxmMFaztLkF4ZwQhXL83AAAAMo"]
[Sat Jul 18 23:52:48.681029 2026] [security2:error] [pid 983601:tid 983816] [client 45.134.20.132:25219] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-atomx.php"] [unique_id "alxmMFaztLkF4ZwQhXL86wAAANo"]
[Sat Jul 18 23:52:48.774570 2026] [security2:error] [pid 983601:tid 983851] [client 4.194.24.143:25785] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/public/css.php"] [unique_id "alxmMFaztLkF4ZwQhXL89AAAAP0"]
[Sat Jul 18 23:52:49.056633 2026] [security2:error] [pid 983601:tid 983741] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmMFaztLkF4ZwQhXL8_wAAAI8"]
[Sat Jul 18 23:52:49.104471 2026] [security2:error] [pid 983601:tid 983850] [client 103.160.26.178:61959] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmMVaztLkF4ZwQhXL9BQAAAPw"]
[Sat Jul 18 23:52:49.104563 2026] [security2:error] [pid 983601:tid 983850] [client 103.160.26.178:61959] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmMVaztLkF4ZwQhXL9BQAAAPw"]
[Sat Jul 18 23:52:49.316322 2026] [security2:error] [pid 983601:tid 983799] [client 4.194.24.143:28054] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/r.php"] [unique_id "alxmMVaztLkF4ZwQhXL9HAAAAMk"]
[Sat Jul 18 23:52:49.346107 2026] [security2:error] [pid 983601:tid 983844] [client 185.132.186.14:64847] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/mah/function.php"] [unique_id "alxmMVaztLkF4ZwQhXL9IQAAAPY"]
[Sat Jul 18 23:52:49.534182 2026] [security2:error] [pid 983601:tid 983744] [client 45.134.20.110:21309] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/admin-footer.php"] [unique_id "alxmMVaztLkF4ZwQhXL9KQAAAJI"]
[Sat Jul 18 23:52:49.596283 2026] [proxy:error] [pid 983601:tid 983769] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:52:49.596349 2026] [proxy_http:error] [pid 983601:tid 983769] [client 193.47.62.168:44650] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:52:49.596960 2026] [proxy:error] [pid 983601:tid 983769] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:52:49.596991 2026] [proxy_http:error] [pid 983601:tid 983769] [client 193.47.62.168:44650] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:52:49.859155 2026] [security2:error] [pid 983601:tid 983756] [client 4.194.24.143:25738] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/radio.php"] [unique_id "alxmMVaztLkF4ZwQhXL9QwAAAJ4"]
[Sat Jul 18 23:52:50.255447 2026] [security2:error] [pid 983601:tid 983771] [client 185.132.186.44:62045] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/plugins/bypass.php"] [unique_id "alxmMlaztLkF4ZwQhXL9UwAAAK0"]
[Sat Jul 18 23:52:50.403676 2026] [security2:error] [pid 983601:tid 983793] [client 45.134.20.111:28553] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/maint/wp-conflg.php"] [unique_id "alxmMlaztLkF4ZwQhXL9YwAAAMM"]
[Sat Jul 18 23:52:50.419163 2026] [security2:error] [pid 983601:tid 983795] [client 4.194.24.143:18431] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/randkeyword.php7"] [unique_id "alxmMlaztLkF4ZwQhXL9ZAAAAMU"]
[Sat Jul 18 23:52:50.797246 2026] [security2:error] [pid 983601:tid 983728] [remote 124.156.212.23:58438] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 23.212.156.124.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "alrowad-hub.net"] [uri "/wp-login.php"] [unique_id "alxmMlaztLkF4ZwQhXL9ewAAmX4"]
[Sat Jul 18 23:52:50.962484 2026] [security2:error] [pid 983601:tid 983852] [client 4.194.24.143:18390] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/readme.php"] [unique_id "alxmMlaztLkF4ZwQhXL9jQAAAP4"]
[Sat Jul 18 23:52:51.152536 2026] [security2:error] [pid 983601:tid 983830] [client 185.132.186.40:25093] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 40.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/admin.php"] [unique_id "alxmM1aztLkF4ZwQhXL9lAAAAOg"]
[Sat Jul 18 23:52:51.296430 2026] [security2:error] [pid 983601:tid 983846] [client 45.134.20.107:23217] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 107.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/XxX.php"] [unique_id "alxmM1aztLkF4ZwQhXL9owAAAPg"]
[Sat Jul 18 23:52:51.397259 2026] [security2:error] [pid 983601:tid 983700] [remote 152.228.213.32:60448] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxmM1aztLkF4ZwQhXL9pwAA7mI"]
[Sat Jul 18 23:52:51.418108 2026] [security2:error] [pid 983601:tid 983826] [client 139.167.225.146:63349] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxmM1aztLkF4ZwQhXL9rQAAAOQ"]
[Sat Jul 18 23:52:51.418210 2026] [security2:error] [pid 983601:tid 983826] [client 139.167.225.146:63349] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxmM1aztLkF4ZwQhXL9rQAAAOQ"]
[Sat Jul 18 23:52:51.449831 2026] [security2:error] [pid 983601:tid 983856] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmM1aztLkF4ZwQhXL9oAAAAQI"]
[Sat Jul 18 23:52:51.522777 2026] [security2:error] [pid 983601:tid 983804] [client 4.194.24.143:42196] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/reze.php"] [unique_id "alxmM1aztLkF4ZwQhXL9sQAAAM4"]
[Sat Jul 18 23:52:51.581309 2026] [security2:error] [pid 983601:tid 983715] [remote 152.228.213.32:60448] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxmM1aztLkF4ZwQhXL9tAAApnE"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:52:52.048694 2026] [security2:error] [pid 983601:tid 983840] [client 185.132.186.43:60175] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 43.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/themes/tflow/up.php"] [unique_id "alxmNFaztLkF4ZwQhXL9zwAAAPI"]
[Sat Jul 18 23:52:52.088629 2026] [security2:error] [pid 983601:tid 983813] [client 4.194.24.143:18415] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/rh.php"] [unique_id "alxmNFaztLkF4ZwQhXL90AAAANc"]
[Sat Jul 18 23:52:52.152431 2026] [security2:error] [pid 983601:tid 983761] [client 45.134.20.124:25135] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 124.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/ubh/install.php"] [unique_id "alxmNFaztLkF4ZwQhXL90gAAAKM"]
[Sat Jul 18 23:52:52.627774 2026] [security2:error] [pid 983601:tid 983784] [client 4.194.24.143:28036] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/rip.php"] [unique_id "alxmNFaztLkF4ZwQhXL98wAAALo"]
[Sat Jul 18 23:52:52.943170 2026] [security2:error] [pid 983601:tid 983781] [client 185.132.186.4:39731] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 4.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/function.php"] [unique_id "alxmNFaztLkF4ZwQhXL-AQAAALc"]
[Sat Jul 18 23:52:53.006406 2026] [security2:error] [pid 983601:tid 983783] [client 45.134.20.130:52899] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 130.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "alxmNVaztLkF4ZwQhXL-DQAAALk"]
[Sat Jul 18 23:52:53.222682 2026] [security2:error] [pid 983601:tid 983778] [client 4.194.24.143:28083] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/root.php"] [unique_id "alxmNVaztLkF4ZwQhXL-HQAAALQ"]
[Sat Jul 18 23:52:53.462535 2026] [security2:error] [pid 983601:tid 983727] [remote 202.51.202.242:50690] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 242.202.51.202.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "wathenbartlett.co.uk"] [uri "/wp-login.php"] [unique_id "alxmNVaztLkF4ZwQhXL-KgAA6n0"]
[Sat Jul 18 23:52:53.708531 2026] [security2:error] [pid 983601:tid 983679] [remote 154.61.75.100:51632] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "peoplestrategies.us"] [uri "/wp-login.php"] [unique_id "alxmNVaztLkF4ZwQhXL-OwAAs00"]
[Sat Jul 18 23:52:53.762497 2026] [security2:error] [pid 983601:tid 983744] [client 4.194.24.143:28086] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/s.php"] [unique_id "alxmNVaztLkF4ZwQhXL-QAAAAJI"]
[Sat Jul 18 23:52:53.842248 2026] [security2:error] [pid 983601:tid 983761] [client 185.132.186.26:32745] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 26.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/templates/beez3/index.php"] [unique_id "alxmNVaztLkF4ZwQhXL-RQAAAKM"]
[Sat Jul 18 23:52:53.859854 2026] [security2:error] [pid 983601:tid 983841] [client 45.134.20.127:54387] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 127.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "alxmNVaztLkF4ZwQhXL-SAAAAPM"]
[Sat Jul 18 23:52:53.866311 2026] [security2:error] [pid 983601:tid 983605] [remote 202.51.202.242:50690] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 242.202.51.202.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "wathenbartlett.co.uk"] [uri "/wp-login.php"] [unique_id "alxmNVaztLkF4ZwQhXL-RwAA9wM"], referer: https://wathenbartlett.co.uk/wp-login.php
[Sat Jul 18 23:52:53.905856 2026] [security2:error] [pid 983601:tid 983629] [remote 117.0.21.154:37782] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxmNVaztLkF4ZwQhXL-SQABABs"]
[Sat Jul 18 23:52:54.310162 2026] [security2:error] [pid 983601:tid 983818] [client 4.194.24.143:25778] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/sang.php"] [unique_id "alxmNlaztLkF4ZwQhXL-agAAANw"]
[Sat Jul 18 23:52:54.447342 2026] [security2:error] [pid 983601:tid 983640] [remote 117.0.21.154:37782] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxmNlaztLkF4ZwQhXL-cAAAvCY"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:52:54.710767 2026] [security2:error] [pid 983601:tid 983813] [client 20.127.125.129:63269] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.125.127.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpanel.technicalseohouse.com"] [uri "/this_is_a_new_hello_world.php"] [unique_id "alxmNlaztLkF4ZwQhXL-gwAAANc"]
[Sat Jul 18 23:52:54.710867 2026] [security2:error] [pid 983601:tid 983813] [client 20.127.125.129:63269] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpanel.technicalseohouse.com"] [uri "/this_is_a_new_hello_world.php"] [unique_id "alxmNlaztLkF4ZwQhXL-gwAAANc"]
[Sat Jul 18 23:52:54.716272 2026] [security2:error] [pid 983601:tid 983803] [client 45.134.20.126:21055] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 126.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "alxmNlaztLkF4ZwQhXL-hAAAAM0"]
[Sat Jul 18 23:52:54.775565 2026] [security2:error] [pid 983601:tid 983780] [client 185.132.186.11:37041] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 11.186.132.185.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "alxmNlaztLkF4ZwQhXL-hQAAALY"]
[Sat Jul 18 23:52:54.852117 2026] [security2:error] [pid 983601:tid 983770] [client 4.194.24.143:25780] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/scxy.php"] [unique_id "alxmNlaztLkF4ZwQhXL-jwAAAKw"]
[Sat Jul 18 23:52:55.195048 2026] [security2:error] [pid 983601:tid 983665] [remote 37.111.214.255:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 255.214.111.37.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "wealthynarrative.com"] [uri "/xmlrpc.php"] [unique_id "alxmN1aztLkF4ZwQhXL-pgAAkT8"]
[Sat Jul 18 23:52:55.195307 2026] [security2:error] [pid 983601:tid 983743] [client 37.111.214.255:0] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "wealthynarrative.com"] [uri "/xmlrpc.php"] [unique_id "alxmN1aztLkF4ZwQhXL-pgAAkT8"]
[Sat Jul 18 23:52:55.378581 2026] [security2:error] [pid 983601:tid 983733] [client 20.230.87.222:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 222.87.230.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.yidaiyi.org"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "alxmN1aztLkF4ZwQhXL-qgAAAIc"]
[Sat Jul 18 23:52:55.378697 2026] [security2:error] [pid 983601:tid 983733] [client 20.230.87.222:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.yidaiyi.org"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "alxmN1aztLkF4ZwQhXL-qgAAAIc"]
[Sat Jul 18 23:52:55.393553 2026] [security2:error] [pid 983601:tid 983744] [client 4.194.24.143:17892] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/sd.php"] [unique_id "alxmN1aztLkF4ZwQhXL-qwAAAJI"]
[Sat Jul 18 23:52:55.572342 2026] [security2:error] [pid 983601:tid 983845] [client 45.134.20.116:60501] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 116.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/twentytwentyfour/content-index.php"] [unique_id "alxmN1aztLkF4ZwQhXL-twAAAPc"]
[Sat Jul 18 23:52:55.665812 2026] [security2:error] [pid 983601:tid 983770] [client 185.132.186.49:30671] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 49.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/install.php"] [unique_id "alxmN1aztLkF4ZwQhXL-wAAAAKw"]
[Sat Jul 18 23:52:55.792385 2026] [security2:error] [pid 983601:tid 983654] [remote 154.61.75.100:51632] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "peoplestrategies.us"] [uri "/wp-login.php"] [unique_id "alxmN1aztLkF4ZwQhXL-xQAAqzQ"], referer: https://peoplestrategies.us/wp-login.php
[Sat Jul 18 23:52:55.965732 2026] [security2:error] [pid 983601:tid 983797] [client 4.194.24.143:18393] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/sf.php"] [unique_id "alxmN1aztLkF4ZwQhXL-zgAAAMc"]
[Sat Jul 18 23:52:56.022540 2026] [security2:error] [pid 983601:tid 983851] [client 34.123.137.137:14936] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "bigwormfishing.com"] [uri "/"] [unique_id "alxmOFaztLkF4ZwQhXL-zwAAAP0"]
[Sat Jul 18 23:52:56.275436 2026] [security2:error] [pid 983601:tid 983794] [client 138.252.89.100:61792] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmOFaztLkF4ZwQhXL-5gAAAMQ"]
[Sat Jul 18 23:52:56.275560 2026] [security2:error] [pid 983601:tid 983794] [client 138.252.89.100:61792] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmOFaztLkF4ZwQhXL-5gAAAMQ"]
[Sat Jul 18 23:52:56.296502 2026] [security2:error] [pid 983601:tid 983772] [client 36.83.95.75:58562] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmOFaztLkF4ZwQhXL-6gAAAK4"]
[Sat Jul 18 23:52:56.296622 2026] [security2:error] [pid 983601:tid 983772] [client 36.83.95.75:58562] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmOFaztLkF4ZwQhXL-6gAAAK4"]
[Sat Jul 18 23:52:56.390708 2026] [security2:error] [pid 983601:tid 983756] [client 50.116.65.227:13384] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "lifeisbetterlakeside.com"] [uri "/wp-content/uploads/2026/04/IMG_2998.jpeg"] [unique_id "alxmOFaztLkF4ZwQhXL-7wAAAJs"]
[Sat Jul 18 23:52:56.425427 2026] [security2:error] [pid 983601:tid 983750] [client 45.134.20.113:44075] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/admin/controller/extension/extension/alfa.php"] [unique_id "alxmOFaztLkF4ZwQhXL-8wAAAJg"]
[Sat Jul 18 23:52:56.471001 2026] [security2:error] [pid 983601:tid 983843] [client 40.77.167.67:60402] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "lifeisbetterlakeside.com"] [uri "/index.php"] [unique_id "alxmN1aztLkF4ZwQhXL-ywAA9U8"]
[Sat Jul 18 23:52:56.507125 2026] [security2:error] [pid 983601:tid 983773] [client 4.194.24.143:17862] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/shell.php"] [unique_id "alxmOFaztLkF4ZwQhXL-9wAAAK8"]
[Sat Jul 18 23:52:56.560599 2026] [security2:error] [pid 983601:tid 983811] [client 185.132.186.25:63939] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/css/colors/blue/rk2.php"] [unique_id "alxmOFaztLkF4ZwQhXL-_gAAANU"]
[Sat Jul 18 23:52:56.875585 2026] [security2:error] [pid 983601:tid 983805] [client 180.252.198.240:53735] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmOFaztLkF4ZwQhXL_GQAAAM8"]
[Sat Jul 18 23:52:56.875667 2026] [security2:error] [pid 983601:tid 983805] [client 180.252.198.240:53735] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmOFaztLkF4ZwQhXL_GQAAAM8"]
[Sat Jul 18 23:52:57.271971 2026] [security2:error] [pid 983601:tid 983770] [client 4.194.24.143:25750] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/sid3.php"] [unique_id "alxmOVaztLkF4ZwQhXL_LwAAAKw"]
[Sat Jul 18 23:52:57.288279 2026] [security2:error] [pid 983601:tid 983824] [client 45.134.20.129:36937] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/twentytwentyfour/system_cache.php%20"] [unique_id "alxmOVaztLkF4ZwQhXL_MQAAAOI"]
[Sat Jul 18 23:52:57.455980 2026] [security2:error] [pid 983601:tid 983840] [client 185.132.186.28:46487] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 28.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/images/class-config.php"] [unique_id "alxmOVaztLkF4ZwQhXL_NwAAAPI"]
[Sat Jul 18 23:52:57.626463 2026] [security2:error] [pid 983601:tid 983777] [client 74.7.244.54:45136] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "ericsnotary.com"] [uri "/robots.txt"] [unique_id "alxmOVaztLkF4ZwQhXL_PQAAALM"]
[Sat Jul 18 23:52:57.833084 2026] [security2:error] [pid 983601:tid 983852] [client 57.141.18.4:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxmOVaztLkF4ZwQhXL_PwAAAP4"]
[Sat Jul 18 23:52:57.853588 2026] [security2:error] [pid 983601:tid 983802] [client 4.194.24.143:42190] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/simple.php"] [unique_id "alxmOVaztLkF4ZwQhXL_VwAAAMw"]
[Sat Jul 18 23:52:58.153138 2026] [security2:error] [pid 983601:tid 983773] [client 45.134.20.108:55825] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/modern/colors.css.php"] [unique_id "alxmOlaztLkF4ZwQhXL_XwAAAK8"]
[Sat Jul 18 23:52:58.361424 2026] [security2:error] [pid 983601:tid 983786] [client 185.132.186.20:49531] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 20.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/components/com_jea/views/form/tmpl/size.php"] [unique_id "alxmOlaztLkF4ZwQhXL_eAAAALw"]
[Sat Jul 18 23:52:58.369869 2026] [ssl:error] [pid 983601:tid 983857] [client 3.233.59.216:19809] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname webmail.tvk.xpx.mybluehost.me provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:52:58.406834 2026] [security2:error] [pid 983601:tid 983776] [client 4.194.24.143:42211] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/sitemap.php"] [unique_id "alxmOlaztLkF4ZwQhXL_fQAAALI"]
[Sat Jul 18 23:52:58.532784 2026] [security2:error] [pid 983601:tid 983818] [client 34.123.137.137:14936] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "bigwormfishing.com"] [uri "/index.php"] [unique_id "alxmOFaztLkF4ZwQhXL_BAAAANw"], referer: http://bigwormfishing.com/wp-json/batch/v1
[Sat Jul 18 23:52:58.660815 2026] [security2:error] [pid 983601:tid 983780] [client 103.160.26.178:62469] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmOlaztLkF4ZwQhXL_gwAAALY"]
[Sat Jul 18 23:52:58.660903 2026] [security2:error] [pid 983601:tid 983780] [client 103.160.26.178:62469] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmOlaztLkF4ZwQhXL_gwAAALY"]
[Sat Jul 18 23:52:58.875455 2026] [security2:error] [pid 983601:tid 983760] [client 128.201.105.240:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "liquidationteam.com"] [uri "/index.php"] [unique_id "alxmOlaztLkF4ZwQhXL_bQAAAKI"]
[Sat Jul 18 23:52:58.958928 2026] [security2:error] [pid 983601:tid 983789] [client 4.194.24.143:18417] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/size.php"] [unique_id "alxmOlaztLkF4ZwQhXL_oAAAAL8"]
[Sat Jul 18 23:52:59.015495 2026] [security2:error] [pid 983601:tid 983839] [client 45.134.20.111:51971] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "alxmO1aztLkF4ZwQhXL_ogAAAPE"]
[Sat Jul 18 23:52:59.066852 2026] [security2:error] [pid 983601:tid 983817] [client 57.141.18.48:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxmOlaztLkF4ZwQhXL_lwAAANs"]
[Sat Jul 18 23:52:59.112586 2026] [security2:error] [pid 983601:tid 983796] [client 20.127.125.129:65237] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.125.127.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpanel.technicalseohouse.com"] [uri "/wp-admin/images/wp-login.php"] [unique_id "alxmO1aztLkF4ZwQhXL_pgAAAMY"]
[Sat Jul 18 23:52:59.112745 2026] [security2:error] [pid 983601:tid 983796] [client 20.127.125.129:65237] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpanel.technicalseohouse.com"] [uri "/wp-admin/images/wp-login.php"] [unique_id "alxmO1aztLkF4ZwQhXL_pgAAAMY"]
[Sat Jul 18 23:52:59.502541 2026] [security2:error] [pid 983601:tid 983813] [client 4.194.24.143:31220] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/sm.php"] [unique_id "alxmO1aztLkF4ZwQhXL_vQAAANc"]
[Sat Jul 18 23:52:59.636661 2026] [security2:error] [pid 983601:tid 983845] [client 185.132.186.45:44341] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 45.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/templates/beez/index.php"] [unique_id "alxmO1aztLkF4ZwQhXL_wwAAAPc"]
[Sat Jul 18 23:52:59.879715 2026] [security2:error] [pid 983601:tid 983742] [client 45.134.20.119:43523] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/css/media-widget-vide02.php"] [unique_id "alxmO1aztLkF4ZwQhXL_1wAAAJA"]
[Sat Jul 18 23:52:59.944343 2026] [security2:error] [pid 983601:tid 983787] [client 217.217.245.230:43727] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.245.217.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxmO1aztLkF4ZwQhXL_2gAAAL0"]
[Sat Jul 18 23:52:59.944447 2026] [security2:error] [pid 983601:tid 983787] [client 217.217.245.230:43727] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxmO1aztLkF4ZwQhXL_2gAAAL0"]
[Sat Jul 18 23:53:00.074277 2026] [security2:error] [pid 983601:tid 983819] [client 4.194.24.143:28089] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/sql.php"] [unique_id "alxmPFaztLkF4ZwQhXL_5AAAAN0"]
[Sat Jul 18 23:53:00.531704 2026] [security2:error] [pid 983601:tid 983845] [client 185.132.186.28:49327] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 28.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/bypass.php"] [unique_id "alxmPFaztLkF4ZwQhXIAAgAAAPc"]
[Sat Jul 18 23:53:00.548184 2026] [security2:error] [pid 983601:tid 983612] [remote 217.182.128.41:33420] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.128.182.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxmPFaztLkF4ZwQhXIAAwAA7Ao"]
[Sat Jul 18 23:53:00.636443 2026] [security2:error] [pid 983601:tid 983753] [client 4.194.24.143:17863] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/ss.php"] [unique_id "alxmPFaztLkF4ZwQhXIABgAAAJs"]
[Sat Jul 18 23:53:00.735591 2026] [security2:error] [pid 983601:tid 983784] [client 45.134.20.106:54523] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "alxmPFaztLkF4ZwQhXIADAAAALo"]
[Sat Jul 18 23:53:00.770548 2026] [security2:error] [pid 983601:tid 983654] [remote 217.182.128.41:33420] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.128.182.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxmPFaztLkF4ZwQhXIADQAAmDQ"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:53:01.113439 2026] [security2:error] [pid 983601:tid 983793] [client 139.167.225.146:63932] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxmPVaztLkF4ZwQhXIAJAAAAMM"]
[Sat Jul 18 23:53:01.113549 2026] [security2:error] [pid 983601:tid 983793] [client 139.167.225.146:63932] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxmPVaztLkF4ZwQhXIAJAAAAMM"]
[Sat Jul 18 23:53:01.202530 2026] [security2:error] [pid 983601:tid 983819] [client 4.194.24.143:18428] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/stats.php"] [unique_id "alxmPVaztLkF4ZwQhXIAKgAAAN0"]
[Sat Jul 18 23:53:01.446610 2026] [security2:error] [pid 983601:tid 983849] [client 185.132.186.1:25369] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 1.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/class.php"] [unique_id "alxmPVaztLkF4ZwQhXIAPAAAAPs"]
[Sat Jul 18 23:53:01.612574 2026] [security2:error] [pid 983601:tid 983770] [client 45.134.20.139:44245] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 139.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/images/buy.php"] [unique_id "alxmPVaztLkF4ZwQhXIAQQAAAKw"]
[Sat Jul 18 23:53:01.746953 2026] [security2:error] [pid 983601:tid 983843] [client 4.194.24.143:17860] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/sump1.php"] [unique_id "alxmPVaztLkF4ZwQhXIARwAAAPU"]
[Sat Jul 18 23:53:02.197344 2026] [security2:error] [pid 983601:tid 983692] [remote 120.72.98.5:63734] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nextlevelpressurewashing.com"] [uri "/wp-login.php"] [unique_id "alxmPlaztLkF4ZwQhXIAXQAAhlo"]
[Sat Jul 18 23:53:02.328261 2026] [security2:error] [pid 983601:tid 983819] [client 4.194.24.143:25781] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/system.php"] [unique_id "alxmPlaztLkF4ZwQhXIAbAAAAN0"]
[Sat Jul 18 23:53:02.345449 2026] [security2:error] [pid 983601:tid 983845] [client 185.132.186.40:55035] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 40.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/css/colors/light/profile.php"] [unique_id "alxmPlaztLkF4ZwQhXIAbgAAAPc"]
[Sat Jul 18 23:53:02.429273 2026] [core:error] [pid 983601:tid 983749] [client 158.51.126.91:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:02.429293 2026] [core:error] [pid 983601:tid 983749] [client 158.51.126.91:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:02.475444 2026] [security2:error] [pid 983601:tid 983786] [client 45.134.20.135:30789] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/templates/beez3/av.php"] [unique_id "alxmPlaztLkF4ZwQhXIAegAAALw"]
[Sat Jul 18 23:53:02.839800 2026] [security2:error] [pid 983601:tid 983682] [remote 120.72.98.5:63734] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nextlevelpressurewashing.com"] [uri "/wp-login.php"] [unique_id "alxmPlaztLkF4ZwQhXIAkwAAx1A"], referer: https://nextlevelpressurewashing.com/wp-login.php
[Sat Jul 18 23:53:02.889364 2026] [security2:error] [pid 983601:tid 983794] [client 4.194.24.143:28094] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/system/03n1hob7p03r2npdefault.php"] [unique_id "alxmPlaztLkF4ZwQhXIAlgAAAMQ"]
[Sat Jul 18 23:53:02.955506 2026] [security2:error] [pid 983601:tid 983798] [client 34.171.141.44:39420] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "deerbeach.com"] [uri "/wp-json/batch/v1"] [unique_id "alxmPlaztLkF4ZwQhXIAngAAAMg"]
[Sat Jul 18 23:53:03.019104 2026] [security2:error] [pid 983601:tid 983732] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmPlaztLkF4ZwQhXIAkAAAAIY"]
[Sat Jul 18 23:53:03.245049 2026] [security2:error] [pid 983601:tid 983734] [client 185.132.186.46:33229] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 46.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/product.php"] [unique_id "alxmP1aztLkF4ZwQhXIAsAAAAIg"]
[Sat Jul 18 23:53:03.251456 2026] [security2:error] [pid 983601:tid 983746] [client 34.171.141.44:39420] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "deerbeach.com"] [uri "/"] [unique_id "alxmP1aztLkF4ZwQhXIAsQAAAJQ"]
[Sat Jul 18 23:53:03.328148 2026] [security2:error] [pid 983601:tid 983837] [client 45.134.20.119:30777] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "alxmP1aztLkF4ZwQhXIAtgAAAO8"]
[Sat Jul 18 23:53:03.370034 2026] [security2:error] [pid 983601:tid 983744] [client 34.210.88.185:20456] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.88.210.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxmP1aztLkF4ZwQhXIAuQAAAJI"]
[Sat Jul 18 23:53:03.437013 2026] [security2:error] [pid 983601:tid 983742] [client 4.194.24.143:18404] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/system/cj5ha2rah8lyiqqdefault.php"] [unique_id "alxmP1aztLkF4ZwQhXIAwQAAAJA"]
[Sat Jul 18 23:53:03.994877 2026] [security2:error] [pid 983601:tid 983795] [client 4.194.24.143:42201] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/system_log.php"] [unique_id "alxmP1aztLkF4ZwQhXIA7AAAAMU"]
[Sat Jul 18 23:53:04.016770 2026] [security2:error] [pid 983601:tid 983818] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmP1aztLkF4ZwQhXIA3wAAANw"]
[Sat Jul 18 23:53:04.055620 2026] [security2:error] [pid 983601:tid 983781] [client 54.149.239.117:18934] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.239.149.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxmQFaztLkF4ZwQhXIA7gAAALc"]
[Sat Jul 18 23:53:04.133242 2026] [security2:error] [pid 983601:tid 983774] [client 34.171.141.44:15564] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "deerbeach.com"] [uri "/wp-json/batch/v1"] [unique_id "alxmQFaztLkF4ZwQhXIA8QAAALA"]
[Sat Jul 18 23:53:04.135674 2026] [security2:error] [pid 983601:tid 983827] [client 185.132.186.47:35187] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 47.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/uploads/autoload_classmap.php"] [unique_id "alxmQFaztLkF4ZwQhXIA8wAAAOU"]
[Sat Jul 18 23:53:04.210264 2026] [security2:error] [pid 983601:tid 983841] [client 45.134.20.114:59915] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/install.php"] [unique_id "alxmQFaztLkF4ZwQhXIA-AAAAPM"]
[Sat Jul 18 23:53:04.546191 2026] [security2:error] [pid 983601:tid 983793] [client 4.194.24.143:25737] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/t.php"] [unique_id "alxmQFaztLkF4ZwQhXIBDAAAAMM"]
[Sat Jul 18 23:53:04.643130 2026] [security2:error] [pid 983601:tid 983766] [client 34.171.141.44:15564] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "deerbeach.com"] [uri "/"] [unique_id "alxmQFaztLkF4ZwQhXIBEwAAAKg"]
[Sat Jul 18 23:53:05.026626 2026] [security2:error] [pid 983601:tid 983811] [client 185.132.186.36:48363] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 36.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/ask.php"] [unique_id "alxmQVaztLkF4ZwQhXIBJAAAANU"]
[Sat Jul 18 23:53:05.089489 2026] [security2:error] [pid 983601:tid 983852] [client 45.134.20.109:43347] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 109.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/plugins/function.php"] [unique_id "alxmQVaztLkF4ZwQhXIBKwAAAP4"]
[Sat Jul 18 23:53:05.118556 2026] [security2:error] [pid 983601:tid 983837] [client 4.194.24.143:20127] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/term.php"] [unique_id "alxmQVaztLkF4ZwQhXIBMAAAAO8"]
[Sat Jul 18 23:53:05.284939 2026] [security2:error] [pid 983601:tid 983825] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmQVaztLkF4ZwQhXIBLQAAAOM"]
[Sat Jul 18 23:53:05.507024 2026] [security2:error] [pid 983601:tid 983617] [remote 154.61.75.100:51662] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "narv.co"] [uri "/xmlrpc.php"] [unique_id "alxmQVaztLkF4ZwQhXIBSAAAlg8"]
[Sat Jul 18 23:53:05.507210 2026] [security2:error] [pid 983601:tid 983748] [client 154.61.75.100:51662] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "narv.co"] [uri "/xmlrpc.php"] [unique_id "alxmQVaztLkF4ZwQhXIBSAAAlg8"]
[Sat Jul 18 23:53:05.707539 2026] [security2:error] [pid 983601:tid 983856] [client 4.194.24.143:18369] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/test.php"] [unique_id "alxmQVaztLkF4ZwQhXIBWwAAAQI"]
[Sat Jul 18 23:53:05.916213 2026] [security2:error] [pid 983601:tid 983784] [client 185.132.186.48:34033] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 48.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "alxmQVaztLkF4ZwQhXIBagAAALo"]
[Sat Jul 18 23:53:05.932758 2026] [security2:error] [pid 983601:tid 983824] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmQVaztLkF4ZwQhXIBYQAAAOI"]
[Sat Jul 18 23:53:05.941325 2026] [security2:error] [pid 983601:tid 983842] [client 45.134.20.107:36389] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 107.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/header.php"] [unique_id "alxmQVaztLkF4ZwQhXIBbgAAAPQ"]
[Sat Jul 18 23:53:05.965697 2026] [security2:error] [pid 983601:tid 983798] [client 20.127.125.129:46992] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.125.127.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpanel.technicalseohouse.com"] [uri "/wp-content/themes/astra/inc/network.php"] [unique_id "alxmQVaztLkF4ZwQhXIBcAAAAMg"]
[Sat Jul 18 23:53:05.965798 2026] [security2:error] [pid 983601:tid 983798] [client 20.127.125.129:46992] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpanel.technicalseohouse.com"] [uri "/wp-content/themes/astra/inc/network.php"] [unique_id "alxmQVaztLkF4ZwQhXIBcAAAAMg"]
[Sat Jul 18 23:53:06.083437 2026] [security2:error] [pid 983601:tid 983778] [client 20.127.125.129:47038] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.125.127.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpanel.technicalseohouse.com"] [uri "/shell.php"] [unique_id "alxmQlaztLkF4ZwQhXIBeAAAALQ"]
[Sat Jul 18 23:53:06.083526 2026] [security2:error] [pid 983601:tid 983778] [client 20.127.125.129:47038] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpanel.technicalseohouse.com"] [uri "/shell.php"] [unique_id "alxmQlaztLkF4ZwQhXIBeAAAALQ"]
[Sat Jul 18 23:53:06.140869 2026] [security2:error] [pid 983601:tid 983753] [client 69.5.169.142:6888] ModSecurity: Access denied with code 406 (phase 1). Match of "ipMatch 127.0.0.1" against "REMOTE_ADDR" required. [file "/opt/mod_security/hg_rules.conf"] [line "1461"] [id "909116"] [msg "Golang default UA"] [hostname "50.116.64.31"] [uri "/onvif/device_service"] [unique_id "alxmQlaztLkF4ZwQhXIBewAAAJs"]
[Sat Jul 18 23:53:06.278027 2026] [security2:error] [pid 983601:tid 983836] [client 4.194.24.143:20155] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/test1.php"] [unique_id "alxmQlaztLkF4ZwQhXIBhgAAAO4"]
[Sat Jul 18 23:53:06.300694 2026] [security2:error] [pid 983601:tid 983844] [client 20.127.125.129:46981] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.125.127.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpanel.technicalseohouse.com"] [uri "/wp-admin/includes/wp-conflg.php"] [unique_id "alxmQlaztLkF4ZwQhXIBiAAAAPY"]
[Sat Jul 18 23:53:06.300819 2026] [security2:error] [pid 983601:tid 983844] [client 20.127.125.129:46981] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpanel.technicalseohouse.com"] [uri "/wp-admin/includes/wp-conflg.php"] [unique_id "alxmQlaztLkF4ZwQhXIBiAAAAPY"]
[Sat Jul 18 23:53:06.658942 2026] [security2:error] [pid 983601:tid 983846] [client 14.224.227.113:59415] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxmQlaztLkF4ZwQhXIBlwAAAPg"]
[Sat Jul 18 23:53:06.697855 2026] [security2:error] [pid 983601:tid 983850] [client 180.252.198.240:54209] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmQlaztLkF4ZwQhXIBoAAAAPw"]
[Sat Jul 18 23:53:06.697952 2026] [security2:error] [pid 983601:tid 983850] [client 180.252.198.240:54209] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmQlaztLkF4ZwQhXIBoAAAAPw"]
[Sat Jul 18 23:53:06.708628 2026] [security2:error] [pid 983601:tid 983715] [remote 68.178.160.25:49910] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxmQlaztLkF4ZwQhXIBngAA8nE"]
[Sat Jul 18 23:53:06.802298 2026] [security2:error] [pid 983601:tid 983845] [client 45.134.20.129:62371] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wordpress/wp-content/uploads/install.php"] [unique_id "alxmQlaztLkF4ZwQhXIBpwAAAPc"]
[Sat Jul 18 23:53:06.806755 2026] [security2:error] [pid 983601:tid 983774] [client 185.132.186.21:42001] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 21.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/css/css.php"] [unique_id "alxmQlaztLkF4ZwQhXIBqAAAALA"]
[Sat Jul 18 23:53:06.819902 2026] [security2:error] [pid 983601:tid 983747] [client 4.194.24.143:28038] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/tfm.php"] [unique_id "alxmQlaztLkF4ZwQhXIBqQAAAJU"]
[Sat Jul 18 23:53:06.880058 2026] [security2:error] [pid 983601:tid 983843] [client 36.83.95.75:59067] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmQlaztLkF4ZwQhXIBqwAAAPU"]
[Sat Jul 18 23:53:06.880169 2026] [security2:error] [pid 983601:tid 983843] [client 36.83.95.75:59067] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmQlaztLkF4ZwQhXIBqwAAAPU"]
[Sat Jul 18 23:53:07.106256 2026] [security2:error] [pid 983601:tid 983801] [client 20.127.125.129:47017] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.125.127.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpanel.technicalseohouse.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "alxmQ1aztLkF4ZwQhXIBvgAAAMs"]
[Sat Jul 18 23:53:07.106355 2026] [security2:error] [pid 983601:tid 983801] [client 20.127.125.129:47017] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpanel.technicalseohouse.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "alxmQ1aztLkF4ZwQhXIBvgAAAMs"]
[Sat Jul 18 23:53:07.126251 2026] [security2:error] [pid 983601:tid 983689] [remote 68.178.160.25:49910] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxmQ1aztLkF4ZwQhXIBvwAA4Fc"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:53:07.388983 2026] [security2:error] [pid 983601:tid 983811] [client 4.194.24.143:18423] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/thebe.php"] [unique_id "alxmQ1aztLkF4ZwQhXIB1AAAANU"]
[Sat Jul 18 23:53:07.661538 2026] [security2:error] [pid 983601:tid 983778] [client 45.134.20.104:54227] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/pki-validation/server.php"] [unique_id "alxmQ1aztLkF4ZwQhXIB6AAAALQ"]
[Sat Jul 18 23:53:07.696645 2026] [security2:error] [pid 983601:tid 983793] [client 185.132.186.17:57459] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/init.php"] [unique_id "alxmQ1aztLkF4ZwQhXIB7AAAAMM"]
[Sat Jul 18 23:53:07.944077 2026] [security2:error] [pid 983601:tid 983756] [client 4.194.24.143:44670] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/themes.php"] [unique_id "alxmQ1aztLkF4ZwQhXIB9wAAAJ4"]
[Sat Jul 18 23:53:07.983226 2026] [security2:error] [pid 983601:tid 983760] [client 138.252.89.100:62333] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmQ1aztLkF4ZwQhXIB-AAAAKI"]
[Sat Jul 18 23:53:07.983330 2026] [security2:error] [pid 983601:tid 983760] [client 138.252.89.100:62333] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmQ1aztLkF4ZwQhXIB-AAAAKI"]
[Sat Jul 18 23:53:07.997633 2026] [security2:error] [pid 983601:tid 983758] [client 20.127.125.129:65259] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.125.127.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpanel.technicalseohouse.com"] [uri "/.well-knownold/inputs.php"] [unique_id "alxmQ1aztLkF4ZwQhXIB-QAAAKA"]
[Sat Jul 18 23:53:07.997760 2026] [security2:error] [pid 983601:tid 983758] [client 20.127.125.129:65259] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpanel.technicalseohouse.com"] [uri "/.well-knownold/inputs.php"] [unique_id "alxmQ1aztLkF4ZwQhXIB-QAAAKA"]
[Sat Jul 18 23:53:08.139590 2026] [security2:error] [pid 983601:tid 983835] [client 23.160.60.207:62467] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.fkconstructionfunding.com"] [uri "/index.php"] [unique_id "alxmQ1aztLkF4ZwQhXIB9QAAAO0"]
[Sat Jul 18 23:53:08.145427 2026] [security2:error] [pid 983601:tid 983782] [client 20.127.125.129:65224] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.125.127.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpanel.technicalseohouse.com"] [uri "/wp-content/plugins/seoplugins/mar.php"] [unique_id "alxmRFaztLkF4ZwQhXICAwAAALg"]
[Sat Jul 18 23:53:08.145538 2026] [security2:error] [pid 983601:tid 983782] [client 20.127.125.129:65224] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpanel.technicalseohouse.com"] [uri "/wp-content/plugins/seoplugins/mar.php"] [unique_id "alxmRFaztLkF4ZwQhXICAwAAALg"]
[Sat Jul 18 23:53:08.326455 2026] [security2:error] [pid 983601:tid 983750] [client 142.93.96.184:54526] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=http://"] [hostname "mail.qwa.exl.mybluehost.me"] [uri "/wp-json/batch/v1"] [unique_id "alxmRFaztLkF4ZwQhXICFQAAAJg"]
[Sat Jul 18 23:53:08.413282 2026] [security2:error] [pid 983601:tid 983840] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmRFaztLkF4ZwQhXICDgAAAPI"]
[Sat Jul 18 23:53:08.501484 2026] [security2:error] [pid 983601:tid 983744] [client 4.194.24.143:20151] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/tiny.php"] [unique_id "alxmRFaztLkF4ZwQhXICIwAAAJI"]
[Sat Jul 18 23:53:08.518041 2026] [security2:error] [pid 983601:tid 983809] [client 45.134.20.134:55957] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 134.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/autoload_classmap/install.php"] [unique_id "alxmRFaztLkF4ZwQhXICJAAAANM"]
[Sat Jul 18 23:53:08.622790 2026] [security2:error] [pid 983601:tid 983828] [client 185.132.186.31:34555] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 31.186.132.185.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "alxmRFaztLkF4ZwQhXICKAAAAOY"]
[Sat Jul 18 23:53:08.947035 2026] [security2:error] [pid 983601:tid 983814] [client 104.248.143.162:51024] ModSecurity: Access denied with code 406 (phase 1). RBL lookup of 162.143.248.104.csi.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1548"] [id "900927"] [msg "contact-form RBL block: csi.websitewelcome.com"] [hostname "rtkenergypartners.com"] [uri "/wp-comments-post.php"] [unique_id "alxmRFaztLkF4ZwQhXICQgAAANg"]
[Sat Jul 18 23:53:08.947179 2026] [security2:error] [pid 983601:tid 983814] [client 104.248.143.162:51024] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "147"] [id "900404"] [msg "wp-comments-post POST logging"] [data "406"] [hostname "rtkenergypartners.com"] [uri "/wp-comments-post.php"] [unique_id "alxmRFaztLkF4ZwQhXICQgAAANg"]
[Sat Jul 18 23:53:08.969865 2026] [security2:error] [pid 983601:tid 983676] [remote 103.255.134.61:37800] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.134.255.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.nvy.ppp.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxmRFaztLkF4ZwQhXICRgAAoUo"]
[Sat Jul 18 23:53:08.970042 2026] [security2:error] [pid 983601:tid 983759] [client 103.255.134.61:37800] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "mail.nvy.ppp.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxmRFaztLkF4ZwQhXICRgAAoUo"]
[Sat Jul 18 23:53:08.996666 2026] [security2:error] [pid 983601:tid 983824] [client 20.127.125.129:56446] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.125.127.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpanel.technicalseohouse.com"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "alxmRFaztLkF4ZwQhXICSgAAAOI"]
[Sat Jul 18 23:53:08.996765 2026] [security2:error] [pid 983601:tid 983824] [client 20.127.125.129:56446] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpanel.technicalseohouse.com"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "alxmRFaztLkF4ZwQhXICSgAAAOI"]
[Sat Jul 18 23:53:09.014765 2026] [security2:error] [pid 983601:tid 983726] [remote 120.72.98.5:63742] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "zbj.ahr.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxmRVaztLkF4ZwQhXICTgAAkHw"]
[Sat Jul 18 23:53:09.014916 2026] [security2:error] [pid 983601:tid 983742] [client 120.72.98.5:63742] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "zbj.ahr.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxmRVaztLkF4ZwQhXICTgAAkHw"]
[Sat Jul 18 23:53:09.056098 2026] [security2:error] [pid 983601:tid 983771] [client 4.194.24.143:42185] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "noisepacks.com"] [uri "/tmp/byp.php"] [unique_id "alxmRVaztLkF4ZwQhXICVAAAAK0"]
[Sat Jul 18 23:53:09.381230 2026] [security2:error] [pid 983601:tid 983830] [client 20.230.87.222:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 222.87.230.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.yidaiyi.org"] [uri "/assets/images/about.php"] [unique_id "alxmRVaztLkF4ZwQhXICYQAAAOg"]
[Sat Jul 18 23:53:09.381317 2026] [security2:error] [pid 983601:tid 983830] [client 20.230.87.222:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.yidaiyi.org"] [uri "/assets/images/about.php"] [unique_id "alxmRVaztLkF4ZwQhXICYQAAAOg"]
[Sat Jul 18 23:53:09.397377 2026] [security2:error] [pid 983601:tid 983820] [client 103.160.26.178:62979] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmRVaztLkF4ZwQhXICYgAAAN4"]
[Sat Jul 18 23:53:09.397475 2026] [security2:error] [pid 983601:tid 983820] [client 103.160.26.178:62979] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmRVaztLkF4ZwQhXICYgAAAN4"]
[Sat Jul 18 23:53:09.417072 2026] [security2:error] [pid 983601:tid 983781] [client 45.134.20.134:48129] ModSecurity: Warning. Pattern match "/1\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1543"] [id "900921"] [msg "temporary TUW-72162 logging rule"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/pwnd/1.php"] [unique_id "alxmRVaztLkF4ZwQhXICZQAAALc"]
[Sat Jul 18 23:53:09.417141 2026] [security2:error] [pid 983601:tid 983781] [client 45.134.20.134:48129] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 134.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/pwnd/1.php"] [unique_id "alxmRVaztLkF4ZwQhXICZQAAALc"]
[Sat Jul 18 23:53:09.517021 2026] [security2:error] [pid 983601:tid 983757] [client 185.132.186.8:26071] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 8.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/autoload_classmap/function.php"] [unique_id "alxmRVaztLkF4ZwQhXICbgAAAJ8"]
[Sat Jul 18 23:53:09.624641 2026] [security2:error] [pid 983601:tid 983739] [client 20.127.125.129:56424] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.125.127.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpanel.technicalseohouse.com"] [uri "/assets/images/about.php"] [unique_id "alxmRVaztLkF4ZwQhXICcwAAAI0"]
[Sat Jul 18 23:53:09.624734 2026] [security2:error] [pid 983601:tid 983739] [client 20.127.125.129:56424] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpanel.technicalseohouse.com"] [uri "/assets/images/about.php"] [unique_id "alxmRVaztLkF4ZwQhXICcwAAAI0"]
[Sat Jul 18 23:53:10.184271 2026] [security2:error] [pid 983601:tid 983768] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmRVaztLkF4ZwQhXICkgAAAKo"]
[Sat Jul 18 23:53:10.279375 2026] [security2:error] [pid 983601:tid 983839] [client 45.134.20.135:57869] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/ubh/av.php"] [unique_id "alxmRlaztLkF4ZwQhXICpAAAAPE"]
[Sat Jul 18 23:53:10.311806 2026] [security2:error] [pid 983601:tid 983641] [remote 68.178.160.25:49912] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxmRlaztLkF4ZwQhXICpQABASc"]
[Sat Jul 18 23:53:10.413725 2026] [security2:error] [pid 983601:tid 983811] [client 185.132.186.23:64887] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 23.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/item.php"] [unique_id "alxmRlaztLkF4ZwQhXICrQAAANU"]
[Sat Jul 18 23:53:10.552037 2026] [security2:error] [pid 983601:tid 983764] [client 217.217.245.230:45543] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.245.217.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxmRlaztLkF4ZwQhXICtQAAAKY"]
[Sat Jul 18 23:53:10.552133 2026] [security2:error] [pid 983601:tid 983764] [client 217.217.245.230:45543] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxmRlaztLkF4ZwQhXICtQAAAKY"]
[Sat Jul 18 23:53:10.736941 2026] [security2:error] [pid 983601:tid 983611] [remote 68.178.160.25:49912] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxmRlaztLkF4ZwQhXICuwAApwk"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:53:11.021153 2026] [security2:error] [pid 983601:tid 983784] [client 5.161.177.47:55326] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "windowtx.com"] [uri "/index.php"] [unique_id "alxmRlaztLkF4ZwQhXICsAAAALo"], referer: https://windowtx.com
[Sat Jul 18 23:53:11.082486 2026] [security2:error] [pid 983601:tid 983747] [client 20.127.125.129:65222] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.125.127.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpanel.technicalseohouse.com"] [uri "/wp-content/uploads/json.php"] [unique_id "alxmR1aztLkF4ZwQhXICzgAAAJU"]
[Sat Jul 18 23:53:11.082575 2026] [security2:error] [pid 983601:tid 983747] [client 20.127.125.129:65222] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpanel.technicalseohouse.com"] [uri "/wp-content/uploads/json.php"] [unique_id "alxmR1aztLkF4ZwQhXICzgAAAJU"]
[Sat Jul 18 23:53:11.098265 2026] [security2:error] [pid 983601:tid 983698] [remote 68.178.160.25:49918] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxmR1aztLkF4ZwQhXICzwAA12A"]
[Sat Jul 18 23:53:11.145804 2026] [security2:error] [pid 983601:tid 983733] [client 45.134.20.132:31335] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/uploads/anas.php"] [unique_id "alxmR1aztLkF4ZwQhXIC0QAAAIc"]
[Sat Jul 18 23:53:11.338114 2026] [security2:error] [pid 983601:tid 983795] [client 185.132.186.6:61925] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 6.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/assets/index.php"] [unique_id "alxmR1aztLkF4ZwQhXIC4gAAAMU"]
[Sat Jul 18 23:53:11.497627 2026] [security2:error] [pid 983601:tid 983715] [remote 68.178.160.25:49918] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxmR1aztLkF4ZwQhXIC8QAA2XE"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:53:11.621528 2026] [security2:error] [pid 983601:tid 983754] [client 20.127.125.129:65223] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.125.127.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpanel.technicalseohouse.com"] [uri "/admin/uploads/lv.php"] [unique_id "alxmR1aztLkF4ZwQhXIC-gAAAJw"]
[Sat Jul 18 23:53:11.621616 2026] [security2:error] [pid 983601:tid 983754] [client 20.127.125.129:65223] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpanel.technicalseohouse.com"] [uri "/admin/uploads/lv.php"] [unique_id "alxmR1aztLkF4ZwQhXIC-gAAAJw"]
[Sat Jul 18 23:53:11.629485 2026] [security2:error] [pid 983601:tid 983817] [client 74.7.227.179:40812] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxmR1aztLkF4ZwQhXIC8AAA23o"], referer: https://tejasenvironmental.com/p=353723
[Sat Jul 18 23:53:12.011863 2026] [security2:error] [pid 983601:tid 983839] [client 45.134.20.117:60803] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/blue/shell.php"] [unique_id "alxmSFaztLkF4ZwQhXIDGgAAAPE"]
[Sat Jul 18 23:53:12.104917 2026] [security2:error] [pid 983601:tid 983792] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmR1aztLkF4ZwQhXIDDwAAAMI"]
[Sat Jul 18 23:53:12.154271 2026] [security2:error] [pid 983601:tid 983852] [client 20.127.125.129:47010] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.125.127.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpanel.technicalseohouse.com"] [uri "/wp-includes/wp-includes/about.php"] [unique_id "alxmSFaztLkF4ZwQhXIDIwAAAP4"]
[Sat Jul 18 23:53:12.154365 2026] [security2:error] [pid 983601:tid 983852] [client 20.127.125.129:47010] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpanel.technicalseohouse.com"] [uri "/wp-includes/wp-includes/about.php"] [unique_id "alxmSFaztLkF4ZwQhXIDIwAAAP4"]
[Sat Jul 18 23:53:12.235941 2026] [security2:error] [pid 983601:tid 983796] [client 185.132.186.12:32139] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/.well-known/pki-validation/index.php"] [unique_id "alxmSFaztLkF4ZwQhXIDKgAAAMY"]
[Sat Jul 18 23:53:12.751067 2026] [security2:error] [pid 983601:tid 983785] [client 57.141.0.51:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.thescarystory.com"] [uri "/index.php"] [unique_id "alxmR1aztLkF4ZwQhXIC6gAAALs"]
[Sat Jul 18 23:53:12.788254 2026] [security2:error] [pid 983601:tid 983802] [client 139.167.225.146:64530] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxmSFaztLkF4ZwQhXIDRQAAAMw"]
[Sat Jul 18 23:53:12.788401 2026] [security2:error] [pid 983601:tid 983802] [client 139.167.225.146:64530] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxmSFaztLkF4ZwQhXIDRQAAAMw"]
[Sat Jul 18 23:53:12.868471 2026] [security2:error] [pid 983601:tid 983787] [client 45.134.20.127:49807] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 127.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/erinyani/default.php"] [unique_id "alxmSFaztLkF4ZwQhXIDSgAAAL0"]
[Sat Jul 18 23:53:13.128505 2026] [security2:error] [pid 983601:tid 983746] [client 185.132.186.16:55499] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 16.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/uploads/admin.php"] [unique_id "alxmSVaztLkF4ZwQhXIDXwAAAJQ"]
[Sat Jul 18 23:53:13.143491 2026] [security2:error] [pid 983601:tid 983761] [client 57.141.18.30:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "ivetstrategies.com"] [uri "/index.php"] [unique_id "alxmRVaztLkF4ZwQhXICjgAAAKM"]
[Sat Jul 18 23:53:13.341020 2026] [security2:error] [pid 983601:tid 983696] [remote 217.182.128.41:56728] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.128.182.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxmSVaztLkF4ZwQhXIDZAAAnF4"]
[Sat Jul 18 23:53:13.554898 2026] [security2:error] [pid 983601:tid 983638] [remote 217.182.128.41:56728] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.128.182.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxmSVaztLkF4ZwQhXIDeAAAwCQ"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:53:13.743327 2026] [security2:error] [pid 983601:tid 983831] [client 45.134.20.111:62257] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/Text/index.php"] [unique_id "alxmSVaztLkF4ZwQhXIDhQAAAOk"]
[Sat Jul 18 23:53:13.949485 2026] [security2:error] [pid 983601:tid 983813] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmSVaztLkF4ZwQhXIDhAAAANc"]
[Sat Jul 18 23:53:14.029422 2026] [security2:error] [pid 983601:tid 983752] [client 185.132.186.8:41131] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 8.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/css/admin.php"] [unique_id "alxmSlaztLkF4ZwQhXIDmwAAAJo"]
[Sat Jul 18 23:53:14.058922 2026] [security2:error] [pid 983601:tid 983622] [remote 4.205.168.44:34328] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mourgroup.com"] [uri "/wp-login.php"] [unique_id "alxmSlaztLkF4ZwQhXIDnQAAkRQ"]
[Sat Jul 18 23:53:14.123949 2026] [security2:error] [pid 983601:tid 983605] [remote 103.90.234.13:53880] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.234.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxmSlaztLkF4ZwQhXIDogAA8gM"]
[Sat Jul 18 23:53:14.242094 2026] [security2:error] [pid 983601:tid 983653] [remote 4.205.168.44:34328] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mourgroup.com"] [uri "/wp-login.php"] [unique_id "alxmSlaztLkF4ZwQhXIDqAAAqTM"], referer: https://mourgroup.com/wp-login.php
[Sat Jul 18 23:53:14.397967 2026] [security2:error] [pid 983601:tid 983856] [client 20.230.87.222:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 222.87.230.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.yidaiyi.org"] [uri "/wp-content/uploads/json.php"] [unique_id "alxmSlaztLkF4ZwQhXIDrgAAAQI"]
[Sat Jul 18 23:53:14.398046 2026] [security2:error] [pid 983601:tid 983856] [client 20.230.87.222:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.yidaiyi.org"] [uri "/wp-content/uploads/json.php"] [unique_id "alxmSlaztLkF4ZwQhXIDrgAAAQI"]
[Sat Jul 18 23:53:14.427520 2026] [security2:error] [pid 983601:tid 983783] [client 57.141.18.103:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxmSlaztLkF4ZwQhXIDqgAAALk"]
[Sat Jul 18 23:53:14.597679 2026] [security2:error] [pid 983601:tid 983785] [client 45.134.20.106:22561] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/xex.php"] [unique_id "alxmSlaztLkF4ZwQhXIDtwAAALs"]
[Sat Jul 18 23:53:14.744174 2026] [security2:error] [pid 983601:tid 983770] [client 20.127.125.129:65220] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.125.127.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cpanel.technicalseohouse.com"] [uri "/wp-content/themes/wp-pridmag/lock.php"] [unique_id "alxmSlaztLkF4ZwQhXIDwAAAAKw"]
[Sat Jul 18 23:53:14.744363 2026] [security2:error] [pid 983601:tid 983770] [client 20.127.125.129:65220] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "cpanel.technicalseohouse.com"] [uri "/wp-content/themes/wp-pridmag/lock.php"] [unique_id "alxmSlaztLkF4ZwQhXIDwAAAAKw"]
[Sat Jul 18 23:53:14.927130 2026] [security2:error] [pid 983601:tid 983755] [client 185.132.186.38:26673] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 38.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/adminfuns.php"] [unique_id "alxmSlaztLkF4ZwQhXID0AAAAJ0"]
[Sat Jul 18 23:53:14.967471 2026] [security2:error] [pid 983601:tid 983632] [remote 103.90.234.13:53880] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.234.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxmSlaztLkF4ZwQhXID0QAAlh4"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:53:15.456048 2026] [security2:error] [pid 983601:tid 983747] [client 45.134.20.110:45193] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/about.php"] [unique_id "alxmS1aztLkF4ZwQhXID7AAAAJU"]
[Sat Jul 18 23:53:15.463691 2026] [security2:error] [pid 983601:tid 983849] [client 47.128.21.233:17810] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "webgardensbypaula.com"] [uri "/robots.txt"] [unique_id "alxmS1aztLkF4ZwQhXID7QAAAPs"]
[Sat Jul 18 23:53:15.548723 2026] [security2:error] [pid 983601:tid 983847] [client 43.152.72.41:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.aleishapenny.ca"] [uri "/index.php"] [unique_id "alxmS1aztLkF4ZwQhXID5QAA-Sc"], referer: https://www.aleishapenny.ca/listing/page/1305?paged=1&view=grid&posts_per_page=48
[Sat Jul 18 23:53:15.626148 2026] [security2:error] [pid 983601:tid 983799] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmS1aztLkF4ZwQhXID6QAAAMk"]
[Sat Jul 18 23:53:15.814548 2026] [fcgid:warn] [pid 983601:tid 983788] (70014)End of file found: [client 159.89.12.166:47364] mod_fcgid: can't get data from http client
[Sat Jul 18 23:53:15.826088 2026] [security2:error] [pid 983601:tid 983767] [client 185.132.186.43:50763] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 43.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/css/autoload_classmap.php"] [unique_id "alxmS1aztLkF4ZwQhXIECgAAAKk"]
[Sat Jul 18 23:53:15.883249 2026] [autoindex:error] [pid 983601:tid 983769] [client 183.87.96.71:0] AH01276: Cannot serve directory /home3/elemeqg5/public_html/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://elementalkneads.com/
[Sat Jul 18 23:53:15.959238 2026] [security2:error] [pid 983601:tid 983627] [remote 74.235.96.117:34936] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.235.74.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxmS1aztLkF4ZwQhXIEFAAAwxk"]
[Sat Jul 18 23:53:16.122128 2026] [security2:error] [pid 983601:tid 983715] [remote 74.235.96.117:34936] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.235.74.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxmTFaztLkF4ZwQhXIEHAAAqHE"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:53:16.176033 2026] [security2:error] [pid 983601:tid 983669] [remote 98.70.32.248:55366] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 248.32.70.98.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.walkingandtalking.net"] [uri "/wp-login.php"] [unique_id "alxmTFaztLkF4ZwQhXIEIAAA30M"], referer: https://mail.walkingandtalking.net/wp-login.php
[Sat Jul 18 23:53:16.267112 2026] [security2:error] [pid 983601:tid 983813] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmTFaztLkF4ZwQhXIEGQAAANc"]
[Sat Jul 18 23:53:16.331989 2026] [security2:error] [pid 983601:tid 983837] [client 45.134.20.108:63575] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/pwnd/install.php"] [unique_id "alxmTFaztLkF4ZwQhXIELgAAAO8"]
[Sat Jul 18 23:53:16.549963 2026] [security2:error] [pid 983601:tid 983795] [client 57.141.18.28:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxmTFaztLkF4ZwQhXIEMwAAAMU"]
[Sat Jul 18 23:53:16.717134 2026] [security2:error] [pid 983601:tid 983833] [client 185.132.186.35:63187] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 35.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp_wlx.php"] [unique_id "alxmTFaztLkF4ZwQhXIESwAAAOs"]
[Sat Jul 18 23:53:17.198229 2026] [security2:error] [pid 983601:tid 983771] [client 45.134.20.130:40801] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 130.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/upload/install.php"] [unique_id "alxmTVaztLkF4ZwQhXIEYQAAAK0"]
[Sat Jul 18 23:53:17.269891 2026] [security2:error] [pid 983601:tid 983762] [client 180.252.198.240:54687] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmTVaztLkF4ZwQhXIEZAAAAKQ"]
[Sat Jul 18 23:53:17.270001 2026] [security2:error] [pid 983601:tid 983762] [client 180.252.198.240:54687] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmTVaztLkF4ZwQhXIEZAAAAKQ"]
[Sat Jul 18 23:53:17.611843 2026] [security2:error] [pid 983601:tid 983820] [client 36.83.95.75:59584] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmTVaztLkF4ZwQhXIEfQAAAN4"]
[Sat Jul 18 23:53:17.611964 2026] [security2:error] [pid 983601:tid 983820] [client 36.83.95.75:59584] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmTVaztLkF4ZwQhXIEfQAAAN4"]
[Sat Jul 18 23:53:17.613368 2026] [security2:error] [pid 983601:tid 983783] [client 185.132.186.25:20233] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "alxmTVaztLkF4ZwQhXIEfgAAALk"]
[Sat Jul 18 23:53:17.819192 2026] [security2:error] [pid 983601:tid 983682] [remote 47.128.97.35:46188] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "abilityplus.org"] [uri "/news/"] [unique_id "alxmTVaztLkF4ZwQhXIEkgAA9FA"]
[Sat Jul 18 23:53:17.854998 2026] [security2:error] [pid 983601:tid 983807] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmTVaztLkF4ZwQhXIEgwAAANE"]
[Sat Jul 18 23:53:18.056991 2026] [security2:error] [pid 983601:tid 983838] [client 45.134.20.134:23871] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 134.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-head.php"] [unique_id "alxmTlaztLkF4ZwQhXIEmgAAAPA"]
[Sat Jul 18 23:53:18.509720 2026] [security2:error] [pid 983601:tid 983751] [client 185.132.186.11:49875] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 11.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "alxmTlaztLkF4ZwQhXIErgAAAJk"]
[Sat Jul 18 23:53:18.929066 2026] [security2:error] [pid 983601:tid 983809] [client 45.134.20.137:53281] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 137.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/admin-footer.php"] [unique_id "alxmTlaztLkF4ZwQhXIExQAAANM"]
[Sat Jul 18 23:53:19.269498 2026] [access_compat:error] [pid 983601:tid 983743] [client 159.89.12.166:47414] AH01797: client denied by server configuration: /var/www/html/server-status
[Sat Jul 18 23:53:19.409934 2026] [security2:error] [pid 983601:tid 983744] [client 185.132.186.12:48887] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp.php"] [unique_id "alxmT1aztLkF4ZwQhXIE3AAAAJI"]
[Sat Jul 18 23:53:19.543690 2026] [security2:error] [pid 983601:tid 983622] [remote 31.42.184.154:55794] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.commonsensesf.com"] [uri "/wp-login.php"] [unique_id "alxmT1aztLkF4ZwQhXIE4gAA5hQ"]
[Sat Jul 18 23:53:19.547338 2026] [security2:error] [pid 983601:tid 983786] [client 138.252.89.100:62856] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmT1aztLkF4ZwQhXIE5AAAALw"]
[Sat Jul 18 23:53:19.547422 2026] [security2:error] [pid 983601:tid 983786] [client 138.252.89.100:62856] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmT1aztLkF4ZwQhXIE5AAAALw"]
[Sat Jul 18 23:53:19.790496 2026] [security2:error] [pid 983601:tid 983807] [client 45.134.20.110:24249] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/upgrade/wp-conflg.php"] [unique_id "alxmT1aztLkF4ZwQhXIE8wAAANE"]
[Sat Jul 18 23:53:19.790979 2026] [security2:error] [pid 983601:tid 983653] [remote 31.42.184.154:55794] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.commonsensesf.com"] [uri "/wp-login.php"] [unique_id "alxmT1aztLkF4ZwQhXIE9AAAlzM"], referer: https://mail.commonsensesf.com/wp-login.php
[Sat Jul 18 23:53:20.050200 2026] [security2:error] [pid 983601:tid 983752] [client 103.160.26.178:63482] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmUFaztLkF4ZwQhXIFBAAAAJo"]
[Sat Jul 18 23:53:20.050295 2026] [security2:error] [pid 983601:tid 983752] [client 103.160.26.178:63482] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmUFaztLkF4ZwQhXIFBAAAAJo"]
[Sat Jul 18 23:53:20.300681 2026] [security2:error] [pid 983601:tid 983765] [client 185.132.186.48:56005] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 48.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/css/colors/blue/wp-trackback.php"] [unique_id "alxmUFaztLkF4ZwQhXIFGAAAAKc"]
[Sat Jul 18 23:53:20.651296 2026] [security2:error] [pid 983601:tid 983856] [client 45.134.20.114:23393] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/makeasmtp.php"] [unique_id "alxmUFaztLkF4ZwQhXIFOAAAAQI"]
[Sat Jul 18 23:53:20.696451 2026] [autoindex:error] [pid 983601:tid 983765] [client 43.166.240.231:0] AH01276: Cannot serve directory /home3/elemeqg5/public_html/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: http://www.elementalkneads.com
[Sat Jul 18 23:53:20.698068 2026] [security2:error] [pid 983601:tid 983837] [client 136.243.222.140:39098] ModSecurity: Warning. Matched phrase "DomainStatsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "www.ccsdifference.com"] [uri "/index.php"] [unique_id "alxmTlaztLkF4ZwQhXIEvgAAANA"]
[Sat Jul 18 23:53:20.934134 2026] [security2:error] [pid 983601:tid 983792] [client 57.141.18.11:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxmUFaztLkF4ZwQhXIFQAAAAMI"]
[Sat Jul 18 23:53:21.192017 2026] [security2:error] [pid 983601:tid 983739] [client 185.132.186.35:63701] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 35.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/themes/chosen.php"] [unique_id "alxmUVaztLkF4ZwQhXIFXAAAAI0"]
[Sat Jul 18 23:53:21.216345 2026] [security2:error] [pid 983601:tid 983783] [client 217.217.245.230:18969] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.245.217.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxmUVaztLkF4ZwQhXIFXgAAALk"]
[Sat Jul 18 23:53:21.216440 2026] [security2:error] [pid 983601:tid 983783] [client 217.217.245.230:18969] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxmUVaztLkF4ZwQhXIFXgAAALk"]
[Sat Jul 18 23:53:21.508387 2026] [security2:error] [pid 983601:tid 983827] [client 45.134.20.119:64845] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/wp-sup.php"] [unique_id "alxmUVaztLkF4ZwQhXIFegAAAOU"]
[Sat Jul 18 23:53:21.990548 2026] [proxy:error] [pid 983601:tid 983839] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:53:21.990628 2026] [proxy_http:error] [pid 983601:tid 983839] [client 193.47.62.168:37668] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:53:21.991269 2026] [proxy:error] [pid 983601:tid 983839] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:53:21.991298 2026] [proxy_http:error] [pid 983601:tid 983839] [client 193.47.62.168:37668] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:53:22.090210 2026] [security2:error] [pid 983601:tid 983805] [client 185.132.186.25:26267] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-header.php"] [unique_id "alxmUlaztLkF4ZwQhXIFpQAAAM8"]
[Sat Jul 18 23:53:22.374742 2026] [security2:error] [pid 983601:tid 983815] [client 45.134.20.111:53065] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wordpress/wp-includes/class-wp-http-ixr-client-view.php"] [unique_id "alxmUlaztLkF4ZwQhXIFrgAAANk"]
[Sat Jul 18 23:53:22.558274 2026] [security2:error] [pid 983601:tid 983845] [client 128.140.41.193:23044] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "mtlegnews.gov"] [uri "/index.php"] [unique_id "alxmUVaztLkF4ZwQhXIFWgAAAPc"], referer: https://mtlegnews.gov/
[Sat Jul 18 23:53:22.985987 2026] [security2:error] [pid 983601:tid 983758] [client 185.132.186.16:44845] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 16.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/themes/admin.php"] [unique_id "alxmUlaztLkF4ZwQhXIF2QAAAKA"]
[Sat Jul 18 23:53:23.231198 2026] [security2:error] [pid 983601:tid 983798] [client 45.134.20.122:28503] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/images/bypass.php"] [unique_id "alxmU1aztLkF4ZwQhXIF4wAAAMg"]
[Sat Jul 18 23:53:23.807232 2026] [security2:error] [pid 983601:tid 983834] [client 13.221.201.234:40370] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.201.221.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxmU1aztLkF4ZwQhXIGAgAAAOw"]
[Sat Jul 18 23:53:23.877605 2026] [security2:error] [pid 983601:tid 983802] [client 185.132.186.32:46169] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/Marvins.php"] [unique_id "alxmU1aztLkF4ZwQhXIGBwAAAMw"]
[Sat Jul 18 23:53:23.953486 2026] [security2:error] [pid 983601:tid 983780] [client 20.230.87.222:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 222.87.230.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.yidaiyi.org"] [uri "/wp-includes/wp-includes/about.php"] [unique_id "alxmU1aztLkF4ZwQhXIGDQAAALY"]
[Sat Jul 18 23:53:23.953575 2026] [security2:error] [pid 983601:tid 983780] [client 20.230.87.222:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.yidaiyi.org"] [uri "/wp-includes/wp-includes/about.php"] [unique_id "alxmU1aztLkF4ZwQhXIGDQAAALY"]
[Sat Jul 18 23:53:24.090068 2026] [security2:error] [pid 983601:tid 983844] [client 45.134.20.117:58785] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "alxmVFaztLkF4ZwQhXIGIgAAAPY"]
[Sat Jul 18 23:53:24.209960 2026] [security2:error] [pid 983601:tid 983754] [client 13.221.201.234:40384] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 234.201.221.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxmVFaztLkF4ZwQhXIGJgAAAJw"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:53:24.774343 2026] [security2:error] [pid 983601:tid 983812] [client 185.132.186.18:58347] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 18.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/about.php"] [unique_id "alxmVFaztLkF4ZwQhXIGTAAAANY"]
[Sat Jul 18 23:53:24.963419 2026] [security2:error] [pid 983601:tid 983831] [client 45.134.20.109:21759] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 109.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/edit.php"] [unique_id "alxmVFaztLkF4ZwQhXIGVgAAAOk"]
[Sat Jul 18 23:53:25.398675 2026] [security2:error] [pid 983601:tid 983824] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmVVaztLkF4ZwQhXIGaQAAAOI"]
[Sat Jul 18 23:53:25.674407 2026] [security2:error] [pid 983601:tid 983769] [client 185.132.186.30:50671] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 30.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-class.php"] [unique_id "alxmVVaztLkF4ZwQhXIGkwAAAKs"]
[Sat Jul 18 23:53:25.782035 2026] [security2:error] [pid 983601:tid 983812] [client 159.89.12.166:59210] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "mail.qqx.crt.mybluehost.me"] [uri "/.env"] [unique_id "alxmVVaztLkF4ZwQhXIGlwAAANY"]
[Sat Jul 18 23:53:25.823633 2026] [security2:error] [pid 983601:tid 983806] [client 45.134.20.138:62915] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 138.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/info.php"] [unique_id "alxmVVaztLkF4ZwQhXIGmQAAANA"]
[Sat Jul 18 23:53:26.064274 2026] [ssl:error] [pid 983601:tid 983734] [client 104.48.69.105:49458] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname blog.danwolfe.us provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:53:26.221241 2026] [security2:error] [pid 983601:tid 983773] [client 57.141.18.86:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "falconarrowshop.com"] [uri "/index.php"] [unique_id "alxmU1aztLkF4ZwQhXIF_AAAAK8"]
[Sat Jul 18 23:53:26.370451 2026] [core:error] [pid 983601:tid 983789] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:26.370475 2026] [core:error] [pid 983601:tid 983789] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:26.531135 2026] [core:error] [pid 983601:tid 983849] [client 3.15.38.153:33266] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:26.531156 2026] [core:error] [pid 983601:tid 983849] [client 3.15.38.153:33266] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:26.572218 2026] [security2:error] [pid 983601:tid 983779] [client 185.132.186.14:32119] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "alxmVlaztLkF4ZwQhXIG2AAAALU"]
[Sat Jul 18 23:53:26.680865 2026] [core:error] [pid 983601:tid 983758] [client 3.15.38.153:33280] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:26.680882 2026] [core:error] [pid 983601:tid 983758] [client 3.15.38.153:33280] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:26.683099 2026] [security2:error] [pid 983601:tid 983817] [client 45.134.20.104:49207] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/autoload_classmap.php"] [unique_id "alxmVlaztLkF4ZwQhXIG4QAAANs"]
[Sat Jul 18 23:53:26.833845 2026] [core:error] [pid 983601:tid 983799] [client 3.15.38.153:33286] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:26.833872 2026] [core:error] [pid 983601:tid 983799] [client 3.15.38.153:33286] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:27.013222 2026] [core:error] [pid 983601:tid 983854] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:27.013244 2026] [core:error] [pid 983601:tid 983854] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:27.173878 2026] [core:error] [pid 983601:tid 983848] [client 3.15.38.153:33292] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:27.173905 2026] [core:error] [pid 983601:tid 983848] [client 3.15.38.153:33292] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:27.326702 2026] [security2:error] [pid 983601:tid 983734] [client 3.15.38.153:33302] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/.env"] [unique_id "alxmV1aztLkF4ZwQhXIHGAAAAIg"]
[Sat Jul 18 23:53:27.398897 2026] [core:error] [pid 983601:tid 983839] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:27.398922 2026] [core:error] [pid 983601:tid 983839] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:27.469828 2026] [security2:error] [pid 983601:tid 983733] [client 185.132.186.30:20637] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 30.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/xx.php"] [unique_id "alxmV1aztLkF4ZwQhXIHHgAAAIc"]
[Sat Jul 18 23:53:27.510018 2026] [security2:error] [pid 983601:tid 983739] [client 54.145.191.230:22874] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.191.145.54.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxmV1aztLkF4ZwQhXIHIAAAAI0"]
[Sat Jul 18 23:53:27.510115 2026] [security2:error] [pid 983601:tid 983739] [client 54.145.191.230:22874] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "www.curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxmV1aztLkF4ZwQhXIHIAAAAI0"]
[Sat Jul 18 23:53:27.544851 2026] [security2:error] [pid 983601:tid 983821] [client 45.134.20.129:50931] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/blue/navi.php"] [unique_id "alxmV1aztLkF4ZwQhXIHIQAAAN8"]
[Sat Jul 18 23:53:27.579560 2026] [core:error] [pid 983601:tid 983858] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:27.579576 2026] [core:error] [pid 983601:tid 983858] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:27.637585 2026] [security2:error] [pid 983601:tid 983804] [client 114.119.141.51:37833] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.samdothan.org"] [uri "/wwwrosauerscom-jobs-772a.pdf"] [unique_id "alxmV1aztLkF4ZwQhXIHKwAAAM4"]
[Sat Jul 18 23:53:27.765397 2026] [core:error] [pid 983601:tid 983778] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:27.765421 2026] [core:error] [pid 983601:tid 983778] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:27.865692 2026] [security2:error] [pid 983601:tid 983817] [client 180.252.198.240:55184] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmV1aztLkF4ZwQhXIHSAAAANs"]
[Sat Jul 18 23:53:27.865797 2026] [security2:error] [pid 983601:tid 983817] [client 180.252.198.240:55184] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmV1aztLkF4ZwQhXIHSAAAANs"]
[Sat Jul 18 23:53:27.947607 2026] [core:error] [pid 983601:tid 983829] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:27.947624 2026] [core:error] [pid 983601:tid 983829] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:28.023716 2026] [security2:error] [pid 983601:tid 983780] [client 36.83.95.75:60079] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmWFaztLkF4ZwQhXIHVAAAALY"]
[Sat Jul 18 23:53:28.023820 2026] [security2:error] [pid 983601:tid 983780] [client 36.83.95.75:60079] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmWFaztLkF4ZwQhXIHVAAAALY"]
[Sat Jul 18 23:53:28.029326 2026] [autoindex:error] [pid 983601:tid 983772] [client 194.103.212.184:0] AH01276: Cannot serve directory /home1/itdynami/public_html/misralrakamia/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:53:28.072193 2026] [security2:error] [pid 983601:tid 983840] [client 74.208.214.194:42866] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxmWFaztLkF4ZwQhXIHXAAAAPI"]
[Sat Jul 18 23:53:28.118944 2026] [core:error] [pid 983601:tid 983805] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:28.118964 2026] [core:error] [pid 983601:tid 983805] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:28.312374 2026] [core:error] [pid 983601:tid 983752] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:28.312391 2026] [core:error] [pid 983601:tid 983752] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:28.406447 2026] [security2:error] [pid 983601:tid 983745] [client 185.132.186.51:27727] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 51.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/autoload_classmap.php"] [unique_id "alxmWFaztLkF4ZwQhXIHfQAAAJM"]
[Sat Jul 18 23:53:28.439369 2026] [security2:error] [pid 983601:tid 983787] [client 45.134.20.124:48037] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 124.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "alxmWFaztLkF4ZwQhXIHggAAAL0"]
[Sat Jul 18 23:53:28.466445 2026] [security2:error] [pid 983601:tid 983834] [client 3.15.38.153:33344] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\.bak|\\\\.bak\\\\.php)$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1260"] [id "390582"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that nclude .bak)"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/.env.bak"] [unique_id "alxmWFaztLkF4ZwQhXIHgwAAAOw"]
[Sat Jul 18 23:53:28.517522 2026] [security2:error] [pid 983601:tid 983757] [client 3.15.38.153:33344] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.backup$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1279"] [id "390588"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .backup)"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/.env.backup"] [unique_id "alxmWFaztLkF4ZwQhXIHhQAAAJ8"]
[Sat Jul 18 23:53:28.589220 2026] [core:error] [pid 983601:tid 983840] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:28.589239 2026] [core:error] [pid 983601:tid 983840] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:28.741587 2026] [security2:error] [pid 983601:tid 983796] [client 3.15.38.153:33358] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.old$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1263"] [id "390583"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .old)"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/.env.old"] [unique_id "alxmWFaztLkF4ZwQhXIHmgAAAMY"]
[Sat Jul 18 23:53:28.810669 2026] [core:error] [pid 983601:tid 983756] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:28.810688 2026] [core:error] [pid 983601:tid 983756] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:28.994526 2026] [core:error] [pid 983601:tid 983803] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:28.994553 2026] [core:error] [pid 983601:tid 983803] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:29.042279 2026] [security2:error] [pid 983601:tid 983647] [remote 62.210.185.4:33162] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 4.185.210.62.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxmWVaztLkF4ZwQhXIHugAAlC0"]
[Sat Jul 18 23:53:29.042526 2026] [security2:error] [pid 983601:tid 983746] [client 62.210.185.4:33162] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxmWVaztLkF4ZwQhXIHugAAlC0"]
[Sat Jul 18 23:53:29.090620 2026] [security2:error] [pid 983601:tid 983788] [client 206.246.108.113:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxmWFaztLkF4ZwQhXIHpwAAAL4"]
[Sat Jul 18 23:53:29.172144 2026] [core:error] [pid 983601:tid 983757] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:29.172164 2026] [core:error] [pid 983601:tid 983757] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:29.206417 2026] [security2:error] [pid 983601:tid 983641] [remote 188.138.102.156:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "innovativecleaningsvs.com"] [uri "/wp-login.php"] [unique_id "alxmWVaztLkF4ZwQhXIHxAAAhyc"]
[Sat Jul 18 23:53:29.294488 2026] [security2:error] [pid 983601:tid 983796] [client 45.134.20.114:41731] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/xp.php%20"] [unique_id "alxmWVaztLkF4ZwQhXIH0gAAAMY"]
[Sat Jul 18 23:53:29.303874 2026] [security2:error] [pid 983601:tid 983732] [client 185.132.186.13:29673] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "alxmWVaztLkF4ZwQhXIH1QAAAIY"]
[Sat Jul 18 23:53:29.355859 2026] [core:error] [pid 983601:tid 983804] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:29.355887 2026] [core:error] [pid 983601:tid 983804] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:29.416398 2026] [security2:error] [pid 983601:tid 983723] [remote 188.138.102.156:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "innovativecleaningsvs.com"] [uri "/wp-login.php"] [unique_id "alxmWVaztLkF4ZwQhXIH3gAAknk"], referer: https://innovativecleaningsvs.com/wp-login.php
[Sat Jul 18 23:53:29.530837 2026] [core:error] [pid 983601:tid 983812] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:29.530861 2026] [core:error] [pid 983601:tid 983812] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:29.722689 2026] [core:error] [pid 983601:tid 983769] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:29.722708 2026] [core:error] [pid 983601:tid 983769] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:29.925366 2026] [core:error] [pid 983601:tid 983847] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:29.925388 2026] [core:error] [pid 983601:tid 983847] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:30.113149 2026] [security2:error] [pid 983601:tid 983753] [client 57.141.18.50:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxmWVaztLkF4ZwQhXIICAAAAJs"]
[Sat Jul 18 23:53:30.113209 2026] [proxy:error] [pid 983601:tid 983843] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:53:30.113271 2026] [proxy_http:error] [pid 983601:tid 983843] [client 193.47.62.168:37678] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:53:30.113851 2026] [proxy:error] [pid 983601:tid 983843] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:53:30.113877 2026] [proxy_http:error] [pid 983601:tid 983843] [client 193.47.62.168:37678] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:53:30.140286 2026] [ssl:error] [pid 983601:tid 983778] [client 104.48.69.105:53978] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname www.bandsir.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:53:30.142877 2026] [core:error] [pid 983601:tid 983836] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:30.142908 2026] [core:error] [pid 983601:tid 983836] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:30.151091 2026] [security2:error] [pid 983601:tid 983815] [client 45.134.20.125:50379] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 125.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/languages/bypass.php"] [unique_id "alxmWlaztLkF4ZwQhXIIGAAAANk"]
[Sat Jul 18 23:53:30.207236 2026] [security2:error] [pid 983601:tid 983812] [client 185.132.186.12:44395] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/blue.php"] [unique_id "alxmWlaztLkF4ZwQhXIIGgAAANY"]
[Sat Jul 18 23:53:30.325298 2026] [core:error] [pid 983601:tid 983779] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:30.325321 2026] [core:error] [pid 983601:tid 983779] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:30.515695 2026] [core:error] [pid 983601:tid 983801] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:30.515714 2026] [core:error] [pid 983601:tid 983801] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:30.535028 2026] [security2:error] [pid 983601:tid 983848] [client 114.119.144.132:28783] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.lutheranphilosopher.com"] [uri "/apps/members/membersList%3Bjsessionid=FF8AC454C1DFDA11AFBCF6F43BDE8C01"] [unique_id "alxmWlaztLkF4ZwQhXIINwAAAPo"], referer: https://www.lutheranphilosopher.com/apps/members/membersList%3Bjsessionid=E1B61FE8D9195D2D9518A894E7556EBD?offset=1&q&sort=DISPLAY_NAME&view=list
[Sat Jul 18 23:53:30.584100 2026] [security2:error] [pid 983601:tid 983742] [client 57.141.18.38:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxmWlaztLkF4ZwQhXIILQAAAJA"]
[Sat Jul 18 23:53:30.689708 2026] [security2:error] [pid 983601:tid 983817] [client 103.160.26.178:63986] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmWlaztLkF4ZwQhXIIQwAAANs"]
[Sat Jul 18 23:53:30.689828 2026] [security2:error] [pid 983601:tid 983817] [client 103.160.26.178:63986] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmWlaztLkF4ZwQhXIIQwAAANs"]
[Sat Jul 18 23:53:30.720179 2026] [core:error] [pid 983601:tid 983792] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:30.720204 2026] [core:error] [pid 983601:tid 983792] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:30.731782 2026] [security2:error] [pid 983601:tid 983853] [client 114.119.150.15:35491] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "itekphonerepair.com"] [uri "/"] [unique_id "alxmWlaztLkF4ZwQhXIISQAAAP8"], referer: https://itekphonerepair.com/?s=%E8%B6%85%E7%BA%A7%E5%A4%A7%E4%B9%90%E9%80%8F%E5%BC%80%E5%A5%96-%E3%80%90%E2%9C%94%EF%B8%8F%E5%AE%98%E7%BD%91AA58%C2%B7CC%E2%9C%94%EF%B8%8F%E3%80%91-188sbk-%E8%B6%85%E7%BA%A7%E5%A4%A7%E4%B9%90%E9%80%8F%E5%BC%80%E5%A5%96engen-%E3%80%90%E2%9C%94%EF%B8%8F%E5%AE%98%E7%BD%91AA58%C2%B7CC%E2%9C%94%EF%B8%8F%E3%80%91-188sbkprqu-%E8%B6%85%E7%BA%A7%E5%A4%A7%E4%B9%90%E9%80%8F%E5%BC%80%E5%A5%9622qdx-188sbk8l2d
[Sat Jul 18 23:53:30.870989 2026] [security2:error] [pid 983601:tid 983798] [client 3.15.38.153:33470] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.sw[a-z]$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1275"] [id "390587"] [rev "5"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that end with .sw)"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/.env.swp"] [unique_id "alxmWlaztLkF4ZwQhXIIVAAAAMg"]
[Sat Jul 18 23:53:30.922512 2026] [security2:error] [pid 983601:tid 983814] [client 3.15.38.153:33470] ModSecurity: Access denied with code 406 (phase 2). Pattern match "[a-z0-9]~$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1257"] [id "390581"] [rev "1"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data Leakage - attempt to access backup file (disable this rule if you require access to files that end with a tilde)"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/.env~"] [unique_id "alxmWlaztLkF4ZwQhXIIWAAAANg"]
[Sat Jul 18 23:53:31.001684 2026] [core:error] [pid 983601:tid 983810] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:31.001706 2026] [core:error] [pid 983601:tid 983810] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:31.022344 2026] [security2:error] [pid 983601:tid 983856] [client 45.134.20.125:50963] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 125.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/bypass_1.php"] [unique_id "alxmW1aztLkF4ZwQhXIIXQAAAQI"]
[Sat Jul 18 23:53:31.104140 2026] [security2:error] [pid 983601:tid 983811] [client 185.132.186.8:28343] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 8.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/content.php"] [unique_id "alxmW1aztLkF4ZwQhXIIYwAAANU"]
[Sat Jul 18 23:53:31.183072 2026] [security2:error] [pid 983601:tid 983758] [client 138.252.89.100:63384] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmW1aztLkF4ZwQhXIIawAAAKA"]
[Sat Jul 18 23:53:31.183164 2026] [security2:error] [pid 983601:tid 983758] [client 138.252.89.100:63384] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmW1aztLkF4ZwQhXIIawAAAKA"]
[Sat Jul 18 23:53:31.191988 2026] [core:error] [pid 983601:tid 983848] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:31.192009 2026] [core:error] [pid 983601:tid 983848] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:31.378296 2026] [core:error] [pid 983601:tid 983753] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:31.378313 2026] [core:error] [pid 983601:tid 983753] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:31.397275 2026] [security2:error] [pid 983601:tid 983755] [client 104.164.176.128:48453] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "mochawavepublishing.com"] [uri "/index.php"] [unique_id "alxmWVaztLkF4ZwQhXIH3QAAAJ0"]
[Sat Jul 18 23:53:31.571437 2026] [core:error] [pid 983601:tid 983760] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:31.571467 2026] [core:error] [pid 983601:tid 983760] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:31.626818 2026] [security2:error] [pid 983601:tid 983769] [client 114.119.134.146:62107] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "thierry-henry.fr"] [uri "/pourquoi-trop-danalyse-paralyse"] [unique_id "alxmW1aztLkF4ZwQhXIImAAAAKs"], referer: https://thierry-henry.fr/pourquoi-trop-danalyse-paralyse?ak_action=accept_mobile
[Sat Jul 18 23:53:31.735499 2026] [security2:error] [pid 983601:tid 983806] [client 20.230.87.222:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 222.87.230.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.yidaiyi.org"] [uri "/wp-content/themes/wp-pridmag/lock.php"] [unique_id "alxmW1aztLkF4ZwQhXIInwAAANA"]
[Sat Jul 18 23:53:31.735589 2026] [security2:error] [pid 983601:tid 983806] [client 20.230.87.222:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.yidaiyi.org"] [uri "/wp-content/themes/wp-pridmag/lock.php"] [unique_id "alxmW1aztLkF4ZwQhXIInwAAANA"]
[Sat Jul 18 23:53:31.759864 2026] [core:error] [pid 983601:tid 983773] [client 3.15.38.153:33500] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:31.759883 2026] [core:error] [pid 983601:tid 983773] [client 3.15.38.153:33500] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:31.771220 2026] [security2:error] [pid 983601:tid 983615] [remote 209.42.21.221:39012] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 221.21.42.209.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxmW1aztLkF4ZwQhXIIogAAxw0"]
[Sat Jul 18 23:53:31.776404 2026] [security2:error] [pid 983601:tid 983759] [client 114.119.142.210:26079] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.zonemist.com"] [uri "/get-a-quote"] [unique_id "alxmW1aztLkF4ZwQhXIIqQAAAKE"], referer: https://www.zonemist.com/technology/studies-and-testing/
[Sat Jul 18 23:53:31.804068 2026] [security2:error] [pid 983601:tid 983829] [client 13.250.107.25:24760] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "cryptomeaning.com"] [uri "/tag/buy-bitcoin-at-walmart/"] [unique_id "alxmW1aztLkF4ZwQhXIIrgAAAOc"], referer: https://cryptomeaning.com/buy-bitcoin-at-walmart/
[Sat Jul 18 23:53:31.888571 2026] [security2:error] [pid 983601:tid 983748] [client 45.134.20.117:27713] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/js/elementskit.php"] [unique_id "alxmW1aztLkF4ZwQhXIItAAAAJY"]
[Sat Jul 18 23:53:31.933728 2026] [security2:error] [pid 983601:tid 983650] [remote 209.42.21.221:39012] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 221.21.42.209.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxmW1aztLkF4ZwQhXIIugAAnTA"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:53:31.951073 2026] [core:error] [pid 983601:tid 983836] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:31.951094 2026] [core:error] [pid 983601:tid 983836] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:31.970371 2026] [security2:error] [pid 983601:tid 983761] [client 57.141.18.55:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxmW1aztLkF4ZwQhXIIpQAAAKM"]
[Sat Jul 18 23:53:31.999620 2026] [security2:error] [pid 983601:tid 983780] [client 185.132.186.45:57151] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 45.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/uploads/about.php"] [unique_id "alxmW1aztLkF4ZwQhXIIvwAAALY"]
[Sat Jul 18 23:53:32.036882 2026] [security2:error] [pid 983601:tid 983804] [client 114.119.146.145:32611] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "massagelacey.com"] [uri "/lacey-massage/"] [unique_id "alxmXFaztLkF4ZwQhXIIwwAAAM4"], referer: https://massagelacey.com/category/massage-techniques
[Sat Jul 18 23:53:32.127879 2026] [core:error] [pid 983601:tid 983821] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:32.127899 2026] [core:error] [pid 983601:tid 983821] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:32.284938 2026] [security2:error] [pid 983601:tid 983784] [client 3.15.38.153:33528] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/app/.env"] [unique_id "alxmXFaztLkF4ZwQhXII0QAAALo"]
[Sat Jul 18 23:53:32.333596 2026] [security2:error] [pid 983601:tid 983770] [client 3.15.38.153:33528] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/apps/.env"] [unique_id "alxmXFaztLkF4ZwQhXII1gAAAKw"]
[Sat Jul 18 23:53:32.360551 2026] [security2:error] [pid 983601:tid 983734] [client 74.208.214.194:42882] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxmXFaztLkF4ZwQhXII2AAAAIg"]
[Sat Jul 18 23:53:32.382995 2026] [security2:error] [pid 983601:tid 983850] [client 3.15.38.153:33528] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/api/.env"] [unique_id "alxmXFaztLkF4ZwQhXII2QAAAPw"]
[Sat Jul 18 23:53:32.433484 2026] [security2:error] [pid 983601:tid 983836] [client 3.15.38.153:33528] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/web/.env"] [unique_id "alxmXFaztLkF4ZwQhXII4AAAAO4"]
[Sat Jul 18 23:53:32.486255 2026] [security2:error] [pid 983601:tid 983761] [client 3.15.38.153:33528] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/site/.env"] [unique_id "alxmXFaztLkF4ZwQhXII4gAAAKM"]
[Sat Jul 18 23:53:32.535500 2026] [security2:error] [pid 983601:tid 983776] [client 3.15.38.153:33528] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/public/.env"] [unique_id "alxmXFaztLkF4ZwQhXII6QAAALI"]
[Sat Jul 18 23:53:32.611050 2026] [core:error] [pid 983601:tid 983811] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:32.611073 2026] [core:error] [pid 983601:tid 983811] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:32.750250 2026] [security2:error] [pid 983601:tid 983801] [client 45.134.20.119:28697] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "alxmXFaztLkF4ZwQhXII-wAAAMs"]
[Sat Jul 18 23:53:32.769611 2026] [security2:error] [pid 983601:tid 983821] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/backend/.env"] [unique_id "alxmXFaztLkF4ZwQhXII_QAAAN8"]
[Sat Jul 18 23:53:32.819859 2026] [security2:error] [pid 983601:tid 983820] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/server/.env"] [unique_id "alxmXFaztLkF4ZwQhXIJBQAAAN4"]
[Sat Jul 18 23:53:32.834388 2026] [security2:error] [pid 983601:tid 983629] [remote 54.90.74.5:49746] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.74.90.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "jndsupport.com"] [uri "/phpinfo.php"] [unique_id "alxmXFaztLkF4ZwQhXIJBwAA1Bs"]
[Sat Jul 18 23:53:32.870156 2026] [security2:error] [pid 983601:tid 983759] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/frontend/.env"] [unique_id "alxmXFaztLkF4ZwQhXIJCgAAAKE"]
[Sat Jul 18 23:53:32.917707 2026] [security2:error] [pid 983601:tid 983782] [client 185.132.186.42:41971] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 42.186.132.185.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/wp-login.php"] [unique_id "alxmXFaztLkF4ZwQhXIJDAAAALg"]
[Sat Jul 18 23:53:32.922662 2026] [security2:error] [pid 983601:tid 983763] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/src/.env"] [unique_id "alxmXFaztLkF4ZwQhXIJEgAAAKU"]
[Sat Jul 18 23:53:32.971206 2026] [security2:error] [pid 983601:tid 983847] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/core/.env"] [unique_id "alxmXFaztLkF4ZwQhXIJGgAAAPk"]
[Sat Jul 18 23:53:33.020431 2026] [security2:error] [pid 983601:tid 983842] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/core/app/.env"] [unique_id "alxmXVaztLkF4ZwQhXIJHwAAAPQ"]
[Sat Jul 18 23:53:33.069919 2026] [security2:error] [pid 983601:tid 983792] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/config/.env"] [unique_id "alxmXVaztLkF4ZwQhXIJIwAAAMI"]
[Sat Jul 18 23:53:33.120533 2026] [security2:error] [pid 983601:tid 983848] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/private/.env"] [unique_id "alxmXVaztLkF4ZwQhXIJJQAAAPo"]
[Sat Jul 18 23:53:33.170155 2026] [security2:error] [pid 983601:tid 983804] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/application/.env"] [unique_id "alxmXVaztLkF4ZwQhXIJJwAAAM4"]
[Sat Jul 18 23:53:33.229086 2026] [security2:error] [pid 983601:tid 983766] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/bootstrap/.env"] [unique_id "alxmXVaztLkF4ZwQhXIJKwAAAKg"]
[Sat Jul 18 23:53:33.279156 2026] [security2:error] [pid 983601:tid 983783] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/database/.env"] [unique_id "alxmXVaztLkF4ZwQhXIJMAAAALk"]
[Sat Jul 18 23:53:33.328768 2026] [security2:error] [pid 983601:tid 983813] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/storage/.env"] [unique_id "alxmXVaztLkF4ZwQhXIJMQAAANc"]
[Sat Jul 18 23:53:33.378181 2026] [security2:error] [pid 983601:tid 983820] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/var/www/.env"] [unique_id "alxmXVaztLkF4ZwQhXIJNQAAAN4"]
[Sat Jul 18 23:53:33.410067 2026] [security2:error] [pid 983601:tid 983609] [remote 20.153.140.50:40578] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "jhavoctattoos.com"] [uri "/wp-login.php"] [unique_id "alxmXVaztLkF4ZwQhXIJNgAAnQc"]
[Sat Jul 18 23:53:33.427788 2026] [security2:error] [pid 983601:tid 983741] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/var/www/html/.env"] [unique_id "alxmXVaztLkF4ZwQhXIJOQAAAI8"]
[Sat Jul 18 23:53:33.478828 2026] [security2:error] [pid 983601:tid 983763] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/current/.env"] [unique_id "alxmXVaztLkF4ZwQhXIJPQAAAKU"]
[Sat Jul 18 23:53:33.529023 2026] [security2:error] [pid 983601:tid 983814] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/release/.env"] [unique_id "alxmXVaztLkF4ZwQhXIJRAAAANg"]
[Sat Jul 18 23:53:33.579726 2026] [security2:error] [pid 983601:tid 983851] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/releases/.env"] [unique_id "alxmXVaztLkF4ZwQhXIJRgAAAP0"]
[Sat Jul 18 23:53:33.604222 2026] [security2:error] [pid 983601:tid 983732] [client 45.134.20.135:24117] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/pki-validation/kur.php"] [unique_id "alxmXVaztLkF4ZwQhXIJSQAAAIY"]
[Sat Jul 18 23:53:33.628872 2026] [security2:error] [pid 983601:tid 983779] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/shared/.env"] [unique_id "alxmXVaztLkF4ZwQhXIJTgAAALU"]
[Sat Jul 18 23:53:33.679587 2026] [security2:error] [pid 983601:tid 983846] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/deploy/.env"] [unique_id "alxmXVaztLkF4ZwQhXIJUAAAAPg"]
[Sat Jul 18 23:53:33.728587 2026] [security2:error] [pid 983601:tid 983792] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/build/.env"] [unique_id "alxmXVaztLkF4ZwQhXIJUgAAAMI"]
[Sat Jul 18 23:53:33.782475 2026] [security2:error] [pid 983601:tid 983808] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/dist/.env"] [unique_id "alxmXVaztLkF4ZwQhXIJVQAAANI"]
[Sat Jul 18 23:53:33.797307 2026] [security2:error] [pid 983601:tid 983670] [remote 20.153.140.50:40578] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "jhavoctattoos.com"] [uri "/wp-login.php"] [unique_id "alxmXVaztLkF4ZwQhXIJVgAAtkQ"], referer: https://jhavoctattoos.com/wp-login.php
[Sat Jul 18 23:53:33.812439 2026] [security2:error] [pid 983601:tid 983766] [client 185.132.186.22:59107] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 22.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "alxmXVaztLkF4ZwQhXIJWgAAAKg"]
[Sat Jul 18 23:53:33.833053 2026] [security2:error] [pid 983601:tid 983798] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/public_html/.env"] [unique_id "alxmXVaztLkF4ZwQhXIJXAAAAMg"]
[Sat Jul 18 23:53:33.876134 2026] [security2:error] [pid 983601:tid 983611] [remote 54.90.74.5:49758] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.74.90.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "jndsupport.com"] [uri "/info.php"] [unique_id "alxmXVaztLkF4ZwQhXIJXQAA1gk"]
[Sat Jul 18 23:53:33.883650 2026] [security2:error] [pid 983601:tid 983802] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/htdocs/.env"] [unique_id "alxmXVaztLkF4ZwQhXIJXwAAAMw"]
[Sat Jul 18 23:53:33.933492 2026] [security2:error] [pid 983601:tid 983840] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/www/.env"] [unique_id "alxmXVaztLkF4ZwQhXIJZAAAAPI"]
[Sat Jul 18 23:53:33.982880 2026] [security2:error] [pid 983601:tid 983827] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/html/.env"] [unique_id "alxmXVaztLkF4ZwQhXIJbgAAAOU"]
[Sat Jul 18 23:53:34.033119 2026] [security2:error] [pid 983601:tid 983841] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/live/.env"] [unique_id "alxmXlaztLkF4ZwQhXIJcgAAAPM"]
[Sat Jul 18 23:53:34.084051 2026] [security2:error] [pid 983601:tid 983830] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/prod/.env"] [unique_id "alxmXlaztLkF4ZwQhXIJeQAAAOg"]
[Sat Jul 18 23:53:34.114280 2026] [security2:error] [pid 983601:tid 983646] [remote 54.90.74.5:49772] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.74.90.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "jndsupport.com"] [uri "/php_info.php"] [unique_id "alxmXlaztLkF4ZwQhXIJegAA0yw"]
[Sat Jul 18 23:53:34.133931 2026] [security2:error] [pid 983601:tid 983779] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/dev/.env"] [unique_id "alxmXlaztLkF4ZwQhXIJewAAALU"]
[Sat Jul 18 23:53:34.184613 2026] [security2:error] [pid 983601:tid 983776] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/staging/.env"] [unique_id "alxmXlaztLkF4ZwQhXIJfQAAALI"]
[Sat Jul 18 23:53:34.234634 2026] [security2:error] [pid 983601:tid 983766] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/opt/.env"] [unique_id "alxmXlaztLkF4ZwQhXIJfgAAAKg"]
[Sat Jul 18 23:53:34.291174 2026] [security2:error] [pid 983601:tid 983813] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/laravel/.env"] [unique_id "alxmXlaztLkF4ZwQhXIJggAAANc"]
[Sat Jul 18 23:53:34.341502 2026] [security2:error] [pid 983601:tid 983746] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/symfony/.env"] [unique_id "alxmXlaztLkF4ZwQhXIJiAAAAJQ"]
[Sat Jul 18 23:53:34.343897 2026] [security2:error] [pid 983601:tid 983831] [client 45.127.250.191:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.according2plant.com"] [uri "/index.php"] [unique_id "alxmXFaztLkF4ZwQhXII9AAAAOk"]
[Sat Jul 18 23:53:34.352926 2026] [security2:error] [pid 983601:tid 983698] [remote 54.90.74.5:49786] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.74.90.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "jndsupport.com"] [uri "/test.php"] [unique_id "alxmXlaztLkF4ZwQhXIJigAAomA"]
[Sat Jul 18 23:53:34.390854 2026] [security2:error] [pid 983601:tid 983758] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/wordpress/.env"] [unique_id "alxmXlaztLkF4ZwQhXIJjgAAAKA"]
[Sat Jul 18 23:53:34.441008 2026] [security2:error] [pid 983601:tid 983817] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/wp/.env"] [unique_id "alxmXlaztLkF4ZwQhXIJkgAAANs"]
[Sat Jul 18 23:53:34.472030 2026] [security2:error] [pid 983601:tid 983794] [client 45.134.20.118:36977] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/click.php"] [unique_id "alxmXlaztLkF4ZwQhXIJlgAAAMQ"]
[Sat Jul 18 23:53:34.492843 2026] [security2:error] [pid 983601:tid 983781] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/cms/.env"] [unique_id "alxmXlaztLkF4ZwQhXIJmAAAALc"]
[Sat Jul 18 23:53:34.541912 2026] [security2:error] [pid 983601:tid 983857] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/drupal/.env"] [unique_id "alxmXlaztLkF4ZwQhXIJngAAAQM"]
[Sat Jul 18 23:53:34.592231 2026] [security2:error] [pid 983601:tid 983850] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/joomla/.env"] [unique_id "alxmXlaztLkF4ZwQhXIJoAAAAPw"]
[Sat Jul 18 23:53:34.616008 2026] [security2:error] [pid 983601:tid 983724] [remote 47.86.33.52:52998] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "fineartsfactory.net"] [uri "/wp-login.php"] [unique_id "alxmXlaztLkF4ZwQhXIJoQAAl3o"]
[Sat Jul 18 23:53:34.625472 2026] [security2:error] [pid 983601:tid 983759] [client 114.119.156.146:63659] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.savilerowtravel.com"] [uri "/news/savile-row-travel-concierge-the-hottest-tickets/delano-miami-south-beach-1200w/"] [unique_id "alxmXlaztLkF4ZwQhXIJowAAAKE"], referer: https://www.savilerowtravel.com/news/savile-row-travel-concierge-the-hottest-tickets/delano-miami-south-beach-1200w/
[Sat Jul 18 23:53:34.642000 2026] [security2:error] [pid 983601:tid 983799] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/magento/.env"] [unique_id "alxmXlaztLkF4ZwQhXIJpAAAAMk"]
[Sat Jul 18 23:53:34.692166 2026] [security2:error] [pid 983601:tid 983834] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/shopify/.env"] [unique_id "alxmXlaztLkF4ZwQhXIJrQAAAOw"]
[Sat Jul 18 23:53:34.710223 2026] [security2:error] [pid 983601:tid 983804] [client 185.132.186.19:42339] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 19.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/languages/about.php"] [unique_id "alxmXlaztLkF4ZwQhXIJrwAAAM4"]
[Sat Jul 18 23:53:34.743858 2026] [security2:error] [pid 983601:tid 983813] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/prestashop/.env"] [unique_id "alxmXlaztLkF4ZwQhXIJsgAAANc"]
[Sat Jul 18 23:53:34.778914 2026] [security2:error] [pid 983601:tid 983663] [remote 47.86.33.52:30134] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxmXlaztLkF4ZwQhXIJswAA8j0"]
[Sat Jul 18 23:53:34.794015 2026] [security2:error] [pid 983601:tid 983753] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/codeigniter/.env"] [unique_id "alxmXlaztLkF4ZwQhXIJtAAAAJs"]
[Sat Jul 18 23:53:34.845043 2026] [security2:error] [pid 983601:tid 983818] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/cakephp/.env"] [unique_id "alxmXlaztLkF4ZwQhXIJtgAAANw"]
[Sat Jul 18 23:53:34.894593 2026] [security2:error] [pid 983601:tid 983827] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/zend/.env"] [unique_id "alxmXlaztLkF4ZwQhXIJvgAAAOU"]
[Sat Jul 18 23:53:34.919412 2026] [security2:error] [pid 983601:tid 983669] [remote 54.90.74.5:49788] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.74.90.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "jndsupport.com"] [uri "/i.php"] [unique_id "alxmXlaztLkF4ZwQhXIJxAAAlEM"]
[Sat Jul 18 23:53:34.943350 2026] [security2:error] [pid 983601:tid 983829] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/yii/.env"] [unique_id "alxmXlaztLkF4ZwQhXIJyQAAAOc"]
[Sat Jul 18 23:53:34.965281 2026] [ssl:error] [pid 983601:tid 983819] [client 104.48.69.105:53994] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname www.icemarc.org provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:53:34.993065 2026] [security2:error] [pid 983601:tid 983837] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/laravel5/.env"] [unique_id "alxmXlaztLkF4ZwQhXIJzQAAAO8"]
[Sat Jul 18 23:53:35.043365 2026] [security2:error] [pid 983601:tid 983847] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/v1/.env"] [unique_id "alxmX1aztLkF4ZwQhXIJ0wAAAPk"]
[Sat Jul 18 23:53:35.092797 2026] [security2:error] [pid 983601:tid 983779] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/v2/.env"] [unique_id "alxmX1aztLkF4ZwQhXIJ1wAAALU"]
[Sat Jul 18 23:53:35.101395 2026] [security2:error] [pid 983601:tid 983699] [remote 188.138.102.156:40666] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxmX1aztLkF4ZwQhXIJ2gAAoGE"]
[Sat Jul 18 23:53:35.142594 2026] [security2:error] [pid 983601:tid 983799] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/v3/.env"] [unique_id "alxmX1aztLkF4ZwQhXIJ3QAAAMk"]
[Sat Jul 18 23:53:35.143383 2026] [security2:error] [pid 983601:tid 983807] [client 139.167.225.146:49309] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxmX1aztLkF4ZwQhXIJ3gAAANE"]
[Sat Jul 18 23:53:35.143469 2026] [security2:error] [pid 983601:tid 983807] [client 139.167.225.146:49309] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxmX1aztLkF4ZwQhXIJ3gAAANE"]
[Sat Jul 18 23:53:35.156227 2026] [security2:error] [pid 983601:tid 983776] [client 85.204.70.98:38458] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "illuminatuscgi.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "alxmX1aztLkF4ZwQhXIJ3wAAALI"]
[Sat Jul 18 23:53:35.192535 2026] [security2:error] [pid 983601:tid 983834] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/api/v1/.env"] [unique_id "alxmX1aztLkF4ZwQhXIJ4AAAAOw"]
[Sat Jul 18 23:53:35.241578 2026] [security2:error] [pid 983601:tid 983856] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/api/v2/.env"] [unique_id "alxmX1aztLkF4ZwQhXIJ5wAAAQI"]
[Sat Jul 18 23:53:35.291467 2026] [security2:error] [pid 983601:tid 983826] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/rest/.env"] [unique_id "alxmX1aztLkF4ZwQhXIJ7AAAAOQ"]
[Sat Jul 18 23:53:35.323824 2026] [security2:error] [pid 983601:tid 983702] [remote 188.138.102.156:40666] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 156.102.138.188.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxmX1aztLkF4ZwQhXIJ7QAA6WQ"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:53:35.325787 2026] [security2:error] [pid 983601:tid 983767] [client 45.134.20.119:48037] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "alxmX1aztLkF4ZwQhXIJ7gAAAKk"]
[Sat Jul 18 23:53:35.341415 2026] [security2:error] [pid 983601:tid 983827] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/graphql/.env"] [unique_id "alxmX1aztLkF4ZwQhXIJ7wAAAOU"]
[Sat Jul 18 23:53:35.378102 2026] [security2:error] [pid 983601:tid 983801] [client 3.109.49.224:24478] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.49.109.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxmX1aztLkF4ZwQhXIJ9AAAAMs"]
[Sat Jul 18 23:53:35.378178 2026] [security2:error] [pid 983601:tid 983801] [client 3.109.49.224:24478] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxmX1aztLkF4ZwQhXIJ9AAAAMs"]
[Sat Jul 18 23:53:35.392501 2026] [security2:error] [pid 983601:tid 983829] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/gateway/.env"] [unique_id "alxmX1aztLkF4ZwQhXIJ9QAAAOc"]
[Sat Jul 18 23:53:35.441534 2026] [security2:error] [pid 983601:tid 983837] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/microservice/.env"] [unique_id "alxmX1aztLkF4ZwQhXIJ-gAAAO8"]
[Sat Jul 18 23:53:35.459368 2026] [security2:error] [pid 983601:tid 983693] [remote 47.86.33.52:52998] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "fineartsfactory.net"] [uri "/wp-login.php"] [unique_id "alxmX1aztLkF4ZwQhXIJ-wAAx1s"], referer: https://fineartsfactory.net/wp-login.php
[Sat Jul 18 23:53:35.462724 2026] [security2:error] [pid 983601:tid 983844] [client 85.204.70.98:38460] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 98.70.204.85.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "illuminatuscgi.com"] [uri "/xmlrpc.php"] [unique_id "alxmX1aztLkF4ZwQhXIJ_AAAAPY"]
[Sat Jul 18 23:53:35.492213 2026] [security2:error] [pid 983601:tid 983769] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/service/.env"] [unique_id "alxmX1aztLkF4ZwQhXIJ_gAAAKs"]
[Sat Jul 18 23:53:35.542334 2026] [security2:error] [pid 983601:tid 983765] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/api/v3/.env"] [unique_id "alxmX1aztLkF4ZwQhXIKAQAAAKc"]
[Sat Jul 18 23:53:35.591850 2026] [security2:error] [pid 983601:tid 983749] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/api/dev/.env"] [unique_id "alxmX1aztLkF4ZwQhXIKBAAAAJc"]
[Sat Jul 18 23:53:35.593068 2026] [security2:error] [pid 983601:tid 983753] [client 54.90.74.5:49790] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmX1aztLkF4ZwQhXIJ9wAAmyk"]
[Sat Jul 18 23:53:35.614547 2026] [security2:error] [pid 983601:tid 983758] [client 185.132.186.11:44347] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 11.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/plugins/wp-theme-editor/include.php"] [unique_id "alxmX1aztLkF4ZwQhXIKCAAAAKA"]
[Sat Jul 18 23:53:35.642431 2026] [security2:error] [pid 983601:tid 983823] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/api/staging/.env"] [unique_id "alxmX1aztLkF4ZwQhXIKDAAAAOE"]
[Sat Jul 18 23:53:35.692207 2026] [security2:error] [pid 983601:tid 983745] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/vendor/.env"] [unique_id "alxmX1aztLkF4ZwQhXIKFQAAAJM"]
[Sat Jul 18 23:53:35.742277 2026] [security2:error] [pid 983601:tid 983804] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/lib/.env"] [unique_id "alxmX1aztLkF4ZwQhXIKGgAAAM4"]
[Sat Jul 18 23:53:35.792865 2026] [security2:error] [pid 983601:tid 983788] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/resources/.env"] [unique_id "alxmX1aztLkF4ZwQhXIKIAAAAL4"]
[Sat Jul 18 23:53:35.842200 2026] [security2:error] [pid 983601:tid 983813] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/assets/.env"] [unique_id "alxmX1aztLkF4ZwQhXIKIgAAANc"]
[Sat Jul 18 23:53:35.870204 2026] [security2:error] [pid 983601:tid 983812] [client 85.204.70.98:38472] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "illuminatuscgi.com"] [uri "/blog/wp-includes/wlwmanifest.xml"] [unique_id "alxmX1aztLkF4ZwQhXIKIwAAANY"]
[Sat Jul 18 23:53:35.893860 2026] [security2:error] [pid 983601:tid 983853] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/uploads/.env"] [unique_id "alxmX1aztLkF4ZwQhXIKJAAAAP8"]
[Sat Jul 18 23:53:35.943597 2026] [security2:error] [pid 983601:tid 983818] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/internal/.env"] [unique_id "alxmX1aztLkF4ZwQhXIKJgAAANw"]
[Sat Jul 18 23:53:35.985836 2026] [security2:error] [pid 983601:tid 983760] [client 159.89.12.166:51090] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 166.12.89.159.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "mail.qqx.crt.mybluehost.me"] [uri "/info.php"] [unique_id "alxmX1aztLkF4ZwQhXIKKwAAAKI"]
[Sat Jul 18 23:53:35.992886 2026] [security2:error] [pid 983601:tid 983763] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/tools/.env"] [unique_id "alxmX1aztLkF4ZwQhXIKLQAAAKU"]
[Sat Jul 18 23:53:35.995195 2026] [security2:error] [pid 983601:tid 983696] [remote 47.86.33.52:30134] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxmX1aztLkF4ZwQhXIKKgAAj14"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:53:36.045297 2026] [security2:error] [pid 983601:tid 983793] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/scripts/.env"] [unique_id "alxmYFaztLkF4ZwQhXIKNgAAAMM"]
[Sat Jul 18 23:53:36.094540 2026] [security2:error] [pid 983601:tid 983766] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/bin/.env"] [unique_id "alxmYFaztLkF4ZwQhXIKOwAAAKg"]
[Sat Jul 18 23:53:36.135997 2026] [security2:error] [pid 983601:tid 983847] [client 85.204.70.98:38488] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "illuminatuscgi.com"] [uri "/web/wp-includes/wlwmanifest.xml"] [unique_id "alxmYFaztLkF4ZwQhXIKPgAAAPk"]
[Sat Jul 18 23:53:36.146791 2026] [security2:error] [pid 983601:tid 983809] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/sbin/.env"] [unique_id "alxmYFaztLkF4ZwQhXIKPwAAANM"]
[Sat Jul 18 23:53:36.178360 2026] [security2:error] [pid 983601:tid 983832] [client 45.134.20.117:36077] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "alxmYFaztLkF4ZwQhXIKQAAAAOo"]
[Sat Jul 18 23:53:36.196464 2026] [security2:error] [pid 983601:tid 983758] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/local/.env"] [unique_id "alxmYFaztLkF4ZwQhXIKQwAAAKA"]
[Sat Jul 18 23:53:36.247191 2026] [security2:error] [pid 983601:tid 983848] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/portal/.env"] [unique_id "alxmYFaztLkF4ZwQhXIKTAAAAPo"]
[Sat Jul 18 23:53:36.297518 2026] [security2:error] [pid 983601:tid 983789] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/dashboard/.env"] [unique_id "alxmYFaztLkF4ZwQhXIKUgAAAL8"]
[Sat Jul 18 23:53:36.352126 2026] [security2:error] [pid 983601:tid 983778] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/panel/.env"] [unique_id "alxmYFaztLkF4ZwQhXIKVQAAALQ"]
[Sat Jul 18 23:53:36.401894 2026] [security2:error] [pid 983601:tid 983739] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/crm/.env"] [unique_id "alxmYFaztLkF4ZwQhXIKVwAAAI0"]
[Sat Jul 18 23:53:36.403475 2026] [security2:error] [pid 983601:tid 983812] [client 85.204.70.98:38496] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "illuminatuscgi.com"] [uri "/wordpress/wp-includes/wlwmanifest.xml"] [unique_id "alxmYFaztLkF4ZwQhXIKWAAAANY"]
[Sat Jul 18 23:53:36.452379 2026] [security2:error] [pid 983601:tid 983808] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/erp/.env"] [unique_id "alxmYFaztLkF4ZwQhXIKXAAAANI"]
[Sat Jul 18 23:53:36.501968 2026] [security2:error] [pid 983601:tid 983801] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/shop/.env"] [unique_id "alxmYFaztLkF4ZwQhXIKYQAAAMs"]
[Sat Jul 18 23:53:36.511356 2026] [security2:error] [pid 983601:tid 983777] [client 185.132.186.34:25741] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 34.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/plugins/up/main.php"] [unique_id "alxmYFaztLkF4ZwQhXIKYgAAALM"]
[Sat Jul 18 23:53:36.550558 2026] [security2:error] [pid 983601:tid 983752] [client 3.15.38.153:33544] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/store/.env"] [unique_id "alxmYFaztLkF4ZwQhXIKZQAAAJo"]
[Sat Jul 18 23:53:36.689261 2026] [security2:error] [pid 983601:tid 983738] [client 85.204.70.98:38512] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "illuminatuscgi.com"] [uri "/website/wp-includes/wlwmanifest.xml"] [unique_id "alxmYFaztLkF4ZwQhXIKdQAAAIw"]
[Sat Jul 18 23:53:36.698257 2026] [security2:error] [pid 983601:tid 983784] [client 3.15.38.153:59826] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/saas/.env"] [unique_id "alxmYFaztLkF4ZwQhXIKdwAAALo"]
[Sat Jul 18 23:53:36.747827 2026] [security2:error] [pid 983601:tid 983814] [client 3.15.38.153:59826] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/client/.env"] [unique_id "alxmYFaztLkF4ZwQhXIKewAAANg"]
[Sat Jul 18 23:53:36.797028 2026] [security2:error] [pid 983601:tid 983796] [client 3.15.38.153:59826] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/project/.env"] [unique_id "alxmYFaztLkF4ZwQhXIKgAAAAMY"]
[Sat Jul 18 23:53:36.846267 2026] [security2:error] [pid 983601:tid 983815] [client 3.15.38.153:59826] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/admin-panel/.env"] [unique_id "alxmYFaztLkF4ZwQhXIKggAAANk"]
[Sat Jul 18 23:53:36.895505 2026] [security2:error] [pid 983601:tid 983843] [client 3.15.38.153:59826] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/control-panel/.env"] [unique_id "alxmYFaztLkF4ZwQhXIKgwAAAPU"]
[Sat Jul 18 23:53:36.944743 2026] [security2:error] [pid 983601:tid 983850] [client 3.15.38.153:59826] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/user-panel/.env"] [unique_id "alxmYFaztLkF4ZwQhXIKhQAAAPw"]
[Sat Jul 18 23:53:36.976950 2026] [security2:error] [pid 983601:tid 983839] [client 85.204.70.98:38516] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "illuminatuscgi.com"] [uri "/wp/wp-includes/wlwmanifest.xml"] [unique_id "alxmYFaztLkF4ZwQhXIKiQAAAPE"]
[Sat Jul 18 23:53:36.995765 2026] [security2:error] [pid 983601:tid 983834] [client 3.15.38.153:59826] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/node/.env"] [unique_id "alxmYFaztLkF4ZwQhXIKigAAAOw"]
[Sat Jul 18 23:53:36.998708 2026] [security2:error] [pid 983601:tid 983842] [remote 54.90.74.5:47720] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmX1aztLkF4ZwQhXIKJwABAVQ"]
[Sat Jul 18 23:53:37.031971 2026] [security2:error] [pid 983601:tid 983742] [client 45.134.20.114:38545] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/error.php"] [unique_id "alxmYVaztLkF4ZwQhXIKjgAAAJA"]
[Sat Jul 18 23:53:37.046707 2026] [security2:error] [pid 983601:tid 983739] [client 3.15.38.153:59826] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/express/.env"] [unique_id "alxmYVaztLkF4ZwQhXIKkgAAAI0"]
[Sat Jul 18 23:53:37.095632 2026] [security2:error] [pid 983601:tid 983840] [client 3.15.38.153:59826] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/next/.env"] [unique_id "alxmYVaztLkF4ZwQhXIKmQAAAPI"]
[Sat Jul 18 23:53:37.145438 2026] [security2:error] [pid 983601:tid 983773] [client 3.15.38.153:59826] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/nuxt/.env"] [unique_id "alxmYVaztLkF4ZwQhXIKnwAAAK8"]
[Sat Jul 18 23:53:37.195619 2026] [security2:error] [pid 983601:tid 983749] [client 3.15.38.153:59826] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/nest/.env"] [unique_id "alxmYVaztLkF4ZwQhXIKogAAAJc"]
[Sat Jul 18 23:53:37.246375 2026] [security2:error] [pid 983601:tid 983837] [client 3.15.38.153:59826] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/react/.env"] [unique_id "alxmYVaztLkF4ZwQhXIKqAAAAO8"]
[Sat Jul 18 23:53:37.249226 2026] [security2:error] [pid 983601:tid 983748] [client 85.204.70.98:38524] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "illuminatuscgi.com"] [uri "/news/wp-includes/wlwmanifest.xml"] [unique_id "alxmYVaztLkF4ZwQhXIKqgAAAJY"]
[Sat Jul 18 23:53:37.295906 2026] [security2:error] [pid 983601:tid 983765] [client 3.15.38.153:59826] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/vue/.env"] [unique_id "alxmYVaztLkF4ZwQhXIKqwAAAKc"]
[Sat Jul 18 23:53:37.344927 2026] [security2:error] [pid 983601:tid 983821] [client 3.15.38.153:59826] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/angular/.env"] [unique_id "alxmYVaztLkF4ZwQhXIKrwAAAN8"]
[Sat Jul 18 23:53:37.395368 2026] [security2:error] [pid 983601:tid 983847] [client 3.15.38.153:59826] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/svelte/.env"] [unique_id "alxmYVaztLkF4ZwQhXIKtAAAAPk"]
[Sat Jul 18 23:53:37.409608 2026] [security2:error] [pid 983601:tid 983768] [client 185.132.186.21:27961] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 21.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/fonts/fontawesome-webfont.php"] [unique_id "alxmYVaztLkF4ZwQhXIKtQAAAKo"]
[Sat Jul 18 23:53:37.446688 2026] [security2:error] [pid 983601:tid 983753] [client 3.15.38.153:59826] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/vite/.env"] [unique_id "alxmYVaztLkF4ZwQhXIKtgAAAJs"]
[Sat Jul 18 23:53:37.495626 2026] [security2:error] [pid 983601:tid 983848] [client 3.15.38.153:59826] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/backup/.env"] [unique_id "alxmYVaztLkF4ZwQhXIKvgAAAPo"]
[Sat Jul 18 23:53:37.511438 2026] [security2:error] [pid 983601:tid 983609] [remote 154.61.75.100:47656] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "wgs.doq.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxmYVaztLkF4ZwQhXIKvwAA9wc"]
[Sat Jul 18 23:53:37.511580 2026] [security2:error] [pid 983601:tid 983845] [client 154.61.75.100:47656] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "wgs.doq.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxmYVaztLkF4ZwQhXIKvwAA9wc"]
[Sat Jul 18 23:53:37.516465 2026] [security2:error] [pid 983601:tid 983838] [client 85.204.70.98:38534] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "illuminatuscgi.com"] [uri "/2018/wp-includes/wlwmanifest.xml"] [unique_id "alxmYVaztLkF4ZwQhXIKwgAAAPA"]
[Sat Jul 18 23:53:37.545270 2026] [security2:error] [pid 983601:tid 983826] [client 3.15.38.153:59826] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/backups/.env"] [unique_id "alxmYVaztLkF4ZwQhXIKxwAAAOQ"]
[Sat Jul 18 23:53:37.594907 2026] [security2:error] [pid 983601:tid 983853] [client 3.15.38.153:59826] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/old/.env"] [unique_id "alxmYVaztLkF4ZwQhXIKyQAAAP8"]
[Sat Jul 18 23:53:37.645075 2026] [security2:error] [pid 983601:tid 983744] [client 3.15.38.153:59826] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/tmp/.env"] [unique_id "alxmYVaztLkF4ZwQhXIKygAAAJI"]
[Sat Jul 18 23:53:37.694315 2026] [security2:error] [pid 983601:tid 983777] [client 3.15.38.153:59826] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/temp/.env"] [unique_id "alxmYVaztLkF4ZwQhXIKzgAAALM"]
[Sat Jul 18 23:53:37.743295 2026] [security2:error] [pid 983601:tid 983858] [client 3.15.38.153:59826] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/lab/.env"] [unique_id "alxmYVaztLkF4ZwQhXIK0wAAAQQ"]
[Sat Jul 18 23:53:37.793653 2026] [security2:error] [pid 983601:tid 983824] [client 3.15.38.153:59826] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/cronlab/.env"] [unique_id "alxmYVaztLkF4ZwQhXIK2AAAAOI"]
[Sat Jul 18 23:53:37.799071 2026] [security2:error] [pid 983601:tid 983737] [client 85.204.70.98:38544] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "illuminatuscgi.com"] [uri "/2019/wp-includes/wlwmanifest.xml"] [unique_id "alxmYVaztLkF4ZwQhXIK2QAAAIs"]
[Sat Jul 18 23:53:37.843385 2026] [security2:error] [pid 983601:tid 983844] [client 3.15.38.153:59826] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/cron/.env"] [unique_id "alxmYVaztLkF4ZwQhXIK3QAAAPY"]
[Sat Jul 18 23:53:37.885983 2026] [security2:error] [pid 983601:tid 983820] [client 45.134.20.115:51075] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/ALFA_DATA/alfacgiapi/all.php"] [unique_id "alxmYVaztLkF4ZwQhXIK4QAAAN4"]
[Sat Jul 18 23:53:37.901512 2026] [security2:error] [pid 983601:tid 983772] [client 3.15.38.153:59826] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/en/.env"] [unique_id "alxmYVaztLkF4ZwQhXIK5AAAAK4"]
[Sat Jul 18 23:53:38.011315 2026] [security2:error] [pid 983601:tid 983748] [client 3.15.38.153:59826] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/administrator/.env"] [unique_id "alxmYVaztLkF4ZwQhXIK6QAAAJY"]
[Sat Jul 18 23:53:38.061666 2026] [security2:error] [pid 983601:tid 983765] [client 3.15.38.153:59826] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/psnlink/.env"] [unique_id "alxmYlaztLkF4ZwQhXIK7AAAAKc"]
[Sat Jul 18 23:53:38.077455 2026] [security2:error] [pid 983601:tid 983821] [client 85.204.70.98:38556] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "illuminatuscgi.com"] [uri "/shop/wp-includes/wlwmanifest.xml"] [unique_id "alxmYlaztLkF4ZwQhXIK7gAAAN8"]
[Sat Jul 18 23:53:38.110653 2026] [security2:error] [pid 983601:tid 983857] [client 3.15.38.153:59826] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/exapi/.env"] [unique_id "alxmYlaztLkF4ZwQhXIK8gAAAQM"]
[Sat Jul 18 23:53:38.114472 2026] [security2:error] [pid 983601:tid 983812] [client 180.252.198.240:55684] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmYlaztLkF4ZwQhXIK8QAAANY"]
[Sat Jul 18 23:53:38.114581 2026] [security2:error] [pid 983601:tid 983812] [client 180.252.198.240:55684] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmYlaztLkF4ZwQhXIK8QAAANY"]
[Sat Jul 18 23:53:38.162225 2026] [security2:error] [pid 983601:tid 983841] [client 3.15.38.153:59826] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/sitemaps/.env"] [unique_id "alxmYlaztLkF4ZwQhXIK-AAAAPM"]
[Sat Jul 18 23:53:38.238688 2026] [core:error] [pid 983601:tid 983816] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:38.238705 2026] [core:error] [pid 983601:tid 983816] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:38.253244 2026] [security2:error] [pid 983601:tid 983732] [client 114.119.157.174:62015] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "bruceledewitz.com"] [uri "/the-struggle-in-the-middle-east-is-religious-it-needs-a-religious-reconciliation/"] [unique_id "alxmYlaztLkF4ZwQhXILAAAAAIY"], referer: https://bruceledewitz.com/blog/
[Sat Jul 18 23:53:38.304565 2026] [security2:error] [pid 983601:tid 983807] [client 185.132.186.34:35115] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 34.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "alxmYlaztLkF4ZwQhXILBAAAANE"]
[Sat Jul 18 23:53:38.334310 2026] [security2:error] [pid 983601:tid 983777] [client 85.204.70.98:38560] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "illuminatuscgi.com"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "alxmYlaztLkF4ZwQhXILBgAAALM"]
[Sat Jul 18 23:53:38.417704 2026] [core:error] [pid 983601:tid 983731] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:38.417719 2026] [core:error] [pid 983601:tid 983731] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:38.573881 2026] [security2:error] [pid 983601:tid 983734] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/logs/.env"] [unique_id "alxmYlaztLkF4ZwQhXILGAAAAIg"]
[Sat Jul 18 23:53:38.598696 2026] [security2:error] [pid 983601:tid 983784] [client 85.204.70.98:38570] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "illuminatuscgi.com"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "alxmYlaztLkF4ZwQhXILGgAAALo"]
[Sat Jul 18 23:53:38.618173 2026] [security2:error] [pid 983601:tid 983823] [client 36.83.95.75:60588] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmYlaztLkF4ZwQhXILGwAAAOE"]
[Sat Jul 18 23:53:38.618255 2026] [security2:error] [pid 983601:tid 983823] [client 36.83.95.75:60588] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmYlaztLkF4ZwQhXILGwAAAOE"]
[Sat Jul 18 23:53:38.624353 2026] [security2:error] [pid 983601:tid 983765] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/cache/.env"] [unique_id "alxmYlaztLkF4ZwQhXILHAAAAKc"]
[Sat Jul 18 23:53:38.674864 2026] [security2:error] [pid 983601:tid 983857] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/mailer/.env"] [unique_id "alxmYlaztLkF4ZwQhXILJAAAAQM"]
[Sat Jul 18 23:53:38.724910 2026] [security2:error] [pid 983601:tid 983796] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/mail/.env"] [unique_id "alxmYlaztLkF4ZwQhXILJwAAAMY"]
[Sat Jul 18 23:53:38.740881 2026] [security2:error] [pid 983601:tid 983782] [client 45.134.20.133:22199] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/images/autoload_classmap.php"] [unique_id "alxmYlaztLkF4ZwQhXILKQAAALg"]
[Sat Jul 18 23:53:38.774312 2026] [security2:error] [pid 983601:tid 983753] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/email/.env"] [unique_id "alxmYlaztLkF4ZwQhXILLQAAAJs"]
[Sat Jul 18 23:53:38.812062 2026] [security2:error] [pid 983601:tid 983788] [client 114.119.136.199:21495] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.new-menus.com"] [uri "/index.php"] [unique_id "alxmYlaztLkF4ZwQhXILLwAAAL4"], referer: http://www.new-menus.com/index.php?page=21
[Sat Jul 18 23:53:38.824531 2026] [security2:error] [pid 983601:tid 983838] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/smtp/.env"] [unique_id "alxmYlaztLkF4ZwQhXILMAAAAPA"]
[Sat Jul 18 23:53:38.856861 2026] [security2:error] [pid 983601:tid 983738] [client 85.204.70.98:38574] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "illuminatuscgi.com"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "alxmYlaztLkF4ZwQhXILNQAAAIw"]
[Sat Jul 18 23:53:38.874760 2026] [security2:error] [pid 983601:tid 983776] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/mailing/.env"] [unique_id "alxmYlaztLkF4ZwQhXILNgAAALI"]
[Sat Jul 18 23:53:38.924978 2026] [security2:error] [pid 983601:tid 983756] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/notifications/.env"] [unique_id "alxmYlaztLkF4ZwQhXILOwAAAJ4"]
[Sat Jul 18 23:53:38.974867 2026] [security2:error] [pid 983601:tid 983739] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/notify/.env"] [unique_id "alxmYlaztLkF4ZwQhXILQQAAAI0"]
[Sat Jul 18 23:53:39.024185 2026] [security2:error] [pid 983601:tid 983813] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/sender/.env"] [unique_id "alxmY1aztLkF4ZwQhXILRQAAANc"]
[Sat Jul 18 23:53:39.074475 2026] [security2:error] [pid 983601:tid 983824] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/campaign/.env"] [unique_id "alxmY1aztLkF4ZwQhXILSAAAAOI"]
[Sat Jul 18 23:53:39.123842 2026] [security2:error] [pid 983601:tid 983743] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/newsletter/.env"] [unique_id "alxmY1aztLkF4ZwQhXILSwAAAJE"]
[Sat Jul 18 23:53:39.130293 2026] [security2:error] [pid 983601:tid 983832] [client 85.204.70.98:38584] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "illuminatuscgi.com"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "alxmY1aztLkF4ZwQhXILTQAAAOo"]
[Sat Jul 18 23:53:39.173454 2026] [security2:error] [pid 983601:tid 983802] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/ses/.env"] [unique_id "alxmY1aztLkF4ZwQhXILUQAAAMw"]
[Sat Jul 18 23:53:39.199337 2026] [security2:error] [pid 983601:tid 983784] [client 185.132.186.13:25107] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/includes/about.php"] [unique_id "alxmY1aztLkF4ZwQhXILUwAAALo"]
[Sat Jul 18 23:53:39.224670 2026] [security2:error] [pid 983601:tid 983857] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/sendgrid/.env"] [unique_id "alxmY1aztLkF4ZwQhXILWAAAAQM"]
[Sat Jul 18 23:53:39.278690 2026] [security2:error] [pid 983601:tid 983796] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/sparkpost/.env"] [unique_id "alxmY1aztLkF4ZwQhXILXAAAAMY"]
[Sat Jul 18 23:53:39.328735 2026] [security2:error] [pid 983601:tid 983750] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/postmark/.env"] [unique_id "alxmY1aztLkF4ZwQhXILZgAAAJg"]
[Sat Jul 18 23:53:39.380069 2026] [security2:error] [pid 983601:tid 983774] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/mailgun/.env"] [unique_id "alxmY1aztLkF4ZwQhXILaAAAALA"]
[Sat Jul 18 23:53:39.380369 2026] [security2:error] [pid 983601:tid 983755] [client 114.119.135.254:47281] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "mourgroup.com"] [uri "/international-big-box_ps-chia-web/"] [unique_id "alxmY1aztLkF4ZwQhXILaQAAAJ0"], referer: https://mourgroup.com/international-big-box_ps-chia-web/
[Sat Jul 18 23:53:39.399322 2026] [security2:error] [pid 983601:tid 983822] [client 85.204.70.98:38594] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "illuminatuscgi.com"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "alxmY1aztLkF4ZwQhXILawAAAOA"]
[Sat Jul 18 23:53:39.432654 2026] [security2:error] [pid 983601:tid 983757] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/mandrill/.env"] [unique_id "alxmY1aztLkF4ZwQhXILbAAAAJ8"]
[Sat Jul 18 23:53:39.482096 2026] [security2:error] [pid 983601:tid 983768] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/mailjet/.env"] [unique_id "alxmY1aztLkF4ZwQhXILbgAAAKo"]
[Sat Jul 18 23:53:39.484599 2026] [security2:error] [pid 983601:tid 983752] [client 114.119.145.183:42987] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "juniper3medical.com"] [uri "/"] [unique_id "alxmY1aztLkF4ZwQhXILbwAAAJo"], referer: http://juniper3medical.com/
[Sat Jul 18 23:53:39.531611 2026] [security2:error] [pid 983601:tid 983781] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/brevo/.env"] [unique_id "alxmY1aztLkF4ZwQhXILcAAAALc"]
[Sat Jul 18 23:53:39.581590 2026] [security2:error] [pid 983601:tid 983855] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/transactional/.env"] [unique_id "alxmY1aztLkF4ZwQhXILcgAAAQE"]
[Sat Jul 18 23:53:39.611720 2026] [security2:error] [pid 983601:tid 983785] [client 45.134.20.138:50003] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 138.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/pki-validation/xmrlpc.php"] [unique_id "alxmY1aztLkF4ZwQhXILdAAAALs"]
[Sat Jul 18 23:53:39.634737 2026] [security2:error] [pid 983601:tid 983839] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/bulk/.env"] [unique_id "alxmY1aztLkF4ZwQhXILdwAAAPE"]
[Sat Jul 18 23:53:39.672285 2026] [security2:error] [pid 983601:tid 983819] [client 85.204.70.98:38602] ModSecurity: Access denied with code 406 (phase 1). Pattern match "/wp-includes/wlwmanifest\\\\.xml" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1541"] [id "900920"] [msg "wlwmanifest spam rule"] [hostname "illuminatuscgi.com"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "alxmY1aztLkF4ZwQhXILewAAAN0"]
[Sat Jul 18 23:53:39.684309 2026] [security2:error] [pid 983601:tid 983858] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/aws/.env"] [unique_id "alxmY1aztLkF4ZwQhXILfQAAAQQ"]
[Sat Jul 18 23:53:39.733823 2026] [security2:error] [pid 983601:tid 983771] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/azure/.env"] [unique_id "alxmY1aztLkF4ZwQhXILgwAAAK0"]
[Sat Jul 18 23:53:39.783502 2026] [security2:error] [pid 983601:tid 983837] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/gcp/.env"] [unique_id "alxmY1aztLkF4ZwQhXILiQAAAO8"]
[Sat Jul 18 23:53:39.815656 2026] [authz_core:error] [pid 983601:tid 983847] [client 54.90.74.5:0] AH01630: client denied by server configuration: /home4/chmbmamy/public_html/error_log
[Sat Jul 18 23:53:39.832610 2026] [security2:error] [pid 983601:tid 983838] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/cloud/.env"] [unique_id "alxmY1aztLkF4ZwQhXILmQAAAPA"]
[Sat Jul 18 23:53:39.884901 2026] [security2:error] [pid 983601:tid 983755] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/infrastructure/.env"] [unique_id "alxmY1aztLkF4ZwQhXILnQAAAJ0"]
[Sat Jul 18 23:53:39.935982 2026] [security2:error] [pid 983601:tid 983795] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/docker/.env"] [unique_id "alxmY1aztLkF4ZwQhXILnwAAAMU"]
[Sat Jul 18 23:53:39.985555 2026] [security2:error] [pid 983601:tid 983809] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/k8s/.env"] [unique_id "alxmY1aztLkF4ZwQhXILowAAANM"]
[Sat Jul 18 23:53:40.038922 2026] [security2:error] [pid 983601:tid 983756] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/kubernetes/.env"] [unique_id "alxmZFaztLkF4ZwQhXILqAAAAJ4"]
[Sat Jul 18 23:53:40.089881 2026] [security2:error] [pid 983601:tid 983855] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/terraform/.env"] [unique_id "alxmZFaztLkF4ZwQhXILqQAAAQE"]
[Sat Jul 18 23:53:40.099932 2026] [security2:error] [pid 983601:tid 983829] [client 185.132.186.7:42425] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 7.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "alxmZFaztLkF4ZwQhXILqgAAAOc"]
[Sat Jul 18 23:53:40.139665 2026] [security2:error] [pid 983601:tid 983741] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/ansible/.env"] [unique_id "alxmZFaztLkF4ZwQhXILrAAAAI8"]
[Sat Jul 18 23:53:40.192071 2026] [security2:error] [pid 983601:tid 983731] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/.git/.env"] [unique_id "alxmZFaztLkF4ZwQhXILsQAAAIU"]
[Sat Jul 18 23:53:40.242495 2026] [security2:error] [pid 983601:tid 983826] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/ci/.env"] [unique_id "alxmZFaztLkF4ZwQhXILtAAAAOQ"]
[Sat Jul 18 23:53:40.274987 2026] [security2:error] [pid 983601:tid 983687] [remote 54.90.74.5:47736] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.sql$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1288"] [id "350590"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw SQL files (disable this rule if you require access to files that end with .sql)"] [severity "CRITICAL"] [hostname "jndsupport.com"] [uri "/backup.sql"] [unique_id "alxmZFaztLkF4ZwQhXILuQAAy1U"]
[Sat Jul 18 23:53:40.292218 2026] [security2:error] [pid 983601:tid 983743] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/cd/.env"] [unique_id "alxmZFaztLkF4ZwQhXILuwAAAJE"]
[Sat Jul 18 23:53:40.342546 2026] [security2:error] [pid 983601:tid 983747] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/jenkins/.env"] [unique_id "alxmZFaztLkF4ZwQhXILwQAAAJU"]
[Sat Jul 18 23:53:40.368689 2026] [security2:error] [pid 983601:tid 983813] [client 114.119.128.10:33045] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "elementconstruction.co.uk"] [uri "/project/campana-road-sw6"] [unique_id "alxmZFaztLkF4ZwQhXILwwAAANc"], referer: https://elementconstruction.co.uk/projects
[Sat Jul 18 23:53:40.392826 2026] [security2:error] [pid 983601:tid 983823] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/gitlab/.env"] [unique_id "alxmZFaztLkF4ZwQhXILxAAAAOE"]
[Sat Jul 18 23:53:40.443719 2026] [security2:error] [pid 983601:tid 983812] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/github/.env"] [unique_id "alxmZFaztLkF4ZwQhXILxQAAANY"]
[Sat Jul 18 23:53:40.471111 2026] [security2:error] [pid 983601:tid 983803] [client 45.134.20.116:60721] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 116.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/maint/repairs.php"] [unique_id "alxmZFaztLkF4ZwQhXILygAAAM0"]
[Sat Jul 18 23:53:40.493570 2026] [security2:error] [pid 983601:tid 983770] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/actions/.env"] [unique_id "alxmZFaztLkF4ZwQhXILywAAAKw"]
[Sat Jul 18 23:53:40.544323 2026] [security2:error] [pid 983601:tid 983774] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/circleci/.env"] [unique_id "alxmZFaztLkF4ZwQhXIL0AAAALA"]
[Sat Jul 18 23:53:40.593817 2026] [security2:error] [pid 983601:tid 983757] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/travis/.env"] [unique_id "alxmZFaztLkF4ZwQhXIL1QAAAJ8"]
[Sat Jul 18 23:53:40.643524 2026] [security2:error] [pid 983601:tid 983852] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/buildkite/.env"] [unique_id "alxmZFaztLkF4ZwQhXIL1wAAAP4"]
[Sat Jul 18 23:53:40.664429 2026] [security2:error] [pid 983601:tid 983842] [client 57.141.18.54:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "ksands.co.uk"] [uri "/index.php"] [unique_id "alxmY1aztLkF4ZwQhXILZwAAAPQ"]
[Sat Jul 18 23:53:40.693703 2026] [security2:error] [pid 983601:tid 983769] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/mysql/.env"] [unique_id "alxmZFaztLkF4ZwQhXIL2QAAAKs"]
[Sat Jul 18 23:53:40.750488 2026] [security2:error] [pid 983601:tid 983732] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/postgres/.env"] [unique_id "alxmZFaztLkF4ZwQhXIL3QAAAIY"]
[Sat Jul 18 23:53:40.758404 2026] [security2:error] [pid 983601:tid 983690] [remote 54.90.74.5:47748] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.sql$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1288"] [id "350590"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw SQL files (disable this rule if you require access to files that end with .sql)"] [severity "CRITICAL"] [hostname "jndsupport.com"] [uri "/dump.sql"] [unique_id "alxmZFaztLkF4ZwQhXIL4AAAxVg"]
[Sat Jul 18 23:53:40.799918 2026] [security2:error] [pid 983601:tid 983762] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/mongodb/.env"] [unique_id "alxmZFaztLkF4ZwQhXIL5QAAAKQ"]
[Sat Jul 18 23:53:40.849709 2026] [security2:error] [pid 983601:tid 983778] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/redis/.env"] [unique_id "alxmZFaztLkF4ZwQhXIL6AAAALQ"]
[Sat Jul 18 23:53:40.904686 2026] [security2:error] [pid 983601:tid 983767] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/elasticsearch/.env"] [unique_id "alxmZFaztLkF4ZwQhXIL7gAAAKk"]
[Sat Jul 18 23:53:40.955126 2026] [security2:error] [pid 983601:tid 983849] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/rabbitmq/.env"] [unique_id "alxmZFaztLkF4ZwQhXIL8QAAAPs"]
[Sat Jul 18 23:53:40.995265 2026] [security2:error] [pid 983601:tid 983771] [client 185.132.186.28:31533] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 28.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/images/images/about.php"] [unique_id "alxmZFaztLkF4ZwQhXIL8wAAAK0"]
[Sat Jul 18 23:53:40.995687 2026] [security2:error] [pid 983601:tid 983827] [client 113.160.97.242:62682] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxmZFaztLkF4ZwQhXIL8gAAAOU"]
[Sat Jul 18 23:53:41.005879 2026] [security2:error] [pid 983601:tid 983772] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/kafka/.env"] [unique_id "alxmZVaztLkF4ZwQhXIL9AAAAK4"]
[Sat Jul 18 23:53:41.055764 2026] [security2:error] [pid 983601:tid 983776] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/queue/.env"] [unique_id "alxmZVaztLkF4ZwQhXIL-gAAALI"]
[Sat Jul 18 23:53:41.075874 2026] [security2:error] [pid 983601:tid 983634] [remote 194.164.192.228:37210] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 228.192.164.194.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxmZVaztLkF4ZwQhXIL_QAAuSA"]
[Sat Jul 18 23:53:41.105030 2026] [security2:error] [pid 983601:tid 983782] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/worker/.env"] [unique_id "alxmZVaztLkF4ZwQhXIMAAAAALg"]
[Sat Jul 18 23:53:41.155487 2026] [security2:error] [pid 983601:tid 983735] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/job/.env"] [unique_id "alxmZVaztLkF4ZwQhXIMBAAAAIk"]
[Sat Jul 18 23:53:41.205588 2026] [security2:error] [pid 983601:tid 983790] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/test/.env"] [unique_id "alxmZVaztLkF4ZwQhXIMCQAAAMA"]
[Sat Jul 18 23:53:41.255962 2026] [security2:error] [pid 983601:tid 983757] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/qa/.env"] [unique_id "alxmZVaztLkF4ZwQhXIMDgAAAJ8"]
[Sat Jul 18 23:53:41.264523 2026] [security2:error] [pid 983601:tid 983710] [remote 194.164.192.228:37210] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 228.192.164.194.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxmZVaztLkF4ZwQhXIMDwAA_mw"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:53:41.305873 2026] [security2:error] [pid 983601:tid 983752] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/preview/.env"] [unique_id "alxmZVaztLkF4ZwQhXIMEQAAAJo"]
[Sat Jul 18 23:53:41.316041 2026] [security2:error] [pid 983601:tid 983606] [remote 54.90.74.5:47750] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.sql$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1288"] [id "350590"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw SQL files (disable this rule if you require access to files that end with .sql)"] [severity "CRITICAL"] [hostname "jndsupport.com"] [uri "/database.sql"] [unique_id "alxmZVaztLkF4ZwQhXIMEgAA7QQ"]
[Sat Jul 18 23:53:41.322224 2026] [security2:error] [pid 983601:tid 983748] [client 114.119.134.204:59989] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.thewelloiledlife.com"] [uri "/page/38/"] [unique_id "alxmZVaztLkF4ZwQhXIMEwAAAJY"], referer: https://www.thewelloiledlife.com/page/39?wpsc_action=rss
[Sat Jul 18 23:53:41.332808 2026] [security2:error] [pid 983601:tid 983768] [client 45.134.20.105:33717] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "alxmZVaztLkF4ZwQhXIMFgAAAKo"]
[Sat Jul 18 23:53:41.356070 2026] [security2:error] [pid 983601:tid 983789] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/beta/.env"] [unique_id "alxmZVaztLkF4ZwQhXIMGAAAAL8"]
[Sat Jul 18 23:53:41.377453 2026] [security2:error] [pid 983601:tid 983814] [client 103.160.26.178:64500] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmZVaztLkF4ZwQhXIMGQAAANg"]
[Sat Jul 18 23:53:41.377550 2026] [security2:error] [pid 983601:tid 983814] [client 103.160.26.178:64500] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmZVaztLkF4ZwQhXIMGQAAANg"]
[Sat Jul 18 23:53:41.406308 2026] [security2:error] [pid 983601:tid 983855] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/uat/.env"] [unique_id "alxmZVaztLkF4ZwQhXIMGwAAAQE"]
[Sat Jul 18 23:53:41.455928 2026] [security2:error] [pid 983601:tid 983744] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/stage/.env"] [unique_id "alxmZVaztLkF4ZwQhXIMIQAAAJI"]
[Sat Jul 18 23:53:41.505459 2026] [security2:error] [pid 983601:tid 983840] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/development/.env"] [unique_id "alxmZVaztLkF4ZwQhXIMJAAAAPI"]
[Sat Jul 18 23:53:41.555084 2026] [security2:error] [pid 983601:tid 983799] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/production/.env"] [unique_id "alxmZVaztLkF4ZwQhXIMKAAAAMk"]
[Sat Jul 18 23:53:41.604356 2026] [security2:error] [pid 983601:tid 983851] [client 3.15.38.153:59836] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/___proxy_subdomain_webmail/config/app/.env"] [unique_id "alxmZVaztLkF4ZwQhXIMLQAAAP0"]
[Sat Jul 18 23:53:41.683368 2026] [core:error] [pid 983601:tid 983773] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:41.683385 2026] [core:error] [pid 983601:tid 983773] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:41.881934 2026] [core:error] [pid 983601:tid 983763] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:41.881951 2026] [core:error] [pid 983601:tid 983763] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:41.885835 2026] [security2:error] [pid 983601:tid 983770] [client 185.132.186.6:36001] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 6.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/images/class.php"] [unique_id "alxmZVaztLkF4ZwQhXIMPAAAAKw"]
[Sat Jul 18 23:53:41.953002 2026] [security2:error] [pid 983601:tid 983616] [remote 54.90.74.5:47758] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\.sql$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1288"] [id "350590"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access raw SQL files (disable this rule if you require access to files that end with .sql)"] [severity "CRITICAL"] [hostname "jndsupport.com"] [uri "/db.sql"] [unique_id "alxmZVaztLkF4ZwQhXIMRQAA8A4"]
[Sat Jul 18 23:53:42.062695 2026] [core:error] [pid 983601:tid 983756] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:42.062712 2026] [core:error] [pid 983601:tid 983756] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:42.189517 2026] [security2:error] [pid 983601:tid 983758] [client 45.134.20.108:46219] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin.php"] [unique_id "alxmZlaztLkF4ZwQhXIMVQAAAKA"]
[Sat Jul 18 23:53:42.246645 2026] [core:error] [pid 983601:tid 983858] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:42.246678 2026] [core:error] [pid 983601:tid 983858] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:42.424283 2026] [core:error] [pid 983601:tid 983846] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:42.424301 2026] [core:error] [pid 983601:tid 983846] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:42.603626 2026] [core:error] [pid 983601:tid 983785] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:42.603659 2026] [core:error] [pid 983601:tid 983785] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:42.673907 2026] [security2:error] [pid 983601:tid 983746] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmZlaztLkF4ZwQhXIMcwAAAJQ"]
[Sat Jul 18 23:53:42.787777 2026] [core:error] [pid 983601:tid 983802] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:42.787803 2026] [core:error] [pid 983601:tid 983802] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:42.793016 2026] [security2:error] [pid 983601:tid 983791] [client 185.132.186.21:43057] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 21.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/plugins/autoload_classmap.php"] [unique_id "alxmZlaztLkF4ZwQhXIMkwAAAME"]
[Sat Jul 18 23:53:42.799332 2026] [security2:error] [pid 983601:tid 983766] [client 138.252.89.100:63907] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmZlaztLkF4ZwQhXIMmgAAAKg"]
[Sat Jul 18 23:53:42.799434 2026] [security2:error] [pid 983601:tid 983766] [client 138.252.89.100:63907] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmZlaztLkF4ZwQhXIMmgAAAKg"]
[Sat Jul 18 23:53:42.941828 2026] [security2:error] [pid 983601:tid 983824] [client 3.15.38.153:59926] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/phpinfo.php"] [unique_id "alxmZlaztLkF4ZwQhXIMpAAAAOI"]
[Sat Jul 18 23:53:43.049950 2026] [security2:error] [pid 983601:tid 983808] [client 45.134.20.118:42187] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-header.php%20"] [unique_id "alxmZ1aztLkF4ZwQhXIMrgAAANI"]
[Sat Jul 18 23:53:43.092299 2026] [security2:error] [pid 983601:tid 983760] [client 3.15.38.153:59928] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/info.php"] [unique_id "alxmZ1aztLkF4ZwQhXIMsAAAAKI"]
[Sat Jul 18 23:53:43.241385 2026] [security2:error] [pid 983601:tid 983737] [client 3.15.38.153:59942] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/php.php"] [unique_id "alxmZ1aztLkF4ZwQhXIMswAAAIs"]
[Sat Jul 18 23:53:43.387893 2026] [security2:error] [pid 983601:tid 983841] [client 3.15.38.153:59958] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/i.php"] [unique_id "alxmZ1aztLkF4ZwQhXIMwQAAAPM"]
[Sat Jul 18 23:53:43.541373 2026] [security2:error] [pid 983601:tid 983813] [client 3.15.38.153:59972] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/pi.php"] [unique_id "alxmZ1aztLkF4ZwQhXIMygAAANc"]
[Sat Jul 18 23:53:43.686591 2026] [security2:error] [pid 983601:tid 983806] [client 3.15.38.153:59976] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/pinfo.php"] [unique_id "alxmZ1aztLkF4ZwQhXIM1AAAANA"]
[Sat Jul 18 23:53:43.691188 2026] [security2:error] [pid 983601:tid 983833] [client 185.132.186.40:23413] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 40.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/web.php"] [unique_id "alxmZ1aztLkF4ZwQhXIM1QAAAOs"]
[Sat Jul 18 23:53:43.837003 2026] [security2:error] [pid 983601:tid 983854] [client 3.15.38.153:59988] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/test.php"] [unique_id "alxmZ1aztLkF4ZwQhXIM4QAAAQA"]
[Sat Jul 18 23:53:43.908309 2026] [security2:error] [pid 983601:tid 983803] [client 45.134.20.118:44099] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/file.php%20"] [unique_id "alxmZ1aztLkF4ZwQhXIM5QAAAM0"]
[Sat Jul 18 23:53:44.015547 2026] [core:error] [pid 983601:tid 983784] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:44.015575 2026] [core:error] [pid 983601:tid 983784] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:44.167019 2026] [security2:error] [pid 983601:tid 983838] [client 3.15.38.153:59992] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/p.php"] [unique_id "alxmaFaztLkF4ZwQhXIM-QAAAPA"]
[Sat Jul 18 23:53:44.314456 2026] [security2:error] [pid 983601:tid 983811] [client 3.15.38.153:60002] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/debug.php"] [unique_id "alxmaFaztLkF4ZwQhXINAwAAANU"]
[Sat Jul 18 23:53:44.396199 2026] [security2:error] [pid 983601:tid 983774] [client 66.249.70.96:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.seedsofchangefilm.com"] [uri "/index.php"] [unique_id "alxmZ1aztLkF4ZwQhXIMwAAAsHc"]
[Sat Jul 18 23:53:44.462656 2026] [security2:error] [pid 983601:tid 983801] [client 3.15.38.153:60010] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/admin/phpinfo.php"] [unique_id "alxmaFaztLkF4ZwQhXINCgAAAMs"]
[Sat Jul 18 23:53:44.496153 2026] [proxy:error] [pid 983601:tid 983753] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:53:44.496209 2026] [proxy_http:error] [pid 983601:tid 983753] [client 87.236.176.112:48535] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:53:44.496663 2026] [proxy:error] [pid 983601:tid 983753] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:53:44.496685 2026] [proxy_http:error] [pid 983601:tid 983753] [client 87.236.176.112:48535] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:53:44.592025 2026] [security2:error] [pid 983601:tid 983760] [client 185.132.186.17:40529] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/css/colors/ocean/about.php"] [unique_id "alxmaFaztLkF4ZwQhXINHgAAAKI"]
[Sat Jul 18 23:53:44.610184 2026] [security2:error] [pid 983601:tid 983764] [client 74.7.241.184:47772] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "mtredistricting.gov"] [uri "/index.php"] [unique_id "alxmaFaztLkF4ZwQhXINCAAApmM"]
[Sat Jul 18 23:53:44.612092 2026] [security2:error] [pid 983601:tid 983768] [client 3.15.38.153:60012] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/test/phpinfo.php"] [unique_id "alxmaFaztLkF4ZwQhXINIQAAAKo"]
[Sat Jul 18 23:53:44.760424 2026] [security2:error] [pid 983601:tid 983805] [client 3.15.38.153:60024] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/dev/phpinfo.php"] [unique_id "alxmaFaztLkF4ZwQhXINJgAAAM8"]
[Sat Jul 18 23:53:44.778264 2026] [security2:error] [pid 983601:tid 983837] [client 45.134.20.113:50587] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.tmb/doc.php"] [unique_id "alxmaFaztLkF4ZwQhXINKAAAAO8"]
[Sat Jul 18 23:53:44.893325 2026] [security2:error] [pid 983601:tid 983758] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmaFaztLkF4ZwQhXINJQAAAKA"]
[Sat Jul 18 23:53:44.907527 2026] [security2:error] [pid 983601:tid 983791] [client 3.15.38.153:60028] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/old/phpinfo.php"] [unique_id "alxmaFaztLkF4ZwQhXINNAAAAME"]
[Sat Jul 18 23:53:45.058284 2026] [security2:error] [pid 983601:tid 983829] [client 3.15.38.153:60044] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/tmp/phpinfo.php"] [unique_id "alxmaVaztLkF4ZwQhXINRQAAAOc"]
[Sat Jul 18 23:53:45.111262 2026] [security2:error] [pid 983601:tid 983672] [remote 57.141.18.124:28628] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 124.18.141.57.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "aviationsynergy.aero"] [uri "/product/4417158"] [unique_id "alxmaVaztLkF4ZwQhXINSAAAnEY"]
[Sat Jul 18 23:53:45.176721 2026] [security2:error] [pid 983601:tid 983690] [remote 4.205.168.44:36288] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxmaVaztLkF4ZwQhXINSwAA_lg"]
[Sat Jul 18 23:53:45.208405 2026] [security2:error] [pid 983601:tid 983790] [client 3.15.38.153:32948] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/public/phpinfo.php"] [unique_id "alxmaVaztLkF4ZwQhXINTAAAAMA"]
[Sat Jul 18 23:53:45.350903 2026] [security2:error] [pid 983601:tid 983706] [remote 4.205.168.44:36288] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxmaVaztLkF4ZwQhXINUgAAumg"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:53:45.384264 2026] [core:error] [pid 983601:tid 983858] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:45.384285 2026] [core:error] [pid 983601:tid 983858] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:45.393009 2026] [security2:error] [pid 983601:tid 983615] [remote 157.66.26.183:36200] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 183.26.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "civitansuncitiesaz.org"] [uri "/wp-login.php"] [unique_id "alxmaVaztLkF4ZwQhXINVgAAkA0"]
[Sat Jul 18 23:53:45.490143 2026] [security2:error] [pid 983601:tid 983755] [client 185.132.186.19:43241] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 19.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/images/index.php"] [unique_id "alxmaVaztLkF4ZwQhXINZAAAAJ0"]
[Sat Jul 18 23:53:45.551616 2026] [security2:error] [pid 983601:tid 983776] [client 3.15.38.153:32968] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/php-info.php"] [unique_id "alxmaVaztLkF4ZwQhXINbQAAALI"]
[Sat Jul 18 23:53:45.654723 2026] [security2:error] [pid 983601:tid 983824] [client 45.134.20.107:46495] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 107.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-editor.php"] [unique_id "alxmaVaztLkF4ZwQhXINdgAAAOI"]
[Sat Jul 18 23:53:45.701388 2026] [security2:error] [pid 983601:tid 983829] [client 3.15.38.153:32970] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/phpversion.php"] [unique_id "alxmaVaztLkF4ZwQhXINewAAAOc"]
[Sat Jul 18 23:53:45.797987 2026] [security2:error] [pid 983601:tid 983680] [remote 157.66.26.183:36200] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 183.26.66.157.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "civitansuncitiesaz.org"] [uri "/wp-login.php"] [unique_id "alxmaVaztLkF4ZwQhXINfwABAE4"], referer: https://civitansuncitiesaz.org/wp-login.php
[Sat Jul 18 23:53:45.854213 2026] [security2:error] [pid 983601:tid 983760] [client 3.15.38.153:32978] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/_phpinfo.php"] [unique_id "alxmaVaztLkF4ZwQhXINhwAAAKI"]
[Sat Jul 18 23:53:46.003041 2026] [security2:error] [pid 983601:tid 983795] [client 3.15.38.153:32994] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/old_phpinfo.php"] [unique_id "alxmalaztLkF4ZwQhXINlgAAAMU"]
[Sat Jul 18 23:53:46.006263 2026] [security2:error] [pid 983601:tid 983832] [client 139.167.225.146:49901] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxmalaztLkF4ZwQhXINlwAAAOo"]
[Sat Jul 18 23:53:46.006390 2026] [security2:error] [pid 983601:tid 983832] [client 139.167.225.146:49901] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxmalaztLkF4ZwQhXINlwAAAOo"]
[Sat Jul 18 23:53:46.150450 2026] [security2:error] [pid 983601:tid 983759] [client 3.15.38.153:32996] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/server-info.php"] [unique_id "alxmalaztLkF4ZwQhXINpQAAAKE"]
[Sat Jul 18 23:53:46.300596 2026] [security2:error] [pid 983601:tid 983781] [client 3.15.38.153:33004] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/server-status.php"] [unique_id "alxmalaztLkF4ZwQhXINrAAAALc"]
[Sat Jul 18 23:53:46.388149 2026] [security2:error] [pid 983601:tid 983810] [client 185.132.186.13:33495] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/bypass.php"] [unique_id "alxmalaztLkF4ZwQhXINrwAAANQ"]
[Sat Jul 18 23:53:46.476116 2026] [core:error] [pid 983601:tid 983814] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:46.476141 2026] [core:error] [pid 983601:tid 983814] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:46.513732 2026] [security2:error] [pid 983601:tid 983764] [client 45.134.20.128:54881] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/style-engine-session.php"] [unique_id "alxmalaztLkF4ZwQhXINuAAAAKY"]
[Sat Jul 18 23:53:46.650885 2026] [core:error] [pid 983601:tid 983806] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:46.650908 2026] [core:error] [pid 983601:tid 983806] [client 3.15.38.153:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:53:46.802095 2026] [security2:error] [pid 983601:tid 983849] [client 3.15.38.153:33046] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/webroot/index.php/_environment"] [unique_id "alxmalaztLkF4ZwQhXIN0QAAAPs"]
[Sat Jul 18 23:53:46.803518 2026] [security2:error] [pid 983601:tid 983817] [client 104.210.56.226:6542] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "gertoger.org"] [uri "/index.php"] [unique_id "alxmaVaztLkF4ZwQhXINaQAA23s"]
[Sat Jul 18 23:53:46.950088 2026] [security2:error] [pid 983601:tid 983834] [client 3.15.38.153:33054] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/mail/phpinfo.php"] [unique_id "alxmalaztLkF4ZwQhXIN2AAAAOw"]
[Sat Jul 18 23:53:47.099834 2026] [security2:error] [pid 983601:tid 983788] [client 3.15.38.153:33064] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/cpanel/phpinfo.php"] [unique_id "alxma1aztLkF4ZwQhXIN5QAAAL4"]
[Sat Jul 18 23:53:47.133522 2026] [security2:error] [pid 983601:tid 983777] [client 191.237.250.106:40242] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxma1aztLkF4ZwQhXIN6QAAALM"]
[Sat Jul 18 23:53:47.249796 2026] [security2:error] [pid 983601:tid 983773] [client 3.15.38.153:33072] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/hosting/phpinfo.php"] [unique_id "alxma1aztLkF4ZwQhXIN8QAAAK8"]
[Sat Jul 18 23:53:47.290562 2026] [security2:error] [pid 983601:tid 983760] [client 185.132.186.10:44135] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "alxma1aztLkF4ZwQhXIN-AAAAKI"]
[Sat Jul 18 23:53:47.334022 2026] [security2:error] [pid 983601:tid 983764] [client 191.237.250.106:40242] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxma1aztLkF4ZwQhXIN9wAAAKY"]
[Sat Jul 18 23:53:47.379015 2026] [security2:error] [pid 983601:tid 983733] [client 45.134.20.120:23025] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 120.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/images/install.php"] [unique_id "alxma1aztLkF4ZwQhXIOAAAAAIc"]
[Sat Jul 18 23:53:47.397772 2026] [security2:error] [pid 983601:tid 983846] [client 3.15.38.153:33078] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/webmail/phpinfo.php"] [unique_id "alxma1aztLkF4ZwQhXIOAQAAAPg"]
[Sat Jul 18 23:53:47.546246 2026] [security2:error] [pid 983601:tid 983842] [client 3.15.38.153:33088] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/smtp/phpinfo.php"] [unique_id "alxma1aztLkF4ZwQhXIOCAAAAPQ"]
[Sat Jul 18 23:53:47.551317 2026] [security2:error] [pid 983601:tid 983806] [client 74.7.242.21:44178] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "mtredistricting.gov"] [uri "/index.php"] [unique_id "alxma1aztLkF4ZwQhXIN_wAA0H4"]
[Sat Jul 18 23:53:47.627707 2026] [security2:error] [pid 983601:tid 983841] [client 191.237.250.106:40242] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxma1aztLkF4ZwQhXIOEwAAAPM"]
[Sat Jul 18 23:53:47.693313 2026] [security2:error] [pid 983601:tid 983845] [client 3.15.38.153:33104] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/phpinfo.php.bak"] [unique_id "alxma1aztLkF4ZwQhXIOGAAAAPc"]
[Sat Jul 18 23:53:47.830322 2026] [security2:error] [pid 983601:tid 983843] [client 191.237.250.106:40242] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxma1aztLkF4ZwQhXIOHAAAAPU"]
[Sat Jul 18 23:53:47.844023 2026] [security2:error] [pid 983601:tid 983814] [client 3.15.38.153:33118] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/phpinfo.php.old"] [unique_id "alxma1aztLkF4ZwQhXIOHwAAANg"]
[Sat Jul 18 23:53:47.860773 2026] [security2:error] [pid 983601:tid 983770] [client 114.119.134.1:46423] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "lifeisbetterlakeside.com"] [uri "/category/decorations/outdoordecorations/christmaswinter-outdoordecorations/"] [unique_id "alxma1aztLkF4ZwQhXIOIgAAAKw"], referer: https://lifeisbetterlakeside.com/lemurs-up-close-and-personal-at-the-alabama-gulf-coast-zoo-part-2/
[Sat Jul 18 23:53:47.995914 2026] [security2:error] [pid 983601:tid 983826] [client 3.15.38.153:33134] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/phpinfo.php~"] [unique_id "alxma1aztLkF4ZwQhXIOKQAAAOQ"]
[Sat Jul 18 23:53:48.118268 2026] [security2:error] [pid 983601:tid 983844] [client 191.237.250.106:40242] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmbFaztLkF4ZwQhXIONAAAAPY"]
[Sat Jul 18 23:53:48.147275 2026] [security2:error] [pid 983601:tid 983832] [client 3.15.38.153:33142] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/info.php.bak"] [unique_id "alxmbFaztLkF4ZwQhXIONQAAAOo"]
[Sat Jul 18 23:53:48.188379 2026] [security2:error] [pid 983601:tid 983857] [client 185.132.186.19:64047] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 19.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/css/colors/midnight/install.php"] [unique_id "alxmbFaztLkF4ZwQhXIOPgAAAQM"]
[Sat Jul 18 23:53:48.234981 2026] [security2:error] [pid 983601:tid 983822] [client 45.134.20.131:28253] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/adminfusm.php"] [unique_id "alxmbFaztLkF4ZwQhXIOQgAAAOA"]
[Sat Jul 18 23:53:48.299742 2026] [security2:error] [pid 983601:tid 983746] [client 3.15.38.153:33154] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/phpinfo.php.save"] [unique_id "alxmbFaztLkF4ZwQhXIOSgAAAJQ"]
[Sat Jul 18 23:53:48.325428 2026] [security2:error] [pid 983601:tid 983786] [client 191.237.250.106:40242] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmbFaztLkF4ZwQhXIORwAAALw"]
[Sat Jul 18 23:53:48.450976 2026] [security2:error] [pid 983601:tid 983741] [client 3.15.38.153:33162] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/staging/phpinfo.php"] [unique_id "alxmbFaztLkF4ZwQhXIOVAAAAI8"]
[Sat Jul 18 23:53:48.599340 2026] [security2:error] [pid 983601:tid 983843] [client 3.15.38.153:33172] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/beta/phpinfo.php"] [unique_id "alxmbFaztLkF4ZwQhXIOWQAAAPU"]
[Sat Jul 18 23:53:48.643484 2026] [security2:error] [pid 983601:tid 983773] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmbFaztLkF4ZwQhXIOVQAAAK8"]
[Sat Jul 18 23:53:48.673701 2026] [security2:error] [pid 983601:tid 983787] [client 191.237.250.106:40242] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmbFaztLkF4ZwQhXIOZQAAAL0"]
[Sat Jul 18 23:53:48.748925 2026] [security2:error] [pid 983601:tid 983846] [client 3.15.38.153:33188] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/uat/phpinfo.php"] [unique_id "alxmbFaztLkF4ZwQhXIOagAAAPg"]
[Sat Jul 18 23:53:48.883391 2026] [security2:error] [pid 983601:tid 983806] [client 191.237.250.106:40242] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmbFaztLkF4ZwQhXIOcQAAANA"]
[Sat Jul 18 23:53:48.896175 2026] [security2:error] [pid 983601:tid 983836] [client 3.15.38.153:33200] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/qa/phpinfo.php"] [unique_id "alxmbFaztLkF4ZwQhXIOegAAAO4"]
[Sat Jul 18 23:53:49.048901 2026] [security2:error] [pid 983601:tid 983799] [client 3.15.38.153:33210] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/preview/phpinfo.php"] [unique_id "alxmbVaztLkF4ZwQhXIOfgAAAMk"]
[Sat Jul 18 23:53:49.081741 2026] [security2:error] [pid 983601:tid 983841] [client 185.132.186.29:28981] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 29.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-trackback.php"] [unique_id "alxmbVaztLkF4ZwQhXIOfwAAAPM"]
[Sat Jul 18 23:53:49.091557 2026] [security2:error] [pid 983601:tid 983833] [client 45.134.20.135:64869] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/adminfusm.php"] [unique_id "alxmbVaztLkF4ZwQhXIOggAAAOs"]
[Sat Jul 18 23:53:49.102489 2026] [security2:error] [pid 983601:tid 983791] [client 57.141.18.123:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "falconarrowshop.com"] [uri "/index.php"] [unique_id "alxmbFaztLkF4ZwQhXIOfAAAAME"]
[Sat Jul 18 23:53:49.158441 2026] [security2:error] [pid 983601:tid 983763] [client 191.237.250.106:40242] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmbVaztLkF4ZwQhXIOhQAAAKU"]
[Sat Jul 18 23:53:49.196263 2026] [security2:error] [pid 983601:tid 983733] [client 3.15.38.153:33216] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/www/phpinfo.php"] [unique_id "alxmbVaztLkF4ZwQhXIOhwAAAIc"]
[Sat Jul 18 23:53:49.339188 2026] [security2:error] [pid 983601:tid 983677] [remote 31.42.184.154:42072] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxmbVaztLkF4ZwQhXIOiQAA8ks"]
[Sat Jul 18 23:53:49.446626 2026] [security2:error] [pid 983601:tid 983857] [client 36.83.95.75:61090] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmbVaztLkF4ZwQhXIOigAAAQM"]
[Sat Jul 18 23:53:49.446778 2026] [security2:error] [pid 983601:tid 983857] [client 36.83.95.75:61090] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmbVaztLkF4ZwQhXIOigAAAQM"]
[Sat Jul 18 23:53:49.469266 2026] [security2:error] [pid 983601:tid 983780] [client 114.119.152.60:61473] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "omenana.com"] [uri "/2019/05/09/urban-legends-as-an-outlet-for-the-modern-african-writer-of-the-speculative-hannu-afere"] [unique_id "alxmbVaztLkF4ZwQhXIOiwAAALY"], referer: https://omenana.com/2019/05/09/urban-legends-as-an-outlet-for-the-modern-african-writer-of-the-speculative-hannu-afere/
[Sat Jul 18 23:53:49.767374 2026] [security2:error] [pid 983601:tid 983839] [client 180.252.198.240:56183] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmbVaztLkF4ZwQhXIOjAAAAPE"]
[Sat Jul 18 23:53:49.767482 2026] [security2:error] [pid 983601:tid 983839] [client 180.252.198.240:56183] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmbVaztLkF4ZwQhXIOjAAAAPE"]
[Sat Jul 18 23:53:49.791842 2026] [http2:info] [pid 989638:tid 989638] h2_workers: created with min=128 max=192 idle_ms=600000
[Sat Jul 18 23:53:49.806501 2026] [security2:error] [pid 989638:tid 989768] [client 216.244.66.244:42432] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "omenana.com"] [uri "/robots.txt"] [unique_id "alxmbZruoK4abRCMbAZB2QAAAAA"]
[Sat Jul 18 23:53:49.806626 2026] [security2:error] [pid 989638:tid 989768] [client 216.244.66.244:42432] ModSecurity: Warning. Matched phrase "Dotbot" at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "omenana.com"] [uri "/robots.txt"] [unique_id "alxmbZruoK4abRCMbAZB2QAAAAA"]
[Sat Jul 18 23:53:49.859591 2026] [security2:error] [pid 989638:tid 989772] [client 3.15.38.153:33226] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/htdocs/phpinfo.php"] [unique_id "alxmbZruoK4abRCMbAZB7QAAAAQ"]
[Sat Jul 18 23:53:49.959287 2026] [security2:error] [pid 989638:tid 989825] [client 45.134.20.130:31565] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 130.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/js/js1.php"] [unique_id "alxmbZruoK4abRCMbAZB-gAAADk"]
[Sat Jul 18 23:53:49.980450 2026] [security2:error] [pid 989638:tid 989829] [client 185.132.186.13:47721] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "alxmbZruoK4abRCMbAZB_gAAAD0"]
[Sat Jul 18 23:53:50.008606 2026] [security2:error] [pid 989638:tid 989824] [client 3.15.38.153:33232] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/public_html/phpinfo.php"] [unique_id "alxmbpruoK4abRCMbAZCBgAAADg"]
[Sat Jul 18 23:53:50.084040 2026] [security2:error] [pid 989638:tid 989659] [remote 31.42.184.154:59784] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxmbpruoK4abRCMbAZCDgAADRQ"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:53:50.156323 2026] [security2:error] [pid 989638:tid 989862] [client 3.15.38.153:33246] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/site/phpinfo.php"] [unique_id "alxmbpruoK4abRCMbAZCFwAAAF4"]
[Sat Jul 18 23:53:50.235487 2026] [security2:error] [pid 989638:tid 989834] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmbpruoK4abRCMbAZCHAAAAEI"]
[Sat Jul 18 23:53:50.305556 2026] [security2:error] [pid 989638:tid 989885] [client 3.15.38.153:33260] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/docs/phpinfo.php"] [unique_id "alxmbpruoK4abRCMbAZCIAAAAHU"]
[Sat Jul 18 23:53:50.455464 2026] [security2:error] [pid 989638:tid 989799] [client 3.15.38.153:33274] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/wp-admin/phpinfo.php"] [unique_id "alxmbpruoK4abRCMbAZCJwAAAB8"]
[Sat Jul 18 23:53:50.515278 2026] [security2:error] [pid 989638:tid 989775] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmbpruoK4abRCMbAZCKAAAAAc"]
[Sat Jul 18 23:53:50.605403 2026] [security2:error] [pid 989638:tid 989770] [client 3.15.38.153:33290] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/administrator/phpinfo.php"] [unique_id "alxmbpruoK4abRCMbAZCLQAAAAI"]
[Sat Jul 18 23:53:50.717256 2026] [security2:error] [pid 989638:tid 989823] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmbpruoK4abRCMbAZCNAAAADc"]
[Sat Jul 18 23:53:50.757892 2026] [security2:error] [pid 989638:tid 989830] [client 3.15.38.153:33296] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/core/phpinfo.php"] [unique_id "alxmbpruoK4abRCMbAZCPQAAAD4"]
[Sat Jul 18 23:53:50.816158 2026] [security2:error] [pid 989638:tid 989843] [client 45.134.20.107:39663] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 107.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "alxmbpruoK4abRCMbAZCQwAAAEs"]
[Sat Jul 18 23:53:50.885767 2026] [security2:error] [pid 989638:tid 989846] [client 185.132.186.38:28793] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 38.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/radio.php"] [unique_id "alxmbpruoK4abRCMbAZCRwAAAE4"]
[Sat Jul 18 23:53:50.907145 2026] [security2:error] [pid 989638:tid 989847] [client 3.15.38.153:33306] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 153.38.15.3.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.bln.noq.mybluehost.me"] [uri "/includes/phpinfo.php"] [unique_id "alxmbpruoK4abRCMbAZCSwAAAE8"]
[Sat Jul 18 23:53:50.995922 2026] [security2:error] [pid 989638:tid 989876] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmbpruoK4abRCMbAZCVgAAAGw"]
[Sat Jul 18 23:53:51.189567 2026] [security2:error] [pid 989638:tid 989892] [client 158.51.126.91:55470] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "cpanel.genesismedicalbilling.com"] [uri "/unprotected/json-minified.js"] [unique_id "alxmb5ruoK4abRCMbAZCYwAAAHw"]
[Sat Jul 18 23:53:51.189669 2026] [security2:error] [pid 989638:tid 989892] [client 158.51.126.91:55470] ModSecurity: Warning. Matched phrase "CCBot" at REQUEST_HEADERS:user-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "cpanel.genesismedicalbilling.com"] [uri "/unprotected/json-minified.js"] [unique_id "alxmb5ruoK4abRCMbAZCYwAAAHw"]
[Sat Jul 18 23:53:51.208482 2026] [security2:error] [pid 989638:tid 989887] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmb5ruoK4abRCMbAZCXAAAAHc"]
[Sat Jul 18 23:53:51.616643 2026] [security2:error] [pid 989638:tid 989823] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmb5ruoK4abRCMbAZCdQAAADc"]
[Sat Jul 18 23:53:51.630285 2026] [security2:error] [pid 989638:tid 989854] [client 114.119.132.202:46059] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "jenfarley.com"] [uri "/state-animals-usa-map/&sa=U"] [unique_id "alxmb5ruoK4abRCMbAZCeQAAAFY"], referer: https://anarim.az/img/search.php?newwindow=1&q=national%2Banimals%2Bof%2Bthe%2Busa&sa=X&ved=2ahUKEwicl5GJ0qT-AhW_KEQIHTdaBfUQ1QJ6BAgBEAg
[Sat Jul 18 23:53:51.642348 2026] [security2:error] [pid 989638:tid 989701] [remote 4.205.168.44:55878] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxmb5ruoK4abRCMbAZCewAAOT4"]
[Sat Jul 18 23:53:51.642505 2026] [security2:error] [pid 989638:tid 989825] [client 4.205.168.44:55878] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxmb5ruoK4abRCMbAZCewAAOT4"]
[Sat Jul 18 23:53:51.674015 2026] [security2:error] [pid 989638:tid 989830] [client 45.134.20.106:48475] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "alxmb5ruoK4abRCMbAZCfgAAAD4"]
[Sat Jul 18 23:53:51.796098 2026] [security2:error] [pid 989638:tid 989850] [client 185.132.186.31:55069] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 31.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/mah.php"] [unique_id "alxmb5ruoK4abRCMbAZCiQAAAFI"]
[Sat Jul 18 23:53:51.845865 2026] [security2:error] [pid 989638:tid 989853] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmb5ruoK4abRCMbAZCjwAAAFU"]
[Sat Jul 18 23:53:51.951102 2026] [security2:error] [pid 989638:tid 989838] [client 103.160.26.178:64999] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmb5ruoK4abRCMbAZCkwAAAEY"]
[Sat Jul 18 23:53:51.951195 2026] [security2:error] [pid 989638:tid 989838] [client 103.160.26.178:64999] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmb5ruoK4abRCMbAZCkwAAAEY"]
[Sat Jul 18 23:53:52.214702 2026] [security2:error] [pid 989638:tid 989885] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmcJruoK4abRCMbAZCpgAAAHU"]
[Sat Jul 18 23:53:52.294333 2026] [security2:error] [pid 989638:tid 989895] [client 114.119.154.65:36113] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.ferrellroofing.com"] [uri "/metro"] [unique_id "alxmcJruoK4abRCMbAZCsQAAAH8"], referer: http://www.ferrellroofing.com/metro/
[Sat Jul 18 23:53:52.533477 2026] [security2:error] [pid 989638:tid 989819] [client 45.134.20.122:41655] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/mu-plugins/admin.php"] [unique_id "alxmcJruoK4abRCMbAZCtwAAADM"]
[Sat Jul 18 23:53:52.533766 2026] [security2:error] [pid 989638:tid 989830] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmcJruoK4abRCMbAZCtgAAAD4"]
[Sat Jul 18 23:53:52.697078 2026] [security2:error] [pid 989638:tid 989864] [client 185.132.186.6:22535] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 6.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/plugins/dummyyummy/wp-signup.php"] [unique_id "alxmcJruoK4abRCMbAZCwwAAAGA"]
[Sat Jul 18 23:53:52.720775 2026] [security2:error] [pid 989638:tid 989730] [remote 182.77.62.24:38520] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.62.77.182.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxmcJruoK4abRCMbAZCxAAAHls"]
[Sat Jul 18 23:53:52.872306 2026] [security2:error] [pid 989638:tid 989783] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmcJruoK4abRCMbAZC0QAAAA8"]
[Sat Jul 18 23:53:53.146639 2026] [security2:error] [pid 989638:tid 989795] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmcZruoK4abRCMbAZC2wAAABs"]
[Sat Jul 18 23:53:53.287997 2026] [security2:error] [pid 989638:tid 989746] [remote 182.77.62.24:38520] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.62.77.182.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxmcZruoK4abRCMbAZC5wAAGGs"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:53:53.390726 2026] [security2:error] [pid 989638:tid 989787] [client 45.134.20.107:63585] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 107.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "alxmcZruoK4abRCMbAZC7QAAABM"]
[Sat Jul 18 23:53:53.615292 2026] [security2:error] [pid 989638:tid 989769] [client 185.132.186.20:39875] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 20.186.132.185.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "alxmcZruoK4abRCMbAZC9wAAAAE"]
[Sat Jul 18 23:53:53.709235 2026] [security2:error] [pid 989638:tid 989830] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmcZruoK4abRCMbAZC_AAAAD4"]
[Sat Jul 18 23:53:53.984569 2026] [security2:error] [pid 989638:tid 989889] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmcZruoK4abRCMbAZDFQAAAHk"]
[Sat Jul 18 23:53:53.995364 2026] [security2:error] [pid 989638:tid 989763] [remote 103.28.36.122:38252] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.36.28.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxmcZruoK4abRCMbAZDFAAAQXw"]
[Sat Jul 18 23:53:54.187043 2026] [security2:error] [pid 989638:tid 989858] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmcpruoK4abRCMbAZDIQAAAFo"]
[Sat Jul 18 23:53:54.287926 2026] [security2:error] [pid 989638:tid 989820] [client 139.167.225.146:50487] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxmcpruoK4abRCMbAZDLgAAADQ"]
[Sat Jul 18 23:53:54.288044 2026] [security2:error] [pid 989638:tid 989820] [client 139.167.225.146:50487] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxmcpruoK4abRCMbAZDLgAAADQ"]
[Sat Jul 18 23:53:54.318149 2026] [security2:error] [pid 989638:tid 989838] [client 138.252.89.100:64434] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmcpruoK4abRCMbAZDLwAAAEY"]
[Sat Jul 18 23:53:54.318293 2026] [security2:error] [pid 989638:tid 989838] [client 138.252.89.100:64434] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmcpruoK4abRCMbAZDLwAAAEY"]
[Sat Jul 18 23:53:54.421671 2026] [security2:error] [pid 989638:tid 989650] [remote 103.28.36.122:38252] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.36.28.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxmcpruoK4abRCMbAZDNwAAJQs"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:53:54.469504 2026] [security2:error] [pid 989638:tid 989800] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmcpruoK4abRCMbAZDOQAAACA"]
[Sat Jul 18 23:53:54.510215 2026] [security2:error] [pid 989638:tid 989844] [client 185.132.186.17:41263] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-conflg.php"] [unique_id "alxmcpruoK4abRCMbAZDPgAAAEw"]
[Sat Jul 18 23:53:54.602290 2026] [security2:error] [pid 989638:tid 989829] [client 35.227.39.208:32976] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "secoaches.co"] [uri "/wp-json/batch/v1"] [unique_id "alxmcpruoK4abRCMbAZDRAAAAD0"]
[Sat Jul 18 23:53:54.667540 2026] [security2:error] [pid 989638:tid 989877] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmcpruoK4abRCMbAZDXwAAAG0"]
[Sat Jul 18 23:53:54.703239 2026] [security2:error] [pid 989638:tid 989878] [client 45.134.20.125:36643] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 125.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/about/function.php%20"] [unique_id "alxmcpruoK4abRCMbAZDZQAAAG4"]
[Sat Jul 18 23:53:54.745121 2026] [security2:error] [pid 989638:tid 989676] [remote 163.227.186.27:47912] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxmcpruoK4abRCMbAZDZwAAdSU"]
[Sat Jul 18 23:53:54.943852 2026] [security2:error] [pid 989638:tid 989873] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmcpruoK4abRCMbAZDigAAAGk"]
[Sat Jul 18 23:53:55.162330 2026] [security2:error] [pid 989638:tid 989807] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmc5ruoK4abRCMbAZDlgAAACc"]
[Sat Jul 18 23:53:55.228094 2026] [security2:error] [pid 989638:tid 989721] [remote 163.227.186.27:47912] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxmc5ruoK4abRCMbAZDowAAYVI"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:53:55.315794 2026] [security2:error] [pid 989638:tid 989877] [client 35.227.39.208:32976] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "secoaches.co"] [uri "/"] [unique_id "alxmc5ruoK4abRCMbAZDrwAAAG0"]
[Sat Jul 18 23:53:55.404324 2026] [security2:error] [pid 989638:tid 989781] [client 185.132.186.5:21247] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-setup.php"] [unique_id "alxmc5ruoK4abRCMbAZDwAAAAA0"]
[Sat Jul 18 23:53:55.469841 2026] [security2:error] [pid 989638:tid 989868] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmc5ruoK4abRCMbAZDywAAAGQ"]
[Sat Jul 18 23:53:55.571968 2026] [security2:error] [pid 989638:tid 989768] [client 45.134.20.134:40569] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 134.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/images/install.php"] [unique_id "alxmc5ruoK4abRCMbAZD1QAAAAA"]
[Sat Jul 18 23:53:55.796650 2026] [proxy:error] [pid 989638:tid 989811] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:53:55.796704 2026] [proxy_http:error] [pid 989638:tid 989811] [client 193.47.62.168:60708] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:53:55.797468 2026] [proxy:error] [pid 989638:tid 989811] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:53:55.797496 2026] [proxy_http:error] [pid 989638:tid 989811] [client 193.47.62.168:60708] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:53:56.052005 2026] [security2:error] [pid 989638:tid 989885] [client 57.141.18.65:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxmc5ruoK4abRCMbAZD6wAAAHU"]
[Sat Jul 18 23:53:56.059156 2026] [security2:error] [pid 989638:tid 989771] [client 114.119.137.146:65123] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "mezzacraft.com"] [uri "/crochet-course-walton-on-thames/"] [unique_id "alxmdJruoK4abRCMbAZD-QAAAAM"], referer: https://www.mezzacraft.com/crochet-lucet-cord-tutorial/amp/
[Sat Jul 18 23:53:56.059423 2026] [security2:error] [pid 989638:tid 989801] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmdJruoK4abRCMbAZD9wAAACE"]
[Sat Jul 18 23:53:56.302150 2026] [security2:error] [pid 989638:tid 989787] [client 185.132.186.6:35791] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 6.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/ms-themes.php"] [unique_id "alxmdJruoK4abRCMbAZEBgAAABM"]
[Sat Jul 18 23:53:56.333151 2026] [security2:error] [pid 989638:tid 989823] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmdJruoK4abRCMbAZECQAAADc"]
[Sat Jul 18 23:53:56.485040 2026] [security2:error] [pid 989638:tid 989776] [client 45.134.20.134:21769] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 134.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "alxmdJruoK4abRCMbAZEGwAAAAg"]
[Sat Jul 18 23:53:56.485810 2026] [security2:error] [pid 989638:tid 989653] [remote 199.189.225.167:26365] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.225.189.199.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxmdJruoK4abRCMbAZEFQAAAA4"]
[Sat Jul 18 23:53:56.533425 2026] [security2:error] [pid 989638:tid 989865] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmdJruoK4abRCMbAZEHAAAAGE"]
[Sat Jul 18 23:53:56.728658 2026] [security2:error] [pid 989638:tid 989649] [remote 199.189.225.167:26365] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 167.225.189.199.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxmdJruoK4abRCMbAZEJgAAMAo"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:53:56.821100 2026] [security2:error] [pid 989638:tid 989791] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmdJruoK4abRCMbAZELQAAABc"]
[Sat Jul 18 23:53:56.907662 2026] [security2:error] [pid 989638:tid 989771] [client 20.230.87.222:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 222.87.230.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.yidaiyi.org"] [uri "/admin/uploads/media.php"] [unique_id "alxmdJruoK4abRCMbAZEMgAAAAM"]
[Sat Jul 18 23:53:56.907744 2026] [security2:error] [pid 989638:tid 989771] [client 20.230.87.222:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.yidaiyi.org"] [uri "/admin/uploads/media.php"] [unique_id "alxmdJruoK4abRCMbAZEMgAAAAM"]
[Sat Jul 18 23:53:57.027743 2026] [security2:error] [pid 989638:tid 989824] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmdJruoK4abRCMbAZEPQAAADg"]
[Sat Jul 18 23:53:57.211936 2026] [security2:error] [pid 989638:tid 989834] [client 185.132.186.2:23571] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 2.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/assets/about.php"] [unique_id "alxmdZruoK4abRCMbAZESwAAAEI"]
[Sat Jul 18 23:53:57.330444 2026] [security2:error] [pid 989638:tid 989800] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmdZruoK4abRCMbAZEUQAAACA"]
[Sat Jul 18 23:53:57.343012 2026] [security2:error] [pid 989638:tid 989877] [client 45.134.20.112:23143] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 112.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/js/widgets/doc.php"] [unique_id "alxmdZruoK4abRCMbAZEVAAAAG0"]
[Sat Jul 18 23:53:57.541313 2026] [security2:error] [pid 989638:tid 989772] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmdZruoK4abRCMbAZEYQAAAAQ"]
[Sat Jul 18 23:53:57.832803 2026] [security2:error] [pid 989638:tid 989869] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmdZruoK4abRCMbAZEeQAAAGU"]
[Sat Jul 18 23:53:58.013907 2026] [security2:error] [pid 989638:tid 989769] [client 38.242.28.47:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "packerjanitorial.com"] [uri "/index.php"] [unique_id "alxmdZruoK4abRCMbAZEUAAAARg"]
[Sat Jul 18 23:53:58.032711 2026] [security2:error] [pid 989638:tid 989841] [client 47.128.113.49:11326] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "3dprintrecycling.com"] [uri "/robots.txt"] [unique_id "alxmdpruoK4abRCMbAZEiAAAAEk"]
[Sat Jul 18 23:53:58.050179 2026] [security2:error] [pid 989638:tid 989890] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmdpruoK4abRCMbAZEhAAAAHo"]
[Sat Jul 18 23:53:58.105211 2026] [security2:error] [pid 989638:tid 989803] [client 185.132.186.28:60577] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 28.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/style.php"] [unique_id "alxmdpruoK4abRCMbAZEkQAAACM"]
[Sat Jul 18 23:53:58.211886 2026] [security2:error] [pid 989638:tid 989788] [client 45.134.20.125:30533] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 125.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/f35_SpaceTn.php"] [unique_id "alxmdpruoK4abRCMbAZEnAAAABQ"]
[Sat Jul 18 23:53:58.247808 2026] [security2:error] [pid 989638:tid 989886] [client 36.68.125.232:55124] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 232.125.68.36.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.uhi.wfw.mybluehost.me"] [uri "/phpinfo.php"] [unique_id "alxmdpruoK4abRCMbAZEnQAAAHY"]
[Sat Jul 18 23:53:58.265898 2026] [security2:error] [pid 989638:tid 989873] [client 49.36.213.103:58320] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.213.36.49.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/xmlrpc.php"] [unique_id "alxmdpruoK4abRCMbAZEmQAAAGk"]
[Sat Jul 18 23:53:58.266104 2026] [security2:error] [pid 989638:tid 989873] [client 49.36.213.103:58320] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz"] [uri "/xmlrpc.php"] [unique_id "alxmdpruoK4abRCMbAZEmQAAAGk"]
[Sat Jul 18 23:53:58.340823 2026] [security2:error] [pid 989638:tid 989814] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmdpruoK4abRCMbAZEnwAAAC4"]
[Sat Jul 18 23:53:58.404428 2026] [security2:error] [pid 989638:tid 989801] [client 216.244.66.226:45644] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.demnetworks.com"] [uri "/robots.txt"] [unique_id "alxmdpruoK4abRCMbAZEogAAACE"]
[Sat Jul 18 23:53:58.404542 2026] [security2:error] [pid 989638:tid 989801] [client 216.244.66.226:45644] ModSecurity: Warning. Matched phrase "Dotbot" at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "www.demnetworks.com"] [uri "/robots.txt"] [unique_id "alxmdpruoK4abRCMbAZEogAAACE"]
[Sat Jul 18 23:53:58.546325 2026] [security2:error] [pid 989638:tid 989828] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmdpruoK4abRCMbAZEqgAAADw"]
[Sat Jul 18 23:53:58.688127 2026] [security2:error] [pid 989638:tid 989865] [client 36.68.125.232:55587] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 232.125.68.36.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.uhi.wfw.mybluehost.me"] [uri "/test.php"] [unique_id "alxmdpruoK4abRCMbAZEtQAAAGE"]
[Sat Jul 18 23:53:58.851336 2026] [security2:error] [pid 989638:tid 989827] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmdpruoK4abRCMbAZEvAAAADs"]
[Sat Jul 18 23:53:59.002974 2026] [security2:error] [pid 989638:tid 989710] [remote 154.61.75.100:33744] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "jndsupport.com"] [uri "/wp-login.php"] [unique_id "alxmdpruoK4abRCMbAZEwwAAZkc"]
[Sat Jul 18 23:53:59.010446 2026] [security2:error] [pid 989638:tid 989833] [client 185.132.186.32:49431] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/infi.php"] [unique_id "alxmd5ruoK4abRCMbAZExwAAAEE"]
[Sat Jul 18 23:53:59.054883 2026] [security2:error] [pid 989638:tid 989817] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmd5ruoK4abRCMbAZExgAAADE"]
[Sat Jul 18 23:53:59.057399 2026] [security2:error] [pid 989638:tid 989854] [client 114.119.132.163:56799] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "timespans.org"] [uri "/concert/talea-ensemble-lorraine-vaillancourt"] [unique_id "alxmd5ruoK4abRCMbAZEzgAAAFY"], referer: https://www.nytimes.com/2019/08/15/arts/music/nyc-this-weekend-classical-music.html
[Sat Jul 18 23:53:59.080766 2026] [security2:error] [pid 989638:tid 989895] [client 45.134.20.127:28853] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 127.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/sunrise/bypass.php"] [unique_id "alxmd5ruoK4abRCMbAZE0AAAAH8"]
[Sat Jul 18 23:53:59.233696 2026] [security2:error] [pid 989638:tid 989844] [client 114.119.132.10:64597] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "sustaintheart.com"] [uri "/sublimation-ink-go-bad/"] [unique_id "alxmd5ruoK4abRCMbAZE4AAAAEw"], referer: https://sustaintheart.com/sublimation-ink-go-bad/
[Sat Jul 18 23:53:59.501049 2026] [ssl:error] [pid 989638:tid 989804] [client 54.86.115.253:13204] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname webmail.saudalsubaie.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:53:59.552060 2026] [security2:error] [pid 989638:tid 989827] [client 36.68.125.232:56642] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\.bak|\\\\.bak\\\\.php)$" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1260"] [id "390582"] [rev "2"] [msg "Atomicorp.com WAF Rules: Attack Blocked -  Data leakage - attempt to access backup file (disable this rule if you require access to files that nclude .bak)"] [severity "CRITICAL"] [hostname "webmail.uhi.wfw.mybluehost.me"] [uri "/___proxy_subdomain_webmail/.env/.env.bak"] [unique_id "alxmd5ruoK4abRCMbAZE7gAAADs"]
[Sat Jul 18 23:53:59.870464 2026] [security2:error] [pid 989638:tid 989834] [client 36.83.95.75:61599] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmd5ruoK4abRCMbAZFEgAAAEI"]
[Sat Jul 18 23:53:59.870578 2026] [security2:error] [pid 989638:tid 989834] [client 36.83.95.75:61599] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmd5ruoK4abRCMbAZFEgAAAEI"]
[Sat Jul 18 23:53:59.904821 2026] [security2:error] [pid 989638:tid 989891] [client 185.132.186.43:21725] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 43.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/maint/index.php"] [unique_id "alxmd5ruoK4abRCMbAZFEwAAAHs"]
[Sat Jul 18 23:53:59.949190 2026] [ssl:error] [pid 989638:tid 989893] [client 3.233.59.216:61434] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname cpcontacts.zoo.xjy.mybluehost.me provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:53:59.956949 2026] [security2:error] [pid 989638:tid 989801] [client 45.134.20.125:33613] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 125.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/fixed.php"] [unique_id "alxmd5ruoK4abRCMbAZFGAAAACE"]
[Sat Jul 18 23:53:59.960036 2026] [security2:error] [pid 989638:tid 989739] [remote 31.42.184.154:38028] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxmd5ruoK4abRCMbAZFGQAAcmQ"]
[Sat Jul 18 23:53:59.977097 2026] [security2:error] [pid 989638:tid 989852] [client 34.172.185.49:42092] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "adirondackengineering.com"] [uri "/wp-json/batch/v1"] [unique_id "alxmd5ruoK4abRCMbAZFHAAAAFQ"]
[Sat Jul 18 23:54:00.036683 2026] [security2:error] [pid 989638:tid 989849] [client 180.252.198.240:56660] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmeJruoK4abRCMbAZFIAAAAFE"]
[Sat Jul 18 23:54:00.036831 2026] [security2:error] [pid 989638:tid 989849] [client 180.252.198.240:56660] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmeJruoK4abRCMbAZFIAAAAFE"]
[Sat Jul 18 23:54:00.196426 2026] [security2:error] [pid 989638:tid 989748] [remote 31.42.184.154:38028] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxmeJruoK4abRCMbAZFKgAAa20"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:54:00.308544 2026] [security2:error] [pid 989638:tid 989838] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmeJruoK4abRCMbAZFNwAAAEY"]
[Sat Jul 18 23:54:00.391138 2026] [security2:error] [pid 989638:tid 989843] [client 34.172.185.49:42092] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "adirondackengineering.com"] [uri "/"] [unique_id "alxmeJruoK4abRCMbAZFPQAAAEs"]
[Sat Jul 18 23:54:00.438998 2026] [security2:error] [pid 989638:tid 989791] [client 36.68.125.232:57819] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 232.125.68.36.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "webmail.uhi.wfw.mybluehost.me"] [uri "/index.php"] [unique_id "alxmeJruoK4abRCMbAZFQAAAABc"]
[Sat Jul 18 23:54:00.441986 2026] [security2:error] [pid 989638:tid 989851] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmeJruoK4abRCMbAZFLgAAAFM"]
[Sat Jul 18 23:54:00.508330 2026] [security2:error] [pid 989638:tid 989860] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmeJruoK4abRCMbAZFQQAAAFw"]
[Sat Jul 18 23:54:00.540801 2026] [security2:error] [pid 989638:tid 989858] [client 14.254.179.216:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "itekphonerepair.com"] [uri "/index.php"] [unique_id "alxmdpruoK4abRCMbAZEvQAAAFo"]
[Sat Jul 18 23:54:00.782354 2026] [security2:error] [pid 989638:tid 989829] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmeJruoK4abRCMbAZFVwAAAD0"]
[Sat Jul 18 23:54:00.810105 2026] [security2:error] [pid 989638:tid 989775] [client 185.132.186.1:48641] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 1.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/x.php"] [unique_id "alxmeJruoK4abRCMbAZFWAAAAAc"]
[Sat Jul 18 23:54:00.830156 2026] [security2:error] [pid 989638:tid 989841] [client 45.134.20.130:21137] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 130.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/js/widgets/themes.php"] [unique_id "alxmeJruoK4abRCMbAZFWQAAAEk"]
[Sat Jul 18 23:54:00.989321 2026] [security2:error] [pid 989638:tid 989802] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmeJruoK4abRCMbAZFYAAAACI"]
[Sat Jul 18 23:54:01.251633 2026] [security2:error] [pid 989638:tid 989646] [remote 194.164.170.191:47662] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 191.170.164.194.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxmeZruoK4abRCMbAZFfwAAbQc"]
[Sat Jul 18 23:54:01.263518 2026] [security2:error] [pid 989638:tid 989861] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmeZruoK4abRCMbAZFgQAAAF0"]
[Sat Jul 18 23:54:01.483586 2026] [security2:error] [pid 989638:tid 989798] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmeZruoK4abRCMbAZFkAAAAB4"]
[Sat Jul 18 23:54:01.490576 2026] [security2:error] [pid 989638:tid 989662] [remote 194.164.170.191:47662] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 191.170.164.194.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxmeZruoK4abRCMbAZFlQAAQRc"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:54:01.706302 2026] [security2:error] [pid 989638:tid 989814] [client 45.134.20.130:46431] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 130.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/fix/bypass.php"] [unique_id "alxmeZruoK4abRCMbAZFowAAAC4"]
[Sat Jul 18 23:54:01.716126 2026] [security2:error] [pid 989638:tid 989803] [client 185.132.186.30:51943] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 30.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "alxmeZruoK4abRCMbAZFpwAAACM"]
[Sat Jul 18 23:54:01.793526 2026] [security2:error] [pid 989638:tid 989795] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmeZruoK4abRCMbAZFsQAAABs"]
[Sat Jul 18 23:54:01.998218 2026] [security2:error] [pid 989638:tid 989799] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmeZruoK4abRCMbAZFtwAAAB8"]
[Sat Jul 18 23:54:02.069112 2026] [security2:error] [pid 989638:tid 989677] [remote 154.61.75.100:33744] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "jndsupport.com"] [uri "/wp-login.php"] [unique_id "alxmepruoK4abRCMbAZFuwAAMyY"], referer: https://jndsupport.com/wp-login.php
[Sat Jul 18 23:54:02.315319 2026] [security2:error] [pid 989638:tid 989773] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmepruoK4abRCMbAZF0QAAAAU"]
[Sat Jul 18 23:54:02.538354 2026] [security2:error] [pid 989638:tid 989855] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmepruoK4abRCMbAZF1gAAAFc"]
[Sat Jul 18 23:54:02.562497 2026] [security2:error] [pid 989638:tid 989818] [client 45.134.20.128:21875] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/category-double.php"] [unique_id "alxmepruoK4abRCMbAZF3QAAADI"]
[Sat Jul 18 23:54:02.564070 2026] [security2:error] [pid 989638:tid 989832] [client 103.160.26.178:65502] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmepruoK4abRCMbAZF3gAAAEA"]
[Sat Jul 18 23:54:02.564130 2026] [security2:error] [pid 989638:tid 989832] [client 103.160.26.178:65502] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmepruoK4abRCMbAZF3gAAAEA"]
[Sat Jul 18 23:54:02.618268 2026] [security2:error] [pid 989638:tid 989873] [client 185.132.186.31:23991] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 31.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/css/index.php"] [unique_id "alxmepruoK4abRCMbAZF4QAAAGk"]
[Sat Jul 18 23:54:02.751660 2026] [security2:error] [pid 989638:tid 989684] [remote 54.90.74.5:38244] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.74.90.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "jndsupport.com"] [uri "/adminer.php"] [unique_id "alxmepruoK4abRCMbAZF7AAAJS0"]
[Sat Jul 18 23:54:02.813530 2026] [security2:error] [pid 989638:tid 989886] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmepruoK4abRCMbAZF8QAAAHY"]
[Sat Jul 18 23:54:02.834960 2026] [security2:error] [pid 989638:tid 989700] [remote 113.160.142.119:34932] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxmepruoK4abRCMbAZF8gAAYD0"]
[Sat Jul 18 23:54:03.003973 2026] [security2:error] [pid 989638:tid 989797] [client 50.116.65.227:20162] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "301"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/11/Fu-Lin-Feature-Image.jpg"] [unique_id "alxme5ruoK4abRCMbAZF_AAAAB0"]
[Sat Jul 18 23:54:03.011582 2026] [security2:error] [pid 989638:tid 989815] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmepruoK4abRCMbAZF-QAAAC8"]
[Sat Jul 18 23:54:03.016457 2026] [security2:error] [pid 989638:tid 989773] [client 50.116.65.227:24828] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/11/Fu-Lin-Feature-Image.jpg"] [unique_id "alxme5ruoK4abRCMbAZF_QAAAAU"]
[Sat Jul 18 23:54:03.335073 2026] [security2:error] [pid 989638:tid 989722] [remote 113.160.142.119:34932] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxme5ruoK4abRCMbAZGFAAADVM"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:54:03.368254 2026] [security2:error] [pid 989638:tid 989845] [client 114.119.138.77:25679] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "locketsandcharms.com"] [uri "/category/origami-owl-business-tips/page/5/"] [unique_id "alxme5ruoK4abRCMbAZGFwAAAE0"], referer: https://locketsandcharms.com/category/origami-owl-business-tips/page/7/
[Sat Jul 18 23:54:03.429718 2026] [security2:error] [pid 989638:tid 989889] [client 45.134.20.131:38789] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "alxme5ruoK4abRCMbAZGIQAAAHk"]
[Sat Jul 18 23:54:03.518781 2026] [security2:error] [pid 989638:tid 989793] [client 185.132.186.16:37639] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 16.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/images/index22.php"] [unique_id "alxme5ruoK4abRCMbAZGJQAAABk"]
[Sat Jul 18 23:54:03.540057 2026] [ssl:error] [pid 989638:tid 989821] [client 54.86.115.253:51919] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname cpanel.uvw.ntv.mybluehost.me provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:54:03.643432 2026] [security2:error] [pid 989638:tid 989837] [client 217.217.245.230:62479] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.245.217.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxme5ruoK4abRCMbAZGLAAAAEU"]
[Sat Jul 18 23:54:03.643536 2026] [security2:error] [pid 989638:tid 989837] [client 217.217.245.230:62479] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxme5ruoK4abRCMbAZGLAAAAEU"]
[Sat Jul 18 23:54:03.776083 2026] [security2:error] [pid 989638:tid 989803] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxme5ruoK4abRCMbAZGMwAAACM"]
[Sat Jul 18 23:54:03.825056 2026] [security2:error] [pid 989638:tid 989777] [client 114.119.130.23:63249] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "mtlegnews.gov"] [uri "/event/chapter-55-task-force-rule-making-committee/"] [unique_id "alxme5ruoK4abRCMbAZGPgAAAAk"], referer: https://content.govdelivery.com/accounts/MTOPI/bulletins/30b51a9
[Sat Jul 18 23:54:03.991411 2026] [security2:error] [pid 989638:tid 989861] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxme5ruoK4abRCMbAZGRwAAAF0"]
[Sat Jul 18 23:54:04.026229 2026] [security2:error] [pid 989638:tid 989829] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxme5ruoK4abRCMbAZGOgAAAD0"]
[Sat Jul 18 23:54:04.279769 2026] [security2:error] [pid 989638:tid 989773] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmfJruoK4abRCMbAZGYQAAAAU"]
[Sat Jul 18 23:54:04.286953 2026] [security2:error] [pid 989638:tid 989792] [client 45.134.20.128:31431] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/blog/signatur.php"] [unique_id "alxmfJruoK4abRCMbAZGYgAAABg"]
[Sat Jul 18 23:54:04.409441 2026] [security2:error] [pid 989638:tid 989842] [client 185.132.186.22:23049] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 22.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-user.php"] [unique_id "alxmfJruoK4abRCMbAZGZwAAAEo"]
[Sat Jul 18 23:54:04.496500 2026] [security2:error] [pid 989638:tid 989784] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmfJruoK4abRCMbAZGaAAAABA"]
[Sat Jul 18 23:54:04.597322 2026] [security2:error] [pid 989638:tid 989785] [client 34.172.185.49:42092] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "adirondackengineering.com"] [uri "/index.php"] [unique_id "alxmeZruoK4abRCMbAZFtAAAABE"], referer: http://adirondackengineering.com/wp-json/batch/v1
[Sat Jul 18 23:54:04.797132 2026] [security2:error] [pid 989638:tid 989863] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmfJruoK4abRCMbAZGgQAAAF8"]
[Sat Jul 18 23:54:04.963510 2026] [security2:error] [pid 989638:tid 989825] [client 139.167.225.146:51087] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxmfJruoK4abRCMbAZGkAAAADk"]
[Sat Jul 18 23:54:04.963600 2026] [security2:error] [pid 989638:tid 989825] [client 139.167.225.146:51087] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxmfJruoK4abRCMbAZGkAAAADk"]
[Sat Jul 18 23:54:05.000353 2026] [security2:error] [pid 989638:tid 989885] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmfJruoK4abRCMbAZGjgAAAHU"]
[Sat Jul 18 23:54:05.152227 2026] [security2:error] [pid 989638:tid 989890] [client 45.134.20.126:61963] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 126.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/assets/db.php"] [unique_id "alxmfZruoK4abRCMbAZGlwAAAHo"]
[Sat Jul 18 23:54:05.296096 2026] [security2:error] [pid 989638:tid 989849] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmfZruoK4abRCMbAZGpwAAAFE"]
[Sat Jul 18 23:54:05.316150 2026] [security2:error] [pid 989638:tid 989778] [client 185.132.186.8:25409] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 8.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "alxmfZruoK4abRCMbAZGrgAAAAo"]
[Sat Jul 18 23:54:05.496291 2026] [security2:error] [pid 989638:tid 989846] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmfZruoK4abRCMbAZGvQAAAE4"]
[Sat Jul 18 23:54:05.728386 2026] [security2:error] [pid 989638:tid 989859] [client 114.119.128.39:61937] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "muafaces.org"] [uri "/shop"] [unique_id "alxmfZruoK4abRCMbAZGzAAAAFs"], referer: http://muafaces.org/shop/
[Sat Jul 18 23:54:05.752431 2026] [security2:error] [pid 989638:tid 989839] [client 138.252.89.100:64957] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmfZruoK4abRCMbAZGzwAAAEc"]
[Sat Jul 18 23:54:05.753158 2026] [security2:error] [pid 989638:tid 989839] [client 138.252.89.100:64957] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmfZruoK4abRCMbAZGzwAAAEc"]
[Sat Jul 18 23:54:05.793936 2026] [security2:error] [pid 989638:tid 989806] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmfZruoK4abRCMbAZG0QAAACY"]
[Sat Jul 18 23:54:06.002287 2026] [security2:error] [pid 989638:tid 989872] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmfZruoK4abRCMbAZG3gAAAGg"]
[Sat Jul 18 23:54:06.016389 2026] [security2:error] [pid 989638:tid 989791] [client 45.134.20.111:53111] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/widgets/security.php"] [unique_id "alxmfpruoK4abRCMbAZG5gAAABc"]
[Sat Jul 18 23:54:06.105264 2026] [security2:error] [pid 989638:tid 989864] [client 113.189.130.91:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "youpositive.co"] [uri "/index.php"] [unique_id "alxme5ruoK4abRCMbAZGIgAAAGA"]
[Sat Jul 18 23:54:06.143213 2026] [security2:error] [pid 989638:tid 989825] [client 114.119.146.229:59131] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "securingmemories.com"] [uri "/index.php/portfolio-item/how-to-change-the-lightbulbs-when-im-gone/"] [unique_id "alxmfpruoK4abRCMbAZG8AAAADk"], referer: https://securingmemories.com/index.php/portfolio-item/2021-family-first-challenge
[Sat Jul 18 23:54:06.223340 2026] [security2:error] [pid 989638:tid 989798] [client 185.132.186.1:59561] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 1.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "alxmfpruoK4abRCMbAZG8wAAAB4"]
[Sat Jul 18 23:54:06.295362 2026] [security2:error] [pid 989638:tid 989775] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmfpruoK4abRCMbAZG_gAAAAc"]
[Sat Jul 18 23:54:06.542355 2026] [security2:error] [pid 989638:tid 989778] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmfpruoK4abRCMbAZHCAAAAAo"]
[Sat Jul 18 23:54:06.599443 2026] [security2:error] [pid 989638:tid 989807] [client 18.136.194.202:56858] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "curlsnpearlsss.com"] [uri "/puerto-rican-meatballs-in-sofrito-sauce-recipe/"] [unique_id "alxmfpruoK4abRCMbAZHHAAAACc"], referer: https://curlsnpearlsss.com/puerto-rican-meatballs-in-sofrito-sauce-recipe/
[Sat Jul 18 23:54:06.734363 2026] [security2:error] [pid 989638:tid 989873] [client 57.141.18.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxmfpruoK4abRCMbAZHFAAAAGk"]
[Sat Jul 18 23:54:06.836418 2026] [security2:error] [pid 989638:tid 989824] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmfpruoK4abRCMbAZHNgAAADg"]
[Sat Jul 18 23:54:06.889912 2026] [security2:error] [pid 989638:tid 989888] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmfpruoK4abRCMbAZHJwAAAHg"]
[Sat Jul 18 23:54:06.890561 2026] [security2:error] [pid 989638:tid 989881] [client 45.134.20.115:22427] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/include/install.php"] [unique_id "alxmfpruoK4abRCMbAZHOwAAAHE"]
[Sat Jul 18 23:54:07.041251 2026] [security2:error] [pid 989638:tid 989817] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmfpruoK4abRCMbAZHSQAAADE"]
[Sat Jul 18 23:54:07.141512 2026] [security2:error] [pid 989638:tid 989777] [client 185.132.186.33:32531] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 33.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/config.php"] [unique_id "alxmf5ruoK4abRCMbAZHVQAAAAk"]
[Sat Jul 18 23:54:07.265370 2026] [security2:error] [pid 989638:tid 989842] [client 114.119.141.42:55939] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "jndsupport.com"] [uri "/siem/t%3Cbr%3Eel:18882883007"] [unique_id "alxmf5ruoK4abRCMbAZHWAAAAEo"], referer: https://jndsupport.com/siem/
[Sat Jul 18 23:54:07.354142 2026] [security2:error] [pid 989638:tid 989775] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmf5ruoK4abRCMbAZHWwAAAAc"]
[Sat Jul 18 23:54:07.561341 2026] [security2:error] [pid 989638:tid 989769] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmf5ruoK4abRCMbAZHZgAAAAE"]
[Sat Jul 18 23:54:07.683130 2026] [security2:error] [pid 989638:tid 989725] [remote 154.61.75.100:33740] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.ait.afz.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxmf5ruoK4abRCMbAZHbwAAKVY"]
[Sat Jul 18 23:54:07.714763 2026] [security2:error] [pid 989638:tid 989839] [client 216.73.217.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "scoophouse.com"] [uri "/index.php"] [unique_id "alxmfpruoK4abRCMbAZG_wAARzA"]
[Sat Jul 18 23:54:07.743738 2026] [security2:error] [pid 989638:tid 989801] [client 45.134.20.135:63439] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/gm.php"] [unique_id "alxmf5ruoK4abRCMbAZHeAAAACE"]
[Sat Jul 18 23:54:07.847458 2026] [security2:error] [pid 989638:tid 989893] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmf5ruoK4abRCMbAZHfwAAAH0"]
[Sat Jul 18 23:54:08.038768 2026] [security2:error] [pid 989638:tid 989877] [client 185.132.186.40:21157] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 40.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/special.php"] [unique_id "alxmgJruoK4abRCMbAZHiwAAAG0"]
[Sat Jul 18 23:54:08.050593 2026] [security2:error] [pid 989638:tid 989730] [remote 91.142.222.105:45928] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxmgJruoK4abRCMbAZHigAAVFs"]
[Sat Jul 18 23:54:08.050855 2026] [security2:error] [pid 989638:tid 989852] [client 91.142.222.105:45928] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxmgJruoK4abRCMbAZHigAAVFs"]
[Sat Jul 18 23:54:08.054292 2026] [security2:error] [pid 989638:tid 989836] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmgJruoK4abRCMbAZHiAAAAEQ"]
[Sat Jul 18 23:54:08.096113 2026] [security2:error] [pid 989638:tid 989800] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmf5ruoK4abRCMbAZHhAAAACA"]
[Sat Jul 18 23:54:08.276441 2026] [security2:error] [pid 989638:tid 989867] [client 20.230.87.222:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 222.87.230.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.yidaiyi.org"] [uri "/wp-admin/images/index.php"] [unique_id "alxmgJruoK4abRCMbAZHoAAAAGM"]
[Sat Jul 18 23:54:08.276528 2026] [security2:error] [pid 989638:tid 989867] [client 20.230.87.222:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.yidaiyi.org"] [uri "/wp-admin/images/index.php"] [unique_id "alxmgJruoK4abRCMbAZHoAAAAGM"]
[Sat Jul 18 23:54:08.328966 2026] [security2:error] [pid 989638:tid 989848] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmgJruoK4abRCMbAZHpAAAAFA"]
[Sat Jul 18 23:54:08.505564 2026] [security2:error] [pid 989638:tid 989802] [client 114.119.132.183:44865] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "ksands.co.uk"] [uri "/services/secure-spaces/residential"] [unique_id "alxmgJruoK4abRCMbAZHsQAAACI"], referer: https://ksands.co.uk/news/secure-ground-transportation-in-london/
[Sat Jul 18 23:54:08.549706 2026] [security2:error] [pid 989638:tid 989839] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmgJruoK4abRCMbAZHsAAAAEc"]
[Sat Jul 18 23:54:08.611305 2026] [security2:error] [pid 989638:tid 989842] [client 49.36.213.103:58906] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.213.36.49.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/xmlrpc.php"] [unique_id "alxmgJruoK4abRCMbAZHvAAAAEo"]
[Sat Jul 18 23:54:08.611409 2026] [security2:error] [pid 989638:tid 989842] [client 49.36.213.103:58906] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz"] [uri "/xmlrpc.php"] [unique_id "alxmgJruoK4abRCMbAZHvAAAAEo"]
[Sat Jul 18 23:54:08.640990 2026] [security2:error] [pid 989638:tid 989892] [client 45.134.20.116:61569] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 116.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "alxmgJruoK4abRCMbAZHwQAAAHw"]
[Sat Jul 18 23:54:08.830524 2026] [security2:error] [pid 989638:tid 989785] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmgJruoK4abRCMbAZHyQAAABE"]
[Sat Jul 18 23:54:08.944723 2026] [security2:error] [pid 989638:tid 989806] [client 185.132.186.51:61411] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 51.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/assets/script.js.php"] [unique_id "alxmgJruoK4abRCMbAZH0QAAACY"]
[Sat Jul 18 23:54:09.045018 2026] [security2:error] [pid 989638:tid 989826] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmgJruoK4abRCMbAZH1AAAADo"]
[Sat Jul 18 23:54:09.324537 2026] [security2:error] [pid 989638:tid 989859] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmgZruoK4abRCMbAZH7wAAAFs"]
[Sat Jul 18 23:54:09.328174 2026] [security2:error] [pid 989638:tid 989894] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmgZruoK4abRCMbAZH4AAAAH4"]
[Sat Jul 18 23:54:09.502211 2026] [security2:error] [pid 989638:tid 989868] [client 45.134.20.108:48729] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/js/content-type.php"] [unique_id "alxmgZruoK4abRCMbAZH_QAAAGQ"]
[Sat Jul 18 23:54:09.543044 2026] [security2:error] [pid 989638:tid 989788] [client 180.252.198.240:57139] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmgZruoK4abRCMbAZIAwAAABQ"]
[Sat Jul 18 23:54:09.543168 2026] [security2:error] [pid 989638:tid 989788] [client 180.252.198.240:57139] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmgZruoK4abRCMbAZIAwAAABQ"]
[Sat Jul 18 23:54:09.683059 2026] [security2:error] [pid 989638:tid 989664] [remote 47.86.33.52:15864] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxmgZruoK4abRCMbAZIDgAAdRk"]
[Sat Jul 18 23:54:09.728813 2026] [security2:error] [pid 989638:tid 989861] [client 34.171.169.105:21754] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "areitoproducciones.com"] [uri "/wp-json/batch/v1"] [unique_id "alxmgZruoK4abRCMbAZIEQAAAF0"]
[Sat Jul 18 23:54:09.844272 2026] [security2:error] [pid 989638:tid 989776] [client 185.132.186.16:30277] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 16.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/themes/twentytwentythree/patterns/index.php"] [unique_id "alxmgZruoK4abRCMbAZIHgAAAAg"]
[Sat Jul 18 23:54:09.941928 2026] [security2:error] [pid 989638:tid 989642] [remote 114.119.155.200:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "origine.nz"] [uri "/author/anna/"] [unique_id "alxmgZruoK4abRCMbAZIIgAAVgM"], referer: https://origine.nz/author-sitemap.xml
[Sat Jul 18 23:54:09.975591 2026] [security2:error] [pid 989638:tid 989866] [client 34.171.169.105:21754] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "areitoproducciones.com"] [uri "/"] [unique_id "alxmgZruoK4abRCMbAZIJAAAAGI"]
[Sat Jul 18 23:54:10.027974 2026] [security2:error] [pid 989638:tid 989829] [client 114.119.159.160:31853] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "mtredistricting.gov"] [uri "/july-8-9-2021-meeting/"] [unique_id "alxmgpruoK4abRCMbAZIJgAAAD0"], referer: https://mtredistricting.gov/meeting-info/
[Sat Jul 18 23:54:10.146900 2026] [security2:error] [pid 989638:tid 989656] [remote 154.61.75.100:35214] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "dasmarque.com"] [uri "/wp-login.php"] [unique_id "alxmgpruoK4abRCMbAZIMgAAKxE"]
[Sat Jul 18 23:54:10.329926 2026] [security2:error] [pid 989638:tid 989847] [client 36.83.95.75:62097] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmgpruoK4abRCMbAZIRgAAAE8"]
[Sat Jul 18 23:54:10.330018 2026] [security2:error] [pid 989638:tid 989847] [client 36.83.95.75:62097] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmgpruoK4abRCMbAZIRgAAAE8"]
[Sat Jul 18 23:54:10.360791 2026] [security2:error] [pid 989638:tid 989891] [client 45.134.20.118:39145] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "alxmgpruoK4abRCMbAZISQAAAHs"]
[Sat Jul 18 23:54:10.408947 2026] [security2:error] [pid 989638:tid 989677] [remote 91.142.222.105:52636] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "claysharecon.com"] [uri "/wp-login.php"] [unique_id "alxmgpruoK4abRCMbAZITAAAICY"]
[Sat Jul 18 23:54:10.724115 2026] [security2:error] [pid 989638:tid 989836] [client 114.119.139.86:35535] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "recruitinginsight.us"] [uri "/2019/11/page/15"] [unique_id "alxmgpruoK4abRCMbAZIYQAAAEQ"], referer: https://recruitinginsight.us/2019/11/page/16?et_blog
[Sat Jul 18 23:54:10.740879 2026] [security2:error] [pid 989638:tid 989793] [client 185.132.186.21:34453] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 21.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/css/colors/sunrise/colors_95.php"] [unique_id "alxmgpruoK4abRCMbAZIYwAAABk"]
[Sat Jul 18 23:54:10.972572 2026] [security2:error] [pid 989638:tid 989676] [remote 91.142.222.105:52636] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "claysharecon.com"] [uri "/wp-login.php"] [unique_id "alxmgpruoK4abRCMbAZIcQAAYyU"], referer: https://claysharecon.com/wp-login.php
[Sat Jul 18 23:54:11.214775 2026] [security2:error] [pid 989638:tid 989777] [client 45.134.20.121:47519] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 121.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/about/goods.php"] [unique_id "alxmg5ruoK4abRCMbAZIfQAAAAk"]
[Sat Jul 18 23:54:11.409459 2026] [security2:error] [pid 989638:tid 989707] [remote 154.61.75.100:33740] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.ait.afz.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxmg5ruoK4abRCMbAZIjQAAPUQ"], referer: https://mail.ait.afz.mybluehost.me/wp-login.php
[Sat Jul 18 23:54:11.573716 2026] [security2:error] [pid 989638:tid 989874] [client 114.119.138.67:37919] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "blog.danwolfe.us"] [uri "/page/27/"] [unique_id "alxmg5ruoK4abRCMbAZIlgAAAGo"], referer: https://blog.danwolfe.us/page/29/?weaverii_mobile_toggle=mobile_view
[Sat Jul 18 23:54:11.587256 2026] [security2:error] [pid 989638:tid 989880] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmg5ruoK4abRCMbAZIlQAAAHA"]
[Sat Jul 18 23:54:11.643123 2026] [security2:error] [pid 989638:tid 989828] [client 185.132.186.16:33365] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 16.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "alxmg5ruoK4abRCMbAZInQAAADw"]
[Sat Jul 18 23:54:11.736212 2026] [security2:error] [pid 989638:tid 989781] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmg5ruoK4abRCMbAZIkwAAAA0"]
[Sat Jul 18 23:54:11.941472 2026] [security2:error] [pid 989638:tid 989847] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmg5ruoK4abRCMbAZIwwAAAE8"]
[Sat Jul 18 23:54:12.088129 2026] [security2:error] [pid 989638:tid 989828] [client 45.134.20.132:24265] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/file/function.php"] [unique_id "alxmhJruoK4abRCMbAZIzQAAADw"]
[Sat Jul 18 23:54:12.177263 2026] [security2:error] [pid 989638:tid 989865] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmhJruoK4abRCMbAZI0AAAAGE"]
[Sat Jul 18 23:54:12.520786 2026] [security2:error] [pid 989638:tid 989810] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmhJruoK4abRCMbAZI5wAAACo"]
[Sat Jul 18 23:54:12.560428 2026] [security2:error] [pid 989638:tid 989799] [client 185.132.186.16:37955] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 16.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/uploads/wp.php"] [unique_id "alxmhJruoK4abRCMbAZI6gAAAB8"]
[Sat Jul 18 23:54:12.635017 2026] [security2:error] [pid 989638:tid 989748] [remote 47.86.33.52:15864] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.33.86.47.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxmhJruoK4abRCMbAZI8QAAN20"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:54:12.771534 2026] [security2:error] [pid 989638:tid 989774] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmhJruoK4abRCMbAZI9QAAAAY"]
[Sat Jul 18 23:54:12.948791 2026] [security2:error] [pid 989638:tid 989837] [client 45.134.20.126:20289] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 126.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/function/goods.php"] [unique_id "alxmhJruoK4abRCMbAZJCwAAAEU"]
[Sat Jul 18 23:54:13.074361 2026] [security2:error] [pid 989638:tid 989849] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmhZruoK4abRCMbAZJDwAAAFE"]
[Sat Jul 18 23:54:13.092881 2026] [security2:error] [pid 989638:tid 989789] [client 34.171.169.105:21754] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "areitoproducciones.com"] [uri "/index.php"] [unique_id "alxmg5ruoK4abRCMbAZIhgAAABU"], referer: http://areitoproducciones.com/wp-json/batch/v1
[Sat Jul 18 23:54:13.179207 2026] [security2:error] [pid 989638:tid 989881] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmhJruoK4abRCMbAZJDAAAAHE"]
[Sat Jul 18 23:54:13.210685 2026] [security2:error] [pid 989638:tid 989892] [client 103.160.26.178:49630] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmhZruoK4abRCMbAZJGwAAAHw"]
[Sat Jul 18 23:54:13.210788 2026] [security2:error] [pid 989638:tid 989892] [client 103.160.26.178:49630] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmhZruoK4abRCMbAZJGwAAAHw"]
[Sat Jul 18 23:54:13.294360 2026] [security2:error] [pid 989638:tid 989810] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmhZruoK4abRCMbAZJHgAAACo"]
[Sat Jul 18 23:54:13.459159 2026] [security2:error] [pid 989638:tid 989784] [client 185.132.186.25:31043] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "alxmhZruoK4abRCMbAZJNgAAABA"]
[Sat Jul 18 23:54:13.757612 2026] [security2:error] [pid 989638:tid 989654] [remote 4.205.168.44:42612] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxmhZruoK4abRCMbAZJRAAARw8"]
[Sat Jul 18 23:54:13.819734 2026] [security2:error] [pid 989638:tid 989822] [client 45.134.20.107:48605] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 107.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/bypass.php"] [unique_id "alxmhZruoK4abRCMbAZJTgAAADY"]
[Sat Jul 18 23:54:13.858868 2026] [security2:error] [pid 989638:tid 989806] [client 181.224.104.231:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "worbals.com"] [uri "/index.php"] [unique_id "alxmg5ruoK4abRCMbAZIpgAAACY"]
[Sat Jul 18 23:54:13.941248 2026] [security2:error] [pid 989638:tid 989656] [remote 4.205.168.44:42612] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.168.205.4.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxmhZruoK4abRCMbAZJWwAAHxE"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:54:14.144272 2026] [security2:error] [pid 989638:tid 989821] [client 74.7.227.179:49578] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxmhpruoK4abRCMbAZJYAAANX4"], referer: https://tejasenvironmental.com/p=209587
[Sat Jul 18 23:54:14.357687 2026] [security2:error] [pid 989638:tid 989770] [client 185.132.186.39:57941] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 39.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/cgi-bin/class.api.php"] [unique_id "alxmhpruoK4abRCMbAZJdwAAAAI"]
[Sat Jul 18 23:54:14.612227 2026] [security2:error] [pid 989638:tid 989775] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmhpruoK4abRCMbAZJhAAAAAc"]
[Sat Jul 18 23:54:14.676433 2026] [security2:error] [pid 989638:tid 989837] [client 45.134.20.120:64339] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 120.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/upgrade/index.php"] [unique_id "alxmhpruoK4abRCMbAZJhgAAAEU"]
[Sat Jul 18 23:54:14.773907 2026] [security2:error] [pid 989638:tid 989824] [client 114.119.154.166:29917] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.guidehunting.com"] [uri "/"] [unique_id "alxmhpruoK4abRCMbAZJjAAAADg"], referer: https://vegas-vulkan.top/uqibfztm/cka%E4%BB%80%E9%BA%BC%E6%84%8F%E6%80%9D-3b35564c45/
[Sat Jul 18 23:54:14.826636 2026] [security2:error] [pid 989638:tid 989663] [remote 5.161.117.42:47100] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 42.117.161.5.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxmhpruoK4abRCMbAZJkAAAEhg"]
[Sat Jul 18 23:54:14.950257 2026] [security2:error] [pid 989638:tid 989840] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "sustaintheart.com"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alxmhpruoK4abRCMbAZJngAAAEg"]
[Sat Jul 18 23:54:15.030599 2026] [security2:error] [pid 989638:tid 989698] [remote 5.161.117.42:47100] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 42.117.161.5.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxmh5ruoK4abRCMbAZJrgAAGzs"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:54:15.144509 2026] [security2:error] [pid 989638:tid 989834] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmhpruoK4abRCMbAZJpAAAAEI"]
[Sat Jul 18 23:54:15.214477 2026] [security2:error] [pid 989638:tid 989872] [client 114.119.138.251:37949] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "sesamegreenbeans.com"] [uri "/wp-content/uploads/2020/08/South-Africa-Trip-Report-Day-3-Feature-Image.jpg"] [unique_id "alxmh5ruoK4abRCMbAZJuAAAAGg"], referer: http://sesamegreenbeans.com/wp-content/uploads/2020/08/South-Africa-Trip-Report-Day-3-Feature-Image.jpg
[Sat Jul 18 23:54:15.256550 2026] [security2:error] [pid 989638:tid 989877] [client 185.132.186.20:50589] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 20.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/cache/index.php"] [unique_id "alxmh5ruoK4abRCMbAZJvAAAAG0"]
[Sat Jul 18 23:54:15.282011 2026] [security2:error] [pid 989638:tid 989772] [client 191.237.250.106:3886] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "sustaintheart.com"] [uri "/press-release-sustaintheart-com-acquires-readartny-com/"] [unique_id "alxmh5ruoK4abRCMbAZJvwAAAAQ"]
[Sat Jul 18 23:54:15.290335 2026] [security2:error] [pid 989638:tid 989785] [client 177.37.19.12:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "worbals.com"] [uri "/index.php"] [unique_id "alxmh5ruoK4abRCMbAZJsgAAABE"]
[Sat Jul 18 23:54:15.547222 2026] [security2:error] [pid 989638:tid 989787] [client 45.134.20.128:34037] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "alxmh5ruoK4abRCMbAZJ0gAAABM"]
[Sat Jul 18 23:54:15.851788 2026] [security2:error] [pid 989638:tid 989714] [remote 31.42.184.154:54166] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "savilerowtravel.com"] [uri "/wp-login.php"] [unique_id "alxmh5ruoK4abRCMbAZJ5QAAVEs"]
[Sat Jul 18 23:54:15.919332 2026] [security2:error] [pid 989638:tid 989817] [client 139.167.225.146:51677] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxmh5ruoK4abRCMbAZJ6wAAADE"]
[Sat Jul 18 23:54:15.919436 2026] [security2:error] [pid 989638:tid 989817] [client 139.167.225.146:51677] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxmh5ruoK4abRCMbAZJ6wAAADE"]
[Sat Jul 18 23:54:16.097248 2026] [security2:error] [pid 989638:tid 989731] [remote 31.42.184.154:54166] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "savilerowtravel.com"] [uri "/wp-login.php"] [unique_id "alxmiJruoK4abRCMbAZJ9gAARVw"], referer: https://savilerowtravel.com/wp-login.php
[Sat Jul 18 23:54:16.310586 2026] [security2:error] [pid 989638:tid 989786] [client 57.141.18.6:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxmiJruoK4abRCMbAZJ-QAAABI"]
[Sat Jul 18 23:54:16.401399 2026] [security2:error] [pid 989638:tid 989787] [client 45.134.20.120:50685] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 120.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/pridmag/db.php"] [unique_id "alxmiJruoK4abRCMbAZKEQAAABM"]
[Sat Jul 18 23:54:16.422379 2026] [security2:error] [pid 989638:tid 989798] [client 114.119.153.112:31175] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.verdunestate.com"] [uri "/lebanon-beirut/propertyDetail.asp"] [unique_id "alxmiJruoK4abRCMbAZKFAAAAB4"], referer: http://www.verdunestate.com/lebanon-beirut/propertyDetail.asp?ID=142
[Sat Jul 18 23:54:16.648173 2026] [security2:error] [pid 989638:tid 989879] [client 114.119.142.94:65223] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "myhealthspot.org"] [uri "/2025/06/16/balloon-appdescargar-juego-de-inflar-globos-apk-10/"] [unique_id "alxmiJruoK4abRCMbAZKIwAAAG8"], referer: http://spiegeltherapie.de/index.php/component/k2/item/3/3?start=13500
[Sat Jul 18 23:54:16.652169 2026] [security2:error] [pid 989638:tid 989860] [client 114.119.139.207:56599] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.thecreole.com"] [uri "/"] [unique_id "alxmiJruoK4abRCMbAZKJAAAAFw"], referer: https://newstral.com/en/article/en/1080219939/sentencings-april-24-25
[Sat Jul 18 23:54:16.668182 2026] [security2:error] [pid 989638:tid 989736] [remote 41.186.86.12:6632] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "website-3c1c9eb1.nextlvlmarketingco.com"] [uri "/wp-login.php"] [unique_id "alxmiJruoK4abRCMbAZKJQAAEGE"]
[Sat Jul 18 23:54:16.841110 2026] [security2:error] [pid 989638:tid 989866] [client 114.119.143.214:42555] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "mollycahill.com"] [uri "/"] [unique_id "alxmiJruoK4abRCMbAZKNgAAAGI"], referer: http://mollycahill.com/
[Sat Jul 18 23:54:17.104574 2026] [security2:error] [pid 989638:tid 989823] [client 185.132.186.10:45255] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "alxmiZruoK4abRCMbAZKRgAAADc"]
[Sat Jul 18 23:54:17.122321 2026] [security2:error] [pid 989638:tid 989861] [client 114.119.153.72:21217] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.sarakety.com"] [uri "/category-s/28.htm"] [unique_id "alxmiZruoK4abRCMbAZKSQAAAF0"], referer: http://www.sarakety.com/Little-Bro-p/1zlbr02.htm
[Sat Jul 18 23:54:17.158523 2026] [security2:error] [pid 989638:tid 989754] [remote 41.186.86.12:6632] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "website-3c1c9eb1.nextlvlmarketingco.com"] [uri "/wp-login.php"] [unique_id "alxmiZruoK4abRCMbAZKSwAAKXM"], referer: https://website-3c1c9eb1.nextlvlmarketingco.com/wp-login.php
[Sat Jul 18 23:54:17.265438 2026] [security2:error] [pid 989638:tid 989808] [client 45.134.20.104:52329] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/plugin-install.php"] [unique_id "alxmiZruoK4abRCMbAZKVwAAACg"]
[Sat Jul 18 23:54:17.318286 2026] [security2:error] [pid 989638:tid 989889] [client 63.179.105.113:51390] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.105.179.63.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxmiZruoK4abRCMbAZKWAAAAHk"]
[Sat Jul 18 23:54:17.336429 2026] [security2:error] [pid 989638:tid 989774] [client 138.252.89.100:65490] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmiZruoK4abRCMbAZKWgAAAAY"]
[Sat Jul 18 23:54:17.336547 2026] [security2:error] [pid 989638:tid 989774] [client 138.252.89.100:65490] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmiZruoK4abRCMbAZKWgAAAAY"]
[Sat Jul 18 23:54:17.488899 2026] [security2:error] [pid 989638:tid 989640] [remote 103.255.134.61:50354] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.134.255.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "qualitycoatingsinspection.com"] [uri "/wp-login.php"] [unique_id "alxmiZruoK4abRCMbAZKZgAASAE"]
[Sat Jul 18 23:54:17.819951 2026] [security2:error] [pid 989638:tid 989860] [client 114.119.152.108:50335] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "adambergeron.com"] [uri "/grantees"] [unique_id "alxmiZruoK4abRCMbAZKegAAAFw"], referer: https://adambergeron.com/grantees?region%5B0%5D=56&region%5B1%5D=54&topic=116
[Sat Jul 18 23:54:18.003958 2026] [security2:error] [pid 989638:tid 989874] [client 185.132.186.36:35335] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 36.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/edit.php"] [unique_id "alxmipruoK4abRCMbAZKigAAAGo"]
[Sat Jul 18 23:54:18.059017 2026] [security2:error] [pid 989638:tid 989760] [remote 103.255.134.61:50354] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 61.134.255.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "qualitycoatingsinspection.com"] [uri "/wp-login.php"] [unique_id "alxmipruoK4abRCMbAZKjgAAb3k"], referer: https://qualitycoatingsinspection.com/wp-login.php
[Sat Jul 18 23:54:18.123632 2026] [security2:error] [pid 989638:tid 989893] [client 45.134.20.122:45157] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "alxmipruoK4abRCMbAZKkwAAAH0"]
[Sat Jul 18 23:54:18.179337 2026] [security2:error] [pid 989638:tid 989806] [client 114.119.137.193:26249] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.secretkeynumerology.com"] [uri "/author/sandhu-m"] [unique_id "alxmipruoK4abRCMbAZKlgAAACY"], referer: https://www.secretkeynumerology.com/author/sandhu-m
[Sat Jul 18 23:54:18.758371 2026] [security2:error] [pid 989638:tid 989864] [client 3.64.55.230:35148] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.55.64.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxmipruoK4abRCMbAZKtwAAAGA"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:54:18.898934 2026] [security2:error] [pid 989638:tid 989819] [client 185.132.186.13:53837] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/webdb.php"] [unique_id "alxmipruoK4abRCMbAZKuwAAADM"]
[Sat Jul 18 23:54:18.991612 2026] [security2:error] [pid 989638:tid 989861] [client 45.134.20.107:24057] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 107.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/js/load.php"] [unique_id "alxmipruoK4abRCMbAZKxAAAAF0"]
[Sat Jul 18 23:54:19.798033 2026] [security2:error] [pid 989638:tid 989882] [client 185.132.186.42:42969] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 42.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/assets/images/doc.php"] [unique_id "alxmi5ruoK4abRCMbAZLBAAAAHI"]
[Sat Jul 18 23:54:19.844574 2026] [security2:error] [pid 989638:tid 989871] [client 45.134.20.136:50553] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 136.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/images/firewall.php7"] [unique_id "alxmi5ruoK4abRCMbAZLCQAAAGc"]
[Sat Jul 18 23:54:20.168532 2026] [security2:error] [pid 989638:tid 989812] [client 35.227.39.208:5256] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "securingmemories.com"] [uri "/wp-json/batch/v1"] [unique_id "alxmjJruoK4abRCMbAZLGQAAACw"]
[Sat Jul 18 23:54:20.648317 2026] [security2:error] [pid 989638:tid 989876] [client 35.227.39.208:5256] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "securingmemories.com"] [uri "/"] [unique_id "alxmjJruoK4abRCMbAZLOgAAAGw"]
[Sat Jul 18 23:54:20.669072 2026] [security2:error] [pid 989638:tid 989785] [client 180.252.198.240:57625] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmjJruoK4abRCMbAZLPAAAABE"]
[Sat Jul 18 23:54:20.669235 2026] [security2:error] [pid 989638:tid 989785] [client 180.252.198.240:57625] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmjJruoK4abRCMbAZLPAAAABE"]
[Sat Jul 18 23:54:20.692282 2026] [security2:error] [pid 989638:tid 989807] [client 185.132.186.11:37055] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 11.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/file2.php"] [unique_id "alxmjJruoK4abRCMbAZLPwAAACc"]
[Sat Jul 18 23:54:20.698265 2026] [security2:error] [pid 989638:tid 989894] [client 45.134.20.128:20867] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "alxmjJruoK4abRCMbAZLQAAAAH4"]
[Sat Jul 18 23:54:20.871045 2026] [security2:error] [pid 989638:tid 989805] [client 36.83.95.75:62602] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmjJruoK4abRCMbAZLRwAAACU"]
[Sat Jul 18 23:54:20.871175 2026] [security2:error] [pid 989638:tid 989805] [client 36.83.95.75:62602] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmjJruoK4abRCMbAZLRwAAACU"]
[Sat Jul 18 23:54:21.090286 2026] [security2:error] [pid 989638:tid 989709] [remote 154.61.75.100:50668] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.75.61.154.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "dasmarque.com"] [uri "/wp-login.php"] [unique_id "alxmjZruoK4abRCMbAZLVQAAekY"], referer: https://dasmarque.com/wp-login.php
[Sat Jul 18 23:54:21.556302 2026] [security2:error] [pid 989638:tid 989818] [client 45.134.20.131:27191] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/upgrade/pdf.php"] [unique_id "alxmjZruoK4abRCMbAZLcgAAADI"]
[Sat Jul 18 23:54:21.585654 2026] [security2:error] [pid 989638:tid 989808] [client 185.132.186.38:50783] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 38.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "alxmjZruoK4abRCMbAZLdwAAACg"]
[Sat Jul 18 23:54:21.730400 2026] [security2:error] [pid 989638:tid 989763] [remote 45.157.54.14:32433] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "kiakahaconstruction.com"] [uri "/xmlrpc.php"] [unique_id "alxmjZruoK4abRCMbAZLgAAAHnw"]
[Sat Jul 18 23:54:21.730598 2026] [security2:error] [pid 989638:tid 989798] [client 45.157.54.14:32433] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "kiakahaconstruction.com"] [uri "/xmlrpc.php"] [unique_id "alxmjZruoK4abRCMbAZLgAAAHnw"]
[Sat Jul 18 23:54:21.754973 2026] [security2:error] [pid 989638:tid 989727] [remote 45.157.54.14:32450] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "kiakahaconstruction.com"] [uri "/xmlrpc.php"] [unique_id "alxmjZruoK4abRCMbAZLhgAAKlg"]
[Sat Jul 18 23:54:21.755130 2026] [security2:error] [pid 989638:tid 989810] [client 45.157.54.14:32450] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "kiakahaconstruction.com"] [uri "/xmlrpc.php"] [unique_id "alxmjZruoK4abRCMbAZLhgAAKlg"]
[Sat Jul 18 23:54:22.012231 2026] [security2:error] [pid 989638:tid 989817] [client 114.119.156.172:46797] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.lowemissionsasia.org"] [uri "/sites/default/files/pdf_file/GSR2014_full%20report_low%20res.pdf"] [unique_id "alxmjpruoK4abRCMbAZLmAAAADE"], referer: http://www.lowemissionsasia.org/resources?qt-resources=1
[Sat Jul 18 23:54:22.047144 2026] [security2:error] [pid 989638:tid 989835] [client 114.119.154.65:0] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.toddnielsen.com"] [uri "/international-leadership-blogathon/successful-leaders-make-their-own-luck"] [unique_id "alxmjpruoK4abRCMbAZLnQAAAEM"], referer: https://lead.iweza.com/the-2nd-international-leadership-blogathon-is-here/
[Sat Jul 18 23:54:22.412133 2026] [security2:error] [pid 989638:tid 989839] [client 45.134.20.129:50723] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 129.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/as.php"] [unique_id "alxmjpruoK4abRCMbAZLtwAAAEc"]
[Sat Jul 18 23:54:22.477502 2026] [security2:error] [pid 989638:tid 989805] [client 185.132.186.14:56033] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/alfa.php"] [unique_id "alxmjpruoK4abRCMbAZLvAAAACU"]
[Sat Jul 18 23:54:22.695263 2026] [security2:error] [pid 989638:tid 989891] [client 49.36.213.103:59295] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.213.36.49.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/xmlrpc.php"] [unique_id "alxmjpruoK4abRCMbAZLywAAAHs"]
[Sat Jul 18 23:54:22.695356 2026] [security2:error] [pid 989638:tid 989891] [client 49.36.213.103:59295] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz"] [uri "/xmlrpc.php"] [unique_id "alxmjpruoK4abRCMbAZLywAAAHs"]
[Sat Jul 18 23:54:23.053684 2026] [security2:error] [pid 989638:tid 989790] [client 114.119.132.58:55653] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.jennylouraya.com"] [uri "/author/mrs-sawahm/page/9"] [unique_id "alxmj5ruoK4abRCMbAZL4QAAABY"], referer: https://www.jennylouraya.com/author/mrs-sawahm/page/10
[Sat Jul 18 23:54:23.087592 2026] [security2:error] [pid 989638:tid 989673] [remote 31.42.184.154:39282] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxmj5ruoK4abRCMbAZL4gAAQiI"]
[Sat Jul 18 23:54:23.190109 2026] [security2:error] [pid 989638:tid 989861] [client 179.15.98.185:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.areitoproducciones.com"] [uri "/index.php"] [unique_id "alxmjZruoK4abRCMbAZLbwAAAF0"], referer: https://www.youtube.com/
[Sat Jul 18 23:54:23.268653 2026] [security2:error] [pid 989638:tid 989851] [client 45.134.20.123:49053] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 123.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/item.php"] [unique_id "alxmj5ruoK4abRCMbAZL9QAAAFM"]
[Sat Jul 18 23:54:23.330117 2026] [security2:error] [pid 989638:tid 989671] [remote 31.42.184.154:39282] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxmj5ruoK4abRCMbAZL-QAAJiA"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:54:23.375710 2026] [security2:error] [pid 989638:tid 989892] [client 185.132.186.26:48695] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 26.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/css/colors/blue/admin.php"] [unique_id "alxmj5ruoK4abRCMbAZL_AAAAHw"]
[Sat Jul 18 23:54:23.813663 2026] [security2:error] [pid 989638:tid 989880] [client 103.160.26.178:50140] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmj5ruoK4abRCMbAZMHQAAAHA"]
[Sat Jul 18 23:54:23.813824 2026] [security2:error] [pid 989638:tid 989880] [client 103.160.26.178:50140] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmj5ruoK4abRCMbAZMHQAAAHA"]
[Sat Jul 18 23:54:24.013123 2026] [security2:error] [pid 989638:tid 989686] [remote 46.37.124.80:0] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "origine.nz"] [uri "/.env"] [unique_id "alxmkJruoK4abRCMbAZMMAAAKy8"]
[Sat Jul 18 23:54:24.128266 2026] [security2:error] [pid 989638:tid 989773] [client 45.134.20.105:64711] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "alxmkJruoK4abRCMbAZMNwAAAAU"]
[Sat Jul 18 23:54:24.277675 2026] [security2:error] [pid 989638:tid 989804] [client 185.132.186.7:46123] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 7.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/click.php"] [unique_id "alxmkJruoK4abRCMbAZMQgAAACQ"]
[Sat Jul 18 23:54:24.397845 2026] [security2:error] [pid 989638:tid 989832] [client 46.37.124.80:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "origine.nz"] [uri "/index.php"] [unique_id "alxmj5ruoK4abRCMbAZMDwAAQDg"]
[Sat Jul 18 23:54:24.715071 2026] [security2:error] [pid 989638:tid 989814] [client 35.227.39.208:5256] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "securingmemories.com"] [uri "/index.php"] [unique_id "alxmjpruoK4abRCMbAZLowAAAC4"], referer: http://securingmemories.com/wp-json/batch/v1
[Sat Jul 18 23:54:24.902097 2026] [security2:error] [pid 989638:tid 989827] [client 113.160.97.242:62685] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "wpad"] [uri "/wpad.dat"] [unique_id "alxmkJruoK4abRCMbAZMbgAAADs"]
[Sat Jul 18 23:54:24.907122 2026] [security2:error] [pid 989638:tid 989801] [client 113.160.97.242:62684] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "wpad"] [uri "/wpad.dat"] [unique_id "alxmkJruoK4abRCMbAZMcAAAACE"]
[Sat Jul 18 23:54:24.921244 2026] [security2:error] [pid 989638:tid 989774] [client 113.160.97.242:62683] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "wpad"] [uri "/wpad.dat"] [unique_id "alxmkJruoK4abRCMbAZMcgAAAAY"]
[Sat Jul 18 23:54:24.992630 2026] [security2:error] [pid 989638:tid 989846] [client 45.134.20.121:49075] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 121.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/install.php"] [unique_id "alxmkJruoK4abRCMbAZMdgAAAE4"]
[Sat Jul 18 23:54:25.185592 2026] [security2:error] [pid 989638:tid 989817] [client 185.132.186.3:39521] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 3.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/.well-known/wp-conflg.php"] [unique_id "alxmkZruoK4abRCMbAZMggAAADE"]
[Sat Jul 18 23:54:25.313099 2026] [security2:error] [pid 989638:tid 989725] [remote 31.42.184.154:39288] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "website-19aec4aa.spencersadventures.com"] [uri "/wp-login.php"] [unique_id "alxmkZruoK4abRCMbAZMiAAALFY"]
[Sat Jul 18 23:54:25.726641 2026] [security2:error] [pid 989638:tid 989742] [remote 46.37.124.80:0] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "origine.nz"] [uri "/backend/.env"] [unique_id "alxmkZruoK4abRCMbAZMrwAAImc"]
[Sat Jul 18 23:54:25.744149 2026] [security2:error] [pid 989638:tid 989716] [remote 46.37.124.80:0] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "origine.nz"] [uri "/api/.env"] [unique_id "alxmkZruoK4abRCMbAZMsAAAS00"]
[Sat Jul 18 23:54:25.776118 2026] [security2:error] [pid 989638:tid 989749] [remote 31.42.184.154:39288] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "website-19aec4aa.spencersadventures.com"] [uri "/wp-login.php"] [unique_id "alxmkZruoK4abRCMbAZMuAAAQ24"], referer: https://website-19aec4aa.spencersadventures.com/wp-login.php
[Sat Jul 18 23:54:25.801446 2026] [security2:error] [pid 989638:tid 989877] [client 46.37.124.80:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "origine.nz"] [uri "/index.php"] [unique_id "alxmkZruoK4abRCMbAZMgAAAbUk"]
[Sat Jul 18 23:54:25.853277 2026] [security2:error] [pid 989638:tid 989838] [client 45.134.20.136:51161] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 136.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/customize/db.php"] [unique_id "alxmkZruoK4abRCMbAZMxAAAAEY"]
[Sat Jul 18 23:54:25.885817 2026] [security2:error] [pid 989638:tid 989778] [client 52.109.124.141:35776] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "msoid.quangminhltd.vn"] [uri "/index.cgi"] [unique_id "alxmkZruoK4abRCMbAZMxQAAAAo"]
[Sat Jul 18 23:54:26.068395 2026] [security2:error] [pid 989638:tid 989787] [client 52.109.124.141:35776] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "404"] [hostname "msoid.quangminhltd.vn"] [uri "/404.html"] [unique_id "alxmkpruoK4abRCMbAZM0QAAABM"]
[Sat Jul 18 23:54:26.077851 2026] [security2:error] [pid 989638:tid 989783] [client 185.132.186.23:27441] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 23.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/css/colors/blue/atomlib.php"] [unique_id "alxmkpruoK4abRCMbAZM0gAAAA8"]
[Sat Jul 18 23:54:26.262954 2026] [security2:error] [pid 989638:tid 989808] [client 46.37.124.80:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "origine.nz"] [uri "/index.php"] [unique_id "alxmkZruoK4abRCMbAZMigAAKGU"]
[Sat Jul 18 23:54:26.340742 2026] [security2:error] [pid 989638:tid 989798] [client 114.119.157.241:35615] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "youpositive.co"] [uri "/ar/images-august-2-of-3-3-1024x683/"] [unique_id "alxmkpruoK4abRCMbAZM2gAAAB4"], referer: https://youpositive.co/ar/calendar
[Sat Jul 18 23:54:26.384969 2026] [security2:error] [pid 989638:tid 989808] [client 46.37.124.80:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "origine.nz"] [uri "/index.php"] [unique_id "alxmkZruoK4abRCMbAZMoAAAKG0"]
[Sat Jul 18 23:54:26.454711 2026] [security2:error] [pid 989638:tid 989880] [client 46.37.124.80:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "origine.nz"] [uri "/index.php"] [unique_id "alxmkZruoK4abRCMbAZMowAAcFo"]
[Sat Jul 18 23:54:26.508657 2026] [security2:error] [pid 989638:tid 989808] [client 46.37.124.80:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "origine.nz"] [uri "/index.php"] [unique_id "alxmkZruoK4abRCMbAZMqQAAKGo"]
[Sat Jul 18 23:54:26.717474 2026] [security2:error] [pid 989638:tid 989806] [client 46.37.124.80:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "origine.nz"] [uri "/index.php"] [unique_id "alxmkZruoK4abRCMbAZMtQAAJnM"]
[Sat Jul 18 23:54:26.717633 2026] [security2:error] [pid 989638:tid 989817] [client 45.134.20.136:41663] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 136.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/css/fan.php"] [unique_id "alxmkpruoK4abRCMbAZM-AAAADE"]
[Sat Jul 18 23:54:26.743496 2026] [security2:error] [pid 989638:tid 989841] [client 46.37.124.80:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "origine.nz"] [uri "/index.php"] [unique_id "alxmkZruoK4abRCMbAZMsQAASV8"]
[Sat Jul 18 23:54:26.770312 2026] [security2:error] [pid 989638:tid 989872] [client 139.167.225.146:52245] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxmkpruoK4abRCMbAZM_QAAAGg"]
[Sat Jul 18 23:54:26.770419 2026] [security2:error] [pid 989638:tid 989872] [client 139.167.225.146:52245] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxmkpruoK4abRCMbAZM_QAAAGg"]
[Sat Jul 18 23:54:26.802240 2026] [security2:error] [pid 989638:tid 989859] [client 46.37.124.80:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "origine.nz"] [uri "/index.php"] [unique_id "alxmkZruoK4abRCMbAZMwgAAW28"]
[Sat Jul 18 23:54:26.812089 2026] [security2:error] [pid 989638:tid 989785] [client 114.119.146.114:52189] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.oswegooperatheater.com"] [uri "/auditions"] [unique_id "alxmkpruoK4abRCMbAZNAgAAABE"], referer: https://oswegocountytoday.com/community/oswego-opera-theater-accepting-audition-applications-for-hms-pinafore/
[Sat Jul 18 23:54:26.981509 2026] [security2:error] [pid 989638:tid 989890] [client 185.132.186.43:47421] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 43.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/js/widgets/bypass.php"] [unique_id "alxmkpruoK4abRCMbAZNEwAAAHo"]
[Sat Jul 18 23:54:27.351226 2026] [security2:error] [pid 989638:tid 989799] [client 44.208.214.205:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.innspace.ca"] [uri "/index.php"] [unique_id "alxmkZruoK4abRCMbAZMrQAAAB8"]
[Sat Jul 18 23:54:27.395202 2026] [security2:error] [pid 989638:tid 989836] [client 114.119.133.63:23229] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "sanifidensolutions.com"] [uri "/"] [unique_id "alxmk5ruoK4abRCMbAZNLQAAAEQ"], referer: https://sidhulawyers.com.au/sitemap_quality_9.xml
[Sat Jul 18 23:54:27.570889 2026] [security2:error] [pid 989638:tid 989873] [client 45.134.20.110:48143] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/blue/colors.php"] [unique_id "alxmk5ruoK4abRCMbAZNOgAAAGk"]
[Sat Jul 18 23:54:27.867550 2026] [security2:error] [pid 989638:tid 989869] [client 114.119.155.94:36899] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.appelmanimages.com"] [uri "/seeing-green-in-march-naperville-lifestyle-photography/"] [unique_id "alxmk5ruoK4abRCMbAZNUAAAAGU"], referer: https://www.appelmanimages.com/seeing-green-in-march-naperville-lifestyle-photography?reply-to=444
[Sat Jul 18 23:54:27.871310 2026] [security2:error] [pid 989638:tid 989870] [client 185.132.186.43:40165] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 43.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "alxmk5ruoK4abRCMbAZNUgAAAGY"]
[Sat Jul 18 23:54:28.045707 2026] [security2:error] [pid 989638:tid 989679] [remote 17.246.15.236:45124] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 236.15.246.17.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.39ishlife.com"] [uri "/wp-content/themes/daisy-theme/rslib/minify/load.php"] [unique_id "alxmlJruoK4abRCMbAZNZwAAVCg"], referer: https://www.39ishlife.com/the-book-that-should-be-on-every-childs-bookshelf/
[Sat Jul 18 23:54:28.292154 2026] [security2:error] [pid 989638:tid 989713] [remote 46.37.124.80:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 80.124.37.46.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "origine.nz"] [uri "/xmlrpc.php"] [unique_id "alxmlJruoK4abRCMbAZNdgAASUo"]
[Sat Jul 18 23:54:28.454039 2026] [security2:error] [pid 989638:tid 989773] [client 45.134.20.113:28469] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/images/mah.php"] [unique_id "alxmlJruoK4abRCMbAZNiQAAAAU"]
[Sat Jul 18 23:54:28.764411 2026] [security2:error] [pid 989638:tid 989843] [client 185.132.186.33:52955] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 33.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/index.php"] [unique_id "alxmlJruoK4abRCMbAZNlgAAAEs"]
[Sat Jul 18 23:54:28.965541 2026] [security2:error] [pid 989638:tid 989772] [client 138.252.89.100:49640] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmlJruoK4abRCMbAZNpAAAAAQ"]
[Sat Jul 18 23:54:28.965649 2026] [security2:error] [pid 989638:tid 989772] [client 138.252.89.100:49640] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmlJruoK4abRCMbAZNpAAAAAQ"]
[Sat Jul 18 23:54:29.272264 2026] [security2:error] [pid 989638:tid 989821] [client 46.37.124.80:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "origine.nz"] [uri "/index.php"] [unique_id "alxmk5ruoK4abRCMbAZNVgAANTI"]
[Sat Jul 18 23:54:29.308401 2026] [security2:error] [pid 989638:tid 989885] [client 45.134.20.109:20279] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 109.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/waf_defender.php"] [unique_id "alxmlZruoK4abRCMbAZNuQAAAHU"]
[Sat Jul 18 23:54:29.652473 2026] [security2:error] [pid 989638:tid 989819] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmlZruoK4abRCMbAZNwgAAADM"]
[Sat Jul 18 23:54:29.655234 2026] [security2:error] [pid 989638:tid 989808] [client 185.132.186.42:20265] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 42.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/edit.php"] [unique_id "alxmlZruoK4abRCMbAZN1QAAACg"]
[Sat Jul 18 23:54:29.876598 2026] [ssl:error] [pid 989638:tid 989877] [client 3.233.59.216:46647] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname webmail.gxh.sty.mybluehost.me provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:54:29.884784 2026] [security2:error] [pid 989638:tid 989822] [client 50.116.65.227:11720] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.fkconstructionfunding.com"] [uri "/wp-content/plugins/contact-form-7/includes/css/styles.css"] [unique_id "alxmlZruoK4abRCMbAZN4AAAADY"]
[Sat Jul 18 23:54:29.894334 2026] [security2:error] [pid 989638:tid 989894] [client 50.116.65.227:11732] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.fkconstructionfunding.com"] [uri "/wp-content/plugins/contact-form-7/includes/css/styles-rtl.css"] [unique_id "alxmlZruoK4abRCMbAZN4QAAAH4"]
[Sat Jul 18 23:54:30.161422 2026] [security2:error] [pid 989638:tid 989857] [client 45.134.20.105:55659] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/ectoplasm/content.php"] [unique_id "alxmlpruoK4abRCMbAZN9wAAAFk"]
[Sat Jul 18 23:54:30.175146 2026] [security2:error] [pid 989638:tid 989886] [client 46.37.124.80:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "origine.nz"] [uri "/index.php"] [unique_id "alxmk5ruoK4abRCMbAZNXwAAdkM"]
[Sat Jul 18 23:54:30.250380 2026] [security2:error] [pid 989638:tid 989821] [client 46.37.124.80:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "origine.nz"] [uri "/index.php"] [unique_id "alxmk5ruoK4abRCMbAZNVwAANSU"]
[Sat Jul 18 23:54:30.311679 2026] [security2:error] [pid 989638:tid 989838] [client 114.119.142.14:37811] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "hedgerow-crafts.com"] [uri "/2018/01/ein-lied-hazel-and-willow-armchair/"] [unique_id "alxmlpruoK4abRCMbAZOAgAAAEY"], referer: https://hedgerow-crafts.com/category/news/page/4
[Sat Jul 18 23:54:30.475218 2026] [security2:error] [pid 989638:tid 989808] [client 74.208.214.194:42034] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxmlpruoK4abRCMbAZOEwAAACg"]
[Sat Jul 18 23:54:30.556569 2026] [security2:error] [pid 989638:tid 989851] [client 185.132.186.27:45333] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/plugins/WordPressCore/index.php"] [unique_id "alxmlpruoK4abRCMbAZOHQAAAFM"]
[Sat Jul 18 23:54:30.973444 2026] [security2:error] [pid 989638:tid 989839] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmlpruoK4abRCMbAZOMgAAAEc"]
[Sat Jul 18 23:54:31.034773 2026] [security2:error] [pid 989638:tid 989787] [client 45.134.20.110:60295] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/install.php"] [unique_id "alxml5ruoK4abRCMbAZOPwAAABM"]
[Sat Jul 18 23:54:31.450978 2026] [security2:error] [pid 989638:tid 989857] [client 185.132.186.36:33477] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 36.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/cgi-bin/autoload_classmap.php"] [unique_id "alxml5ruoK4abRCMbAZOXgAAAFk"]
[Sat Jul 18 23:54:31.637360 2026] [security2:error] [pid 989638:tid 989818] [client 36.83.95.75:63105] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxml5ruoK4abRCMbAZObAAAADI"]
[Sat Jul 18 23:54:31.637453 2026] [security2:error] [pid 989638:tid 989818] [client 36.83.95.75:63105] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxml5ruoK4abRCMbAZObAAAADI"]
[Sat Jul 18 23:54:31.810382 2026] [security2:error] [pid 989638:tid 989814] [client 180.252.198.240:58108] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxml5ruoK4abRCMbAZOewAAAC4"]
[Sat Jul 18 23:54:31.810675 2026] [security2:error] [pid 989638:tid 989814] [client 180.252.198.240:58108] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxml5ruoK4abRCMbAZOewAAAC4"]
[Sat Jul 18 23:54:31.894982 2026] [security2:error] [pid 989638:tid 989780] [client 45.134.20.120:20173] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 120.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "alxml5ruoK4abRCMbAZOgAAAAAw"]
[Sat Jul 18 23:54:32.106223 2026] [ssl:error] [pid 989638:tid 989869] [client 98.84.1.175:14982] AH02032: Hostname box5936.bluehost.com (default host as no SNI was provided) and hostname cpanel.mvc.mub.mybluehost.me provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Jul 18 23:54:32.243223 2026] [security2:error] [pid 989638:tid 989844] [client 46.37.124.80:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "origine.nz"] [uri "/index.php"] [unique_id "alxmlJruoK4abRCMbAZNcgAATEE"]
[Sat Jul 18 23:54:32.245692 2026] [security2:error] [pid 989638:tid 989830] [client 2406:2d40:7669:4420:9211:2337:2b85:1a2f:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "origine.nz"] [uri "/index.php"] [unique_id "alxmlJruoK4abRCMbAZNqQAAPlQ"]
[Sat Jul 18 23:54:32.349437 2026] [security2:error] [pid 989638:tid 989891] [client 185.132.186.21:43075] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 21.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-links-opml.php"] [unique_id "alxmmJruoK4abRCMbAZOoAAAAHs"]
[Sat Jul 18 23:54:32.567230 2026] [security2:error] [pid 989638:tid 989856] [client 114.119.158.189:59025] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.hoomanr.com"] [uri "/web/logSheetOn.php"] [unique_id "alxmmJruoK4abRCMbAZOqAAAAFg"], referer: http://www.hoomanr.com/web/managersAdvantage/
[Sat Jul 18 23:54:32.762410 2026] [security2:error] [pid 989638:tid 989878] [client 45.134.20.112:32895] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 112.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/content.php"] [unique_id "alxmmJruoK4abRCMbAZOtwAAAG4"]
[Sat Jul 18 23:54:32.826253 2026] [security2:error] [pid 989638:tid 989701] [remote 62.210.185.4:50500] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 4.185.210.62.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxmmJruoK4abRCMbAZOvAAAWz4"]
[Sat Jul 18 23:54:32.990589 2026] [security2:error] [pid 989638:tid 989689] [remote 62.210.185.4:50500] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 4.185.210.62.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxmmJruoK4abRCMbAZOxAAAAjI"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:54:33.264062 2026] [security2:error] [pid 989638:tid 989879] [client 185.132.186.1:51381] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 1.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/user/network.php"] [unique_id "alxmmZruoK4abRCMbAZO2gAAAG8"]
[Sat Jul 18 23:54:33.420664 2026] [security2:error] [pid 989638:tid 989805] [client 114.119.157.82:32581] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "bluedoorbar.co.nz"] [uri "/cvw2323r2eew/scaricare/Tre%2Bgiorni%2Ba%2BBolgheri"] [unique_id "alxmmZruoK4abRCMbAZO5QAAACU"], referer: http://bluedoorbar.co.nz/cvw2323r2eew/scaricare/Tre%2Bgiorni%2Ba%2BBolgheri
[Sat Jul 18 23:54:33.618700 2026] [security2:error] [pid 989638:tid 989878] [client 45.134.20.108:36767] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/twentytwentyfour/icascreenshots.php"] [unique_id "alxmmZruoK4abRCMbAZO7QAAAG4"]
[Sat Jul 18 23:54:33.625500 2026] [security2:error] [pid 989638:tid 989850] [client 113.160.97.242:62691] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "wpad"] [uri "/wpad.dat"] [unique_id "alxmmZruoK4abRCMbAZO7gAAAFI"]
[Sat Jul 18 23:54:33.628985 2026] [security2:error] [pid 989638:tid 989825] [client 113.160.97.242:62690] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "wpad"] [uri "/wpad.dat"] [unique_id "alxmmZruoK4abRCMbAZO7wAAADk"]
[Sat Jul 18 23:54:33.631618 2026] [security2:error] [pid 989638:tid 989825] [client 113.160.97.242:62689] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "wpad"] [uri "/wpad.dat"] [unique_id "alxmmZruoK4abRCMbAZO8AAAADk"]
[Sat Jul 18 23:54:33.715107 2026] [security2:error] [pid 989638:tid 989737] [remote 113.160.142.119:56736] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "worbals.com"] [uri "/wp-login.php"] [unique_id "alxmmZruoK4abRCMbAZO-QAAMWI"]
[Sat Jul 18 23:54:33.912130 2026] [security2:error] [pid 989638:tid 989868] [client 114.119.159.254:26373] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "asliceofleadership.com"] [uri "/upsurgecommunications/"] [unique_id "alxmmZruoK4abRCMbAZPCwAAAGQ"], referer: https://asliceofleadership.com/
[Sat Jul 18 23:54:34.155266 2026] [security2:error] [pid 989638:tid 989797] [client 185.132.186.51:50705] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 51.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/atomlib.php"] [unique_id "alxmmpruoK4abRCMbAZPFgAAAB0"]
[Sat Jul 18 23:54:34.206256 2026] [security2:error] [pid 989638:tid 989755] [remote 113.160.142.119:56736] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "worbals.com"] [uri "/wp-login.php"] [unique_id "alxmmpruoK4abRCMbAZPHQAADXQ"], referer: https://worbals.com/wp-login.php
[Sat Jul 18 23:54:34.374864 2026] [security2:error] [pid 989638:tid 989811] [client 103.160.26.178:50850] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmmpruoK4abRCMbAZPNAAAACs"]
[Sat Jul 18 23:54:34.374970 2026] [security2:error] [pid 989638:tid 989811] [client 103.160.26.178:50850] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmmpruoK4abRCMbAZPNAAAACs"]
[Sat Jul 18 23:54:34.481185 2026] [security2:error] [pid 989638:tid 989808] [client 45.134.20.128:21159] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/upgrade/bypass.php"] [unique_id "alxmmpruoK4abRCMbAZPOgAAACg"]
[Sat Jul 18 23:54:35.045410 2026] [security2:error] [pid 989638:tid 989683] [remote 31.42.184.154:43984] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-login.php"] [unique_id "alxmm5ruoK4abRCMbAZPiQAATCw"]
[Sat Jul 18 23:54:35.051052 2026] [security2:error] [pid 989638:tid 989838] [client 185.132.186.41:56123] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "alxmm5ruoK4abRCMbAZPjAAAAEY"]
[Sat Jul 18 23:54:35.124720 2026] [security2:error] [pid 989638:tid 989865] [client 85.204.70.114:43914] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "legallyknownaszacharyhoy999.com"] [uri "/index.php"] [unique_id "alxmmpruoK4abRCMbAZPdwAAAGE"]
[Sat Jul 18 23:54:35.264168 2026] [security2:error] [pid 989638:tid 989876] [client 85.204.70.114:43914] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.70.204.85.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "legallyknownaszacharyhoy999.com"] [uri "/xmlrpc.php"] [unique_id "alxmm5ruoK4abRCMbAZPlgAAAGw"]
[Sat Jul 18 23:54:35.264254 2026] [security2:error] [pid 989638:tid 989876] [client 85.204.70.114:43914] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "legallyknownaszacharyhoy999.com"] [uri "/xmlrpc.php"] [unique_id "alxmm5ruoK4abRCMbAZPlgAAAGw"]
[Sat Jul 18 23:54:35.317790 2026] [security2:error] [pid 989638:tid 989721] [remote 31.42.184.154:43984] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-login.php"] [unique_id "alxmm5ruoK4abRCMbAZPnAAAeVI"], referer: https://swafforddetailing.com/wp-login.php
[Sat Jul 18 23:54:35.347287 2026] [security2:error] [pid 989638:tid 989870] [client 45.134.20.114:54679] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 114.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/rk2.php"] [unique_id "alxmm5ruoK4abRCMbAZPogAAAGY"]
[Sat Jul 18 23:54:35.949102 2026] [security2:error] [pid 989638:tid 989891] [client 185.132.186.16:32163] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 16.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/xl2023.php"] [unique_id "alxmm5ruoK4abRCMbAZPxAAAAHs"]
[Sat Jul 18 23:54:36.202076 2026] [security2:error] [pid 989638:tid 989864] [client 45.134.20.120:20287] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 120.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/ocean/alam.php"] [unique_id "alxmnJruoK4abRCMbAZP0QAAAGA"]
[Sat Jul 18 23:54:36.852351 2026] [security2:error] [pid 989638:tid 989783] [client 185.132.186.19:61739] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 19.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/certificates/admin.php"] [unique_id "alxmnJruoK4abRCMbAZQIwAAAA8"]
[Sat Jul 18 23:54:36.959505 2026] [proxy:error] [pid 989638:tid 989778] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:54:36.959555 2026] [proxy_http:error] [pid 989638:tid 989778] [client 193.47.62.168:53706] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:54:36.959973 2026] [proxy:error] [pid 989638:tid 989778] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:54:36.959995 2026] [proxy_http:error] [pid 989638:tid 989778] [client 193.47.62.168:53706] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:54:37.094480 2026] [security2:error] [pid 989638:tid 989871] [client 45.134.20.133:50297] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/b.php"] [unique_id "alxmnZruoK4abRCMbAZQNwAAAGc"]
[Sat Jul 18 23:54:37.141614 2026] [security2:error] [pid 989638:tid 989769] [client 90.73.180.100:57990] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.180.73.90.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "whiteoutcb.com"] [uri "/xmlrpc.php"] [unique_id "alxmnZruoK4abRCMbAZQPgAAAAE"]
[Sat Jul 18 23:54:37.141688 2026] [security2:error] [pid 989638:tid 989769] [client 90.73.180.100:57990] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "whiteoutcb.com"] [uri "/xmlrpc.php"] [unique_id "alxmnZruoK4abRCMbAZQPgAAAAE"]
[Sat Jul 18 23:54:37.745142 2026] [security2:error] [pid 989638:tid 989830] [client 185.132.186.2:48459] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 2.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/images/media/dog.php"] [unique_id "alxmnZruoK4abRCMbAZQYwAAAD4"]
[Sat Jul 18 23:54:37.797564 2026] [security2:error] [pid 989638:tid 989871] [client 50.116.65.227:11780] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.fkconstructionfunding.com"] [uri "/wp-content/plugins/contact-form-7/includes/css/styles.css"] [unique_id "alxmnZruoK4abRCMbAZQagAAAGc"]
[Sat Jul 18 23:54:37.808285 2026] [security2:error] [pid 989638:tid 989789] [client 50.116.65.227:11796] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "www.fkconstructionfunding.com"] [uri "/wp-content/plugins/contact-form-7/includes/css/styles-rtl.css"] [unique_id "alxmnZruoK4abRCMbAZQbAAAABU"]
[Sat Jul 18 23:54:37.824970 2026] [security2:error] [pid 989638:tid 989821] [client 139.167.225.146:52856] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 146.225.167.139.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxmnZruoK4abRCMbAZQZwAAADU"]
[Sat Jul 18 23:54:37.825131 2026] [security2:error] [pid 989638:tid 989821] [client 139.167.225.146:52856] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "nevelow.com"] [uri "/xmlrpc.php"] [unique_id "alxmnZruoK4abRCMbAZQZwAAADU"]
[Sat Jul 18 23:54:37.951355 2026] [security2:error] [pid 989638:tid 989804] [client 45.134.20.111:40565] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/certificates/past.php"] [unique_id "alxmnZruoK4abRCMbAZQdAAAACQ"]
[Sat Jul 18 23:54:37.969192 2026] [security2:error] [pid 989638:tid 989859] [client 200.80.180.42:8063] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "thierry-henry.fr"] [uri "/index.php"] [unique_id "alxmnZruoK4abRCMbAZQbgAAAFs"]
[Sat Jul 18 23:54:38.265367 2026] [security2:error] [pid 989638:tid 989816] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmnpruoK4abRCMbAZQfwAAADA"]
[Sat Jul 18 23:54:38.643087 2026] [security2:error] [pid 989638:tid 989855] [client 185.132.186.11:37783] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 11.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/xp.php"] [unique_id "alxmnpruoK4abRCMbAZQrAAAAFc"]
[Sat Jul 18 23:54:38.811183 2026] [security2:error] [pid 989638:tid 989801] [client 45.134.20.117:56555] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/css/as.php"] [unique_id "alxmnpruoK4abRCMbAZQuwAAACE"]
[Sat Jul 18 23:54:39.173916 2026] [security2:error] [pid 989638:tid 989689] [remote 31.42.184.154:44000] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxmn5ruoK4abRCMbAZQ2AAACTI"]
[Sat Jul 18 23:54:39.429154 2026] [security2:error] [pid 989638:tid 989728] [remote 31.42.184.154:44000] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxmn5ruoK4abRCMbAZQ5wAAf1k"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:54:39.548233 2026] [security2:error] [pid 989638:tid 989786] [client 185.132.186.42:45755] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 42.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "alxmn5ruoK4abRCMbAZQ7wAAABI"]
[Sat Jul 18 23:54:39.671430 2026] [security2:error] [pid 989638:tid 989834] [client 45.134.20.113:33871] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 113.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/pwnd/sst.php"] [unique_id "alxmn5ruoK4abRCMbAZQ-AAAAEI"]
[Sat Jul 18 23:54:39.847828 2026] [security2:error] [pid 989638:tid 989893] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmn5ruoK4abRCMbAZQ9gAAAH0"]
[Sat Jul 18 23:54:39.906021 2026] [autoindex:error] [pid 989638:tid 989830] [client 43.153.85.46:0] AH01276: Cannot serve directory /home3/alpchxmy/public_html/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: http://noisepacks.com
[Sat Jul 18 23:54:39.998338 2026] [security2:error] [pid 989638:tid 989793] [client 18.193.106.195:53388] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 195.106.193.18.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxmn5ruoK4abRCMbAZRDgAAABk"]
[Sat Jul 18 23:54:40.338423 2026] [proxy:error] [pid 989638:tid 989879] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:54:40.338504 2026] [proxy_http:error] [pid 989638:tid 989879] [client 87.236.176.156:50359] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:54:40.339408 2026] [proxy:error] [pid 989638:tid 989879] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:54:40.339440 2026] [proxy_http:error] [pid 989638:tid 989879] [client 87.236.176.156:50359] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:54:40.413535 2026] [security2:error] [pid 989638:tid 989833] [client 20.230.87.222:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 222.87.230.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.yidaiyi.org"] [uri "/browse.php"] [unique_id "alxmoJruoK4abRCMbAZRIwAAAEE"]
[Sat Jul 18 23:54:40.413651 2026] [security2:error] [pid 989638:tid 989833] [client 20.230.87.222:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.yidaiyi.org"] [uri "/browse.php"] [unique_id "alxmoJruoK4abRCMbAZRIwAAAEE"]
[Sat Jul 18 23:54:40.435188 2026] [security2:error] [pid 989638:tid 989732] [remote 54.90.74.5:38114] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "jndsupport.com"] [uri "/prisma/.env"] [unique_id "alxmoJruoK4abRCMbAZRKAAAf10"]
[Sat Jul 18 23:54:40.443076 2026] [security2:error] [pid 989638:tid 989819] [client 185.132.186.17:45945] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/assets/index.php"] [unique_id "alxmoJruoK4abRCMbAZRKwAAADM"]
[Sat Jul 18 23:54:40.532319 2026] [security2:error] [pid 989638:tid 989878] [client 45.134.20.125:52385] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 125.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/edit-tags.php"] [unique_id "alxmoJruoK4abRCMbAZRLwAAAG4"]
[Sat Jul 18 23:54:40.608594 2026] [security2:error] [pid 989638:tid 989892] [client 138.252.89.100:50361] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmoJruoK4abRCMbAZRNQAAAHw"]
[Sat Jul 18 23:54:40.608729 2026] [security2:error] [pid 989638:tid 989892] [client 138.252.89.100:50361] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmoJruoK4abRCMbAZRNQAAAHw"]
[Sat Jul 18 23:54:40.856170 2026] [security2:error] [pid 989638:tid 989706] [remote 8.217.108.67:6664] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxmoJruoK4abRCMbAZRSwAAYEM"]
[Sat Jul 18 23:54:40.968070 2026] [security2:error] [pid 989638:tid 989883] [client 50.116.65.227:13814] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "recruitinginsight.us"] [uri "/wp-cron.php"] [unique_id "alxmoJruoK4abRCMbAZRVQAAAHM"]
[Sat Jul 18 23:54:41.340336 2026] [security2:error] [pid 989638:tid 989882] [client 185.132.186.41:46887] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-links.php"] [unique_id "alxmoZruoK4abRCMbAZRZwAAAHI"]
[Sat Jul 18 23:54:41.387843 2026] [security2:error] [pid 989638:tid 989776] [client 45.134.20.121:58181] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 121.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wsax.php"] [unique_id "alxmoZruoK4abRCMbAZRaQAAAAg"]
[Sat Jul 18 23:54:41.408183 2026] [security2:error] [pid 989638:tid 989652] [remote 8.217.108.67:6664] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 67.108.217.8.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mezzacraft.com"] [uri "/wp-login.php"] [unique_id "alxmoZruoK4abRCMbAZRawAAJQ0"], referer: https://mezzacraft.com/wp-login.php
[Sat Jul 18 23:54:42.010514 2026] [security2:error] [pid 989638:tid 989803] [client 36.83.95.75:63666] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmopruoK4abRCMbAZRoQAAACM"]
[Sat Jul 18 23:54:42.010621 2026] [security2:error] [pid 989638:tid 989803] [client 36.83.95.75:63666] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmopruoK4abRCMbAZRoQAAACM"]
[Sat Jul 18 23:54:42.144349 2026] [security2:error] [pid 989638:tid 989869] [client 13.206.204.243:38810] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "155"] [id "900406"] [msg "wp-login POST logging"] [data "200"] [hostname "www.curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxmoZruoK4abRCMbAZRbwAAAGU"], referer: https://www.curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:54:42.230700 2026] [security2:error] [pid 989638:tid 989834] [client 185.132.186.52:20041] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 52.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/as.php"] [unique_id "alxmopruoK4abRCMbAZRtQAAAEI"]
[Sat Jul 18 23:54:42.274986 2026] [security2:error] [pid 989638:tid 989860] [client 45.134.20.111:42321] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 111.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/bless.php%20"] [unique_id "alxmopruoK4abRCMbAZRuQAAAFw"]
[Sat Jul 18 23:54:42.507524 2026] [autoindex:error] [pid 989638:tid 989808] [client 134.122.94.138:56817] AH01276: Cannot serve directory /home3/alaraycr/public_html/allisonrodrigue/: No matching DirectoryIndex (index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.php,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jul 18 23:54:42.838770 2026] [security2:error] [pid 989638:tid 989813] [client 180.252.198.240:58582] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmopruoK4abRCMbAZR4AAAAC0"]
[Sat Jul 18 23:54:42.838906 2026] [security2:error] [pid 989638:tid 989813] [client 180.252.198.240:58582] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmopruoK4abRCMbAZR4AAAAC0"]
[Sat Jul 18 23:54:42.904861 2026] [security2:error] [pid 989638:tid 989832] [client 54.85.69.47:65066] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 47.69.85.54.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php"] [unique_id "alxmopruoK4abRCMbAZR6AAAAEA"], referer: https://curlsnpearlsss.com/es/puerto-rican-beans-habichuelas-guisadas/
[Sat Jul 18 23:54:43.125694 2026] [security2:error] [pid 989638:tid 989860] [client 185.132.186.6:38931] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 6.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/css/index.php"] [unique_id "alxmo5ruoK4abRCMbAZR9AAAAFw"]
[Sat Jul 18 23:54:43.128413 2026] [security2:error] [pid 989638:tid 989687] [remote 103.75.185.95:43186] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxmo5ruoK4abRCMbAZR8AAAJDA"]
[Sat Jul 18 23:54:43.130970 2026] [security2:error] [pid 989638:tid 989798] [client 45.134.20.116:21347] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 116.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/uploads/system_cache.php"] [unique_id "alxmo5ruoK4abRCMbAZR9gAAAB4"]
[Sat Jul 18 23:54:43.132905 2026] [security2:error] [pid 989638:tid 989807] [client 136.243.59.237:59400] ModSecurity: Warning. Matched phrase "DomainStatsBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "www.ccsdifference.com"] [uri "/index.php"] [unique_id "alxmopruoK4abRCMbAZRywAAAEM"]
[Sat Jul 18 23:54:43.632038 2026] [security2:error] [pid 989638:tid 989711] [remote 103.75.185.95:43186] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxmo5ruoK4abRCMbAZSFAAAIUg"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:54:43.989759 2026] [security2:error] [pid 989638:tid 989784] [client 45.134.20.119:23147] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/files.php"] [unique_id "alxmo5ruoK4abRCMbAZSLgAAABA"]
[Sat Jul 18 23:54:44.025866 2026] [security2:error] [pid 989638:tid 989799] [client 185.132.186.4:64745] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 4.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "alxmpJruoK4abRCMbAZSMQAAAB8"]
[Sat Jul 18 23:54:44.793331 2026] [security2:error] [pid 989638:tid 989849] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmpJruoK4abRCMbAZSZQAAAFE"]
[Sat Jul 18 23:54:44.845064 2026] [security2:error] [pid 989638:tid 989853] [client 45.134.20.109:25083] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 109.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/tflow/admin-footer.php"] [unique_id "alxmpJruoK4abRCMbAZSeQAAAFU"]
[Sat Jul 18 23:54:44.920980 2026] [security2:error] [pid 989638:tid 989887] [client 185.132.186.20:50745] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 20.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/pomo/admin.php"] [unique_id "alxmpJruoK4abRCMbAZSgwAAAHc"]
[Sat Jul 18 23:54:45.015938 2026] [security2:error] [pid 989638:tid 989778] [client 103.160.26.178:51569] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmpZruoK4abRCMbAZShgAAAAo"]
[Sat Jul 18 23:54:45.016064 2026] [security2:error] [pid 989638:tid 989778] [client 103.160.26.178:51569] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmpZruoK4abRCMbAZShgAAAAo"]
[Sat Jul 18 23:54:45.261169 2026] [security2:error] [pid 989638:tid 989852] [client 47.128.59.255:52036] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "perrysnopeep.com"] [uri "/robots.txt"] [unique_id "alxmpZruoK4abRCMbAZSkwAAAFQ"]
[Sat Jul 18 23:54:45.581407 2026] [security2:error] [pid 989638:tid 989867] [client 74.208.214.194:41516] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxmpZruoK4abRCMbAZSrgAAAGM"]
[Sat Jul 18 23:54:45.700440 2026] [security2:error] [pid 989638:tid 989841] [client 45.134.20.108:22807] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 108.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "alxmpZruoK4abRCMbAZStAAAAEk"]
[Sat Jul 18 23:54:45.813478 2026] [security2:error] [pid 989638:tid 989801] [client 185.132.186.24:28245] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 24.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/IXR/security.php"] [unique_id "alxmpZruoK4abRCMbAZSugAAACE"]
[Sat Jul 18 23:54:46.276355 2026] [security2:error] [pid 989638:tid 989845] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmppruoK4abRCMbAZSzwAAAE0"]
[Sat Jul 18 23:54:46.521326 2026] [security2:error] [pid 989638:tid 989886] [client 20.230.87.222:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 222.87.230.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.yidaiyi.org"] [uri "/shell20211028.php"] [unique_id "alxmppruoK4abRCMbAZS7wAAAHY"]
[Sat Jul 18 23:54:46.521420 2026] [security2:error] [pid 989638:tid 989886] [client 20.230.87.222:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.yidaiyi.org"] [uri "/shell20211028.php"] [unique_id "alxmppruoK4abRCMbAZS7wAAAHY"]
[Sat Jul 18 23:54:46.560776 2026] [security2:error] [pid 989638:tid 989860] [client 45.134.20.138:35407] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 138.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/about.php"] [unique_id "alxmppruoK4abRCMbAZS9wAAAFw"]
[Sat Jul 18 23:54:46.706688 2026] [security2:error] [pid 989638:tid 989871] [client 185.132.186.44:28143] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 44.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/plugins/phpadmin/as.php"] [unique_id "alxmppruoK4abRCMbAZS_gAAAGc"]
[Sat Jul 18 23:54:46.730637 2026] [security2:error] [pid 989638:tid 989785] [client 20.230.87.222:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 222.87.230.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.yidaiyi.org"] [uri "/wp-content/themes/twenty/twenty.php"] [unique_id "alxmppruoK4abRCMbAZTAQAAABE"]
[Sat Jul 18 23:54:46.730704 2026] [security2:error] [pid 989638:tid 989785] [client 20.230.87.222:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.yidaiyi.org"] [uri "/wp-content/themes/twenty/twenty.php"] [unique_id "alxmppruoK4abRCMbAZTAQAAABE"]
[Sat Jul 18 23:54:46.744909 2026] [security2:error] [pid 989638:tid 989808] [client 50.116.65.227:13880] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "lifeisbetterlakeside.com"] [uri "/wp-content/uploads/2024/08/IMG_8766.jpeg"] [unique_id "alxmppruoK4abRCMbAZTBAAAAAQ"]
[Sat Jul 18 23:54:47.381350 2026] [security2:error] [pid 989638:tid 989872] [client 116.179.32.30:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "mollycahill.com"] [uri "/index.php"] [unique_id "alxmppruoK4abRCMbAZTFQAAAGg"]
[Sat Jul 18 23:54:47.423971 2026] [security2:error] [pid 989638:tid 989871] [client 45.134.20.106:50111] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "alxmp5ruoK4abRCMbAZTPgAAAGc"]
[Sat Jul 18 23:54:47.432900 2026] [security2:error] [pid 989638:tid 989708] [remote 152.228.213.32:50416] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "grecaalma.com"] [uri "/wp-login.php"] [unique_id "alxmp5ruoK4abRCMbAZTPQAAXEU"]
[Sat Jul 18 23:54:47.599282 2026] [security2:error] [pid 989638:tid 989781] [client 185.132.186.20:63483] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 20.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "alxmp5ruoK4abRCMbAZTRwAAAA0"]
[Sat Jul 18 23:54:47.609263 2026] [security2:error] [pid 989638:tid 989701] [remote 152.228.213.32:50416] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "grecaalma.com"] [uri "/wp-login.php"] [unique_id "alxmp5ruoK4abRCMbAZTSgAAez4"], referer: https://grecaalma.com/wp-login.php
[Sat Jul 18 23:54:48.252020 2026] [security2:error] [pid 989638:tid 989790] [client 54.90.74.5:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxmp5ruoK4abRCMbAZTdgAAABY"]
[Sat Jul 18 23:54:48.281517 2026] [security2:error] [pid 989638:tid 989860] [client 45.134.20.134:38773] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 134.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/pwnd/cloud.php"] [unique_id "alxmqJruoK4abRCMbAZThgAAAFw"]
[Sat Jul 18 23:54:48.494123 2026] [security2:error] [pid 989638:tid 989789] [client 185.132.186.18:52845] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 18.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/plugins/hello.php"] [unique_id "alxmqJruoK4abRCMbAZTngAAABU"]
[Sat Jul 18 23:54:48.693796 2026] [security2:error] [pid 989638:tid 989663] [remote 74.235.96.117:36696] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.235.74.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "massagelacey.com"] [uri "/wp-login.php"] [unique_id "alxmqJruoK4abRCMbAZTwgAAHxg"]
[Sat Jul 18 23:54:48.788763 2026] [security2:error] [pid 989638:tid 989843] [client 73.145.92.193:58641] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "lifeisbetterlakeside.com"] [uri "/index.php"] [unique_id "alxmqJruoK4abRCMbAZTsgAASxI"], referer: https://lifeisbetterlakeside.com/lemurs-up-close-and-personal-at-the-alabama-gulf-coast-zoo-part-2/
[Sat Jul 18 23:54:49.162707 2026] [security2:error] [pid 989638:tid 989821] [client 45.134.20.128:40951] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 128.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "alxmqZruoK4abRCMbAZT4QAAADU"]
[Sat Jul 18 23:54:49.392860 2026] [security2:error] [pid 989638:tid 989806] [client 185.132.186.16:33737] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 16.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/plugins/seoo/about.php"] [unique_id "alxmqZruoK4abRCMbAZT8wAAACY"]
[Sat Jul 18 23:54:49.530746 2026] [security2:error] [pid 989638:tid 989861] [client 50.116.65.227:22270] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "200"] [hostname "lifeisbetterlakeside.com"] [uri "/wp-content/uploads/2024/08/IMG_8766.jpeg"] [unique_id "alxmqZruoK4abRCMbAZT-wAAABI"]
[Sat Jul 18 23:54:49.800877 2026] [security2:error] [pid 989638:tid 989668] [remote 68.178.160.25:49790] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxmqZruoK4abRCMbAZUEQAAHR0"]
[Sat Jul 18 23:54:49.879709 2026] [security2:error] [pid 989638:tid 989731] [remote 74.235.96.117:36696] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.235.74.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "massagelacey.com"] [uri "/wp-login.php"] [unique_id "alxmqZruoK4abRCMbAZUFwAASFw"], referer: https://massagelacey.com/wp-login.php
[Sat Jul 18 23:54:50.021202 2026] [security2:error] [pid 989638:tid 989783] [client 45.134.20.118:29543] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/ubh/adminfus.php"] [unique_id "alxmqpruoK4abRCMbAZUIgAAAA8"]
[Sat Jul 18 23:54:50.168165 2026] [security2:error] [pid 989638:tid 989830] [client 74.7.244.47:39636] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "301"] [hostname "drawingthedog.com"] [uri "/robots.txt"] [unique_id "alxmqpruoK4abRCMbAZUKwAAPkw"]
[Sat Jul 18 23:54:50.211714 2026] [security2:error] [pid 989638:tid 989701] [remote 68.178.160.25:49790] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thewelloiledlife.com"] [uri "/wp-login.php"] [unique_id "alxmqpruoK4abRCMbAZUMQAAQz4"], referer: https://thewelloiledlife.com/wp-login.php
[Sat Jul 18 23:54:50.287707 2026] [security2:error] [pid 989638:tid 989811] [client 185.132.186.23:33717] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 23.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/fonts/about.php"] [unique_id "alxmqpruoK4abRCMbAZUMwAAACs"]
[Sat Jul 18 23:54:50.317001 2026] [security2:error] [pid 989638:tid 989820] [client 74.7.244.47:39640] ModSecurity: Warning. Matched phrase "oBot" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "200"] [hostname "www.drawingthedog.com"] [uri "/robots.txt"] [unique_id "alxmqpruoK4abRCMbAZUNQAANEs"], referer: https://drawingthedog.com/robots.txt
[Sat Jul 18 23:54:50.450363 2026] [security2:error] [pid 989638:tid 989862] [client 20.230.87.222:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 222.87.230.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.yidaiyi.org"] [uri "/wp-content/themes/twentytwentytwo/alfa-rex.php"] [unique_id "alxmqpruoK4abRCMbAZURQAAAF4"]
[Sat Jul 18 23:54:50.450448 2026] [security2:error] [pid 989638:tid 989862] [client 20.230.87.222:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.yidaiyi.org"] [uri "/wp-content/themes/twentytwentytwo/alfa-rex.php"] [unique_id "alxmqpruoK4abRCMbAZURQAAAF4"]
[Sat Jul 18 23:54:50.558483 2026] [security2:error] [pid 989638:tid 989869] [client 213.180.203.224:47812] ModSecurity: Access denied with code 429 (phase 2). Pattern match "Mozilla\\\\/5\\\\.0 \\\\(compatible; YandexBot\\\\/3\\\\.0; \\\\+http:\\\\/\\\\/yandex\\\\.com\\\\/bots\\\\)" at REQUEST_HEADERS:User-Agent. [file "/opt/mod_security/othercrawler.conf"] [line "3"] [id "901008"] [msg "Yandex Crawler 429 ADDED BY MONITORING DO NOT WHITELIST"] [hostname "ace-med.com"] [uri "/robots.txt"] [unique_id "alxmqpruoK4abRCMbAZUTQAAAGU"]
[Sat Jul 18 23:54:50.884153 2026] [security2:error] [pid 989638:tid 989811] [client 45.134.20.119:35827] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/pki-validation/webdb.php"] [unique_id "alxmqpruoK4abRCMbAZUYQAAACs"]
[Sat Jul 18 23:54:51.063294 2026] [security2:error] [pid 989638:tid 989862] [client 16.145.89.170:49502] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 170.89.145.16.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "cryptomeaning.com"] [uri "/wp-cron.php"] [unique_id "alxmq5ruoK4abRCMbAZUcgAAAF4"]
[Sat Jul 18 23:54:51.109892 2026] [security2:error] [pid 989638:tid 989798] [client 3.64.55.230:14698] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.cryptomeaning.com"] [uri "/index.php"] [unique_id "alxmqZruoK4abRCMbAZT4gAAAB4"]
[Sat Jul 18 23:54:51.185118 2026] [security2:error] [pid 989638:tid 989768] [client 185.132.186.6:20787] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 6.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/moon.php"] [unique_id "alxmq5ruoK4abRCMbAZUfgAAAAA"]
[Sat Jul 18 23:54:51.792161 2026] [security2:error] [pid 989638:tid 989855] [client 45.134.20.122:47905] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "alxmq5ruoK4abRCMbAZUnAAAAFc"]
[Sat Jul 18 23:54:52.078703 2026] [security2:error] [pid 989638:tid 989886] [client 185.132.186.23:58191] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 23.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/user/about.php"] [unique_id "alxmrJruoK4abRCMbAZUsAAAAHY"]
[Sat Jul 18 23:54:52.103020 2026] [security2:error] [pid 989638:tid 989860] [client 138.252.89.100:50896] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmrJruoK4abRCMbAZUsgAAAFw"]
[Sat Jul 18 23:54:52.103099 2026] [security2:error] [pid 989638:tid 989860] [client 138.252.89.100:50896] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmrJruoK4abRCMbAZUsgAAAFw"]
[Sat Jul 18 23:54:52.286818 2026] [security2:error] [pid 989638:tid 989822] [client 20.230.87.222:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 222.87.230.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.yidaiyi.org"] [uri "/index/lock.php"] [unique_id "alxmrJruoK4abRCMbAZUvQAAADY"]
[Sat Jul 18 23:54:52.286944 2026] [security2:error] [pid 989638:tid 989822] [client 20.230.87.222:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.yidaiyi.org"] [uri "/index/lock.php"] [unique_id "alxmrJruoK4abRCMbAZUvQAAADY"]
[Sat Jul 18 23:54:52.500010 2026] [security2:error] [pid 989638:tid 989837] [client 49.36.213.103:60531] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.213.36.49.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/xmlrpc.php"] [unique_id "alxmrJruoK4abRCMbAZUygAAAEU"]
[Sat Jul 18 23:54:52.500113 2026] [security2:error] [pid 989638:tid 989837] [client 49.36.213.103:60531] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz"] [uri "/xmlrpc.php"] [unique_id "alxmrJruoK4abRCMbAZUygAAAEU"]
[Sat Jul 18 23:54:52.583221 2026] [security2:error] [pid 989638:tid 989827] [client 36.83.95.75:64421] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmrJruoK4abRCMbAZU0gAAADs"]
[Sat Jul 18 23:54:52.583312 2026] [security2:error] [pid 989638:tid 989827] [client 36.83.95.75:64421] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmrJruoK4abRCMbAZU0gAAADs"]
[Sat Jul 18 23:54:52.662420 2026] [security2:error] [pid 989638:tid 989849] [client 180.252.198.240:59056] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmrJruoK4abRCMbAZU1wAAAFE"]
[Sat Jul 18 23:54:52.662530 2026] [security2:error] [pid 989638:tid 989849] [client 180.252.198.240:59056] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmrJruoK4abRCMbAZU1wAAAFE"]
[Sat Jul 18 23:54:52.664813 2026] [security2:error] [pid 989638:tid 989798] [client 45.134.20.110:62939] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/js/admin.php"] [unique_id "alxmrJruoK4abRCMbAZU2AAAAB4"]
[Sat Jul 18 23:54:52.978933 2026] [security2:error] [pid 989638:tid 989859] [client 185.132.186.9:23563] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/js/widgets/index.php"] [unique_id "alxmrJruoK4abRCMbAZU-wAAAFs"]
[Sat Jul 18 23:54:53.526065 2026] [security2:error] [pid 989638:tid 989844] [client 45.134.20.107:49959] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 107.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/js/widgets/item.php"] [unique_id "alxmrZruoK4abRCMbAZVHQAAAEw"]
[Sat Jul 18 23:54:53.874016 2026] [security2:error] [pid 989638:tid 989812] [client 185.132.186.14:34059] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/webadmin.php"] [unique_id "alxmrZruoK4abRCMbAZVOAAAACw"]
[Sat Jul 18 23:54:54.380652 2026] [security2:error] [pid 989638:tid 989796] [client 45.134.20.127:25069] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 127.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/uploads/xsec.php"] [unique_id "alxmrpruoK4abRCMbAZVVgAAABw"]
[Sat Jul 18 23:54:54.770065 2026] [security2:error] [pid 989638:tid 989775] [client 185.132.186.6:28281] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 6.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "alxmrpruoK4abRCMbAZVcQAAAAc"]
[Sat Jul 18 23:54:54.948034 2026] [security2:error] [pid 989638:tid 989854] [client 3.109.49.224:15346] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.49.109.3.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxmrpruoK4abRCMbAZVgQAAAFY"]
[Sat Jul 18 23:54:54.948115 2026] [security2:error] [pid 989638:tid 989854] [client 3.109.49.224:15346] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "curlsnpearlsss.com"] [uri "/xmlrpc.php"] [unique_id "alxmrpruoK4abRCMbAZVgQAAAFY"]
[Sat Jul 18 23:54:55.240159 2026] [security2:error] [pid 989638:tid 989812] [client 45.134.20.133:48749] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/images/Marvins.php"] [unique_id "alxmr5ruoK4abRCMbAZVkAAAACw"]
[Sat Jul 18 23:54:55.489400 2026] [security2:error] [pid 989638:tid 989825] [client 57.141.18.28:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxmr5ruoK4abRCMbAZVmgAAADk"]
[Sat Jul 18 23:54:55.664716 2026] [security2:error] [pid 989638:tid 989781] [client 185.132.186.18:47011] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 18.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/about.php"] [unique_id "alxmr5ruoK4abRCMbAZVrQAAAA0"]
[Sat Jul 18 23:54:55.761204 2026] [security2:error] [pid 989638:tid 989864] [client 113.160.97.242:60254] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "quangminhltd.vn"] [uri "/wpad.dat"] [unique_id "alxmr5ruoK4abRCMbAZVtwAAAGA"]
[Sat Jul 18 23:54:55.766738 2026] [security2:error] [pid 989638:tid 989819] [client 103.160.26.178:52093] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmr5ruoK4abRCMbAZVuAAAADM"]
[Sat Jul 18 23:54:55.766827 2026] [security2:error] [pid 989638:tid 989819] [client 103.160.26.178:52093] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmr5ruoK4abRCMbAZVuAAAADM"]
[Sat Jul 18 23:54:56.113331 2026] [security2:error] [pid 989638:tid 989861] [client 45.134.20.110:20613] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/pwnd-1/kurd.php"] [unique_id "alxmsJruoK4abRCMbAZV0QAAAF0"]
[Sat Jul 18 23:54:56.200861 2026] [security2:error] [pid 989638:tid 989771] [client 46.37.124.80:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "origine.nz"] [uri "/index.php"] [unique_id "alxmrJruoK4abRCMbAZUvwAAAyA"]
[Sat Jul 18 23:54:56.567518 2026] [security2:error] [pid 989638:tid 989852] [client 185.132.186.1:40309] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 1.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/xl2023.php"] [unique_id "alxmsJruoK4abRCMbAZV6AAAAFQ"]
[Sat Jul 18 23:54:56.903778 2026] [security2:error] [pid 989638:tid 989778] [client 217.217.245.230:49955] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.245.217.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxmsJruoK4abRCMbAZWBQAAAAo"]
[Sat Jul 18 23:54:56.903854 2026] [security2:error] [pid 989638:tid 989778] [client 217.217.245.230:49955] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxmsJruoK4abRCMbAZWBQAAAAo"]
[Sat Jul 18 23:54:57.086414 2026] [security2:error] [pid 989638:tid 989891] [client 45.134.20.107:56263] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 107.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/tflow/install.php"] [unique_id "alxmsZruoK4abRCMbAZWFwAAAHs"]
[Sat Jul 18 23:54:57.188481 2026] [security2:error] [pid 989638:tid 989826] [client 20.230.87.222:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 222.87.230.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.yidaiyi.org"] [uri "/wp-includes/style-engine/about.php"] [unique_id "alxmsZruoK4abRCMbAZWHQAAADo"]
[Sat Jul 18 23:54:57.188641 2026] [security2:error] [pid 989638:tid 989826] [client 20.230.87.222:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.yidaiyi.org"] [uri "/wp-includes/style-engine/about.php"] [unique_id "alxmsZruoK4abRCMbAZWHQAAADo"]
[Sat Jul 18 23:54:57.457800 2026] [security2:error] [pid 989638:tid 989858] [client 185.132.186.34:54879] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 34.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/go.php"] [unique_id "alxmsZruoK4abRCMbAZWMQAAAFo"]
[Sat Jul 18 23:54:57.653679 2026] [security2:error] [pid 989638:tid 989804] [client 40.77.167.18:34796] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "lifeisbetterlakeside.com"] [uri "/index.php"] [unique_id "alxmsZruoK4abRCMbAZWHwAAJDA"]
[Sat Jul 18 23:54:57.757468 2026] [security2:error] [pid 989638:tid 989793] [client 103.105.97.215:50281] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 215.97.105.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/xmlrpc.php"] [unique_id "alxmsZruoK4abRCMbAZWQAAAABk"]
[Sat Jul 18 23:54:57.757593 2026] [security2:error] [pid 989638:tid 989793] [client 103.105.97.215:50281] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz"] [uri "/xmlrpc.php"] [unique_id "alxmsZruoK4abRCMbAZWQAAAABk"]
[Sat Jul 18 23:54:57.861960 2026] [security2:error] [pid 989638:tid 989701] [remote 217.182.128.41:41556] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.128.182.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxmsZruoK4abRCMbAZWTwAAaD4"]
[Sat Jul 18 23:54:57.942762 2026] [security2:error] [pid 989638:tid 989775] [client 45.134.20.127:50575] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 127.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/languages/radio.php"] [unique_id "alxmsZruoK4abRCMbAZWWQAAAAc"]
[Sat Jul 18 23:54:58.063269 2026] [security2:error] [pid 989638:tid 989760] [remote 217.182.128.41:41556] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 41.128.182.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "toddnielsen.com"] [uri "/wp-login.php"] [unique_id "alxmspruoK4abRCMbAZWfwAAOXk"], referer: https://toddnielsen.com/wp-login.php
[Sat Jul 18 23:54:58.347329 2026] [security2:error] [pid 989638:tid 989823] [client 69.5.169.225:15086] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "50.116.64.31"] [uri "/index.cgi"] [unique_id "alxmspruoK4abRCMbAZWlgAAADc"]
[Sat Jul 18 23:54:58.358126 2026] [security2:error] [pid 989638:tid 989832] [client 185.132.186.46:63761] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 46.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/xleet.php"] [unique_id "alxmspruoK4abRCMbAZWmgAAAEA"]
[Sat Jul 18 23:54:58.808824 2026] [security2:error] [pid 989638:tid 989817] [client 45.134.20.125:29165] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 125.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/uploads/fileman.php"] [unique_id "alxmspruoK4abRCMbAZWxAAAADE"]
[Sat Jul 18 23:54:59.267781 2026] [security2:error] [pid 989638:tid 989842] [client 185.132.186.50:62073] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/templates/beez3/bypass.php"] [unique_id "alxms5ruoK4abRCMbAZW7AAAAEo"]
[Sat Jul 18 23:54:59.671446 2026] [security2:error] [pid 989638:tid 989875] [client 45.134.20.130:30921] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 130.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "alxms5ruoK4abRCMbAZXAAAAAGs"]
[Sat Jul 18 23:55:00.107436 2026] [security2:error] [pid 989638:tid 989668] [remote 103.75.185.95:52972] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxmtJruoK4abRCMbAZXHQAAXR0"]
[Sat Jul 18 23:55:00.157729 2026] [security2:error] [pid 989638:tid 989793] [client 185.132.186.10:34723] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/css/colors/blue/ahax.php"] [unique_id "alxmtJruoK4abRCMbAZXJgAAABk"]
[Sat Jul 18 23:55:00.536213 2026] [security2:error] [pid 989638:tid 989872] [client 45.134.20.106:47409] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "alxmtJruoK4abRCMbAZXRQAAAGg"]
[Sat Jul 18 23:55:00.593642 2026] [security2:error] [pid 989638:tid 989694] [remote 103.75.185.95:52972] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxmtJruoK4abRCMbAZXSAAAXjc"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:55:01.052374 2026] [security2:error] [pid 989638:tid 989833] [client 185.132.186.35:29685] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 35.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/.well-known/admin.php"] [unique_id "alxmtZruoK4abRCMbAZXaQAAAEE"]
[Sat Jul 18 23:55:01.391651 2026] [security2:error] [pid 989638:tid 989802] [client 45.134.20.138:62565] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 138.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/admin.php%20"] [unique_id "alxmtZruoK4abRCMbAZXggAAACI"]
[Sat Jul 18 23:55:01.632333 2026] [security2:error] [pid 989638:tid 989833] [client 20.230.87.222:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 222.87.230.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.yidaiyi.org"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "alxmtZruoK4abRCMbAZXmQAAAEE"]
[Sat Jul 18 23:55:01.632441 2026] [security2:error] [pid 989638:tid 989833] [client 20.230.87.222:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.yidaiyi.org"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "alxmtZruoK4abRCMbAZXmQAAAEE"]
[Sat Jul 18 23:55:01.644985 2026] [proxy:error] [pid 989638:tid 989883] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:55:01.645072 2026] [proxy_http:error] [pid 989638:tid 989883] [client 193.47.62.168:59740] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:55:01.645912 2026] [proxy:error] [pid 989638:tid 989883] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:55:01.645947 2026] [proxy_http:error] [pid 989638:tid 989883] [client 193.47.62.168:59740] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:55:01.819835 2026] [security2:error] [pid 989638:tid 989777] [client 34.136.134.112:28902] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "entuvy.com"] [uri "/wp-json/batch/v1"] [unique_id "alxmtZruoK4abRCMbAZXpAAAAAk"]
[Sat Jul 18 23:55:01.922273 2026] [security2:error] [pid 989638:tid 989834] [client 34.136.134.112:28902] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "entuvy.com"] [uri "/"] [unique_id "alxmtZruoK4abRCMbAZXqQAAAEI"]
[Sat Jul 18 23:55:01.954899 2026] [security2:error] [pid 989638:tid 989894] [client 185.132.186.27:35355] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/assets/file.php"] [unique_id "alxmtZruoK4abRCMbAZXrwAAAH4"]
[Sat Jul 18 23:55:02.265337 2026] [security2:error] [pid 989638:tid 989803] [client 45.134.20.138:53691] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 138.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/hong1.php"] [unique_id "alxmtpruoK4abRCMbAZXzgAAACM"]
[Sat Jul 18 23:55:02.366008 2026] [security2:error] [pid 989638:tid 989805] [client 180.252.198.240:59532] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmtpruoK4abRCMbAZX2gAAACU"]
[Sat Jul 18 23:55:02.366584 2026] [security2:error] [pid 989638:tid 989805] [client 180.252.198.240:59532] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmtpruoK4abRCMbAZX2gAAACU"]
[Sat Jul 18 23:55:02.423974 2026] [security2:error] [pid 989638:tid 989772] [client 34.136.134.112:4150] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "entuvy.com"] [uri "/wp-json/batch/v1"] [unique_id "alxmtpruoK4abRCMbAZX3QAAAAQ"]
[Sat Jul 18 23:55:02.465163 2026] [security2:error] [pid 989638:tid 989879] [client 185.8.106.147:38752] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "cira.org"] [uri "/index.php"] [unique_id "alxmtJruoK4abRCMbAZXOAAAbzg"]
[Sat Jul 18 23:55:02.630462 2026] [security2:error] [pid 989638:tid 989814] [client 34.136.134.112:4150] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "entuvy.com"] [uri "/"] [unique_id "alxmtpruoK4abRCMbAZX7QAAAC4"]
[Sat Jul 18 23:55:02.849740 2026] [security2:error] [pid 989638:tid 989835] [client 185.132.186.38:22853] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 38.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/cgi-bin/index.php"] [unique_id "alxmtpruoK4abRCMbAZX-wAAAEM"]
[Sat Jul 18 23:55:03.125519 2026] [security2:error] [pid 989638:tid 989869] [client 45.134.20.135:44121] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 135.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/maint/byps.php"] [unique_id "alxmt5ruoK4abRCMbAZYDAAAAGU"]
[Sat Jul 18 23:55:03.157777 2026] [security2:error] [pid 989638:tid 989857] [client 170.80.3.147:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "youpositive.co"] [uri "/index.php"] [unique_id "alxmtpruoK4abRCMbAZXwwAAAFk"]
[Sat Jul 18 23:55:03.262549 2026] [security2:error] [pid 989638:tid 989886] [client 36.83.95.75:65025] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmt5ruoK4abRCMbAZYFAAAAHY"]
[Sat Jul 18 23:55:03.262655 2026] [security2:error] [pid 989638:tid 989886] [client 36.83.95.75:65025] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmt5ruoK4abRCMbAZYFAAAAHY"]
[Sat Jul 18 23:55:03.688419 2026] [security2:error] [pid 989638:tid 989838] [client 138.252.89.100:51426] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmt5ruoK4abRCMbAZYLwAAAEY"]
[Sat Jul 18 23:55:03.688504 2026] [security2:error] [pid 989638:tid 989838] [client 138.252.89.100:51426] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmt5ruoK4abRCMbAZYLwAAAEY"]
[Sat Jul 18 23:55:03.757725 2026] [security2:error] [pid 989638:tid 989768] [client 185.132.186.50:21441] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/uploads/file.php"] [unique_id "alxmt5ruoK4abRCMbAZYNAAAAAA"]
[Sat Jul 18 23:55:03.993194 2026] [security2:error] [pid 989638:tid 989893] [client 45.134.20.133:34249] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "alxmt5ruoK4abRCMbAZYPgAAAH0"]
[Sat Jul 18 23:55:04.028092 2026] [security2:error] [pid 989638:tid 989659] [remote 103.90.234.13:41682] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.234.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thslogistics.net"] [uri "/wp-login.php"] [unique_id "alxmuJruoK4abRCMbAZYQAAATRQ"]
[Sat Jul 18 23:55:04.648943 2026] [security2:error] [pid 989638:tid 989796] [client 185.132.186.20:40973] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 20.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/plugins/view-more/ioxi.php"] [unique_id "alxmuJruoK4abRCMbAZYbgAAABw"]
[Sat Jul 18 23:55:04.823918 2026] [security2:error] [pid 989638:tid 989708] [remote 103.90.234.13:41682] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 13.234.90.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "thslogistics.net"] [uri "/wp-login.php"] [unique_id "alxmuJruoK4abRCMbAZYgQAAQEU"], referer: https://thslogistics.net/wp-login.php
[Sat Jul 18 23:55:04.848898 2026] [security2:error] [pid 989638:tid 989816] [client 45.134.20.127:29277] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 127.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "alxmuJruoK4abRCMbAZYggAAADA"]
[Sat Jul 18 23:55:05.172834 2026] [proxy:error] [pid 989638:tid 989878] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:55:05.172927 2026] [proxy_http:error] [pid 989638:tid 989878] [client 82.39.206.157:48474] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:55:05.173656 2026] [proxy:error] [pid 989638:tid 989878] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:55:05.173690 2026] [proxy_http:error] [pid 989638:tid 989878] [client 82.39.206.157:48474] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:55:05.545291 2026] [security2:error] [pid 989638:tid 989834] [client 185.132.186.9:48581] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 9.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "alxmuZruoK4abRCMbAZYqgAAAEI"]
[Sat Jul 18 23:55:05.546393 2026] [security2:error] [pid 989638:tid 989720] [remote 68.178.160.25:51048] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxmuZruoK4abRCMbAZYqAAAeVE"]
[Sat Jul 18 23:55:05.714376 2026] [security2:error] [pid 989638:tid 989777] [client 45.134.20.131:34947] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 131.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/twentytwentyfour/patterns/content-type.php"] [unique_id "alxmuZruoK4abRCMbAZYuQAAAAk"]
[Sat Jul 18 23:55:05.754419 2026] [security2:error] [pid 989638:tid 989851] [client 34.210.88.185:25632] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 185.88.210.34.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-cron.php"] [unique_id "alxmuZruoK4abRCMbAZYvAAAAFM"]
[Sat Jul 18 23:55:05.972481 2026] [security2:error] [pid 989638:tid 989740] [remote 68.178.160.25:51048] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.160.178.68.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxmuZruoK4abRCMbAZY0wAAZWU"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:55:06.056507 2026] [core:error] [pid 989638:tid 989858] [client 82.39.206.157:43038] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:55:06.056527 2026] [core:error] [pid 989638:tid 989858] [client 82.39.206.157:43038] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:55:06.295420 2026] [security2:error] [pid 989638:tid 989835] [client 103.160.26.178:52600] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmupruoK4abRCMbAZY8gAAAEM"]
[Sat Jul 18 23:55:06.295537 2026] [security2:error] [pid 989638:tid 989835] [client 103.160.26.178:52600] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmupruoK4abRCMbAZY8gAAAEM"]
[Sat Jul 18 23:55:06.446294 2026] [security2:error] [pid 989638:tid 989894] [client 185.132.186.2:34845] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 2.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "alxmupruoK4abRCMbAZZAQAAAH4"]
[Sat Jul 18 23:55:06.575202 2026] [security2:error] [pid 989638:tid 989864] [client 45.134.20.118:59801] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/network/class.php"] [unique_id "alxmupruoK4abRCMbAZZCQAAAGA"]
[Sat Jul 18 23:55:06.994388 2026] [security2:error] [pid 989638:tid 989882] [client 85.206.128.219:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "innovativecleaningsvs.com"] [uri "/index.php"] [unique_id "alxmupruoK4abRCMbAZZAAAAciU"]
[Sat Jul 18 23:55:07.326054 2026] [security2:error] [pid 989638:tid 989868] [client 201.207.239.69:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "www.maxenengineering.com"] [uri "/maxenengineering/index.php"] [unique_id "alxmuJruoK4abRCMbAZYcgAAAGQ"]
[Sat Jul 18 23:55:07.353542 2026] [security2:error] [pid 989638:tid 989819] [client 185.132.186.37:24001] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 37.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/css/colors/index.php"] [unique_id "alxmu5ruoK4abRCMbAZZTQAAADM"]
[Sat Jul 18 23:55:07.429049 2026] [security2:error] [pid 989638:tid 989836] [client 45.134.20.107:61715] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 107.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "alxmu5ruoK4abRCMbAZZVQAAAEQ"]
[Sat Jul 18 23:55:07.484297 2026] [security2:error] [pid 989638:tid 989892] [client 58.169.210.37:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "aosta.nz"] [uri "/index.php"] [unique_id "alxmu5ruoK4abRCMbAZZTgAAAHw"], referer: https://aosta.nz/
[Sat Jul 18 23:55:07.552922 2026] [security2:error] [pid 989638:tid 989778] [client 217.217.245.230:56427] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 230.245.217.217.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxmu5ruoK4abRCMbAZZYAAAAAo"]
[Sat Jul 18 23:55:07.553043 2026] [security2:error] [pid 989638:tid 989778] [client 217.217.245.230:56427] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "muafaces.org"] [uri "/xmlrpc.php"] [unique_id "alxmu5ruoK4abRCMbAZZYAAAAAo"]
[Sat Jul 18 23:55:07.881186 2026] [security2:error] [pid 989638:tid 989868] [client 216.244.66.203:47738] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.samdothan.org"] [uri "/stmap_97xnswz.html"] [unique_id "alxmu5ruoK4abRCMbAZZdQAAAGQ"]
[Sat Jul 18 23:55:07.881276 2026] [security2:error] [pid 989638:tid 989868] [client 216.244.66.203:47738] ModSecurity: Warning. Matched phrase "Dotbot" at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "www.samdothan.org"] [uri "/stmap_97xnswz.html"] [unique_id "alxmu5ruoK4abRCMbAZZdQAAAGQ"]
[Sat Jul 18 23:55:08.138630 2026] [security2:error] [pid 989638:tid 989779] [client 103.105.97.215:50923] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 215.97.105.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/xmlrpc.php"] [unique_id "alxmvJruoK4abRCMbAZZiwAAAAs"]
[Sat Jul 18 23:55:08.138779 2026] [security2:error] [pid 989638:tid 989779] [client 103.105.97.215:50923] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz"] [uri "/xmlrpc.php"] [unique_id "alxmvJruoK4abRCMbAZZiwAAAAs"]
[Sat Jul 18 23:55:08.164532 2026] [security2:error] [pid 989638:tid 989848] [client 146.75.210.15:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "areitoproducciones.com"] [uri "/index.php"] [unique_id "alxmuZruoK4abRCMbAZYzgAAAFA"]
[Sat Jul 18 23:55:08.281797 2026] [security2:error] [pid 989638:tid 989881] [client 45.134.20.123:27653] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 123.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/ms-file.php"] [unique_id "alxmvJruoK4abRCMbAZZkwAAAHE"]
[Sat Jul 18 23:55:08.533534 2026] [security2:error] [pid 989638:tid 989860] [client 216.244.66.231:53278] ModSecurity: Access denied with code 406 (phase 1). Pattern match "ZoominfoBot|NetcraftSurveyAgent|MJ12bot|(?i:BUbiNG)|D(?i:otbot)| oBot/|MegaIndex\\\\.ru|Barkrowler|Spbot|DomainCrawler|Seznam|CCBot|SiteExplorer|OpenLinkProfiler|Sogou web spider|360Spider|Semrush|Panscient|crawler\\\\.feedback([+]\\\\S+)?@gmail\\\\.com|MauiBo ..." at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "585"] [id "999812"] [msg "Problematic Crawler"] [hostname "www.thewelloiledlife.com"] [uri "/wp-content/uploads/2016/11/Pumpkin-Spice-blog.png"] [unique_id "alxmvJruoK4abRCMbAZZpQAAAFw"]
[Sat Jul 18 23:55:08.533623 2026] [security2:error] [pid 989638:tid 989860] [client 216.244.66.231:53278] ModSecurity: Warning. Matched phrase "Dotbot" at REQUEST_HEADERS:User-agent. [file "/opt/mod_security/hg_rules.conf"] [line "168"] [id "350001"] [msg "BAD BOT - Detected LOGGING"] [data "406"] [hostname "www.thewelloiledlife.com"] [uri "/wp-content/uploads/2016/11/Pumpkin-Spice-blog.png"] [unique_id "alxmvJruoK4abRCMbAZZpQAAAFw"]
[Sat Jul 18 23:55:08.699315 2026] [security2:error] [pid 989638:tid 989894] [client 185.132.186.3:22475] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 3.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/admin.php"] [unique_id "alxmvJruoK4abRCMbAZZrAAAAH4"]
[Sat Jul 18 23:55:09.115974 2026] [security2:error] [pid 989638:tid 989889] [client 216.131.76.241:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "500"] [hostname "www.jennylouraya.com"] [uri "/index.php"] [unique_id "alxmvJruoK4abRCMbAZZggAAAHk"]
[Sat Jul 18 23:55:09.134514 2026] [security2:error] [pid 989638:tid 989845] [client 216.131.76.241:50103] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "500"] [hostname "www.jennylouraya.com"] [uri "/feed/"] [unique_id "alxmvJruoK4abRCMbAZZgAAAAE0"]
[Sat Jul 18 23:55:09.194378 2026] [security2:error] [pid 989638:tid 989816] [client 45.134.20.125:61091] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 125.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "alxmvZruoK4abRCMbAZZxwAAADA"]
[Sat Jul 18 23:55:09.580879 2026] [security2:error] [pid 989638:tid 989803] [client 74.208.214.194:35718] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxmvZruoK4abRCMbAZZ5gAAACM"]
[Sat Jul 18 23:55:09.603381 2026] [security2:error] [pid 989638:tid 989829] [client 185.132.186.31:37295] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 31.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "alxmvZruoK4abRCMbAZZ6QAAAD0"]
[Sat Jul 18 23:55:09.761161 2026] [security2:error] [pid 989638:tid 989787] [client 216.131.76.241:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "500"] [hostname "www.jennylouraya.com"] [uri "/index.php"] [unique_id "alxmvZruoK4abRCMbAZZ-wAAABM"]
[Sat Jul 18 23:55:09.763802 2026] [security2:error] [pid 989638:tid 989797] [client 216.131.76.241:50178] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "500"] [hostname "www.jennylouraya.com"] [uri "/feed/"] [unique_id "alxmvZruoK4abRCMbAZZ9AAAAB0"]
[Sat Jul 18 23:55:09.785940 2026] [security2:error] [pid 989638:tid 989778] [client 157.254.194.57:52250] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "302"] [hostname "box5936.bluehost.com"] [uri "/index.cgi"] [unique_id "alxmvZruoK4abRCMbAZZ-gAAAAo"]
[Sat Jul 18 23:55:09.902589 2026] [security2:error] [pid 989638:tid 989691] [remote 152.228.213.32:53800] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "healthylifegourmet.org"] [uri "/wp-login.php"] [unique_id "alxmvZruoK4abRCMbAZZ_wAADjQ"]
[Sat Jul 18 23:55:10.060183 2026] [security2:error] [pid 989638:tid 989857] [client 45.134.20.134:62473] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 134.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/widgets/av.php"] [unique_id "alxmvpruoK4abRCMbAZaDwAAAFk"]
[Sat Jul 18 23:55:10.101436 2026] [security2:error] [pid 989638:tid 989703] [remote 152.228.213.32:53800] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.213.228.152.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "healthylifegourmet.org"] [uri "/wp-login.php"] [unique_id "alxmvpruoK4abRCMbAZaEwAATEA"], referer: https://healthylifegourmet.org/wp-login.php
[Sat Jul 18 23:55:10.516477 2026] [security2:error] [pid 989638:tid 989828] [client 185.132.186.18:42509] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 18.186.132.185.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "alxmvpruoK4abRCMbAZaKwAAADw"]
[Sat Jul 18 23:55:10.918095 2026] [security2:error] [pid 989638:tid 989779] [client 45.134.20.117:56705] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/chosen.php%20"] [unique_id "alxmvpruoK4abRCMbAZaQwAAAAs"]
[Sat Jul 18 23:55:11.190662 2026] [security2:error] [pid 989638:tid 989847] [client 4.194.24.143:56225] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/nine2code.php"] [unique_id "alxmv5ruoK4abRCMbAZaXAAAAE8"]
[Sat Jul 18 23:55:11.271180 2026] [security2:error] [pid 989638:tid 989848] [client 110.32.151.178:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "littleaosta.nz"] [uri "/index.php"] [unique_id "alxmv5ruoK4abRCMbAZaWgAAAFA"], referer: https://littleaosta.nz/wp-content/uploads/2026/06/LITTLE-AOSTA-MENU-DINNER-JUNE.pdf
[Sat Jul 18 23:55:11.408678 2026] [security2:error] [pid 989638:tid 989846] [client 185.132.186.50:40409] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/plugins/ioxi/ioxiworm.php"] [unique_id "alxmv5ruoK4abRCMbAZaaQAAAE4"]
[Sat Jul 18 23:55:11.475447 2026] [security2:error] [pid 989638:tid 989753] [remote 142.93.10.93:37118] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 93.10.93.142.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxmv5ruoK4abRCMbAZaagAAcXI"]
[Sat Jul 18 23:55:11.647179 2026] [security2:error] [pid 989638:tid 989654] [remote 142.93.10.93:37118] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 93.10.93.142.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxmv5ruoK4abRCMbAZaeQAAfw8"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:55:11.771808 2026] [security2:error] [pid 989638:tid 989797] [client 45.134.20.110:20753] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/bs1.php"] [unique_id "alxmv5ruoK4abRCMbAZagwAAAB0"]
[Sat Jul 18 23:55:11.792719 2026] [security2:error] [pid 989638:tid 989769] [client 62.201.242.188:51251] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "toddnielsen.com"] [uri "/index.php"] [unique_id "alxmvpruoK4abRCMbAZaQgAAAVo"], referer: https://toddnielsen.com
[Sat Jul 18 23:55:11.838666 2026] [security2:error] [pid 989638:tid 989844] [client 57.141.18.48:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxmv5ruoK4abRCMbAZaewAAAEw"]
[Sat Jul 18 23:55:12.324074 2026] [security2:error] [pid 989638:tid 989813] [client 185.132.186.51:61107] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 51.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/blog/wp-content/about.php"] [unique_id "alxmwJruoK4abRCMbAZaoQAAAC0"]
[Sat Jul 18 23:55:12.626970 2026] [security2:error] [pid 989638:tid 989789] [client 45.134.20.134:44301] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 134.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "alxmwJruoK4abRCMbAZatgAAABU"]
[Sat Jul 18 23:55:12.857791 2026] [security2:error] [pid 989638:tid 989812] [client 180.252.198.240:60013] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmwJruoK4abRCMbAZa2QAAACw"]
[Sat Jul 18 23:55:12.858080 2026] [security2:error] [pid 989638:tid 989812] [client 180.252.198.240:60013] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmwJruoK4abRCMbAZa2QAAACw"]
[Sat Jul 18 23:55:13.219948 2026] [security2:error] [pid 989638:tid 989800] [client 185.132.186.6:36905] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 6.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/hehehehe.php"] [unique_id "alxmwZruoK4abRCMbAZa7gAAACA"]
[Sat Jul 18 23:55:13.318632 2026] [security2:error] [pid 989638:tid 989863] [client 4.194.24.143:9378] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/num.php"] [unique_id "alxmwZruoK4abRCMbAZa9gAAAF8"]
[Sat Jul 18 23:55:13.482990 2026] [security2:error] [pid 989638:tid 989864] [client 45.134.20.123:23831] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 123.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/network.php"] [unique_id "alxmwZruoK4abRCMbAZa_wAAAGA"]
[Sat Jul 18 23:55:13.733383 2026] [security2:error] [pid 989638:tid 989872] [client 36.83.95.75:65528] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmwZruoK4abRCMbAZbEwAAAGg"]
[Sat Jul 18 23:55:13.733486 2026] [security2:error] [pid 989638:tid 989872] [client 36.83.95.75:65528] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmwZruoK4abRCMbAZbEwAAAGg"]
[Sat Jul 18 23:55:13.897848 2026] [security2:error] [pid 989638:tid 989711] [remote 103.75.185.95:42324] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "avatrip.co"] [uri "/wp-login.php"] [unique_id "alxmwZruoK4abRCMbAZbIQAANEg"]
[Sat Jul 18 23:55:14.118521 2026] [security2:error] [pid 989638:tid 989768] [client 185.132.186.18:37827] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 18.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/.well-known/acme-challenge/install.php"] [unique_id "alxmwpruoK4abRCMbAZbKwAAAAA"]
[Sat Jul 18 23:55:14.337011 2026] [security2:error] [pid 989638:tid 989777] [client 45.134.20.117:21773] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/page.php"] [unique_id "alxmwpruoK4abRCMbAZbPgAAAAk"]
[Sat Jul 18 23:55:14.356666 2026] [security2:error] [pid 989638:tid 989785] [client 4.194.24.143:54356] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/odf7udtspqtpxzyxmw2rccdefault.php"] [unique_id "alxmwpruoK4abRCMbAZbQgAAABE"]
[Sat Jul 18 23:55:14.429052 2026] [security2:error] [pid 989638:tid 989679] [remote 103.75.185.95:42324] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 95.185.75.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "avatrip.co"] [uri "/wp-login.php"] [unique_id "alxmwpruoK4abRCMbAZbRQAAQig"], referer: https://avatrip.co/wp-login.php
[Sat Jul 18 23:55:14.665446 2026] [security2:error] [pid 989638:tid 989850] [client 49.36.213.103:61486] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.213.36.49.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/xmlrpc.php"] [unique_id "alxmwpruoK4abRCMbAZbVAAAAFI"]
[Sat Jul 18 23:55:14.665609 2026] [security2:error] [pid 989638:tid 989850] [client 49.36.213.103:61486] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz"] [uri "/xmlrpc.php"] [unique_id "alxmwpruoK4abRCMbAZbVAAAAFI"]
[Sat Jul 18 23:55:14.932060 2026] [security2:error] [pid 989638:tid 989794] [client 4.194.24.143:61767] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/option.php"] [unique_id "alxmwpruoK4abRCMbAZbbQAAABo"]
[Sat Jul 18 23:55:15.019402 2026] [security2:error] [pid 989638:tid 989807] [client 185.132.186.19:34115] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 19.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/.well-known/acme-challenge/plugins.php"] [unique_id "alxmw5ruoK4abRCMbAZbbwAAACc"]
[Sat Jul 18 23:55:15.085847 2026] [security2:error] [pid 989638:tid 989863] [client 138.252.89.100:51962] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmw5ruoK4abRCMbAZbcAAAAF8"]
[Sat Jul 18 23:55:15.085945 2026] [security2:error] [pid 989638:tid 989863] [client 138.252.89.100:51962] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmw5ruoK4abRCMbAZbcAAAAF8"]
[Sat Jul 18 23:55:15.192543 2026] [security2:error] [pid 989638:tid 989803] [client 45.134.20.124:47531] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 124.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/includes/index.php"] [unique_id "alxmw5ruoK4abRCMbAZbdwAAACM"]
[Sat Jul 18 23:55:15.480045 2026] [security2:error] [pid 989638:tid 989889] [client 4.194.24.143:54377] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/p.php"] [unique_id "alxmw5ruoK4abRCMbAZbjAAAAHk"]
[Sat Jul 18 23:55:15.554329 2026] [security2:error] [pid 989638:tid 989650] [remote 49.13.1.223:57332] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.1.13.49.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxmw5ruoK4abRCMbAZbjQAADAs"]
[Sat Jul 18 23:55:15.758953 2026] [security2:error] [pid 989638:tid 989753] [remote 49.13.1.223:57332] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 223.1.13.49.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxmw5ruoK4abRCMbAZbnAAAR3I"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:55:15.820862 2026] [security2:error] [pid 989638:tid 989792] [client 40.77.177.126:19461] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "vfcthomasville.org"] [uri "/index.php"] [unique_id "alxmw5ruoK4abRCMbAZbnQAAGEM"]
[Sat Jul 18 23:55:15.914585 2026] [security2:error] [pid 989638:tid 989832] [client 185.132.186.49:41557] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 49.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/.well-known/acme-challenge/license.php"] [unique_id "alxmw5ruoK4abRCMbAZbpwAAAEA"]
[Sat Jul 18 23:55:16.021694 2026] [security2:error] [pid 989638:tid 989847] [client 4.194.24.143:19767] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/past.php"] [unique_id "alxmxJruoK4abRCMbAZbrgAAAE8"]
[Sat Jul 18 23:55:16.049206 2026] [security2:error] [pid 989638:tid 989857] [client 45.134.20.120:36915] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 120.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/uploads/chosen.php"] [unique_id "alxmxJruoK4abRCMbAZbsAAAAFk"]
[Sat Jul 18 23:55:16.177039 2026] [security2:error] [pid 989638:tid 989779] [client 74.7.227.179:41362] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "tejasenvironmental.com"] [uri "/index.php"] [unique_id "alxmxJruoK4abRCMbAZbrwAAC1g"], referer: https://tejasenvironmental.com/p=577081
[Sat Jul 18 23:55:16.291332 2026] [core:error] [pid 989638:tid 989771] [client 82.39.206.157:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:55:16.291354 2026] [core:error] [pid 989638:tid 989771] [client 82.39.206.157:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:55:16.589678 2026] [security2:error] [pid 989638:tid 989790] [client 4.194.24.143:19718] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/php.php"] [unique_id "alxmxJruoK4abRCMbAZb0QAAABY"]
[Sat Jul 18 23:55:16.806493 2026] [security2:error] [pid 989638:tid 989800] [client 185.132.186.17:58923] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "alxmxJruoK4abRCMbAZb5wAAACA"]
[Sat Jul 18 23:55:16.902473 2026] [security2:error] [pid 989638:tid 989818] [client 45.134.20.110:59683] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/WordPressCore/include.php"] [unique_id "alxmxJruoK4abRCMbAZb8gAAADI"]
[Sat Jul 18 23:55:16.995252 2026] [security2:error] [pid 989638:tid 989788] [client 103.160.26.178:53102] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmxJruoK4abRCMbAZb-AAAABQ"]
[Sat Jul 18 23:55:16.995374 2026] [security2:error] [pid 989638:tid 989788] [client 103.160.26.178:53102] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmxJruoK4abRCMbAZb-AAAABQ"]
[Sat Jul 18 23:55:17.249045 2026] [security2:error] [pid 989638:tid 989798] [client 4.194.24.143:9389] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/php8.php"] [unique_id "alxmxZruoK4abRCMbAZcAwAAAB4"]
[Sat Jul 18 23:55:17.698088 2026] [security2:error] [pid 989638:tid 989779] [client 185.132.186.29:24597] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 29.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/themes/astra/inc/fm.php"] [unique_id "alxmxZruoK4abRCMbAZcHgAAAAs"]
[Sat Jul 18 23:55:17.723928 2026] [security2:error] [pid 989638:tid 989796] [client 20.230.87.222:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 222.87.230.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.yidaiyi.org"] [uri "/moon.php"] [unique_id "alxmxZruoK4abRCMbAZcIQAAABw"]
[Sat Jul 18 23:55:17.724055 2026] [security2:error] [pid 989638:tid 989796] [client 20.230.87.222:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.yidaiyi.org"] [uri "/moon.php"] [unique_id "alxmxZruoK4abRCMbAZcIQAAABw"]
[Sat Jul 18 23:55:17.756886 2026] [security2:error] [pid 989638:tid 989835] [client 45.134.20.121:51791] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 121.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/admin-footer.php"] [unique_id "alxmxZruoK4abRCMbAZcIwAAAEM"]
[Sat Jul 18 23:55:17.824113 2026] [security2:error] [pid 989638:tid 989818] [client 4.194.24.143:56221] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/phpinfo.php"] [unique_id "alxmxZruoK4abRCMbAZcKgAAADI"]
[Sat Jul 18 23:55:18.600644 2026] [security2:error] [pid 989638:tid 989847] [client 185.132.186.51:58247] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 51.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/plugins/ccx/index.php"] [unique_id "alxmxpruoK4abRCMbAZcagAAAE8"]
[Sat Jul 18 23:55:18.610863 2026] [security2:error] [pid 989638:tid 989685] [remote 91.142.222.105:52982] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxmxpruoK4abRCMbAZcaQAAZi4"]
[Sat Jul 18 23:55:18.613655 2026] [security2:error] [pid 989638:tid 989772] [client 45.134.20.126:43231] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 126.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/admin-footer.php"] [unique_id "alxmxpruoK4abRCMbAZcawAAAAQ"]
[Sat Jul 18 23:55:18.681401 2026] [security2:error] [pid 989638:tid 989793] [client 103.105.97.215:51462] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 215.97.105.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/xmlrpc.php"] [unique_id "alxmxpruoK4abRCMbAZcbgAAABk"]
[Sat Jul 18 23:55:18.681505 2026] [security2:error] [pid 989638:tid 989793] [client 103.105.97.215:51462] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz"] [uri "/xmlrpc.php"] [unique_id "alxmxpruoK4abRCMbAZcbgAAABk"]
[Sat Jul 18 23:55:19.422805 2026] [security2:error] [pid 989638:tid 989724] [remote 31.42.184.154:40834] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "39ishlife.com"] [uri "/wp-login.php"] [unique_id "alxmx5ruoK4abRCMbAZckQAAOFU"]
[Sat Jul 18 23:55:19.479435 2026] [security2:error] [pid 989638:tid 989786] [client 45.134.20.110:38167] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 110.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/assets/info.php"] [unique_id "alxmx5ruoK4abRCMbAZclQAAABI"]
[Sat Jul 18 23:55:19.511890 2026] [security2:error] [pid 989638:tid 989888] [client 185.132.186.34:50493] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 34.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/themes/index.php"] [unique_id "alxmx5ruoK4abRCMbAZcmwAAAHg"]
[Sat Jul 18 23:55:19.651004 2026] [security2:error] [pid 989638:tid 989709] [remote 31.42.184.154:40834] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "39ishlife.com"] [uri "/wp-login.php"] [unique_id "alxmx5ruoK4abRCMbAZcogAAO0Y"], referer: https://39ishlife.com/wp-login.php
[Sat Jul 18 23:55:20.322252 2026] [security2:error] [pid 989638:tid 989771] [client 2a06:98c0:3600::103:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "apolloinfrastructureholdings.com"] [uri "/wp-admin/install.php"] [unique_id "alxmyJruoK4abRCMbAZcxAAAAAM"]
[Sat Jul 18 23:55:20.351270 2026] [security2:error] [pid 989638:tid 989784] [client 45.134.20.137:49609] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 137.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "alxmyJruoK4abRCMbAZcxQAAABA"]
[Sat Jul 18 23:55:20.403658 2026] [security2:error] [pid 989638:tid 989812] [client 185.132.186.43:51969] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 43.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "alxmyJruoK4abRCMbAZcxwAAACw"]
[Sat Jul 18 23:55:20.805007 2026] [security2:error] [pid 989638:tid 989813] [client 20.230.87.222:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 222.87.230.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.yidaiyi.org"] [uri "/wp-includes/ID3/index.php"] [unique_id "alxmyJruoK4abRCMbAZc4AAAAC0"]
[Sat Jul 18 23:55:20.805085 2026] [security2:error] [pid 989638:tid 989813] [client 20.230.87.222:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.yidaiyi.org"] [uri "/wp-includes/ID3/index.php"] [unique_id "alxmyJruoK4abRCMbAZc4AAAAC0"]
[Sat Jul 18 23:55:21.087533 2026] [security2:error] [pid 989638:tid 989768] [client 4.194.24.143:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "3ddynamics.org"] [uri "/index.php"] [unique_id "alxmxpruoK4abRCMbAZcXAAAAAA"]
[Sat Jul 18 23:55:21.178363 2026] [security2:error] [pid 989638:tid 989873] [client 189.203.132.122:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "tiokubito.cl"] [uri "/index.php"] [unique_id "alxmxpruoK4abRCMbAZcbAAAaSM"]
[Sat Jul 18 23:55:21.207309 2026] [security2:error] [pid 989638:tid 989812] [client 45.134.20.104:21927] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/pomo/item.php"] [unique_id "alxmyZruoK4abRCMbAZc_gAAACw"]
[Sat Jul 18 23:55:21.289078 2026] [security2:error] [pid 989638:tid 989826] [client 57.141.18.117:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxmyZruoK4abRCMbAZc7wAAADo"]
[Sat Jul 18 23:55:21.294163 2026] [security2:error] [pid 989638:tid 989791] [client 185.132.186.16:56273] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 16.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "alxmyZruoK4abRCMbAZdAQAAABc"]
[Sat Jul 18 23:55:21.302609 2026] [security2:error] [pid 989638:tid 989824] [client 4.194.24.143:54366] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/post.php"] [unique_id "alxmyZruoK4abRCMbAZdAgAAADg"]
[Sat Jul 18 23:55:21.341816 2026] [security2:error] [pid 989638:tid 989865] [client 57.141.18.16:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "www.drawingthedog.com"] [uri "/index.php"] [unique_id "alxmyZruoK4abRCMbAZc9gAAAGE"]
[Sat Jul 18 23:55:21.357245 2026] [security2:error] [pid 989638:tid 989643] [remote 117.0.21.154:52432] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bruceledewitz.com"] [uri "/wp-login.php"] [unique_id "alxmyZruoK4abRCMbAZdBAAANwQ"]
[Sat Jul 18 23:55:22.074964 2026] [security2:error] [pid 989638:tid 989895] [client 45.134.20.127:31245] ModSecurity: Warning. Pattern match "/1\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1543"] [id "900921"] [msg "temporary TUW-72162 logging rule"] [hostname "swafforddetailing.com"] [uri "/wp-content/1.php%20"] [unique_id "alxmypruoK4abRCMbAZdOAAAAH8"]
[Sat Jul 18 23:55:22.075087 2026] [security2:error] [pid 989638:tid 989895] [client 45.134.20.127:31245] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 127.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/1.php%20"] [unique_id "alxmypruoK4abRCMbAZdOAAAAH8"]
[Sat Jul 18 23:55:22.159990 2026] [security2:error] [pid 989638:tid 989826] [client 4.194.24.143:19763] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/public/assets/design_1/css/parts/course_cards/grid_card_1.min.php"] [unique_id "alxmypruoK4abRCMbAZdPgAAADo"]
[Sat Jul 18 23:55:22.188901 2026] [security2:error] [pid 989638:tid 989792] [client 185.132.186.26:35671] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 26.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "alxmypruoK4abRCMbAZdQQAAABg"]
[Sat Jul 18 23:55:22.936907 2026] [security2:error] [pid 989638:tid 989797] [client 45.134.20.122:57857] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 122.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/blue/wp-atom.php"] [unique_id "alxmypruoK4abRCMbAZdbQAAAB0"]
[Sat Jul 18 23:55:23.089545 2026] [security2:error] [pid 989638:tid 989848] [client 185.132.186.25:39819] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 25.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "alxmy5ruoK4abRCMbAZdcQAAAFA"]
[Sat Jul 18 23:55:23.148283 2026] [security2:error] [pid 989638:tid 989895] [client 4.194.24.143:54399] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/public/css.php"] [unique_id "alxmy5ruoK4abRCMbAZddwAAAH8"]
[Sat Jul 18 23:55:23.493435 2026] [security2:error] [pid 989638:tid 989791] [client 189.203.132.122:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "tiokubito.cl"] [uri "/index.php"] [unique_id "alxmy5ruoK4abRCMbAZdhAAAFwU"]
[Sat Jul 18 23:55:23.795900 2026] [security2:error] [pid 989638:tid 989877] [client 45.134.20.112:57051] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 112.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "alxmy5ruoK4abRCMbAZdsQAAAG0"]
[Sat Jul 18 23:55:23.876982 2026] [security2:error] [pid 989638:tid 989878] [client 4.194.24.143:56202] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/r.php"] [unique_id "alxmy5ruoK4abRCMbAZduwAAAG4"]
[Sat Jul 18 23:55:23.909984 2026] [security2:error] [pid 989638:tid 989874] [client 180.252.198.240:60488] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmy5ruoK4abRCMbAZdvgAAAGo"]
[Sat Jul 18 23:55:23.910090 2026] [security2:error] [pid 989638:tid 989874] [client 180.252.198.240:60488] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxmy5ruoK4abRCMbAZdvgAAAGo"]
[Sat Jul 18 23:55:23.984697 2026] [security2:error] [pid 989638:tid 989810] [client 185.132.186.17:50291] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 17.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "alxmy5ruoK4abRCMbAZdwgAAACo"]
[Sat Jul 18 23:55:24.024332 2026] [security2:error] [pid 989638:tid 989796] [client 189.203.132.122:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "302"] [hostname "tiokubito.cl"] [uri "/index.php"] [unique_id "alxmy5ruoK4abRCMbAZdtQAAHGk"]
[Sat Jul 18 23:55:24.127154 2026] [security2:error] [pid 989638:tid 989785] [client 4.194.24.143:6249] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/nine2code.php"] [unique_id "alxmzJruoK4abRCMbAZdyAAAABE"]
[Sat Jul 18 23:55:24.393015 2026] [security2:error] [pid 989638:tid 989805] [client 36.83.95.75:49650] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmzJruoK4abRCMbAZd3AAAACU"]
[Sat Jul 18 23:55:24.393118 2026] [security2:error] [pid 989638:tid 989805] [client 36.83.95.75:49650] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxmzJruoK4abRCMbAZd3AAAACU"]
[Sat Jul 18 23:55:24.443607 2026] [security2:error] [pid 989638:tid 989803] [client 4.194.24.143:19758] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/radio.php"] [unique_id "alxmzJruoK4abRCMbAZd4gAAACM"]
[Sat Jul 18 23:55:24.451278 2026] [proxy:error] [pid 989638:tid 989813] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:55:24.451346 2026] [proxy_http:error] [pid 989638:tid 989813] [client 82.39.206.157:54354] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:55:24.451840 2026] [proxy:error] [pid 989638:tid 989813] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:55:24.451873 2026] [proxy_http:error] [pid 989638:tid 989813] [client 82.39.206.157:54354] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:55:24.627844 2026] [security2:error] [pid 989638:tid 989726] [remote 117.0.21.154:35864] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxmzJruoK4abRCMbAZd8QAAdVc"]
[Sat Jul 18 23:55:24.671427 2026] [security2:error] [pid 989638:tid 989816] [client 45.134.20.119:41615] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/assets/install.php"] [unique_id "alxmzJruoK4abRCMbAZd8gAAADA"]
[Sat Jul 18 23:55:24.697774 2026] [security2:error] [pid 989638:tid 989776] [client 113.160.97.242:62693] ModSecurity: Access denied with code 406 (phase 2). String match "/wpad.dat" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1512"] [id "900416"] [msg "Web Proxy Auto-Detect file"] [hostname "wpad"] [uri "/wpad.dat"] [unique_id "alxmzJruoK4abRCMbAZd9AAAAAg"]
[Sat Jul 18 23:55:24.732387 2026] [security2:error] [pid 989638:tid 989874] [client 4.194.24.143:6511] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/num.php"] [unique_id "alxmzJruoK4abRCMbAZd-gAAAGo"]
[Sat Jul 18 23:55:24.883572 2026] [security2:error] [pid 989638:tid 989844] [client 185.132.186.47:52443] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 47.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "alxmzJruoK4abRCMbAZeMQAAAEw"]
[Sat Jul 18 23:55:25.101292 2026] [security2:error] [pid 989638:tid 989649] [remote 117.0.21.154:35864] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.21.0.117.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "locketsandcharms.com"] [uri "/wp-login.php"] [unique_id "alxmzZruoK4abRCMbAZeSQAAWQo"], referer: https://locketsandcharms.com/wp-login.php
[Sat Jul 18 23:55:25.277328 2026] [security2:error] [pid 989638:tid 989859] [client 4.194.24.143:6508] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/odf7udtspqtpxzyxmw2rccdefault.php"] [unique_id "alxmzZruoK4abRCMbAZeZwAAAFs"]
[Sat Jul 18 23:55:25.540824 2026] [security2:error] [pid 989638:tid 989791] [client 45.134.20.130:37463] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 130.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/.well-known/acme-challenge/gecko-old.php"] [unique_id "alxmzZruoK4abRCMbAZedQAAABc"]
[Sat Jul 18 23:55:25.781865 2026] [security2:error] [pid 989638:tid 989849] [client 185.132.186.4:43405] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 4.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/css/colors/ocean/index.php"] [unique_id "alxmzZruoK4abRCMbAZehQAAAFE"]
[Sat Jul 18 23:55:25.830680 2026] [security2:error] [pid 989638:tid 989774] [client 4.194.24.143:6667] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/option.php"] [unique_id "alxmzZruoK4abRCMbAZehwAAAAY"]
[Sat Jul 18 23:55:25.953946 2026] [security2:error] [pid 989638:tid 989858] [client 4.194.24.143:56218] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/randkeyword.php7"] [unique_id "alxmzZruoK4abRCMbAZemAAAAFo"]
[Sat Jul 18 23:55:26.390912 2026] [security2:error] [pid 989638:tid 989865] [client 4.194.24.143:6517] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/p.php"] [unique_id "alxmzpruoK4abRCMbAZewgAAAGE"]
[Sat Jul 18 23:55:26.482316 2026] [security2:error] [pid 989638:tid 989842] [client 45.134.20.107:22889] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 107.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "alxmzpruoK4abRCMbAZexQAAAEo"]
[Sat Jul 18 23:55:26.657245 2026] [security2:error] [pid 989638:tid 989808] [client 138.252.89.100:52488] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmzpruoK4abRCMbAZe0QAAACg"]
[Sat Jul 18 23:55:26.657337 2026] [security2:error] [pid 989638:tid 989808] [client 138.252.89.100:52488] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxmzpruoK4abRCMbAZe0QAAACg"]
[Sat Jul 18 23:55:26.671722 2026] [security2:error] [pid 989638:tid 989769] [client 185.132.186.4:39439] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 4.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/images/media/index.php"] [unique_id "alxmzpruoK4abRCMbAZe0gAAAAE"]
[Sat Jul 18 23:55:26.940832 2026] [security2:error] [pid 989638:tid 989811] [client 4.194.24.143:6217] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/past.php"] [unique_id "alxmzpruoK4abRCMbAZe7gAAACs"]
[Sat Jul 18 23:55:27.100819 2026] [security2:error] [pid 989638:tid 989850] [client 4.194.24.143:19756] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/readme.php"] [unique_id "alxmz5ruoK4abRCMbAZe-gAAAFI"]
[Sat Jul 18 23:55:27.312027 2026] [security2:error] [pid 989638:tid 989719] [remote 31.42.184.154:40864] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxmz5ruoK4abRCMbAZfBgAAOFA"]
[Sat Jul 18 23:55:27.338140 2026] [security2:error] [pid 989638:tid 989784] [client 45.134.20.106:61003] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 106.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/images/autoload_classmap.php"] [unique_id "alxmz5ruoK4abRCMbAZfCgAAABA"]
[Sat Jul 18 23:55:27.482802 2026] [security2:error] [pid 989638:tid 989884] [client 4.194.24.143:42436] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/php.php"] [unique_id "alxmz5ruoK4abRCMbAZfFwAAAHQ"]
[Sat Jul 18 23:55:27.562520 2026] [security2:error] [pid 989638:tid 989673] [remote 31.42.184.154:40864] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxmz5ruoK4abRCMbAZfHQAAQCI"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:55:27.563026 2026] [security2:error] [pid 989638:tid 989857] [client 185.132.186.48:36225] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 48.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "alxmz5ruoK4abRCMbAZfHgAAAFk"]
[Sat Jul 18 23:55:27.627837 2026] [security2:error] [pid 989638:tid 989775] [client 103.160.26.178:53610] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmz5ruoK4abRCMbAZfJwAAAAc"]
[Sat Jul 18 23:55:27.627927 2026] [security2:error] [pid 989638:tid 989775] [client 103.160.26.178:53610] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxmz5ruoK4abRCMbAZfJwAAAAc"]
[Sat Jul 18 23:55:27.847302 2026] [security2:error] [pid 989638:tid 989664] [remote 113.160.142.119:52518] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 119.142.160.113.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bruceledewitz.com"] [uri "/wp-login.php"] [unique_id "alxmz5ruoK4abRCMbAZfMgAAARk"], referer: https://bruceledewitz.com/wp-login.php
[Sat Jul 18 23:55:28.031395 2026] [security2:error] [pid 989638:tid 989784] [client 4.194.24.143:6702] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/php8.php"] [unique_id "alxm0JruoK4abRCMbAZfRQAAABA"]
[Sat Jul 18 23:55:28.045714 2026] [security2:error] [pid 989638:tid 989640] [remote 120.72.98.5:17434] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 5.98.72.120.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "walkingandtalking.net"] [uri "/xmlrpc.php"] [unique_id "alxm0JruoK4abRCMbAZfRAAACgE"]
[Sat Jul 18 23:55:28.045858 2026] [security2:error] [pid 989638:tid 989778] [client 120.72.98.5:17434] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "walkingandtalking.net"] [uri "/xmlrpc.php"] [unique_id "alxm0JruoK4abRCMbAZfRAAACgE"]
[Sat Jul 18 23:55:28.094272 2026] [security2:error] [pid 989638:tid 989792] [client 4.194.24.143:61821] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/reze.php"] [unique_id "alxm0JruoK4abRCMbAZfSwAAABg"]
[Sat Jul 18 23:55:28.168085 2026] [security2:error] [pid 989638:tid 989707] [remote 87.106.67.224:33590] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.67.106.87.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "terrapro.marketing"] [uri "/wp-login.php"] [unique_id "alxm0JruoK4abRCMbAZfTAAASEQ"]
[Sat Jul 18 23:55:28.191110 2026] [security2:error] [pid 989638:tid 989880] [client 45.134.20.112:47645] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 112.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "alxm0JruoK4abRCMbAZfUAAAAHA"]
[Sat Jul 18 23:55:28.454618 2026] [security2:error] [pid 989638:tid 989821] [client 185.132.186.32:31765] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 32.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "alxm0JruoK4abRCMbAZfYAAAADU"]
[Sat Jul 18 23:55:28.593074 2026] [security2:error] [pid 989638:tid 989836] [client 4.194.24.143:6657] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/phpinfo.php"] [unique_id "alxm0JruoK4abRCMbAZfcgAAAEQ"]
[Sat Jul 18 23:55:28.823391 2026] [security2:error] [pid 989638:tid 989825] [client 4.194.24.143:56226] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/rh.php"] [unique_id "alxm0JruoK4abRCMbAZfewAAADk"]
[Sat Jul 18 23:55:28.945251 2026] [security2:error] [pid 989638:tid 989681] [remote 87.106.67.224:33590] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 224.67.106.87.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "terrapro.marketing"] [uri "/wp-login.php"] [unique_id "alxm0JruoK4abRCMbAZfhAAARSo"], referer: https://terrapro.marketing/wp-login.php
[Sat Jul 18 23:55:29.056379 2026] [security2:error] [pid 989638:tid 989871] [client 45.134.20.139:53167] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 139.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "alxm0ZruoK4abRCMbAZfjwAAAGc"]
[Sat Jul 18 23:55:29.107404 2026] [security2:error] [pid 989638:tid 989813] [client 103.105.97.215:51913] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 215.97.105.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/xmlrpc.php"] [unique_id "alxm0ZruoK4abRCMbAZflQAAAC0"]
[Sat Jul 18 23:55:29.107515 2026] [security2:error] [pid 989638:tid 989813] [client 103.105.97.215:51913] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz"] [uri "/xmlrpc.php"] [unique_id "alxm0ZruoK4abRCMbAZflQAAAC0"]
[Sat Jul 18 23:55:29.310973 2026] [security2:error] [pid 989638:tid 989733] [remote 31.42.184.154:51042] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/wp-login.php"] [unique_id "alxm0ZruoK4abRCMbAZfoAAAdV4"]
[Sat Jul 18 23:55:29.349120 2026] [security2:error] [pid 989638:tid 989819] [client 4.194.24.143:6240] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/post.php"] [unique_id "alxm0ZruoK4abRCMbAZfowAAADM"]
[Sat Jul 18 23:55:29.381399 2026] [security2:error] [pid 989638:tid 989865] [client 185.132.186.10:37259] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.186.132.185.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "alxm0ZruoK4abRCMbAZfpAAAAGE"]
[Sat Jul 18 23:55:29.665655 2026] [security2:error] [pid 989638:tid 989827] [client 4.194.24.143:54371] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/rip.php"] [unique_id "alxm0ZruoK4abRCMbAZfuwAAADs"]
[Sat Jul 18 23:55:29.678841 2026] [security2:error] [pid 989638:tid 989746] [remote 31.42.184.154:51042] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "youpositive.co"] [uri "/wp-login.php"] [unique_id "alxm0ZruoK4abRCMbAZfvAAAe2s"], referer: https://youpositive.co/wp-login.php
[Sat Jul 18 23:55:29.775828 2026] [proxy:error] [pid 989638:tid 989871] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:55:29.775911 2026] [proxy_http:error] [pid 989638:tid 989871] [client 82.39.206.157:40240] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:55:29.775994 2026] [proxy:error] [pid 989638:tid 989797] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:55:29.776047 2026] [proxy_http:error] [pid 989638:tid 989797] [client 82.39.206.157:40154] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:55:29.776325 2026] [proxy:error] [pid 989638:tid 989871] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:55:29.776349 2026] [proxy_http:error] [pid 989638:tid 989871] [client 82.39.206.157:40240] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:55:29.776677 2026] [proxy:error] [pid 989638:tid 989797] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:55:29.776711 2026] [proxy_http:error] [pid 989638:tid 989797] [client 82.39.206.157:40154] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:55:29.777054 2026] [proxy:error] [pid 989638:tid 989828] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:55:29.777139 2026] [proxy_http:error] [pid 989638:tid 989828] [client 82.39.206.157:40218] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:55:29.777804 2026] [proxy:error] [pid 989638:tid 989828] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:55:29.777833 2026] [proxy_http:error] [pid 989638:tid 989828] [client 82.39.206.157:40218] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:55:29.899667 2026] [security2:error] [pid 989638:tid 989805] [client 4.194.24.143:6500] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/public/assets/design_1/css/parts/course_cards/grid_card_1.min.php"] [unique_id "alxm0ZruoK4abRCMbAZfygAAACU"]
[Sat Jul 18 23:55:29.908613 2026] [security2:error] [pid 989638:tid 989807] [client 45.134.20.132:58165] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 132.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/install.php"] [unique_id "alxm0ZruoK4abRCMbAZfzQAAACc"]
[Sat Jul 18 23:55:30.272376 2026] [security2:error] [pid 989638:tid 989812] [client 185.132.186.10:48041] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 10.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-admin/maint/themes.php"] [unique_id "alxm0pruoK4abRCMbAZf5wAAACw"]
[Sat Jul 18 23:55:30.344745 2026] [security2:error] [pid 989638:tid 989813] [client 4.194.24.143:54363] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/root.php"] [unique_id "alxm0pruoK4abRCMbAZf6QAAAC0"]
[Sat Jul 18 23:55:30.451915 2026] [security2:error] [pid 989638:tid 989782] [client 4.194.24.143:42450] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/public/css.php"] [unique_id "alxm0pruoK4abRCMbAZf8gAAAA4"]
[Sat Jul 18 23:55:30.455832 2026] [security2:error] [pid 989638:tid 989845] [client 20.230.87.222:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 222.87.230.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.yidaiyi.org"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "alxm0pruoK4abRCMbAZf8wAAAE0"]
[Sat Jul 18 23:55:30.455923 2026] [security2:error] [pid 989638:tid 989845] [client 20.230.87.222:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.yidaiyi.org"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "alxm0pruoK4abRCMbAZf8wAAAE0"]
[Sat Jul 18 23:55:30.477109 2026] [proxy:error] [pid 989638:tid 989865] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:55:30.477193 2026] [proxy_http:error] [pid 989638:tid 989865] [client 193.47.62.168:55486] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:55:30.477653 2026] [proxy:error] [pid 989638:tid 989865] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:55:30.477679 2026] [proxy_http:error] [pid 989638:tid 989865] [client 193.47.62.168:55486] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:55:30.511291 2026] [security2:error] [pid 989638:tid 989810] [client 49.36.213.103:61896] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.213.36.49.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/xmlrpc.php"] [unique_id "alxm0pruoK4abRCMbAZf-gAAACo"]
[Sat Jul 18 23:55:30.511391 2026] [security2:error] [pid 989638:tid 989810] [client 49.36.213.103:61896] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz"] [uri "/xmlrpc.php"] [unique_id "alxm0pruoK4abRCMbAZf-gAAACo"]
[Sat Jul 18 23:55:30.762866 2026] [security2:error] [pid 989638:tid 989788] [client 45.134.20.136:48307] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 136.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/install.php"] [unique_id "alxm0pruoK4abRCMbAZgCAAAABQ"]
[Sat Jul 18 23:55:30.941109 2026] [security2:error] [pid 989638:tid 989827] [client 4.194.24.143:61805] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/s.php"] [unique_id "alxm0pruoK4abRCMbAZgEQAAADs"]
[Sat Jul 18 23:55:30.955449 2026] [proxy:error] [pid 989638:tid 989882] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:55:30.955529 2026] [proxy_http:error] [pid 989638:tid 989882] [client 82.39.206.157:40226] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:55:30.955782 2026] [security2:error] [pid 989638:tid 989857] [client 82.39.206.157:40212] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "cpcontacts.samdothan.org"] [uri "/___proxy_subdomain_cpcontacts/api/.env"] [unique_id "alxm0pruoK4abRCMbAZgEwAAAFk"]
[Sat Jul 18 23:55:30.956271 2026] [proxy:error] [pid 989638:tid 989882] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:55:30.956312 2026] [proxy_http:error] [pid 989638:tid 989882] [client 82.39.206.157:40226] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:55:30.956372 2026] [security2:error] [pid 989638:tid 989863] [client 82.39.206.157:40196] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "cpcontacts.samdothan.org"] [uri "/___proxy_subdomain_cpcontacts/backend/.env"] [unique_id "alxm0pruoK4abRCMbAZgFwAAAF8"]
[Sat Jul 18 23:55:30.956380 2026] [proxy:error] [pid 989638:tid 989878] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:55:30.956434 2026] [security2:error] [pid 989638:tid 989779] [client 82.39.206.157:40138] ModSecurity: Access denied with code 406 (phase 2). Pattern match "(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini|web.config)\\\\b|( |^|\\\\.\\\\.)/etc/|/\\\\.(?:history|bash_history|sh_history|env)$)" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "211"] [id "390709"] [rev "30"] [msg "Atomicorp.com WAF Rules: Attempt to access protected file remotely"] [data "/.env"] [severity "CRITICAL"] [hostname "cpcontacts.samdothan.org"] [uri "/___proxy_subdomain_cpcontacts/.env"] [unique_id "alxm0pruoK4abRCMbAZgGAAAAAs"]
[Sat Jul 18 23:55:30.956437 2026] [proxy_http:error] [pid 989638:tid 989878] [client 82.39.206.157:40160] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:55:30.956661 2026] [proxy:error] [pid 989638:tid 989849] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:55:30.956735 2026] [proxy_http:error] [pid 989638:tid 989849] [client 82.39.206.157:40176] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:55:30.956871 2026] [proxy:error] [pid 989638:tid 989878] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:55:30.956896 2026] [proxy_http:error] [pid 989638:tid 989878] [client 82.39.206.157:40160] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:55:30.956958 2026] [proxy:error] [pid 989638:tid 989814] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:55:30.956996 2026] [proxy_http:error] [pid 989638:tid 989814] [client 82.39.206.157:40186] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:55:30.957184 2026] [proxy:error] [pid 989638:tid 989849] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:55:30.957216 2026] [proxy_http:error] [pid 989638:tid 989849] [client 82.39.206.157:40176] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:55:30.957415 2026] [proxy:error] [pid 989638:tid 989814] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:55:30.957456 2026] [proxy_http:error] [pid 989638:tid 989814] [client 82.39.206.157:40186] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:55:31.003416 2026] [security2:error] [pid 989638:tid 989854] [client 4.194.24.143:6684] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/r.php"] [unique_id "alxm05ruoK4abRCMbAZgHAAAAFY"]
[Sat Jul 18 23:55:31.124688 2026] [core:error] [pid 989638:tid 989847] [client 82.39.206.157:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:55:31.124706 2026] [core:error] [pid 989638:tid 989847] [client 82.39.206.157:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:55:31.170533 2026] [security2:error] [pid 989638:tid 989884] [client 185.132.186.22:52359] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 22.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/plugins/seoplugins/index.php"] [unique_id "alxm05ruoK4abRCMbAZgLQAAAHQ"]
[Sat Jul 18 23:55:31.545729 2026] [security2:error] [pid 989638:tid 989768] [client 4.194.24.143:42477] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/radio.php"] [unique_id "alxm05ruoK4abRCMbAZgSgAAAAA"]
[Sat Jul 18 23:55:31.636959 2026] [security2:error] [pid 989638:tid 989890] [client 45.134.20.125:40585] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 125.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "alxm05ruoK4abRCMbAZgUgAAAHo"]
[Sat Jul 18 23:55:31.717185 2026] [security2:error] [pid 989638:tid 989822] [client 4.194.24.143:56209] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/sang.php"] [unique_id "alxm05ruoK4abRCMbAZgVgAAADY"]
[Sat Jul 18 23:55:32.061841 2026] [security2:error] [pid 989638:tid 989780] [client 185.132.186.30:22579] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 30.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/fonts/themes.php"] [unique_id "alxm1JruoK4abRCMbAZgaQAAAAw"]
[Sat Jul 18 23:55:32.088514 2026] [security2:error] [pid 989638:tid 989889] [client 4.194.24.143:42464] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/randkeyword.php7"] [unique_id "alxm1JruoK4abRCMbAZgbgAAAHk"]
[Sat Jul 18 23:55:32.319429 2026] [security2:error] [pid 989638:tid 989734] [remote 91.142.222.105:53300] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.222.142.91.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/wp-login.php"] [unique_id "alxm1JruoK4abRCMbAZgeAAABV8"], referer: https://aosta.nz/wp-login.php
[Sat Jul 18 23:55:32.484727 2026] [security2:error] [pid 989638:tid 989792] [client 4.194.24.143:9385] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/scxy.php"] [unique_id "alxm1JruoK4abRCMbAZghAAAABg"]
[Sat Jul 18 23:55:32.503849 2026] [security2:error] [pid 989638:tid 989878] [client 45.134.20.115:46837] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/ws.php"] [unique_id "alxm1JruoK4abRCMbAZghgAAAG4"]
[Sat Jul 18 23:55:32.652365 2026] [security2:error] [pid 989638:tid 989819] [client 4.194.24.143:6423] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/readme.php"] [unique_id "alxm1JruoK4abRCMbAZglwAAADM"]
[Sat Jul 18 23:55:32.916549 2026] [core:error] [pid 989638:tid 989784] [client 82.39.206.157:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:55:32.916567 2026] [core:error] [pid 989638:tid 989784] [client 82.39.206.157:0] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Jul 18 23:55:32.957848 2026] [security2:error] [pid 989638:tid 989871] [client 185.132.186.7:20775] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 7.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/themes/twentytwentytwo/assets/fonts/index.php"] [unique_id "alxm1JruoK4abRCMbAZgrwAAAGc"]
[Sat Jul 18 23:55:33.195402 2026] [security2:error] [pid 989638:tid 989810] [client 4.194.24.143:42456] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/reze.php"] [unique_id "alxm1ZruoK4abRCMbAZgvAAAACo"]
[Sat Jul 18 23:55:33.241159 2026] [security2:error] [pid 989638:tid 989828] [client 4.194.24.143:9365] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/sd.php"] [unique_id "alxm1ZruoK4abRCMbAZgxgAAADw"]
[Sat Jul 18 23:55:33.357396 2026] [security2:error] [pid 989638:tid 989873] [client 45.134.20.105:57997] ModSecurity: Warning. Pattern match "/1\\\\.php" at REQUEST_URI. [file "/opt/mod_security/hg_rules.conf"] [line "1543"] [id "900921"] [msg "temporary TUW-72162 logging rule"] [hostname "swafforddetailing.com"] [uri "/wp-includes/rest-api/1.php"] [unique_id "alxm1ZruoK4abRCMbAZgyQAAAGk"]
[Sat Jul 18 23:55:33.357517 2026] [security2:error] [pid 989638:tid 989873] [client 45.134.20.105:57997] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 105.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/rest-api/1.php"] [unique_id "alxm1ZruoK4abRCMbAZgyQAAAGk"]
[Sat Jul 18 23:55:33.748273 2026] [security2:error] [pid 989638:tid 989893] [client 4.194.24.143:6228] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/rh.php"] [unique_id "alxm1ZruoK4abRCMbAZg4AAAAH0"]
[Sat Jul 18 23:55:33.811771 2026] [security2:error] [pid 989638:tid 989769] [client 177.0.242.145:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "jndsupport.com"] [uri "/index.php"] [unique_id "alxm1ZruoK4abRCMbAZg1wAAAAE"]
[Sat Jul 18 23:55:33.850796 2026] [security2:error] [pid 989638:tid 989822] [client 185.132.186.23:22329] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 23.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/certificates/index.php"] [unique_id "alxm1ZruoK4abRCMbAZg5wAAADY"]
[Sat Jul 18 23:55:34.018141 2026] [security2:error] [pid 989638:tid 989860] [client 20.230.87.222:0] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 222.87.230.20.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "www.yidaiyi.org"] [uri "/wp-admin/css/colors/index.php"] [unique_id "alxm1pruoK4abRCMbAZg6wAAAFw"]
[Sat Jul 18 23:55:34.018238 2026] [security2:error] [pid 989638:tid 989860] [client 20.230.87.222:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "1573"] [id "900935"] [msg "Empty User-Agent LOGGING"] [data "409"] [hostname "www.yidaiyi.org"] [uri "/wp-admin/css/colors/index.php"] [unique_id "alxm1pruoK4abRCMbAZg6wAAAFw"]
[Sat Jul 18 23:55:34.061180 2026] [security2:error] [pid 989638:tid 989879] [client 4.194.24.143:9402] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/sf.php"] [unique_id "alxm1pruoK4abRCMbAZg7wAAAG8"]
[Sat Jul 18 23:55:34.217303 2026] [security2:error] [pid 989638:tid 989867] [client 45.134.20.124:42635] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 124.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "alxm1pruoK4abRCMbAZhAAAAAGM"]
[Sat Jul 18 23:55:34.501290 2026] [security2:error] [pid 989638:tid 989807] [client 180.252.198.240:60950] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 240.198.252.180.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxm1pruoK4abRCMbAZhMQAAACc"]
[Sat Jul 18 23:55:34.501382 2026] [security2:error] [pid 989638:tid 989807] [client 180.252.198.240:60950] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "cephasnext.com"] [uri "/xmlrpc.php"] [unique_id "alxm1pruoK4abRCMbAZhMQAAACc"]
[Sat Jul 18 23:55:34.686075 2026] [security2:error] [pid 989638:tid 989779] [client 103.232.231.147:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "301"] [hostname "packerjanitorial.com"] [uri "/index.php"] [unique_id "alxm1pruoK4abRCMbAZhGgAAC3k"], referer: https://packerjanitorial.com
[Sat Jul 18 23:55:34.733712 2026] [security2:error] [pid 989638:tid 989810] [client 4.194.24.143:9358] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/shell.php"] [unique_id "alxm1pruoK4abRCMbAZhPgAAACo"]
[Sat Jul 18 23:55:34.746337 2026] [security2:error] [pid 989638:tid 989891] [client 185.132.186.1:26101] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 1.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/byp.php"] [unique_id "alxm1pruoK4abRCMbAZhQAAAAHs"]
[Sat Jul 18 23:55:34.813908 2026] [security2:error] [pid 989638:tid 989757] [remote 31.42.184.154:45000] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "faadenergy.com"] [uri "/wp-login.php"] [unique_id "alxm1pruoK4abRCMbAZhSgAAaHY"]
[Sat Jul 18 23:55:34.933190 2026] [security2:error] [pid 989638:tid 989785] [client 4.194.24.143:42434] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/rip.php"] [unique_id "alxm1pruoK4abRCMbAZhUQAAABE"]
[Sat Jul 18 23:55:34.988102 2026] [security2:error] [pid 989638:tid 989857] [client 57.141.18.1:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "cheesewithjam.com"] [uri "/index.php"] [unique_id "alxm1pruoK4abRCMbAZhSQAAAFk"]
[Sat Jul 18 23:55:35.041603 2026] [security2:error] [pid 989638:tid 989684] [remote 31.42.184.154:45000] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "faadenergy.com"] [uri "/wp-login.php"] [unique_id "alxm15ruoK4abRCMbAZhVQAAEC0"], referer: https://faadenergy.com/wp-login.php
[Sat Jul 18 23:55:35.042174 2026] [security2:error] [pid 989638:tid 989663] [remote 45.157.54.14:58158] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 14.54.157.45.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "website-510b2c1f.uritems.net"] [uri "/xmlrpc.php"] [unique_id "alxm15ruoK4abRCMbAZhVAAAcBg"]
[Sat Jul 18 23:55:35.042308 2026] [security2:error] [pid 989638:tid 989880] [client 45.157.54.14:58158] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "website-510b2c1f.uritems.net"] [uri "/xmlrpc.php"] [unique_id "alxm15ruoK4abRCMbAZhVAAAcBg"]
[Sat Jul 18 23:55:35.097730 2026] [security2:error] [pid 989638:tid 989792] [client 45.134.20.104:27133] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 104.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/shop.php"] [unique_id "alxm15ruoK4abRCMbAZhWwAAABg"]
[Sat Jul 18 23:55:35.146332 2026] [security2:error] [pid 989638:tid 989828] [client 36.83.95.75:50159] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 75.95.83.36.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxm15ruoK4abRCMbAZhXgAAADw"]
[Sat Jul 18 23:55:35.146477 2026] [security2:error] [pid 989638:tid 989828] [client 36.83.95.75:50159] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "transparentservices.online"] [uri "/xmlrpc.php"] [unique_id "alxm15ruoK4abRCMbAZhXgAAADw"]
[Sat Jul 18 23:55:35.492527 2026] [security2:error] [pid 989638:tid 989778] [client 4.194.24.143:6409] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/root.php"] [unique_id "alxm15ruoK4abRCMbAZhcAAAAAo"]
[Sat Jul 18 23:55:35.501548 2026] [security2:error] [pid 989638:tid 989727] [remote 20.153.140.50:58286] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxm15ruoK4abRCMbAZhbwAAAFg"]
[Sat Jul 18 23:55:35.546659 2026] [security2:error] [pid 989638:tid 989730] [remote 131.72.236.158:37920] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 158.236.72.131.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxm15ruoK4abRCMbAZhcgAAals"]
[Sat Jul 18 23:55:35.638392 2026] [security2:error] [pid 989638:tid 989795] [client 185.132.186.40:47747] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 40.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/blog/wp-includes/about.php"] [unique_id "alxm15ruoK4abRCMbAZhegAAABs"]
[Sat Jul 18 23:55:35.916994 2026] [security2:error] [pid 989638:tid 989736] [remote 20.153.140.50:58286] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 50.140.153.20.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxm15ruoK4abRCMbAZhkAAAPGE"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:55:35.976079 2026] [security2:error] [pid 989638:tid 989779] [client 45.134.20.138:32955] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 138.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-content/plugins/pwnd-1/dedi1.php"] [unique_id "alxm15ruoK4abRCMbAZhkQAAAAs"]
[Sat Jul 18 23:55:36.072861 2026] [security2:error] [pid 989638:tid 989855] [client 4.194.24.143:6253] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/s.php"] [unique_id "alxm2JruoK4abRCMbAZhlgAAAFc"]
[Sat Jul 18 23:55:36.120446 2026] [security2:error] [pid 989638:tid 989845] [client 4.194.24.143:0] ModSecurity: Warning. Pattern match "301|404|302" at RESPONSE_STATUS. [file "/opt/mod_security/hg_rules.conf"] [line "1570"] [id "900934"] [msg "404 php LOGGING"] [data "404"] [hostname "3ddynamics.org"] [uri "/index.php"] [unique_id "alxm2JruoK4abRCMbAZhlQAAAE0"]
[Sat Jul 18 23:55:36.124029 2026] [security2:error] [pid 989638:tid 989766] [remote 31.42.184.154:45002] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxm2JruoK4abRCMbAZhngAAQH8"]
[Sat Jul 18 23:55:36.124148 2026] [security2:error] [pid 989638:tid 989832] [client 31.42.184.154:45002] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxm2JruoK4abRCMbAZhngAAQH8"]
[Sat Jul 18 23:55:36.270178 2026] [security2:error] [pid 989638:tid 989790] [client 49.36.213.103:62316] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 103.213.36.49.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/xmlrpc.php"] [unique_id "alxm2JruoK4abRCMbAZhqgAAABY"]
[Sat Jul 18 23:55:36.270361 2026] [security2:error] [pid 989638:tid 989790] [client 49.36.213.103:62316] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz"] [uri "/xmlrpc.php"] [unique_id "alxm2JruoK4abRCMbAZhqgAAABY"]
[Sat Jul 18 23:55:36.309722 2026] [security2:error] [pid 989638:tid 989870] [client 4.194.24.143:19712] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/sid3.php"] [unique_id "alxm2JruoK4abRCMbAZhrgAAAGY"]
[Sat Jul 18 23:55:36.396178 2026] [security2:error] [pid 989638:tid 989661] [remote 131.72.236.158:37920] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 158.236.72.131.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxm2JruoK4abRCMbAZhswAAORY"], referer: https://aosta.nz.dbn.vkf.mybluehost.me/wp-login.php
[Sat Jul 18 23:55:36.559527 2026] [security2:error] [pid 989638:tid 989828] [client 185.132.186.3:30103] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 3.186.132.185.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "alxm2JruoK4abRCMbAZhuQAAADw"]
[Sat Jul 18 23:55:36.614986 2026] [security2:error] [pid 989638:tid 989819] [client 4.194.24.143:6663] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/sang.php"] [unique_id "alxm2JruoK4abRCMbAZhwAAAADM"]
[Sat Jul 18 23:55:36.619604 2026] [security2:error] [pid 989638:tid 989764] [remote 31.42.184.154:45008] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 154.184.42.31.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxm2JruoK4abRCMbAZhwgAASn0"]
[Sat Jul 18 23:55:36.619717 2026] [security2:error] [pid 989638:tid 989842] [client 31.42.184.154:45008] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz.dbn.vkf.mybluehost.me"] [uri "/xmlrpc.php"] [unique_id "alxm2JruoK4abRCMbAZhwgAASn0"]
[Sat Jul 18 23:55:36.709500 2026] [security2:error] [pid 989638:tid 989880] [client 13.232.206.133:52812] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 133.206.232.13.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "curlsnpearlsss.com"] [uri "/wp-login.php"] [unique_id "alxm2JruoK4abRCMbAZhxQAAAHA"], referer: https://curlsnpearlsss.com/wp-login.php
[Sat Jul 18 23:55:36.850486 2026] [security2:error] [pid 989638:tid 989838] [client 45.134.20.123:39243] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 123.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/js/widgets/setting.php"] [unique_id "alxm2JruoK4abRCMbAZh2gAAAEY"]
[Sat Jul 18 23:55:36.889305 2026] [security2:error] [pid 989638:tid 989820] [client 78.142.18.40:51252] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 40.18.142.78.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "omenana.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxm2JruoK4abRCMbAZh3AAAADQ"]
[Sat Jul 18 23:55:37.158408 2026] [security2:error] [pid 989638:tid 989877] [client 4.194.24.143:6227] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/scxy.php"] [unique_id "alxm2ZruoK4abRCMbAZh7gAAAG0"]
[Sat Jul 18 23:55:37.319210 2026] [security2:error] [pid 989638:tid 989822] [client 34.23.246.146:23120] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1588"] [id "900939"] [msg "Invalid WordPress REST batch path"] [data "ARGS:requests.requests.path=///"] [hostname "nextlvlmarketingco.com"] [uri "/wp-json/batch/v1"] [unique_id "alxm2ZruoK4abRCMbAZh_QAAADY"]
[Sat Jul 18 23:55:37.458953 2026] [security2:error] [pid 989638:tid 989862] [client 185.132.186.23:36325] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 23.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/blog/wp-admin/about.php"] [unique_id "alxm2ZruoK4abRCMbAZiDQAAAF4"]
[Sat Jul 18 23:55:37.524777 2026] [security2:error] [pid 989638:tid 989805] [client 34.23.246.146:23120] ModSecurity: Access denied with code 406 (phase 2). Match of "rx ^/(?![/\\\\x5c])" against "ARGS:requests.requests.path" required. [file "/opt/mod_security/hg_rules.conf"] [line "1613"] [id "900942"] [msg "Invalid WordPress REST batch path (rest_route)"] [data "ARGS:requests.requests.path=///"] [hostname "nextlvlmarketingco.com"] [uri "/"] [unique_id "alxm2ZruoK4abRCMbAZiEgAAACU"]
[Sat Jul 18 23:55:37.702535 2026] [security2:error] [pid 989638:tid 989789] [client 4.194.24.143:6658] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/sd.php"] [unique_id "alxm2ZruoK4abRCMbAZiGgAAABU"]
[Sat Jul 18 23:55:37.707363 2026] [security2:error] [pid 989638:tid 989812] [client 45.134.20.121:60549] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 121.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "alxm2ZruoK4abRCMbAZiHAAAACw"]
[Sat Jul 18 23:55:37.864364 2026] [security2:error] [pid 989638:tid 989828] [client 78.142.18.40:52225] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 40.18.142.78.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "omenana.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxm2ZruoK4abRCMbAZiJQAAADw"]
[Sat Jul 18 23:55:38.245584 2026] [security2:error] [pid 989638:tid 989788] [client 4.194.24.143:42435] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/sf.php"] [unique_id "alxm2pruoK4abRCMbAZiPwAAABQ"]
[Sat Jul 18 23:55:38.283853 2026] [security2:error] [pid 989638:tid 989779] [client 4.194.24.143:61812] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/simple.php"] [unique_id "alxm2pruoK4abRCMbAZiQgAAAAs"]
[Sat Jul 18 23:55:38.288071 2026] [security2:error] [pid 989638:tid 989845] [client 78.142.18.40:57147] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 40.18.142.78.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "omenana.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxm2pruoK4abRCMbAZiQwAAAE0"]
[Sat Jul 18 23:55:38.351508 2026] [security2:error] [pid 989638:tid 989852] [client 103.160.26.178:54127] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 178.26.160.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxm2pruoK4abRCMbAZiRwAAAFQ"]
[Sat Jul 18 23:55:38.351673 2026] [security2:error] [pid 989638:tid 989852] [client 103.160.26.178:54127] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "icemarc.org"] [uri "/xmlrpc.php"] [unique_id "alxm2pruoK4abRCMbAZiRwAAAFQ"]
[Sat Jul 18 23:55:38.353933 2026] [security2:error] [pid 989638:tid 989787] [client 138.252.89.100:53021] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 100.89.252.138.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxm2pruoK4abRCMbAZiSAAAABM"]
[Sat Jul 18 23:55:38.354039 2026] [security2:error] [pid 989638:tid 989787] [client 138.252.89.100:53021] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "joulecommunications.com"] [uri "/xmlrpc.php"] [unique_id "alxm2pruoK4abRCMbAZiSAAAABM"]
[Sat Jul 18 23:55:38.354722 2026] [security2:error] [pid 989638:tid 989771] [client 185.132.186.11:31487] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 11.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/themes/twentyfive/include.php"] [unique_id "alxm2pruoK4abRCMbAZiSQAAAAM"]
[Sat Jul 18 23:55:38.569333 2026] [security2:error] [pid 989638:tid 989810] [client 45.134.20.123:45305] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/mod_security/hg_rules.conf"] [line "655"] [id "900155"] [msg "WP Brute UA block"] [hostname "swafforddetailing.com"] [uri "/wp-admin/css/colors/light/as.php"] [unique_id "alxm2pruoK4abRCMbAZiWAAAACo"]
[Sat Jul 18 23:55:38.702068 2026] [security2:error] [pid 989638:tid 989819] [client 78.142.18.40:53915] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 40.18.142.78.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "omenana.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alxm2pruoK4abRCMbAZiYgAAADM"]
[Sat Jul 18 23:55:38.797507 2026] [security2:error] [pid 989638:tid 989851] [client 4.194.24.143:6480] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/shell.php"] [unique_id "alxm2pruoK4abRCMbAZiagAAAFM"]
[Sat Jul 18 23:55:38.980087 2026] [proxy:error] [pid 989638:tid 989818] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:55:38.980163 2026] [proxy_http:error] [pid 989638:tid 989818] [client 193.47.62.168:55610] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:55:38.980619 2026] [proxy:error] [pid 989638:tid 989818] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:2079 (127.0.0.1:2079) failed
[Sat Jul 18 23:55:38.980644 2026] [proxy_http:error] [pid 989638:tid 989818] [client 193.47.62.168:55610] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Sat Jul 18 23:55:39.250715 2026] [security2:error] [pid 989638:tid 989827] [client 185.132.186.30:45209] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 30.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-includes/css/about.php"] [unique_id "alxm25ruoK4abRCMbAZijgAAADs"]
[Sat Jul 18 23:55:39.447516 2026] [security2:error] [pid 989638:tid 989650] [remote 163.227.186.27:57552] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxm25ruoK4abRCMbAZimAAAAws"]
[Sat Jul 18 23:55:39.447604 2026] [security2:error] [pid 989638:tid 989788] [client 45.134.20.118:34079] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 118.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-admin/user/header.php"] [unique_id "alxm25ruoK4abRCMbAZimQAAABQ"]
[Sat Jul 18 23:55:39.537953 2026] [security2:error] [pid 989638:tid 989833] [client 4.194.24.143:6405] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/sid3.php"] [unique_id "alxm25ruoK4abRCMbAZipQAAAEE"]
[Sat Jul 18 23:55:39.787857 2026] [security2:error] [pid 989638:tid 989781] [client 4.194.24.143:19720] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/sitemap.php"] [unique_id "alxm25ruoK4abRCMbAZisgAAAA0"]
[Sat Jul 18 23:55:39.799473 2026] [security2:error] [pid 989638:tid 989867] [client 103.105.97.215:52363] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 215.97.105.103.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "aosta.nz"] [uri "/xmlrpc.php"] [unique_id "alxm25ruoK4abRCMbAZitQAAAGM"]
[Sat Jul 18 23:55:39.799566 2026] [security2:error] [pid 989638:tid 989867] [client 103.105.97.215:52363] ModSecurity: Warning. Pattern match "POST" at REQUEST_METHOD. [file "/opt/mod_security/hg_rules.conf"] [line "151"] [id "900405"] [msg "xmlrpc POST logging"] [data "409"] [hostname "aosta.nz"] [uri "/xmlrpc.php"] [unique_id "alxm25ruoK4abRCMbAZitQAAAGM"]
[Sat Jul 18 23:55:39.922152 2026] [security2:error] [pid 989638:tid 989721] [remote 163.227.186.27:57552] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 27.186.227.163.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "bluedoorbar.co.nz"] [uri "/wp-login.php"] [unique_id "alxm25ruoK4abRCMbAZiwQAAI1I"], referer: https://bluedoorbar.co.nz/wp-login.php
[Sat Jul 18 23:55:40.038425 2026] [security2:error] [pid 989638:tid 989750] [remote 74.235.96.117:36428] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.235.74.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.idf.ldc.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxm3JruoK4abRCMbAZi1gAAa28"]
[Sat Jul 18 23:55:40.079943 2026] [security2:error] [pid 989638:tid 989860] [client 4.194.24.143:6471] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/simple.php"] [unique_id "alxm3JruoK4abRCMbAZi2QAAAFw"]
[Sat Jul 18 23:55:40.143720 2026] [security2:error] [pid 989638:tid 989850] [client 185.132.186.38:54929] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 38.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/cgi-bin/install.php"] [unique_id "alxm3JruoK4abRCMbAZi3gAAAFI"]
[Sat Jul 18 23:55:40.221541 2026] [security2:error] [pid 989638:tid 989766] [remote 74.235.96.117:36428] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 117.96.235.74.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "mail.idf.ldc.mybluehost.me"] [uri "/wp-login.php"] [unique_id "alxm3JruoK4abRCMbAZi5QAADn8"], referer: https://mail.idf.ldc.mybluehost.me/wp-login.php
[Sat Jul 18 23:55:40.319688 2026] [security2:error] [pid 989638:tid 989786] [client 45.134.20.134:45111] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 134.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-includes/IXR/about.php"] [unique_id "alxm3JruoK4abRCMbAZi8AAAABI"]
[Sat Jul 18 23:55:40.567358 2026] [security2:error] [pid 989638:tid 989833] [client 74.208.214.194:58262] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 194.214.208.74.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "ait.afz.mybluehost.me"] [uri "/wp-cron.php"] [unique_id "alxm3JruoK4abRCMbAZjAgAAAEE"]
[Sat Jul 18 23:55:40.591142 2026] [security2:error] [pid 989638:tid 989765] [remote 41.186.86.12:60550] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxm3JruoK4abRCMbAZjBwAATn4"]
[Sat Jul 18 23:55:40.621233 2026] [security2:error] [pid 989638:tid 989798] [client 4.194.24.143:6701] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/sitemap.php"] [unique_id "alxm3JruoK4abRCMbAZjDAAAAB4"]
[Sat Jul 18 23:55:40.750384 2026] [security2:error] [pid 989638:tid 989837] [client 4.194.24.143:19729] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/size.php"] [unique_id "alxm3JruoK4abRCMbAZjEwAAAEU"]
[Sat Jul 18 23:55:41.041526 2026] [security2:error] [pid 989638:tid 989776] [client 185.132.186.11:38035] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 11.186.132.185.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "maxenengineering.com"] [uri "/wp-content/wso.php"] [unique_id "alxm3ZruoK4abRCMbAZjMQAAAAg"]
[Sat Jul 18 23:55:41.075944 2026] [security2:error] [pid 989638:tid 989724] [remote 41.186.86.12:60550] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 12.86.186.41.testwprbl.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "176"] [id "900407"] [msg "Wordpress and Joomla Brute RBL: testwprbl.websitewelcome.com"] [hostname "sesamegreenbeans.com"] [uri "/wp-login.php"] [unique_id "alxm3ZruoK4abRCMbAZjOQAAMFU"], referer: https://sesamegreenbeans.com/wp-login.php
[Sat Jul 18 23:55:41.169565 2026] [security2:error] [pid 989638:tid 989848] [client 4.194.24.143:6218] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/size.php"] [unique_id "alxm3ZruoK4abRCMbAZjQgAAAFA"]
[Sat Jul 18 23:55:41.193924 2026] [security2:error] [pid 989638:tid 989820] [client 45.134.20.115:34937] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 115.20.134.45.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "swafforddetailing.com"] [uri "/wp-api.php"] [unique_id "alxm3ZruoK4abRCMbAZjQwAAADQ"]
[Sat Jul 18 23:55:41.566474 2026] [security2:error] [pid 989638:tid 989863] [client 4.194.24.143:54396] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "3ddynamics.org"] [uri "/sm.php"] [unique_id "alxm3ZruoK4abRCMbAZjYgAAAF8"]
[Sat Jul 18 23:55:41.731800 2026] [security2:error] [pid 989638:tid 989889] [client 4.194.24.143:6717] ModSecurity: Access denied with code 409 (phase 1). RBL lookup of 143.24.194.4.vulnscan.websitewelcome.com succeeded at REMOTE_ADDR. [file "/opt/mod_security/hg_rules.conf"] [line "1566"] [id "900933"] [msg "Vulnerability Scan RBL: vulnscan.websitewelcome.com"] [hostname "greenport-texas.com"] [uri "/sm.php"] [unique_id "alxm3ZruoK4abRCMbAZjaQAAAHk"]